DCL-16-099, License Amendment Request 16-04, Request to Adopt Emergency Action Level Schemes Pursuant to NEI 99-01, Revision 6, Development of Emergency Action Levels for Non-Passive Reactors.

License Amendment Request 16-04, Request to Adopt Emergency Action Level Schemes Pursuant to NEI 99-01, Revision 6, Development of Emergency Action Levels for Non-Passive Reactors.

ML16315A184
Person / Time
Site:	Diablo Canyon
Issue date:	10/25/2016
From:	Gerfen P Pacific Gas & Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
DCL-16-099
Download: ML16315A184 (722)

Text

{{#Wiki_filter:Pacific: Gas and Electric Company* Paula Gerfen Diablo Canyon Power Plant Station Director Mail code 104/5/502 P.O. Box 56 Avila Beach, CA 93424 805.545.4596 Internal: 691.4596 Fax: 805.545.4234 October 25, 2016 PG&E Letter DCL-16-099 U.S. Nuclear Regulatory Commission 10 CFR 50.90 ATTN:- Document Control Desk Washington, D.C. 20555-0001 Diablo Canyon Units 1 and 2 Docket No. 50-275, OL-DPR-80 Docket No. 50-323, OL-DPR-82 License Amendment Request 16-04 Request to Adopt Emergency Action Level Schemes Pursuant to NEI 99-01, Revision 6, "Development of Emergency Action Levels for Non-Passive Reactors"

References:

1. NEI 99-01, Revision 6, "Development of Emergency Action Levels for Non-Passive Reactors," dated November 2012 (ADAMS Accession No. ML12326A805)

2. Letter from Mark Thaggard (U.S. Nuclear Regulatory Commission) to Susan Perkins-Grew (Nuclear Energy Institute), "U.S. Nuclear Regulatory Commission Review and Endorsement of NEI 99-01, Revision 6, Dated November, 2012 (TAC No. D92368)" dated March 28, 2013 (ADAMS Accession No. ML12346A463)

3. NRC Regulatory Issue Summary (RIS) 2005-02, Revision 1,

(

                         "Clarifying the Process for Making Emergency Plan Changes,"

dated April 19, 2011 (ADAMS Accession No.; ML100340545)

4. NRC Order EA-12-051, "Order Modifying Licenses with Regard to*

Reliable Spent Fuel Pool Instrumentation" (ADAMS Accession No. ML12056A044)

Dear Commissioners and Staff:

Pursuant to 10 CFR 50.90, Pacific Gas and Electric Company (PG&E) hereby requests approval of the enclosed proposed amendment to Facility Operating License Nos. DPR-80 and DPR-82 for Units 1 and 2 of the Diab lo Canyon Power .1

   . Plant (DCPP), respectively. The enclosed license amendment request (LAR) proposes to revise the Emergency Plan (E-Plari) for DCPP to adopt the Nuclear Energy lnstitute's (NEl's) revised Emergency Action Level (EAL) schemes described in NEI 99-01, Revision 6, "Development of Emergency Action Levels for Non-A  member   of  the STARS   Alliance Callaway

• Diablo Canyon
• Palo Verde
• Wolf Creek l

Document Control Desk PG&E Letter DCL-16-099 October 25, 2016 Page2 Passive Reactors," which have been endorsed by the NRC as documented in an NRC letter dated March 28, 2013 (Reference 2). The E-Plan, as changed, would continue to meet the standards in 10 CFR 50.47 and the requirements in Appendix E to 10 CFR 50. DCPP's currently approved E-Plan EAL schemes are based on the guidance established in NEI 99-01, Revision 4, dated January 2003, except for the security-

  . related EALs, which are from the guidance established in NEI 99-01, Revision 5, dated February 2008.

Federal Regulation 10 CFR 50, Appendix E, Section IV.B.2 requires that "a licensee desiring to change its entire emergency action level scheme to submit an application for an amendment to its license and receive NRC approval before implementing the change." Regulatory Issue Summary (RIS) 2005-02, Revision 1 (Reference 3), provides guidance that a revision to an entire EAL scheme must be submitted for prior NRC approval as specified in Section IV.B of Appendix E to 10 CFR 50. Therefore, pursuant to 10 CFR 50.90, PG&E hereby requests NRC review and approval of revisions to DCPP's E-Plan EALs. PG&E, thereby, proposes to adopt the EAL scheme based on the latest NRG-endorsed guidance as described in NEI 99-01, Revision 6. This revision to the EAL schemes also incorporates spen.t fuel pool emergency action levels required by NRC Order EA-12-051 (Reference 4). The changes in this LAR are not required to address an immediate safety concern. PG&E requests approval of this LAR no later than October 19, 2017. PG&E requests the license amendments be made effective upon NRC issuance, to be implemented within 180 days from the NRC approval of the license amendment to permit program changes and training. The enclosure to this letter contains the evaluation of the proposed change along with the following attachments: Attachment 1: EAL Comparison Matrix Attachment 2: EAL Technical Basis Document Markup Attachment 3: EAL Technical Basis Document, Revised PG&E makes no new or revised regulatory commitments (as defined by NEI 99-04) in this letter. It has been determined that this amendment application does not involve a significant hazard consideration as determined per 10 CFR 50.92, "Issuance of amendment." Pursuant to 10 CFR 51.22, "Criterion for categorical exclusion; A member of the STARS Alliance Callaway

• Diablo Canyon
• Palo Verde
• Wolf Creek l_

Document Control Desk PG&E Letter DCL-16-099 October 25, 2016 Page3 identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review," section (b), no environmental impact statement or environmental assessment need to be prepared in connection with the issuance of this amendment. In accordance with site administrative procedures and the Quality Assurance Program, the proposed amendment has been reviewed by the Plant Staff Review Committee.

• Pursuant to 10 CFR 50.91, "Notice for public comment; State consultation," PG&E is sending a copy of this proposed amendment to the California Department of Public Health.

If you have any questions or require additional information, please contact Mr. Hossain Hamzehee at 805-545-4720. I state under penalty of perjury that the foregoing is true and correct. Executed on October 25, 2016.

Si72, Paula::: C?f-Station Director e1 d?/4418/50521100 Enclosure cc: Diablo Distribution cc/enc: Kriss Kennedy, NRC Region IV Administrator Chris W. Newport, NRC Senior Resident Inspector Gonzalo L. Perez, Branch Chief, California Department of Public Health Balwant K. Singal, NRC Senior Project Manager A member of the STARS _ Alliance Callaway

• Diablo Canyon
• Palo Verde
• Wolf Creek

1 Enclosure PG&E Letter DCL-16-099 Evaluation of the Proposed Change License Amendment Request 16-04 Request to Adopt Emergency Action Level Schemes Pursuant to NEI 99-01, Revision 6, "Development of Emergency Action Levels for Non-Passive Reactors"

1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION

3. TECHNICAL EVALUATION

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria ,

4.2 Precedent 4.3 Significant Hazards Consideration 4.4 Conclusions

5. ENVIRONMENTAL CONSIDERATION

6. REFERENCES

'-~ ------------------------------- ATTACHMENTS:

1. EAL Comparison Matrix

2. EAL Technical Basis Document Markup

3. EAL Technical Basis Document, Revised

   \

Enclosure PG&E Letter DCL-16-099 EVALUATION

1. ,

SUMMARY

DESCRIPTION This letter is a request to amend Operating Licenses DPR-80 and DPR-82 for Units 1 and 2 of the Diablo Canyon Power Plant (DCPP), respectively. The proposed change would revise the facility's currently approved Emergency Plan Emergency Action Level (EAL) scheme which are currently based on the guidance established in Nuclear Energy Institute (NEI) 99-01, Revision 4, dated January 2003 (Reference 1) and NEI 99-01, Revision 5, dated February 2008 (Reference 2) for security-related EALs, to the guidance established in NEI 99-01, Revision 6, "Development of Emergency Action Levels for Non-Passive Reactors," (Reference 3) which has been endorsed by the NRG (Reference 4). The proposed changes to the EAL scheme contained in this submittal do not reduce the capability to meet the applicable emergency planning requirements established in 10 CFR 50.47, "Emergency Plans," and 10 CFR 50, Appendix E, "Emergency Planning and Preparedness for Production and Utilization Facilities." Adopting NEI 99-01, Revision 6, will continue to provide consistent emergency classifications internally and externally. Federal Regulation 10 CFR 50, Appendix E, Section IV.B.2 requires prior NRG approval when a licensee is changing from one NRG-approved EAL scheme to another EAL scheme.

2. DETAILED DESCRIPTION The proposed EAL changes were revi~wed considering the requirements of 10 CFR 50.54(q), "Conditions of Licenses - Emergency Plans/ paragraph (b) of 10 CFR 50.47, and 10 CFR 50 Appendix E, Regulatory Issue Summary (RIS) 2003-18, "Use of 99-01, Methodology for Development of Emergency Action Levels," (including supporting supplements, Reference 5), and RIS 2005-02, Revision 1, "Clarifying the Process for Making Emergency Plan Changes" (Reference 6). Adopting the proposed changes to the DCPP EAL scheme does not reduce the effectiveness of the Emergency Plan (E-Plan) and the Emergency Plan continues to comply with the standards established in .10 CFR 50.47 and 10 CFR 50, Appendix E.

The attached marked-up and clean copies of the EAL Technical Bases Document (TBD) (Attachments 2 and 3, respectively) provide an explanation and rationale for each EAL included in the EAL change. The EAL Basis document includes the necessary plant information. The EAL Comparison Matrix in Attachment 1 provides a line-by-line comparison between the proposed DCPP Initiating Conditions and Mode Applicability and EAL wording with the Initiating Conditions and Mode Applicability, and the 1 of 7 l

Enclosure PG&E Letter DCL-16-099 NEI 99-01, Revision 6, example EAL wording. This document provides a means of assessing DCPP differences and deviations from the NRG-endorsed guidance given in NEI 99-01, Revision 6. - Discussion of each DCPP EAL bases and a list of source document references are given in the EAL TBD. It is therefore advisable to reference the EAL TBD for background information while using the Comparison Matrix. 2.1 Background EALs are the plant-specific indications, conditions, or instrument readings that are utilized to classify emergency conditions defined in the DCPP E-Plan. In 1992, the NRG endorsed NUMARC/NESP-007, "Methodology for Development of Emergency Action Levels;" (Reference 7) as an alternative to NUREG-0654 EAL guidance. NEI 99-01 (NUMARC/NESP-007) Revisions 4 and 5 were subsequently issued for industry implementation. Enhancements over earlier revisions included:

• Consolidating the system malfunction initiating conditions and example EALs which address conditions that may be postulated to occur during plant shutdpwn conditions.
• Initiating conditions and example EALs that fully address conditions that may be postulated to occur at permanently defueled stations and independent spent fuel storage installations (ISFSls).

  *

• Simplifying the fission product barrier EAL threshold for a Site Area Emergency.

Subsequently, Revision 6 of NEI 99-01 was issued which incorporates resolutions to numerous implementation issues including the NRG EAL frequently-asked questions. Using Reference 3, DCPP, in coordination with other members of the STARS Alliance, conducted an EAL implem~ntation upgrade project that produced the EALs discussed herein.

3. TECHNICAL EVALUATION DCPP's currently approved E-Plan EAL schemes are based on the guidance established in NEI 99-01, Revision 4, dated January 2003, and NEI 99-01, Revision 5, dated February 2008 for security-related EALs. The proposed change revises the E-Plan EAL scheme to be based on NEI 99-01, Revision 6.

Within Attachment 1, the basis for each difference or deviation between NEI 99-01, Revision 6, guidance and the DCPP TBD is provided. The differences do not alter the meaning or intent of the Initiating Conditions (I Cs) or EALs. The deviations from the NEI 99-01, Revision 6, guidance are justified and have been deemed acceptable deviations by NRG, as indicated in NRG Emergency Preparedness Frequently Asked Question (EPFAQ) Nos. 2015-013 2 of 7

Enclosure PG&E Letter DCL-16-099 (ADAMS Accession No. ML16166A366) and 2015-014 (ADAMS Accession No. ML16166A240). These changes affect only the DCPP E-Plan and otherwise do not alter requirements of the Operating License or the Technical Specifications. These changes do not alter any of the assumptions used in the safety analyses, nor do they cause any safety system parameters to exceed their acceptance limits. Therefore, the proposed changes have no adverse effect on plant safety.

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 10 CFR 50.47(b)(4) requires the emergency plan to meet the following standard:

A standard emergency classification and action level scheme, the bases of which include facility system and effluent parameters, is in use by the nuclear facility licensee, and State and local response plans. call for reliance on information provided by facility licensees for determinations of minimum initial offsite response measures. 10 CFR 50 Appendix E, section IV, "Content of Emergency Plans," Item B, "Assessment Actions," states:

1. The means to be used for determining the magnitude of, and for continually assessing the impact of, the release of .

radioactive materials shall be described, including. emergency action levels that are to be used as criteria for determining the need for notification and participation of local and State agencies, the Commission, and other Federal agencies, and the emergency action levels that are to be used for determining when and what type of protective measures should be considered within and outside the site

                        *boundary to protect health and safety. The emergency action levels shall be based on in-plant conditions and instrumentation in addition to onsite and offsite monitoring.
                       *By June 20, 2012, for nuclear power reactor licensees, these action levels must include hostile action_ that may adversely affect the nuclear power plant. The initial emergency action levels shall be discussed and agreed on by the applicant or licensee and state and local governmental authorities, and approved by the NRC. Thereafter, emergency action levels shall be reviewed with the State and local governmental authorities on an annual basis ..

3of7

Enclosure PG&E Letter DCL-16-099

2. A licensee desiring to change its entire emergency action level scheme shall submit an application for an amendment to its license and receive NRC approval before implementing the change. Licensees shall follow the change process in

                     § 50.54(q) for all other emergency action level changes.

The NRC endorsement letter of NEI 99-01, Revision 6, states, "Please note that this is considered a significant change to the EAL scheme development methodology and licensees seeking to use this guidance in the development of their EAL scheme must adhere to the requirements of 10 CFR Part 50, Appendix E, Section IV.B.2." This section of Appendix E requires licensees desiring to change its entire emergency action level scheme to submit an application for amendment to its license and receive prior NRC approval before implementing the change. Consequently, this request for NRC approval of the proposed EAL scheme change I is as specified in 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," and 10 CFR 50.4, 'Written Communications." 4.2 Precedent This request is similar in nature to requests for Braidwood Station, Units 1 and 2 (Reference 8), Byron Station, Units 1 and 2, Callaway Plant, Unit 1 (Reference 9), Clinton Power Station, Unit 1 , Dresden Nuclear Power Station, Units 1, 2, and 3, LaSalle County Station, Units 1 and 2 , Limerick Generating Station, Units 1 and 2, Oyster Creek Nuclear Generating Station, Peach Bottom Atomic Power Station, Units 1, 2, and 3, Quad Cities Nuclear Power Station, Units 1 and 2, South Texas Project, Units 1 and 2 (Reference 10), Three Mile Island Nuclear Station, Units 1 and 2, and V.C. Summer Nuclear Station, Unit 1 (Reference 11). 4.3 Significant Hazards Consideration Pacific Gas and Electric (PG&E) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No. The proposed changes to the Diablo Canyon Power Plant (DCPP) emergency action levels (EALs) do not impact the physical function of 4of7 I

Enclosure PG&E Letter DCL-16-099 plant structures, systems, or components (SSCs) or the manner in which SSCs perform their design function. The proposed, changes neither adversely affect accident initiators or precursors, nor alter design assumptions. The proposed changes do not alter or prevent the ability of SSCs to perform their intended function to mitigate the consequences of an initiating event within assumed acceptance limits. No operating procedures or adm_inistrative controls that function to prevent or mitigate accidents are affected by the proposed changes. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different accident from any accident previously evaluated?

Response: No. The proposed changes do not involve a physical alteration of the_plant (i.e., no new or different type of equipment will be installed or removed) or a change in the method of plant operation. The proposed changes will not introduce failure modes that could result in a new accident, and the change does not alter assumptions made in the safety analysis. The proposed changes to the DCPP EALs are not initiators of any accidents._ Therefore, the proposed change does not create the possibility of a new or different accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: . No. Margin of safety is associated with the ability of the fission product barriers (i.e., fuel cladding, reactor coolant system pressure boundary, and containment structure) to limit the level of radiation dose to the public. The proposed changes do not impact operation of the plant or its response to transients or accidents. The proposed changes do not affect the Technical Specifications or the Operating License. The proposed changes do not involve a change in the method of plant operation, and no accident analyses will be affected by the proposed changes. Additionally, the proposed changes will not relax any criteria used to establish safety limits and will not relax any safety system settings. The safety analysis acceptance criteria are not affected by these changes. The proposed changes will not result in plant operation in a configuration outside the design basis. The proposed changes do not adversely affect systems that 5of7

Enclosure PG&E Letter DCL-16-099 respond to safely shut down the plant and to maintain the plant in a safe shutdown condition. The E-Plan will continue to activate an emergency response commensurate with the extent of degradation of plant safety. Therefore, the proposed change does not involve a significant reduction in a margin of safety. Based on the above evaluation, PG&E concludes that the proposed change does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified. 4.4 Conclusions In conclusion, based on PG&E's analysis of the no significant hazards consideration discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. ENVIRONMENTAL CONSIDERATION The proposed changes to the EALs maintain the environmental bounds of the current environmental assessment associated with DCPP. The proposed changes will not affect plant safety and will n_ot have an adverse effect on the probability of an accident occurring.

• PG&E has evaluated the proposed amendment and has determined that the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES

1. NEI 99.:01, Revision 4 (NUMARC/NESP-007), "Methodology for Development of Emergency Action Levels," dated Januar-V 2003 (ADAMS Accession No. ML030230250) 6of7

Enclosure PG&E Letter DCL-16-099

2. NEI 99-01, Revision 5, "Methodology for Development of Emergency Action Levels," dated February 2008 (ADAMS Accession No. ML080450149)

3. NEI 99-01, Revision 6, "Development of Emergency Action Levels for Non-Passive Reactors," dated November 2012 (ADAMS Accession No. ML12326A805)

4. Letter from Mark Thaggard (U.S. Nuclear Regulatory Commission) to Susan Perkins-Grew (Nuclear Energy Institute), "U.S. Nuclear Regulatory Commission Review and Endorsement of NEI 99-01, Revision 6, Dated November, 2012 (TAC No. D92368)" dated March 28, 2013 (ADAMS Accession No. ML12346A463)

5. NRC Regulatory Issue Summary 2003-18, "Use of NEI 99-01,

   'Methodology for Development of Emergency Action Levels,' Revision 4, Dated January 2003," dated October 8, 2003

6. NRC Regulatory ls_sue Summary 2005-02, Revision 1, "Clarifying the_

Process for Making Emergency Plan Changes," dated April 19, 2011 (ADAMS Accession No. ML100340545)

7. NUMARC/NESP-007, Revision 2, "Methodology for Development of Emergency Action Levels," dated January 1992 (ADAMS Accession No. ML041120174)

8. Exelon Generation Letter RS-14-115, RA-14-032, TMl-14-046;-"License Amendment Request to Adopt Emergency Action Level Schemes Pursuant to NEI 99-01, Revision 6, 'Development of Emergency Action Levels for Non-Passive Reactors,"' dated May 30, 2014 (ADAMS Accession No. ML14164A054)

9. Ameren Missouri Letter ULNRC-06143, "License Amendment Request for Emergency Action Level (EAL) Upgrade Adopting NRG-Endorsed NEI 99-01, Revision 6," dated October 2, 2014 (ADAMS Accession No. ML14275A441) -

10. South Texas Project Nuclear Operating Company Letter NOC-AE-14003087, "License Amendment Request for Revision to Unit 1 and Unit 2 Emergency Action Levels," dated May 15,_2014 (ADAMS Accession No. ML14164A305)

11. South Carolina Electric and Gas letter RC-14~0032, "License Amendment Request ~R-14-02392 Request for NRC Approval of Proposed Changes to Emergency Action Levels," dated April 7, 2014 (ADAMS Accession No. ML14122A156) 7 of 7

Enclosure Attachment 1 PG&E Letter DCL-16-099 EAL Comparison Matrix

Diablo Canyon Power Plant NEI 99-01 Revision 6 EAL Comparison Matrix 10/12/16 L _ _ _ _ _ _ _ _ -- - --

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table of Contents Section lntroduction-------------------------------------------------------------------------'."-----------------------------------------------------------------------------1 Comp ariso ~ Matrix Form at ----------------------------------------------------------------------------------------------------------------------------------1 EAL Word in"g ----------------------------------------------------------------------------------------------------------------------------------------------------1 EAL Em phas is Tech niq ues-------------------------------------------------------------------------------------------------------------------------------------1 Global Differences----------------------------------------------------------------------------------------------------------------------------------------------2 Differences and Deviations-------------------------------------------------------------------------------------------------------------------------------------3 Category A - Abnormal Rad Levels I Rad Effluents -----------------------------------------------------------------------------------------------12 Category C - Cold Shutdown I Refueling System Malfunction -------------------------------------------------------------------------------------30 Category D - Permanently Defueled Static n Malfunction -------~-------------------------------------------------,.,----------------------------- 52 Category E - Events Related to Independent Spent Fuel Storage Installations ---------------------------------------------------------------54 Category F - Fission Product Barrier Deg rad ati on --------------------------------------------------------------------------------------------------- 56 Category H - Hazards and Other Conditions Affecting Plant Safety------------------------------------------------------------------------------69 Category S - System Malfunction -------------------------------------------------------------------------------------------------------------------------88 Table 1 - DC PP EAL Categories/Subcategories ---------------------------------------------------------------------------.:-:,--------------------------5 Table 2 - NEI I DCPP EAL Identification Cross-Reference --------------------------------------------------------------------------------------------6 Table 3 - Summary of Deviations -------------------------------------------------------------------------------------------------------------------------11 Attachment A - Bleed and Feed Condition Associated with CSFST Heat Sink Red Path Thresholds----------------------------------- 114 i of i

EAL Comparison Matrix OSSI Project #14-0303 DCPP Introduction EAL Emphasis Techniques This document provides a line-by-line comparison of the Initiating Conditions Due to the width of the table columns and table formatting constraints in this (!Cs), Mode Applicability and Emergency Action Levels (EALs) in NEI 99-01 document, line breaks and indentation may differ slightly from the Revision (Rev.) 6, "Development of Emergency Action Levels for Non- appearance of comparable wording in the source documents. NEI 99-01 Passive Reactors," (ADAMS Accession Number ML12326A805), and the Rev. 6 is the source document for the NEI EALs; the DCPP EAL Technical Diablo Canyon Power Plant (DCPP) !Cs, Mode Applicability and EALs. This Bases Document for the DCPP EALs. document provides a means of assessing DCPP differences and deviations The print and paragraph formatting conventions summarized below guide from the NRC endorsed guidance given in NEI 99-01 Rev. 6. Discussion of presentation of the DCPP EALs in accordance with the EAL writing criteria. DCPP EAL bases and lists of source document references are given in the Space restrictions in the EAL table of this document sometimes override this EAL Technical Bases Document. It is, therefore, advisable to reference the criteria in cases when following the criteria would introduce undesirable EAL Technical Bases Document for background information while using this complications in the EAL layout. document.

• Upper case-bold print is used for the logic terms AND, OR, and Comparison Matrix Format EITHER.

The !Cs and EALs discussed in this document are grouped according to NEI

• Bold font is used for certain logic terms, negative terms (not, 99-01 Rev. 6 Recognition Categories. Within each Recognition Category, cannot, etc.), any, all.

the !Cs and EALs are listed in tabular format according to the order in which they are given in NEI 99-01 Revision 6. Generally, each row of the

• Upper case print is reserved for defined terms, acronyms, system comparison matrix provides the following information: abbreviations, logic terms (and, or, etc. when not used as a conjunction), annunciator window engravings.
• NEI EAL/IC identifier
• Three or more items in a list are normally introduced with "Any of the
• NEI EAUIC wording following ... " or "All of the following ... " Items of the list begin with
• DCPP EAUIC identifier bullets when a priority or sequence is not inferred.
• DCPP EAUIC wording
• The use of AND/OR logic within the same EAL has been avoided when possible. When such logic cannot be avoided, indentation and
• Description of any differences or deviations separation of subordinate contingent phrases is employed.

EAL Wording In Section 4.1, NEI recommends the following: "The guidance in NEI 99-01 is not intended to be applied to plants 'as-is'; however, developers should attempt to keep their site-specific schemes as close to the generic guidance as possible. The goal is to meet the intent of the generic Initiating Conditions (!Cs) and Emergency Action Levels (EALs) within the context of site-specific characteristics - locale, plant design, operating features, terminology, etc. Meeting this goal will result in a shorter and less cumbersome NRC review and approval process, closer alignment with the schemes of other nuclear power plant sites and better positioning to adopt future industry-wide scheme enhancements." 1 of 114

EAL Co_mparison Matrix OSSI Project #14-0303 DCPP Global Differences

• NEI 99-01 Rev. 6 defines the thresholds requiring emergency The differences listed below generally apply throughout the set of EALs and classification (example EALs) and assigns them to !Cs which, in are not repeated in the Justification sections of this document. The global turn, are grouped in "Recognition Categories." The DCPP differences do not decrease the effectiveness of the intent of NEI 99-01 Rev. IC/EAL scheme includes the following features:

6. a. Division of the NEI EAL set into three groups:

1. The NEI phrase "Notification of Unusual Event" has been changed to o EALs applicable under ill! plant operating modes -

        "Unusual Event" or abbreviated 'UE' to reduce EAL-user reading                                  This group would be reviewed by the EAL-user any burden.                                                                                         time emergency classification is considered.

2. NEI 99-01 Rev. 6 IC Example EALs are implemented in separate o EALs applicable only under hot operating modes -

plant EALs to improve clarity and readability. For example, NEI lists This group would only be reviewed by the EAL-user all IC HU3 Example EALs under one IC. The corresponding DCPP when the plant is in Hot Shutdown, Hot Standby, EALs appear as unique EALs (e.g., HU3.1 through HU3.4). Startup or Power Operation mode.

3. Mode applicability identifiers (numbers/letter) modify the NEI 99-01 o EALs applicable only under cold operating modes -

Rev. 6 mode applicability names as follows: 1 - Power Operation, 2 - This group would only be reviewed by the EAL-user Startup, 3 - Hot Standby, 4 - Hot Shutdown, 5 - Cold Shutdown, 6 - when the plant is in Cold Shutdown, Refueling or Refueling, D - Defueled. NEI 99-01 Rev. 6 defines Defueled as* Defueled mode. follows: "Reactor Vessel contains no irradiated fuel (full core off-load during refueling or extended outage)." The purpose of the groups is to avoid review of hot condition EALs when the plant is in a cold condition and

4. NEI 99-01 uses the terms greater than, less than, greater than or avoid review of cold condition EALs when the plant is in a equal to, etc. in the wording of some example EALs. For hot condition. This approach significantly minimizes the consistency and to reduce EAL-user reading burden, PG&E has total number of EALs that must be reviewed by the EAL-adopted use of Boolean symbols in place of the NEI 99-01 Rev. 6 user for a given plant condition and, thereby, speeds text modifiers within the EAL wording. identification of the EAL that applies to the emergency.

5. The term "Emergency Director" has been replaced by "Shift b. Within each of the above three groups, assignment of Manager/Site Emergency Coordinator/Emergency Director EALs to categories/subcategories - Category and (SM/SEC/ED)" consistent with site-specific nomenclature. subcategory titles are selected to represent conditions

6. Wherever the generic bracketed PWR term "reactor vessel/RCS" is that are operationally significant to the EAL-user.

provided, PG&E uses the term Reactor Coolant System or "RCS" as Subcategories are used as necessary to further divide the the site-specific nomenclature. EALs of a category into logical sets of possible emergency classification thresholds. The DCPP EAL

7. IC/EAL identification:

categories/subcategories and their relationship to NEI

• NEI Recognition Category A "Abnormal Radiation Levels/ Recognition Categories are listed in Table 1.

Radiological Effluents" has been changed to Category R c. Unique identification of each EAL - Four characters "Abnormal Rad Levels I Rad Effluents." The designator "R" is comprise the EAL identifier as illustrated in Figure 1. more intuitively associated with radiation (rad) or radiological events. NEI IC designators beginning with "A" have likewise been changed to "R." 2 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Figure 1 - EAL Identifier EAL-user find higher emergency classification EALs EAL Identifier that may become active if plant conditions worsen. xxx.x Table 2 lists the DCPP ICs and EALs that correspond to Category (R, H, E, S, F, C) _J II L Sequential number within subcategory/classification the NEI ICs/Example EALs when the above EAUIC Emergency classificallon (G, S, A, U) _J L Subcategory number (1 if no subcategory) organization and identification scheme is implemented. The first character is a letter associated with the category Differences and Deviations in which the EAL is located. The second character is a letter associated with the emergency classification level In accordance NRC Regulatory Issue Summary (RIS) 2003-18 "Use of (G for General Emergency, S for Site Area Emergency, A Nuclear Energy Institute (NEI) 99-01, Methodology for Development of for Alert, and U for Notification of Unusual Event). The Emergency Action Levels." Supplements 1 and 2, a difference is an EAL third character is a number associated with one or more change in which the basis scheme guidance differs in wording but agrees in subcategories within a given category. Subcategories are meaning and intent, such that classification of an event would be the same, sequentially numbered beginning with the number "1 ". If a whether using the basis scheme guidance or the DCPP EAL. A deviation is category does' not have a subcategory, this character is an EAL change in which the basis scheme guidance differs in wording and is assigned the number "1". The fourth character is a altered in meaning or intent, such that classification of the event could be number preceded by a period for each EAL within a different between the basis scheme guidance and the DCPP proposed EAL. subcategory. EALs are sequentially numbered within the Administrative changes that do not actually change the textual content are emergency classification level of a subcategory beginning neither differences nor deviations. Likewise, any format change that does with the number '1'. not alter the wording of the IC or EAL is considered neither a difference nor a The EAL identifier is designed to fulfill the following deviation. objectives: The following are examples of differences: o Uniqueness - The EAL identifier ensures that there

• Choosing the applicable EAL based upon plant type (i.e., BWR can be no confusion over which EAL is driving the versus PWR).

need for emergency classification.

• Using a numbering scheme other than that provided in NEI 99-01 o Speed in locating the EAL of concern - When the Rev. 6 that does not change the intent of the overall scheme.

EALs are displayed in a matrix format, knowledge of the EAL identifier alone can lead the EAL-user to

• Where the NEI 99-01 Rev. 6 guidance specifically provides an option the location of the EAL within the classification to not include an EAL if equipment for the EAL does not exist at matrix. The identifier conveys the category, DCPP (e.g., automatic real-time dose assessment capability).

subcategory and classification level. This assists

• Pulling information from the bases section up to the actual EAL that ERO responders (who may not be in the same does not change the intent of the EAL.

facility as the ED) to find the EAL of concern in a timely manner without the need for a word

• Choosing to state ALL Operating Modes are applicable instead of description of the classification threshold. stating N/A, or listing each mode individually under the Abnormal Rad Level/Radiological Effluent and Hazard and Other Conditions o Possible classification upgrade - The Affecting Plant Safety sections.

category/subcategory/identifier scheme helps the 3of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP

• Using synonymous wording (e.g., greater than or equal to versus at
• Any change to the IC or EAL, or basis wording as stated in NEI 99-or above, less than or equal versus at or below, greater than or less 01 Rev. 6 that does alter the intent of the IC or EAL, i.e., the IC than versus above or below, etc.) and/or EAL:
• Adding DCPP equipment/instrument identification or noun names to o Does not classify at the classification level consistent with EA Ls. NEI 99-01 Rev. 6,
• Combining like ICs that are exactly the same but have different o Is not logically integrated with other EALs in the EAL operating modes as long as the intent of each IC is maintained and scheme, or the overall progression of the EAL scheme is not affected. o Results in an incomplete EAL scheme (i.e., does not classify
• Any change to the IC, EAL, or basis wording, as stated in NEI 99-01 all potential emergency conditions).

Rev. 6, that does not alter the intent of the IC or EAL, i.e., the IC The "Difference Justification" columns in the remaining sections of this and/or EAL continues to: document identify each difference between the NEI 99-01 Rev. 6 IC/EAL o Classify at the correct classification level wording and the DCPP IC/EAL wording. An explanation that justifies the reason for each difference is then provided. If the difference is determined to o Logically integrate with other EALs in the EAL scheme, and be a deviation, a statement is made to that affect and explanation is given o Ensure that the resulting EAL scheme is complete (i.e., that states why classification may be different from the NEI 99-01 Rev. 6 classifies all potential emergency conditions). IC/EAL and the reason for its acceptability. In all cases, however, the The following are examples of deviations: differences and deviations do not decrease the effectiveness of the intent of NEI 99-01 Rev. 6.

• Use of altered mode applicability. PG&E has identified two deviations from the NEI 99-01 Rev. 6 guidance as
• Altering key words or time limits. represented in Table 3. These have been deemed by NRC to be acceptable deviations from the NEI 99-01 Rev. 6 guidance, as indicated in NRC
• Changing words of physical reference (protected area, safety-related Emergency Preparedness Frequently Asked Question (EPFAQ) Nos. 2015-equipment, etc.).

013 (ADAMS Accession Number ML16166A366) and 2015-014 (ADAMS

• Eliminating an IC. This includes the removal of an IC from the Accession Number ML16166A240).

Fission Product Barrier Degradation category as this impacts the logic of Fission Product Barrier ICs.

• Changing a Fission Product Barrier from a Loss to a Potential Loss or vice-versa.
• Not using NEI 99-01 Rev. 6 definitions, as the intent is for all NEI 99-01 Rev. 6 users to have a standard set of defined terms as defined in NEI 99-01 Rev. 6. Differences due to plant types are permissible (BWR or PWR). Verbatim compliance to the wording in NEI 99-01 Rev. 6 is not necessary as long as the intent of the defined word is maintained. Use of the wording provided in NEI 99-01 Rev. 6 is encouraged since the intent is for all users to have a standard set of defined terms as defined in NEI 99-01 Rev. 6.

4 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table 1 - DCPP EAL Categories/Subcategories DCPP EALs NEI Recognition Category Category I Subcategory Group: Any Operating Mode: 1 - Radiological Effluent Abnormal Rad Levels/Radiological Effluent R - Abnormal Rad Levels/Rad Effluent 2 - Irradiated Fuel Event ICs/EALs 3 - Area Radiation Levels H - Hazards and Other Conditions Affecting 1 - Security Hazards and Other Conditions Affecting Plant Safety 2- Seismic Event Plant Safety ICs/EALs 3 - Natural or Technological Hazard 4- Fire 5 - Hazardous Gases 6 - Control Room Evacuation 7 - SM/SEC/ED Judgment E- ISFSI ISFSI ICs/EALs 1 - Confinement Boundary Group: Hot Conditions: 1 - Loss of Essential AC Power System Malfunction ICs/EALs 2 - Loss of Vital DC Power 3 - Loss of Control Room Indications 4- RCS Activity S - System Malfunction 5 - RCS Leakage 6 - RTS Failure 7 - Loss of Communications 8 - Containment Failure 9 - Hazardous Event Affecting Safety Systems F - Fission Product Barrier None Fission Product Barrier ICs/EALs Group: Cold Conditions: 1- RCS Level Cold Shutdown./ Refueling System 2- Loss of Vital AC Power Malfunction ICs/EALs C - Cold Shutdown/Refueling System 3- RCS Temperature Malfunctiqn 4- Loss of Vital DC Power 5- Loss of Communications 6- Hazardous Event Affecting Safety Systems 5 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table 2 - NEI I DCPP EAL Identification Cross-Reference NEI DCPP Example IC Category and Subcategory EAL EAL AU1 1 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RU1.1 AU1 2 R -Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RU1.1 AU1 3 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RU1.2 AU2 1 R -Abnormal Rad Levels I Rad Effluent, 2 - Irradiated Fuel Event RU2.1 AA1 1 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RA1.1 AA1 2 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RA1.2 AA1 3 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RA1.3 AA1 4 R -Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RA1.4 AA2 1 R -Abnormal Rad Levels I Rad Effluent, 2 - Irradiated Fuel Event RA2.1 AA2 2 R - Abnormal Rad Levels I Rad Effluent, 2 - Irradiated Fuel Event RA2.2 AA2 3 R -Abnormal Rad Levels I Rad Effluent, 2 - Irradiated Fuel Event RA2.3 AA3 1 R -Abnormal Rad Levels I Rad Effluent, 3 - Area Radiation Levels RA3.1 AA3 2 R - Abnormal Rad Levels I Rad Effluent, 3 - Area Radiation Levels RA3.2 AS1 1 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RS1.1 AS1 2 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RS1.2 AS1 3 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RS1.3 6 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP Example IC Category and Subcategory EAL EAL AS2 1 R -Abnormal Rad Levels I Rad Effluent, 2 - Irradiated Fuel Event RS2.1 AG1 1 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RG1.1 AG1 2 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RG1.2 AG1 3 R - Abnormal Rad Levels I Rad Effluent, 1 - Radiological Effluent RG1.3 AG2 1 R - Abnormal Rad Levels I Rad Effluent, 2 - Irradiated Fuel Event RG2.1 CU1 1 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CU1.1 CU1 2 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CU1.2 CU2 1 C - Cold SD/ Refueling System Malfunction, 2 - Loss of Vital AC Power CU2.1 CU3 1 C - Cold SD/ Refueling System Malfunction, 3 - RCS Temperature CU3.1 CU3 2 C - Cold SD/ Refueling System Malfunction, 3 - RCS Temperature CU3.2 CU4 1 C - Cold SD/ Refueling System Malfunction, 4 - Loss of Vital DC Power CU4.1 CU5 1, 2, 3 C - Cold SD/ Refueling System Malfunction, 5 - Loss of Communications CU5.1 CA1 1 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CA1.1 CA1 2 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CA1.2 CA2 1 C - Cold SD/ Refueling System Malfunction, 1 - Loss of Vital AC Power CA2.1 CA3 1, 2 C - Cold SD/ Refueling System Malfunction, 3 - RCS Temperature CA3.1 CA6 1 C - Cold SD/ Refueling System Malfunction, 6 - Hazardous Event Affecting Safety Systems CA6.1 CS1 1 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CS1.1 7 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP Example IC Category and Subcategory EAL EAL CS1 2 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CS1.2 CS1 3 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CS1.3 CG1 1 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CG1.1 CG1 2 C - Cold SD/ Refueling System Malfunction, 1 - RCS Level CG1.2 E-HU1 1 E-ISFSI EU1.1 FA1 1 F - Fission Product Barrier Degradation FA1.1 FS1 1 F - Fission Product Barrier Degradation FS1.1 FG1 1 F - Fission Product Barrier Degradation FG1.1 HU1 1, 2, 3 H - Hazards and Other Conditions Affecting Plant Safety, 1 - Security HU1.1 HU2 1 H - Hazards and Other Conditions Affecting Plant Safety, 2 - Seismic Event HU2.1 HU3* 1 H - Hazards and Other Conditions Affecting Plant Safety, 3 - Natural or Technological Hazard HU3.1 HU3 2 H - Hazards and Other Conditions Affecting Plant Safety, 3 - Natural or Technological Hazard HU3.2 HU3 3 H - Hazards and Other Conditions Affecting Plant Safety, 3 - Natural or Technological Hazard HU3.3 HU3 4 H - Hazards and Other Conditions Affecting Plant Safety, 3 - Natural or Technological Hazard HU3.4 HU3 5 N/A N/A HU4 1 H - Hazards and Other Conditions Affecting Plant Safety, 4 - Fire HU4.1 HU4 2 H - Hazards and Other Conditions Affecting Plant Safety, 4- Fire HU4.2 HU4 3 H - Hazards and Other Conditions Affecting Plant Safety, 4 - Fire HU4.3 8of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP Example IC Category and Subcategory EAL EAL HU4 4 H - Hazards and Other Conditions Affecting Plant Safety, 4 - Fire HU4.4 HU7 1 H - Hazards and other Conditions Affecting Plant Safety, 7 - EC Judgment HU7.1 HA1 1, 2 H - Hazards and Other Conditions Affecting Plant Safety, 1 - Security HA1.1 HA5 1 H - Hazards and Other Conditions Affecting Plant Safety, 5 - Hazardous Gases HA5.1 HA6 1 H - Hazards and Other Conditions Affecting Plant Safety, 6 - Control Room Evacuation HA6.1 HA7 1 H - Hazards and Other Conditions Affecting Plant Safety, 7 - EC Judgment HA7.1 HS1 1 H - Hazards and Other Conditions Affecting Plant Safety, 1 - Security HS1.1 HS6 1 H - Hazards and Other Conditions Affecting Rlant Safety, 6 - Control Room Evacuation HS6.1 HS7 1 H - Hazards and Other Conditions Affecting Plant Safety, 7 - EC Judgment HS7.1 HG1 1 N/A N/A HG7 1 H - Hazards and Other Conditions Affecting Plant Safety, 7 - EC Judgment HG7.1 SU1 1 S - System Malfunction, 1 - Loss of Vital AC Power SU1.1 SU2 1 S - System Malfunction, 3 - Loss of Control Room Indications SU3.1 SU3 1 S - System Malfunction, 4 - RCS Activity SU4.1 SU3 2 S - System Malfunction, 4 - RCS Activity SU4.2 SU4 1, 2, 3 S - System Malfunction, 5 - RCS Leakage SU5.1 SU5 1 S - System Malfunction, 6 - RTS Failure SU6.1 SU5 2 S - System Malfunction, 6 - RTS Failure SU6.2 9 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP Example IC Category and Subcategory EAL EAL SU6 1, 2, 3 S - System Malfunction, 7 - Loss of Communications SU7.1 8U7 1, 2 S - System Malfunction, 8 - Containment Failure SU8.1 8A1 1 S - System Malfunction, 1 - Loss of Vital AC Power SA1.1 8A2 1 S - System Malfunction, 3 - Loss of Control Room Indications SA3.1 SAS 1 S - System Malfunction, 6 - RTS Failure 8A6.1 SA9 1 S - System Malfunction, 9 - Hazardous Event Affecting Safety Systems SA9.1 SS1 1 S - System Malfunction, 1 - Loss of Vital AC Power SS1.1 SS5 1 S - System Malfunction, 6 - RTS Failure SS6.1 SS8 1 S - System Malfunction, 2 - Loss of Vital DC Power 882.1 SG1 1 S - System Malfunction, 1 - Loss of Vital AC Power SG1.1 SG8 1 S - System Malfunction, 1 - Loss of Vital AC Power SG2.1 10of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table 3 - Summary of Deviations NEI DCPP  ; I Description IC Example EAL EAL HG1 1 N/A Generic IC HG1 and associated example EAL are not implemented in the DCPP scheme. There are several other ICs that are redundant with this IC, and are better suited . to ensure timely and effective emergency declarations. In addition, the development of new spent fuel pool level EALs, as a result of NRC Order EA 051, clarified the intended emergency classificatio'n level for spent fuel pool level events. 'This deviation is justified because:

1. Hostile Action in the Plant Protected Area is bounded by ICs HS1 arid HS7.

Hostile Action resulting in a loss of physical control is bound by EAL HG7, as well as any event that may lead to radiological releases to the public in excess of Environmental Protection Agency (EPA) Protective Action Guides (PAGs).

a. If, for whatever reason, the Control Room must be evacuated, and control of safety functions (e.g., reactivity control, core cooling, and RCS heat removal) cannot be reestablished, then IC HS6 would apply, as well as IC 1

HS7 if desired by the EAL decision-maker.

b. Also, as stated above, any event (including Hostile Action) that could reasonably be expected to have a release exceeding EPA PAGs would be bound'by IC HG7.

c. From a Hostile Action perspective, ICs HS1, HS7, and HG7 are appropriate, and therefore, make this part of HG1 redundant and unnecessary.

d. From a loss of physical control perspective, ICs HS6, HS7, and HG7 are appropriate, and therefore, make\this part of HG1 redundant and unnecessary. ~

2. Any event which causes a loss of spent fuel pool level will be bounded by generic ICs AA2, AS2, and AG2, regardless of whether it was based upon a Hostile Action or not, thus making this part of HG1 redundant and unnecessary.

11of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP Description IC EAL i Example EAL

a. An event that leads to a radiological release will be bounded by generic ICs AU1, AA 1, AS1, and AG1. Events that lead to radiological releases in excess of EPA PAGs will be bounded by EALs AG1 and HG7, thus making this part of HG1 redundant and unnecessary.

ICs AA2, AS2, AG2, AS1, AG1, HS1, HS6, HS7 and HG7 have been implemented consistent with NEI 99-01 Rev. 6 and thus HG1 is adequately bounded as described above. This is an acceptable deviation from the generic NEI 99-01 Rev. 6 guidance, as indicated in NRC EPFAQ No. 2015-013 (ADAMS Accession Number ML16166A366). HS6 1 HS6.1 Deleted defueled mode applicability. Control of the cited safety functions are not critical for a defueled reactor as there is no energy source in the reactor vessel or RCS. The Mode applicability for the reactivity control safety function has been limited to Modes 1, 2, and 3 (hot operating conditions). In the cold operating modes adequate shutdown margin exists under all conditions. This is an acceptable deviation from the generic NEI 99-01 Rev. 6 guidance, as indicated in NRC EPFAQ No. 2015-014 (ADAMS Accession Number ML16166A240). 12of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category A Abnormal Rad Levels I Radiological Effluent 13of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI IC Wording and Mode DCPP DCPP IC Wording and Mode NEI IC# Difference Justification Applicability IC#(s) Applicability AU1 Release of gaseous or liquid RU1 Release of gaseous or liquid The DCPP Offsite Dose Calculation Manual (ODCM) is the radioactivity greater than 2 times radioactivity greater than 2 times the site-specific effluent release controlling document. the (site-specific effluent release Offsite Dose Calculation Manual limits controlling document) limits for for 60 minutes or longer. 60 minutes or longer. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Reading on ANY effluent Reading on any Table R-1 effluent Example EALs #1 and #2 have been combined into a single radiation monitor greater than 2 radiation monitor > column "UE" for EAL to simplify presentation. times the (site-specific effluent  ;?: 60 minutes. (Notes 1, 2, 3) The NEI phrase" ... effluent radiation .monitor greater than 2 release controlling document) times the (site-specific effluent release controlling limits for 60 minutes or longer: document)" and "effluent radiation monitor greater than 2 (site-specific monitor list and times the alarm setpoint established by a current radioactivity threshold values corresponding discharge permit" have been replaced with "... any Table R-1 to 2 times the controlling RU1.1 effluent radiation monitor > column "UE." document limits) UE thresholds for all DCPP monitored release pathways are 2 Reading on ANY effluent listed in Table R-1 to consolidate the information in a single radiation monitor greater than 2 location and, thereby, simplify identification of the thresholds times the alarm setpoint by the EAL user. The values shown in Table R-1 column established by a current "UE," consistent with the NEI bases, conservatively represent radioactivity discharge permit for two times the ODCM release limits for both liquid and 60 minutes or longer. gaseous release. 3 Sample analysis for a gaseous or RU1.2 Sample analysis for a gaseous or The DCPP Offsite Dose Calculation Manual is the site-liquid release indicates a liquid release indicates a concentration specific effluent release controlling document. concentration or release rate or release rate > 2 x Offsite Dose greater than 2 times the (s_ite- Calculation Manual limits for;?: 60 specific effluent release minutes. (Notes 1, 2) controlling document) limits for 14 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI Ex. DCPP NEI Example E;:\L Wording DCPP EAL Wording Difference Justification EAL# EAL# 60 minutes or longer. Notes

• The Emergency Director should declare the Unusual N/A Note 1: The SM/SEC/ED should declare the event promptly The classification timeliness note has been standardized across the DCPP EAL scheme by referencing the "time limit" Event promptly upon upon determining that time specified within the EAL wording.

determining that 60 minutes limit has been exceeded, or has been exceeded, or will will likely be exceeded. likely be exceeded. Note 2: If an ongoing release is The classification timeliness note has been standardized

• If an ongoing release is detected and the release detected and the release start time cannot be across the DCPP EAL scheme by referencing the "time limit" start time is unknown, determined, assume that the specified within the EAL wording. Changed the wording "is assume that the release release duration has unknown" to "cannot be determined." Release start time duration has exceeded 60 exceeded the specified time would normally not be known until action is taken to minutes. limit. determine when the release started.
• If the effluent flow past an effluent monitor is known to Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions have stopped, indicating that to isolate the release path, the release path is isolated, then the effluent monitor the effluent monitor reading None reading is no longer valid for is no longer VALID. for classification purposes. classification purposes.

15 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table R-1 Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm Ill

s 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.BE-3 µCi/cc Cll Ill Plant Vent m 1.BE-10 amps C) 1(2)-RM-87 ---- ---- -- 3.0E-1 µCi/cc Liquid Radwaste Effluent "C Line O-RM-18 ----- ----- ----- 1.6E+5 cpm

                   *s er

i SGBD Tank 1(2)-RM-23 ----- ----- ----- 2.0E+4 cpm 16of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI IC Wording and Mode DCPP DCPP IC Wording and Mode NEI IC#* Difference Justification Applicability IC#(s) Applicability AU2 UNPLANNED loss of water level RU2 UNPLANNED loss of water level None above irradiated fuel. above irradiated fuel. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. UNPLANNED water level RU2.1 UNPLANNED water level drop in the Added the word " ... equivalent. .. " to indications to clarify that drop in the REFUELING REFUELING PATHWAY as indicated there may be multiple means of assessing a refueling cavity PATHWAY as indicated by by low water level alarm or equivalent level drop. ANY of the following: indication. Added the words " ... to low alarm setpoint. .. " to provide a low, (site-specific level AND but operationally significant, threshold for the operators to indications). become aware of an area radiation level increase. UNPLANNED rise to low alarm AND The site-specific list of radiation monitors are listed in bullet setpoint in corresponding area

b. UNPLANNED rise in area format for ease of reading.

radiation levels as indicated by any of radiation levels as indicated the following radiation monitors: RM-2 is applicable in Refueling Mode (6) only. by ANY of the following radiation monitors.

• RM-58 Spent Fuel Pool Area (site-specific list of area radiation monitors)
• RM-59 New Fuel Area
• RM-2 Containment Area (Mode 6 only)
• Any temporary installed monitor in vicinity of the REFUELING PATHWAY (when installed) 17 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Jul)tification IC#(s) AA1 Release of gaseous or liquid RA1 Release of gaseous or liquid None radioactivity resulting in offsite radioactivity resulting in offsite dose dose greater than 10 mrem TEDE greater than 10 mrem TEDE or 50 or 50 mrem thyroid COE. mrem thyroid COE. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Reading on ANY of the following RA1.1 Reading on any Table R-1 effluent The DCPP radiation monitors that detect radioactivity radiation monitors greater than 1 effluent release to the environment are listed in Table R-1. radiation monitor > column "ALERT" the reading shown for 15 UE, Alert, SAE, and GE thresholds for all DCPP for;:: 15 minutes. (Notes 1, 2, 3, 4) minutes or longer: continuously monitored gaseous and liquid release pathways are listed in Table R-1 to consolidate the information in a (site-specific monitor list and single location and, thereby, simplify identification of the threshold values) thresholds by the EAL-user. 2 Dose assessment using actual RA1.2 Dose assessment using actual The site boundary is the site-specific receptor point. meteorology indicates doses meteorology indicates doses > 10 greater than 10 mrem TEDE or mrem TEDE or 50 mrem thyroid COE 50 mrem thyroid COE at or at or beyond the SITE BOUNDARY. beyond (site-specific dose (Note 4) receptor point). 3 Analysis of a liquid effluent RA1.3 Analysis of a liquid effluent sample The site boundary is the site-specific receptor point. sample indicates a concentration indicates a concentration or release or release rate that would result rate that would result in doses > 10 in doses greater than 10 mrem rrirem TEDE or 50 mrem thyroid COE TEDE or 50 mrem thyroid COE at or beyond the SITE BOUNDARY at or beyond (site-specific dose for 60 minutes of exposure. (Notes 1, - receptor point) for one hour of 2) exposure. 18 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Field survey results indicate 4 RA1.4 Field survey results indicate EITHER The site boundary is the site-specific receptor point. EITHER of the following at or of the following at or beyond the SITE beyond (site-specific dose BOUNDARY: receptor point): Added " ... and are ... " for clarification of intent.

• Closed window dose rates greater than 10 mR/hr
• Closed window dose rates are

                                                           > 10 mR/hr and are expected
                                                                                                                                          \

expected to continue for 60 to continue for~ 60 minutes. minutes or longer.

• Analyses of field survey
• Analyses of field survey samples indicate thyroid CDE samples indicate thyroid

                                                           > 50 mrem for 60 minutes of CDE greater than 50 mrem for one hour of inhalation.                   inhalation.
                                            *-.    (Notes 1, 2)

Notes

• The Emergency Director should declare the Alert N/A Note 1: The SM/SEC/ED should declare the event promptly The classification timeliness note has been standardized across the DCPP EAL scheme by referencing the "time limit" promptly upon determining upon determining that time specified within the EAL wording.

that the applicable time has limit has been exceeded, or been exceeded, or will likely will likely be exceeded. be exceeded. Note 2: If an ongoing release is The classification timeliness note has been standardized

• If an ongoing release is detected and the release detected. and the release start time cannot be across the DCPP !;AL scheme by referencing the "time limit" start time is unknown, determined, assume that specified within the EAL wording. Changed the wording "is assume that the release the release duration has unknown" to "cannot be determined." Release start time duration has exceeded 15 exceeded the specified time would normally not be known until action is taken to minutes. limit. determine when the release started.
• If the effluent flow past an effluent monitor is known to Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions have stopped, indicating None to isolate the release path, that the release path is then the effluent monitor isolated, the effluent monitor reading is no longer valid for reading is no longer VALID classification purposes. for classification purposes.

Note 4 The pre-calculated effluent

                                               '(

The pre-calculated effluent monitor values presented in monitor values presented in EALs RA1.1, RS1.1 and Incorporated site-specific EAL numbers associated with EAL #1 should be used for RG1 .1 should only be used generic EAL#1. emergency classification for emergency classification Added the word "onlv" to emphasize that the Table R-1 19of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP assessments until the results assessments until the effluent threshold values are only to be used in the absence from a dose assessment results from a dose of dose assessment using real meteorology being available. using actual meteorology are assessment using actual available. meteorology are available. 20 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) AA2 Significant lowering of water RA2 Significant lowering of water level None level above, or damage to, above, or damage to, irradiated fuel. irradiated fuel. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Uncovery of irradiated fuel in the RA2.1 Uncovery of irradiated fuel in the

• None REFUELING PATHWAY. REFUELING PATHWAY.

2 Damage to irr.adiated fuel RA2.2 Damage to irradiated fuel resulting in a The NEI phrase " ... from the fuel as indicated by ANY of the resulting in a release of release of radioactivity. following radiation monitors" has been replaced with " ... AND radioactivity from the fuel as High alarm on any of the following radiation monitors:" for indicated by ANY of the following AND clarification that the classification requires two conditions: radiation monitors: High alarm on any of the following damage to fuel and a resultant high radiation alarm. (site-specific listing of radiation radiation monitors: The site-specific list of radiation monitors are listed in bullet monitors, and the associated

• RM-59 New Fuel Storage Area format for ease of reading.

readings, setpoints and/or The High alarm setpoints for the radiation monitors are alarms)

• RM-58 Spent Fuel Pool Area indicative of significant increases in area or airborne radiation.
• Any temporary installed monitor in vicinity of the REFUELING PATHWAY (when installed)
• RM-2 Containment Area (Mode 6 only)
• RM-44A/B Containment Ventilation Exhaust (Mode 6 only) 3 Lowering of spent fuel pool level RA2.3 Lowering of spent fuel pool level to 10 Post-Fukushima order EA-12-051 required the installation of to (site-specific Level 2 value). ft. above top of the fuel racks (Level reliable SFP level indication capable of identifying normal level

[See Developer Notes] 2). (Level 1), SFP level 10 feet (ft.) above the top of the fuel racks (Level 2) and SFP level at the top of the fuel racks (Level 3). 21 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP SFP level instruments Ll-801 and Ll-801 provide SFP level

                                                                                                                                                =

indications in feet above top of the fuel racks. Level 1 23.75

                                                                                                    =

ft., Level 2 10 ft., Level 3 = 1 ft. A project to add new Main Annunciator window PK11-04 alarm when Level 2 is reached is expected to be complete prior to PG&E implementation of NEI 99-01 Rev. 6. DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) AA3 Radiation levels that impede RA3 Radiation levels that IMPEDE access EAL RA3.2 mode applicability is consistent with Table R-2 access to equipment necessary to equipment necessary for normal Area/Room assessment. Added the following note to the for normal plant operations, plant operations, cooldown or bases: cooldown or shutdown shutdown. "NOTE: EAL RA3.2 mode applicability has been limited to MODE: All MODE: All (except RA3.2 - Modes 2, the applicable modes identified in Table R-2 Safe Operation 3, 4 only) & Shutdown Rooms/Areas. If due to plant operating procedure or plant configuration changes, the applicable plant modes specified in Table R-2 are changed, a corresponding change to Attachment 3 'Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases' and to EAL RA3.2 mode applicability is required." NEI Ex. DCPP EAL# NEI Example EAL Wording DCPP EAL Wording Difference Justification .. EAL# 1 Dose rate greater than 15 mR/hr RA3.1 Dose rate > 15 mR/hr in EITHER of No other site-specific areas requiring continuous occupancy in ANY of the following areas: the following areas: exist at DCPP.

• Control Room Control Room (O-RM-1 or portable gamma radiation instrument)

O-RM-1 monitors the Control Room for area radiation. A portable gamma radiation instrument may be used when 0-

• Central Alarm Station OR RM-1 is out of service.

           *   (other site-specific areas/rooms)                          Central Alarm Station (by survey)

The Central Alarm Station (CAS) does not have installed area radiation monitoring and thus must be determined by survey. 2 An UNPLANNED event results RA3.2 An UNPLANNED event results in Table R-2 contains the site-specific list of plant rooms or areas 22 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP in radiation levels that prohibit or radiation levels that prohibit or with entry-related mode applicability identified. impede access to any of the IMPEDE access to any Table R-2 following plant rooms or areas: rooms or areas. (Note 5) (site-specific list of plant rooms or areas with entry-related mode applicability identified) Note If the equipment in the listed Note 5 If the equipment in the listed room or None room or area was already area was already inoperable or out-of-inoperable or out-of-service service before the event occurred, before the event occurred, then then no emergency classification is no emergency classification is warranted. warranted. Table R-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode(s) Auxiliary BuildinCI - 115' - BASTs 2, 3,4 Auxiliarv Buildinq - 100' - BA Pumps 2, 3,4 Auxiliary Buildinq - 85' -Aux Control Board 2, 3,4 Auxiliary BuildinCI - 64' - BART Tank area 2,3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 23 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) AS1 Release of gaseous radioactivity RS1 Release of gaseous radioactivity None resulting in offsite dose greater resulting in offsite dose greater than than 100 mrem TEDE or 500 100 mrem TEDE or 500 mrem thyroid mrem thyroid COE CDE. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Reading on ANY of the following RS1.1 Reading on any Table R-1 effluent The DCPP radiation monitors that detect radioactivity effluent radiation monitors greater than radiation monitor> column "SAE" for release to the environment are listed in Table R-1. UE, Alert, the reading shown for 15 ~ 15 minutes. SAE and GE thresholds for all DCPP monitored gaseous and minutes or longer: (Notes 1, 2, 3, 4) liquid release pathways are listed in Table R-1 to consolidate (site-specific monitor list and the information in a single location and, thereby, simplify threshold values) identification of the thresholds by the EAL-user. 2 Dose assessment using actual RS1.2 Dose assessment using actual The site boundary is the site-specific receptor point. meteorology indicates doses meteorology indicates doses > 100 greater than 100 mrem TEDE or mrem TEDE or 500 mrem thyroid COE 500 mrem thyroid CDE at or at or beyond the SITE BOUNDARY. beyond (site-specific dose (Note 4) receptor point) 3 Field survey results indicate RS1.3 Field survey results indicate EITHER The site boundary is the site-specific receptor point. EITHER of the following at or of the following at or beyond the SITE beyond (site-specific dose BOUNDARY: receptor point): Added " ... and are ... " for clarification of intent.

• Closed window dose rates
• Closed window dose rates are

                                                           > 100 mR/hr and are expected greater than 100 mR/hr                     to continue for~ 60 minutes.

• expected to continue for 60 minutes or longer.
• Analyses of field survey
• Analyses of field survey samples indicate thyroid samples indicate thyroid CDE >

500 mrem for 60 minutes of 24 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP COE greater than 500 inhalation. mrem for one hour of (Notes 1, 2) inhalation. Notes

• The Emergency Director Note 1: The SM/SEC/ED should The classification timeliness note has been standardized should declare the Site Area declare the event promptly across the DCPP EAL scheme by referencing the "time limit" Emergency promptly upon upon determining that time specified within the EAL wording.

determining that the limit has been exceeded, or applicable time has been will likely be exceeded. exceeded, or will likely be exceeded. Note 2: If an ongoing release is

• If an ongoing release is detected and the release The classification timeliness note has been standardized detected and the release start start time cannot be across the DCPP EAL scheme by referencing the "time limit" time is unknown, assume that determined, assume that the specified within the EAL wording. Changed the wording "is the release duration has release duration has unknown" to "cannot be determined." Release start time exceeded 15 minutes. exceeded the specified time would normally not be known until action is taken to determine
• If the effluent flow past an limit. when the release started.

effluent monitor is known to Note 3: If the effluent flow past an have stopped due to actions effluent monitor is known to None to isolate the release path, have stopped, indicating that then the effluent monitor the release path is isolated, reading is no longer valid for the effluent monitor reading classification purposes. is no longer VALID for classification purposes.

• The pre-calculated effluent monitor values presented in Note 4 The pre-calculated effluent EAL #1 should be used for Incorporated site-specific EAL numbers associated with monitor values presented in emergency classification generic EAL#1.

EALs RA 1.1, RS1 .1 and assessments until the results RG1 .1 should only be used Added the word "only" to emphasize that the Table R-1 from a dose assessment for emergency classification effluent threshold values are only to be used in the absence of using actual meteorology are assessments until the results dose assessment using real meteorology being available. available. from a dose assessment using actual meteorology are available. 25 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording c- Difference Justification IC#(s) AS2 Spent fuel pool level at (site- RS2 Spent fuel pool level at the top of the Top of the fuel racks is the site-specific Level 3 description. specific Level 3 description) fuel racks. MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# ' EAL# 1 ,Lowering of spent fuel pool level RS2.1 Lowering of spent fuel pool level to 0 Post-Fukushima order EA-12-051 required the installation of to (site-specific Level 3 value) ft. above top of the fuel racks (Level reliable SFP level indication capable of identifying normal level 3). (Level 1), SFP level 10 ft. above the top of the fuel racks (Level 2) and SFP level at the top of the fuel racks (Level 3).

                                          ~                                                  SFP level instruments Ll-801 and Ll-801 provide SFP level indications in feet above top of the fuel racks. Level 1 =23.75 ft., Level 2 = 10 ft., Level 3 = 0 ft. (includes 1 ft. instrument uncertainly).

26of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) AG1 Release of gaseous RG1 Release of gaseous radioactivity None radioactivity resulting in offsite resulting in offsite dose greater than dose greater than 1,000 mrem 1,000 mrem TEDE or 5,000 mrem TEDE or 5,000 mrem thyroid thyroid COE. COE. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Reading on ANY of the RG1.1 Reading on any Table R-1 effluent The DCPP radiation monitors that detect radioactivity effluent following radiation monitors radiation monitor> column "GE" for release to the environment are listed in Table R-1. UE, Alert, greater than the reading shown  ;::: 15 minutes. SAE, and GE thresholds for all DCPP monitored gaseous or for 15 minutes or longer: (Notes 1, 2, 3, 4) liquid release pathways are listed in Table R-1 to consolidate the (site-specific monitor list and information in a single location and, thereby, simplify threshold values) identification of the thresholds by the EAL-user. 2 Dose assessment using actual RG1.2 Dose assessment using actual The site boundary is the site-specific receptor point. meteorology indicates doses meteorology indicates doses > 1,000 greater than 1,000 mrem TEDE mrem TEDE or or 5,000 mrem thyroid COE at 5,000 mrem thyroid COE at or or beyond (site-specific dose beyond the SITE BOUNDARY. receptor point). (Note 4) 3 Field survey results indicate RG1.3 Field survey results indicate EITHER The site boundary is the site-specific receptor point. EITHER of the following at or of the following at or beyond the beyond (site-specific dose SITE BOUNDARY: receptor point): Added " ... and are ... " for clarification of intent.

• Closed window dose rates
• Closed window dose rates are >

1,000 mR/hr and are expected greater than 1,000 mR/hr to continue for ;::: 60 minutes. expected to continue for 60 minutes or longer.

• Analyses of field survey

         *Analyses of field survey                        samples indicate thyroid COE >

samples indicate thyroid 5,000 mrem for 60 minutes of 27 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP COE greater than 5,000 inhalation. mrem for one hour of inhalation. (Notes 1, 2) Notes

• The Emergency Director Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across should declare the Site Area declare the event promptly the DCPP EAL scheme by referencing the "time limit" specified Emergency promptly upon upon determining that within the EAL wording.

determining that the time limit has been applicable time has been exceeded, or will likely be exceeded, or will likely be exceeded. exceeded. Note 2: If an ongoing release is

• If an ongoing release is detected and the release detected and the release start time cannot be The classification timeliness note has been standardized across start time is unknown, determined, assume that the DCPP EAL scheme by referencing the "time limit" specified assume that the release within the EAL wording. Changed the wording "is unknown" to the release duration has duration has exceeded 15 "cannot be determined." Release start time would normally not exceeded the specified minutes. time limit. be known until action is taken to determine when the release started.
• If the effluent flow past an Note 3: If the effluent flow past an effluent monitor is known to effluent monitor is known have stopped due to actions to have stopped, to isolate the release path, indicating that the release then the effluent monitor path is isolated, the None reading is no longer valid for effluent monitor reading is '-

classification purposes. no longer VALID for classification purposes.

• The pre-calculated effluent monitor values presented in Note 4 The pre-calculated EAL #1 should be used for effluent monitor values emergency classification presented in EALs RA 1.1, assessments until the results RS1 .1 and RG1 .1 should from a dose assessment only be used for Incorporated site-specific EAL numbers associated with generic using actual meteorology are emergency classification EAL#1.

available. assessments untirthe

• results from a dose Added the word "only" to emphasize that the Table R-1 effluent assessment using actual threshold values are only to be used in the absence of dose meteorology are available. assessment using real meteorology being available.

28 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) AG2 Spent fuel pool level cannot be RG2 Spent fuel pool level cannot be Top of the fuel racks is the site-specific Level 3 description. restored to at least (site-specific restored to at least the top of the fuel Level 3 description) for 60 racks for 60 minutes or longer. minutes or longer. MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Spent fuel pool level cannot be RG2.1 Spent fuel pool level cannot be Post-Fukushima order EA-12-051 required the installation of restored to at least (site-specific restored to at least 0 ft. above top of reliable SFP level indication capable of identifying normal level Level 3 value) for 60 minutes or the fuel racks (Level 3) for ~ 60 (Level 1), SFP level 10 ft. above the top of the fuel racks longer. minutes. (Note 1) (Level 2) and SFP level at the top of the fuel racks (Level 3). SFP level instruments Ll-801 and Ll-801 provide SFP level indications in feet above top of the fuel racks. Level 1 =23.75 ft., Level 2 = 10 ft., Level 3 = 1 ft. (includes 1 ft. instrument uncertainly). Note The Emergency Director should NIA Note 1: The SM/SEC/ED should The classification timeliness note has been standardized declare the General Emergency declare the event promptly across the DCPP EAL scheme by referencing the "time limit" promptly upon determining that upon determining that time specified within the EAL wording. 60 minutes has been exceeded, limit has been exceeded, or or will likely be exceeded. will likely be exceeded. 29 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category C Cold Shutdown I Refueling System Malfunction 30of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CU1 UNPLANNED loss of (reactor CU1 UNPLANNED loss of RCS Deleted" ... for 15 minutes or longer." Since only one of the two EALs vessel/RCS [PWR] or RCP inventory. associated with IC CU1 has a timing component, the IC needs to [BWR]) inventory for 15 minutes_ reflect both EALs intent. MODE: 5 - Cold Shutdown, 6 - or longer. Refueling MODE: Cold Shutdown, Refueling NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 UNPLANNED loss of reactor CU1.1 UNPLANNED loss of RCS Revised "reactor coolant" to "RCS inventory" to be consistent with coolant results in (reactor inventory results in RCS water the IC and CA 1 wording. vessel/RCS [PWR] or RCP level less than a procedurally Replace "required" with "procedurally designated" to be specific as [B WR]) level less than a designated lower limit for~ 15 the source of the required level band. required lower limit for 15 minutes. (Note 1) minutes or longer. 2 a. (Reactor vessel/RCS [PWR] CU1.2 RCS water level cannot be Added the phrase "due to a loss of RCS inventory" because the NEI or RCP [BWR]) level cannot monitored. basis states: "Sump and/or tank level changes must be evaluated be monitored. AND EITHER against other potential sources of water flow to ensure they are indicative of leakage from the RCS." " AND

• UNPLANNED increase in Added bulleted criteria "Visual observation of UNISOLABLE RCS

" any Table C-1 sump/tank

b. UNPLANNED increase in LEAKAGE" to include direct observation of RCS leakage.

level due to loss of RCS (site-specific sump and/or inventory. Table C-1 lists the site-specific sump and tanks that may be used as tank) levels. indirect RCS leakage indications based on level increases.

• Visual observation of UNISOLABLE RCS LEAKAGE.

Note The Emergency Director N/A Note.1: The SM/SEC/ED The classification timeliness note has been standardized across the should declare the Unusual should declare the DCPP EAL scheme by referencing the "time limit" specified within Event promptly upon event promptly upon the EAL wording. determining that 15 minutes determining that time has been exceeded, or will limit has been 31of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP likely be exceeded. exceeded, or will likely be exceeded. Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT
• RCDT
• CCW surge tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT 32of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) I CU2 Loss of all but one AC power CU2 Loss of all but one AC power The DCPP vital buses are the site-specific emergency buses. source to emergency buses for source to vital buses for 15 15 minutes or longer. minutes or longer. MODE: Cold Shutdown, MODE: 5 - Cold Shutdown, 6 - Refueling, Defueled Refueling, D - Defueled NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. AC power capability to (site- CU2.1 AC power capability, Table C-3, 4.16KV vital buses 1(2)F, 1(2)G and 1(2)H are the site-specific specific emergency buses) is to Unit 1 or Unit 2 vital 4.16KV emergency buses. reduced to a single power buses F, G and H reduced to a Site-specific AC power sources are listed in Table C-3. source for 15 minutes or single power source for <:: 15 longer. minutes. (Note 1) Reworded second conditional for clarity. AND AND

b. Any additional single power A failure of that single power source failure will result in source will result in loss of all loss of all AC power to AC power to SAFETY SAFETY SYSTEMS.

SYSTEMS. Note The Emergency Director should N/A Note 1: The SM/SEC/ED The classification timeliness note has been standardized across the declare the Unusual Event should declare the DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that event promptly upon the EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. 33of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP I Table C-3 AC Power Capability I Unit 1 Unit2 Q)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

                       ~

0

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR Q)
• DG 1-1-Bus H
• DG 2 Bus H

                       +'
                       'iii

• DG 1 Bus G
• DG 2 Bus G c:

0

• DG 1 Bus F
• DG 2 Bus F
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie 34of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CU3 UNPLANNED increase in RCS CU3 UNPLANNED increase in RCS None temperature temperature. MODE: Cold Shutdown, MODE: 5 - Cold Shutdown, 6 - Refueling RefuelinQ NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 UNPLANNED increase in RCS CU3.1 UNPLANNED increase in RCS 200 degrees Fahrenheit (°F) is the site-specific Technical temperature to greater than (site- temperature to > 200°F. (Note Specification (Tech. Spec.) cold shutdown temperature limit. specific Technical Specification 10) Added Note 10 to emphasize that hot condition EALs are cold shutdown temperature limit) subsequently applicable for any new event. 2 Loss of ALL RCS temperature CU3.2 Loss of all RCS temperature and None and (reactor vessel/RCS [PWR] all RCS level indication for ~ 15 or RCP [BWR]) level indication minutes. (Note 1) for 15 minutes or longer. Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that promptly upon the EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. N/A N/A N/A Note 10: Begin monitoring hot Added Note 10 to emphasize that hot condition EALs are condition EALs subsequently applicable for any new event. concurrently. 35of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CU4 Loss of Vital DC power for 15 CU4 Loss of Vital DC power for 15 None minutes or longer. minutes or longer. MODE: Cold Shutdown, MODE: 5 - Cold Shutdown, 6 - Refueling Refueling NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Indicated voltage is less than CU4.1 < 105 voe bus voltage indications 105 VDC is the site-specific minimum vital DC bus voltage. (site-specific bus voltage value) on Technical Specification DC operability requirements are specified in Tech. Spec. on required Vital DC buses for 15 required 125 voe buses for;::: 15 minutes or longer. minutes. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across declare the Unusual Event declare the event promptly the DCPP EAL scheme by referencing the "time limit" specified promptly upon determining that upon determining that time within the EAL wording. 15 minutes has been exceeded, limit has been exceeded, or will likely be exceeded. or will likely be exceeded. 36of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CU5 Loss of all onsite or offsite CU5 Loss of all onsite or offsite None communications capabilities. communications capabilities. MODE: Cold Shutdown, MODE: 5 - Cold Shutdown, 6 - Refueling, Defueled Refueling, D - Defueled NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of ALL of the following CU5.1 Loss of all Table C-5 onsite Example EALs #1, 2, and 3 have been combined into a single onsite communication methods: communication methods.

• EAL for simplification of presentation.

(site specific list of OR Table C-4 provides a site-specific list of onsite, offsite (ORO), and communications methods) Loss of all Table C-5 offsite NRC communications methods. communication methods. 2 Loss of ALL of the following ORO OR r communications methods: Loss of all Table C-5 NRC (site specific list-of communication methods. communications methods) 3 Loss of ALL of the following NRC communications methods: (site specific list of communications methods) 37 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table C-5 Communication Methods System On site Offsite NRC Unit 1, Unit 2 and TSC Radio Consoles x x DCPP Telephone System (PBX) x x x Portable radio equipment (handie-talkies) x Operations Radio System x x Security Radio Systems x CAS and SAS Consoles x x x Fire Radio System x Hot Shutdown Panel Radio Consoles x x x Public Address System x NRC FTS x Mobile radios x Satellite phones x x x Direct line (ATL) to the County and State OES x 38of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CA1 Loss of (reactor vessel/RCS CA1 Loss of RCS inventory. None [PWR] or RCP [BWR]) inventory MODE: 5 - Cold Shutdown, 6 - MODE: Cold Shutdown, Refueling Refueling NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of (reactor vessel/RCS CA1.1 Loss of RCS inventory as When reactor vessel water level decreases to 107 ft. 6 inches (in.) [PWR] or RCP [BWR]) inventory indicated by reactor vessel level elevation (el.), RCS level is approximately 21 in. above the bottom of as indicated by level less than < 107 ft. 6 in. (107.5 ft.) on the RCS hot leg penetration. This is the minimum procedurally (site-specific level). RVRLIS, Ll-400 standpipe or allowed RCS level to preclude vortexing of the Residual Heat ultrasonic sensor. Removal (RHR) pumps while in Shutdown Cooling. OR

                                                  < 67.5% RVLIS full range (RVLIS equivalent to 107 ft. 6 in.).

2 a. (Reactor vessel/RCS [PWR] CA1.2 RCS water level cannot be Added bulleted criteria "Visual observation of UNISOLABLE RCS or RCP [BWR]) level cannot monitored for ;o: 15 minutes. LEAKAGE" to include direct observation of RCS leakage. be monitored for 15 minutes (Note 1) Table C-1 lists the site-specific sump and tanks that may be used as or longer AND EITHER indirect RCS leakage indications based on level increases. AND

• UNPLANNED increase in

b. UNPLANNED increase in any Table C-1 Sump I Tank (site-specific sump and/or level) due to a loss of RCS tank) levels due to a loss of inventory.

(reactor vessel/RCS [PWR] or RCP [BWR]) inventory.

• Visual observation of UNISOLABLE RCS LEAKAGE.

Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Alert promptly upon declare the event promptly upon DCPP EAL scheme by referencinq the "time limit" specified within the 39 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP determining that 15 minutes has determining that time limit has EAL wording. been exceeded, or will likely be been exceeded, or will likely be exceeded exceeded. DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CA2 Loss of all offsite and all onsite CA2 Loss of all offsite and all onsite The DCPP vital buses are the emergency buses. ) AC power to emergency buses AC power to vital buses for 15 for 15 minutes or longer minutes or longer. MODE: Cold Shutdown, MODE: 5 -Cold Shutdown, 6 - Refueling, Defueled Refueling, D - Defueled NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of ALL offsite and ALL CA2.1 Loss of all offsite and all onsite 4.16KV buses 1(2)F, 1(2)G, and 1(2)H are the site-specific onsite AC Power to (site-specific AC power capability, Table C-3, emergency buses. emergency buses) for 15 to Unit 1 or Unit 2 vital 4.16KV Site-specific AC power sources are tabularized in Table C-3. minutes or longer. buses F, G and H for~ 15 minutes. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED The classification timeliness note has been standardized across the declare the Unusual Event should declare the DCPP EAL scheme by referencing the "time limit" specified within the promptly upon determining that event promptly upon EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. 40of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CA3 Inability to maintain the plant in CA3 Inability to maintain the plant in None cold shutdown. - cold shutdown. MODE: Cold Shutdown, MODE: 5 - Cold Shutdown, Refueling 6 - Refueling NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 UNPLANNED increase in RCS UNPLANNED increase in RCS Example EALs #1 and #2 have been combined into a single EAL temperature to greater than temperature to > 200°F for as EAL #2 is the alternative threshold based on a loss of RCS (site-specific Technical > Table C-4 duration. temperature indication. Specification cold shutdown (Note 1, 10) 200°F is the site-specific Tech. Spec. cold shutdown temperature temperature limit) for greater OR limit. than the duration specified in the following table. UNPLANNED RCS pressure Table C-4 is the site-specific implementation of the generic RCS CA3.1 increase> 10 psig (this does Heat-up Duration Threshold table. 2 UNPLANNED RCS pressure not apply during water-solid increase greater than (site- 10 psig is the site-specific pressure increase readable by Control plant conditions). Room indications. specific pressure reading). (This EAL does not apply during Added Note 10 to emphasize that hot condition EALs are water-solid plant conditions. subsequently applicable for any new event. [PWR]) Note The Emergency Director should N/A Note 1: The SM/SEC/ED The classification timeliness note has been standardized across the declare the Unusual Event should declare the DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that event promptly upon the EAL wording. 15 minutes has been exceeded, deter.mining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. N/A N/A N/A Note 1O: Begin monitoring hot Added Note 10 to emphasize that hot condition EALs are condition EALs subsequently applicable for any new event. concurrently. 41 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI: Table: RCS Heat-up Duration Thresholds RCS Status Containment Closure Status Heat-up Duration Intact (but not at reduced Not applicable 60 minutes* inventory [PWR]) Not intact (or at reduced Established 20 minutes* inventory [PWR]) Not Established 0 minutes

• If an RCS heat removal system is in operation within this time frame and RCS temperature is being reduced, the EAL is not applicable.

DCPP: Table C-4: RCS Heat-up Duration Thresholds CONTAINMENT CLOSURE RCS Status Heat-up Duration Status INTACT (but not REDUCED N/A 60 minutes* INVENTORY) Not INTACT established 20 minutes* OR REDUCED INVENTORY not established 0 minutes

• If an RCS heat removal system is in operation within this time frame and RCS temperature is trending down, the EAL is not applicable.

42 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CA6 Hazardous event affecting a CA6 Hazardous event affecting a None SAFETY SYSTEM needed for SAFETY SYSTEM needed for the current operating mode. the current operating mode. MODE: Cold Shutdown, MODE: 5 - Cold Shutdown, 6 - Refueling Refueling 43 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL#

a. The occurrence of ANY of The hazardous events have been tabularized in Table C-6.

1 CA6.1 The occurrence of any Table the following hazardous C-6 hazardous event. Tsunami has been added as a site-specific hazard for DCPP. events:

• Seismic event AND EITHER:

(earthquake)

• Internal or external
• Event damage has caused flooding event indications of degraded performance in at least one
• High winds or tornado strike train of a SAFETY SYSTEM needed for the current
• FIRE operating mode.
• EXPLOSION

           *  (site-specific hazards)

• Other events with similar
• The event has caused VISIBLE DAMAGE to a hazard characteristics as SAFETY SYSTEM determined by the Shift component or structure '

Manager needed for the current AND operating mode.

b. EITHER of the following:

1. Event damage has' caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode.

OR

2. The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode.

44of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table C-6 Hazardous Events

• Seismic event (earthquake)
• Internal or external FLOODING event
• High winds or TORNADO strike
• FIRE
• EXPLOSION
• Tsunami
• Other events with similar hazard characteristics as determined by the SM/SEC/ED 45of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CS1 Loss of (reactor vessel/RCS CS1 Loss of RCS inventory affecting None [PWR] or RCP [BWR]) inventory core decay heat removal affecting core decay heat capability. removal capability. MODE: 5 - Cold Shutdown, 6 - MODE: Cold Shutdown, Refueling Refueling NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. CONTAINMENT CLOSURE CS1.1 With CONTAINMENT When reactor vessel water level lowers to 62.1 %, water level is six not established. CLOSURE not established, inches below the elevation of the bottom of the RCS hot leg RVLIS full range < 62.1 %. penetration. AND (Note 12)

b. (Reactor vessel/RCS [PWR]

or RCP [BWR]) level less than (site-specific level). 2 a. CONTAINMENT CLOSURE CS1.2 With CONTAINMENT When reactor vessel water level drops below Reactor Vessel Level established. CLOSURE established, RVLIS Instrumentation System (RVLIS) full range indication of 56.6% core full range < 56.6% (Top of Fuel). uncovery is about to occur. AND (Note 12)

b. (Reactor vessel/RCS [PWR]

or RCP [BWR]) level less than (site-specific level). RCS water level cannot be ' 3 a. (Reactor vessel/RCS [PWR] CS1.3 Bridge (Manipulator) Crane Radiation Monitor> 9 Rad per hour monitored for ;o: 30 minutes. or RCP [BWR]) level cannot (R/hr) (90% of instrument scale) would be indicative of possible core (Note 1) be monitored for 30 minutes uncovery in the Refueling mode. or longer. AND Core uncovery is indicated by Table C-1 lists the site-specific sump and tanks that may be used as AND any of the following: indirect RCS leakage indications based on level increases.

b. Core uncovery is indicated by

• UNPLANNED increase in ANY of the following: any Table C-1 sump/tank 46of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP

           *   (Site-specific radiation monitor) reading greater level of sufficient magnitude to indicate core uncover.

than (site-specific value)

• Any Bridge (Manipulator)

Crane Radiation Monitor > 9

• Erratic source range monitor indication [PWR] R/hr.
• Erratic Source Range
• UNPLANNED increase in (site-specific sump and/or Monitor indication.

tank) levels of sufficient magnitude to indicate core uncovery

           *   (Other site-specific indications)

Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Site Area declare the event DCPP EAL scheme by referencing the "time limit" specified within the Emergency promptly upon promptly upon EAL wording. determining that 30 minutes has determining that time been exceeded, or will likely be limit has been exceeded exceeded, or will likely be exceeded. N/A N/A N/A Note 12: With RVLIS out-of- Added Note 12 to emphasize that with RVLIS out of service, service, classification classification should be based on either CS1 .3 or CG1 .2 when RCS shall be based on inventory cannot be monitored. CS1 .3 or CG1 .2 if RCS inventory cannot be monitored. 47 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) CG1 Loss of (reactor vessel/RCS CG1 Loss of RCS inventory affecting None [PWR] or RCP [BWR]) inventory fuel clad integrity with affecting fuel clad integrity with containment challenged. containment challenged MODE: 5 - Cold Shutdown, 6 - MODE: Cold Shutdown, Refueling Refueling NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. (Reactor vessel/RCS [PWR] CG1.1 RVLIS full range < 56.6% (Top of When reactor vessel water level drops below RVLIS full range or RCP [BWR]) level less than Fuel) for<:: 30 minutes. (Note 1) indication of 56.6% core uncovery is about to occur. (site-specific level) for 30 AND Table C-2 provides a tabularized list of containment challenge minutes or longer. indications. Any Containment Challenge AND indication, Table C-2. 4% hydrogen concentration in the presence of oxygen represents

b. ANY indication from the an explosive mixture in containment.

Containment Challenge Table (see below). 2 a. (Reactor vessel/RCS [PWR] CG1.2 RCS water level cannot be Bridge (Manipulator) Crane Radiation Monitor> 9 R/hr (90% of or RCP [BWR]) level cannot monitored for<:: 30 minutes. instrument scale) would be indicative of possible core uncovery be monitored for 30 minutes (Note 1) in the Refueling mode. or longer. AND Table C-2 provides a tabularized list of containment challenge Core uncovery is indicated by AND indications. any of the following:

b. Core uncovery is indicated by 4% hydrogen concentration in the presence of oxygen represents ANY of the following:

• UNPLANNED increase in an explosive mixture in containment.

any Table C-1 sump/tank

           *    (Site-specific radiation monitor) reading greater level of sufficient magnitude to indicate core than (site-specific value)                uncover.

• Erratic source range monitor indication [PWR]
• Any Bridge (Manipulator)

Crane Radiation Monitor 48 of 114

                                                                                                                                                       -- - _J

EAL Comparison Matrix OSSI Project #14-0303 DCPP

• UNPLANNED increase in (site-specific sump and/or

                                                          > 9 R/hr.

tank) levels of sufficient

• Erratic Source Range magnitude to indicate core . Monitor indication.

uncovery AND

           *     (Other site-specific indications)

Any Containment Challenge indication, Table C-2. AND

c. ANY indication from the Containment Challenge Table (see below).

Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across declare the General Emergency declare the event the DCPP EAL scheme by referencing the "time limit" specified promptly upon determining that promptly upon within the EAL wording. 30 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. Note 6: If CONTAINMENT Note 6 implements the asterisked note associated with the N/A CLOSURE is re-generic Containment Challenge,table. established prior to exceeding the 30-minute time limit, declaration of a General Emergency is not required. N/A N/A N/A Note 12: With RVLIS out-of- Added Note 12 to emphasize that with RVLIS out of service, service, classification classification should be based on either CS1 .3 or CG1 .2 when shall be based on RCS inventory cannot be monitored. CS1 .3 or CG1 .2 if RCS inventory cannot be monitored. 49 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Containment Challenge Table

• CONTAINMENT CLOSURE not established*

 *   (Explosive mixture) exists inside containment

• UNPLANNED increase in containment pressure
• Secondary containment radiation monitor reading above (site-specific value) [BWR]
• If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required.

Table C-2 Containment Challenge Indications

• CONTAINMENT CLOSURE not established (Note 6)
• Containment hydrogen concentration ~ 4%
• UNPLANNED rise in Containment pressure

                                                                                                               /

50of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category D Permanently Defueled Station Malfunction 51of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI IC# DCPP NEI IC Wording DCPP IC Wording Difference Justification IC#(s) PD-AU1 Recognition Category D N/A N/A NEI Recognition Category PD ICs and EALs are applicable only to PD-AU2 Permanently Defueled Station permanently defueled stations. DCPP is not a defueled station. PD-SU1 PD-HU1 PD-HU2 PD-HU3 PD-AA1 PD-AA2 PD-HA1 PD-HA3 52of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category E Independent Spent Fuel Storage Installation 53 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) E-HU1 Damage to a loaded cask EU1 Damage to a loaded cask None CONFINEMENT BOUNDARY CONFINEMENT BOUNDARY. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Damage to a loaded cask EU1.1 Damage to a loaded cask The DCPP ISFSI Technical Specifications do not have maximum CONFINEMENT BOUNDARY as CONFINEMENT BOUNDARY contact dose rate specified for the exterior of an overpack. The indicated by an on-contact as indicated by an on-contact values in Table E-1 are derived from the ISFSI UFSAR. Since the radiation reading greater than (2 radiation reading> Table E-1. UFSAR Table 7.3-1A are the maximum calculated dose rate values, times the site-specific cask and are not expected to ever be exceeded, a conservative specific technical specification approach of exceeding the highest possible fuel value dose rates, allowable radiation level) on the plus 5 mRem/hour, was used as an indication of damage to an surface of the spent fuel cask. overpack. Note: These values are approximately 2 times the maximum expected dose rate for low burn-up fuel. Table E-1 ISFSI Radiation Readings Dose Point Location Surface Dose Rate (see figure) (mRem/hour) 1 Base vent 72 2 Mid plane 80 3 Top vent 76 4 Lid-center 22 4a Lid-over top vents 139 54 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category F Fission Product Barri~er Degradation 55 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) FA1 Any Loss or any Potential Loss of FA1 Any loss or any potential loss of None either the Fuel Clad or RCS either Fuel Clad or RCS. barrier. MODE: 1 - Power Operation, 2 - MODE: Power Operation, Hot Startup, 3 - Hot Standby, 4 - Hot Standby, Startup, Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording -* DCPP EAL Wording Difference Justification EAL# EAL# 1 Any Loss or any Potential Loss of FA1.1 Any loss or any potential loss of Table F-1 provides the fission product barrier loss and potential loss either the Fuel Clad or RCS either Fuel Clad or RCS. (Table thresholds. barrier. F-1) 56 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) FS1 Loss or Potential Loss of any two FS1 Loss or potential loss of any two None barriers barriers. MODE: Power Operation, Hot MODE: 1 - Power Operation, 2 - Standby, Startup, Hot Shutdown Startup, 3 - Hot Standby, 4 - Hot Shutdown NEI Ex. DCPP .. NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss or Potential Loss of any two FS1.1 Loss or potential loss of any two Table F-1 provides the fission product barrier loss and potential loss barriers. barriers. (Table F-1) thresholds. 57of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) FG1 Loss of any two barriers and Loss FG1 Loss of any two barriers and loss None or Potential Loss of third barrier. or potential loss of the third MODE: Power Operation, Hot barrier. Standby, Startup, Hot Shutdown MODE: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of any two barriers and FG1.1 Loss of any two barriers Table F-1 provides the fission product barrier loss and potential loss Loss or Potential Loss of third thresholds. barrier. AND Loss or potential loss of the third barrier. (Table F-1) 58 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP I Table F-1 Fission Product Barrier Threshold Matrix Fuel Clad (FC) Barrier Reactor Coolant System (RCS) Barrier Containment (CMT) Barrier Category Loss Potential Loss Loss Potential Loss Loss Potential Loss

 .                                                                               1. An automatic or manual

1. Operation of a standby charging pump is required ECCS (SI) actuation requi red by EITHER :

A 1. A leaking or RUPTURED SG by EITHER :

• UNISOLABLE RCS RCS or None None is FAULTED outside of None
• UNISOLABLE RCS LEAKAGE SG Tube containment Leakage LEAKAGE
• SG tube leakage
• SG tube RUPTURE 2. CSFST Integrity-RED path conditions met

1. CSFST Core Cooling-MAGENTA path conditions 1. CSFST Core Cooling-RED B met 1. CS FST Heat Sink-RED path path cond itions met

1. CSFST Core Cooling- conditions met AND Inadeq uate 2. CS FST Heat Sink-RED path None None Heat RED path cond itions met conditions met AND Restoration procedures not Removal AND Bleed and feed criteria met effective within 15 minutes (Note 1)

Bleed and feed criteria met c 1. Contai nment rad iation (RM-30 or RM-31) > 300 R/hr CMT 1. Containment radia tion 1. Containment radiation Radiation None None None

2. Dose equivalent 1-131 (RM-30 or RM-31) > 40 R/hr (R M-30 or RM-31 ) > 5, 000 R/hr

      / RCS       coolant activity > 300 Activity     µCi/gm

1. Contain ment isolation is requ ired AND EITHER : 1. CSFST Containment-RED path

• Containment integrity conditions met (2: 47 psig) has been lost based on 2. Containmen t hydrogen D SM/S EC/ED concentration 2: 4%

CMT None None None None determination

3. Containment pressure 2: 22 Integrity

• UN ISOLABLE pathway from psig with < one fu ll train of or Bypass Contain ment to the depressurization equipment environment exists operating per design for

2. Ind ications of RCS 2: 15 min utes (Note 1, 9)

LEAKAG E outside of Containment E 1. Any condition in the opinion 1. Any condition in the opinion 1. Any condition in the opinion 1. Any condition in the opinion 1. Any condition in the opinion 1. An y condition in the opinion SM/SEC of the SM/SEC/ED that of the SM/S EC/ED that of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that

        /ED       indicates loss of the fuel       indicates potential loss of       indicates loss of the RCS          indicates potential loss of the      indica tes loss of the           indicates potential loss of the Judgment      clad barrier                     the fuel clad barrier             barrier                            RCS barrier                          containment barrier              containment barrier 59 of 114

                                                                   ----~~---

EAL Comparison Matrix OSSI Project #14-0303 DCPP PWR Fuel Clad Fission Product Barrier Degradation Thresholds NE I DCPP NEI Threshold Wording DCPP FPB Wording Difference Justification FPB# FPB #(s) FC Loss RCS or SG Tube Leakage N/A N/A N/A 1 Not A pplicable FC Loss Inadequate Heat Removal FC Loss CSFST Core Cooling-RED Consistent with the generic developers note options Critical Safety path conditions met. Function Status T ree (CSFST) Co re Cooling Red Path is used in 2 A. Core exit thermocouple B. 1 lieu of Core Exit Thermocouples (CET) temperatures. readi ngs greater than (site-specific temperature value). FC Loss RCS Activity/CMNT Rad FC Loss Containment radiation (RM -30 Containment rad iation monitor readings greater than 300 R/h r or RM-3 1) > 300 R/hr. ind icates the release of reactor coolant, with elevated activity 3 A. Conta inment radiat ion C.1 ind icative of fuel damage, into the Contain ment. The read ing is monitor read ing greater than derived assuming the instantaneous release and dispersal of the (site-specific value) reactor coolant noble gas and iodine inventory associated with a OR concentration of 300 µC i/cc dose equ ivalent 1-131 into the Containment atmosphere. B. (Site-specific indications that reactor coolant activity is FC Loss Coolant activity > 300 µCi/gm None greater than 300 µCi/gm dose Dose Equivalent 1-131 . equivalent 1-131) C.2 FC Loss CNMT Integrity or Bypass N/A N/A N/A 4 Not Applicable FC Loss Other Indications N/A N/A No other site-specific Fuel Clad Loss indication has been identified 5 for DCPP. A. (s ite-specific as applicable) 60 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP NEI Threshold Wording DCPP FPB Wording Difference Justification FPB# FPB #(s) FC Loss ED Judgment FC Loss Any condition in the opinion of None the SM/SEC/ED that indicates 6 A. ANY condition in the E.1 loss of the fuel clad barrier. opinion of the Emergency Director that indicates Loss of the Fuel Clad Barrier. FC RCS or SG Tube Leakage N/A N/A See FC P-Loss B.1. The RCS level threshold is implemented as P-Loss CSFST Core Cooling Magenta Path cond itions met. A. RCS/reactor vessel level 1 less than (site-specific level) FC Inadequate Heat Removal FC CSFST Core Cooling- Consistent with the generic developers note options CSFST Core P-Loss P-Loss MAGENTA path conditions Cooling MAGENTA Path is used in lieu of CET temperatures. A. Core exit thermocouple B.1 met. 2 readings greater than (site- MAGENTA is the DCPP specific path color equivalent of ORANGE specific temperature value) path in the generic Pressurized Water Reactors Owners Group (PWROG) CSFSTs. OR B. Inadequate RCS heat FC CSFST Heat Sink-RED path Consistent with the generic developers note options CSFST Heat removal capability via steam P-Loss conditions met. Sink Red Path is used . generators as indicated by B.2 AND For DCPP indication that heat removal is extremely challenged is (site-specific indications) . manifested by CSFST Heat Sink RED path conditions met in Bleed and feed criteria met. combination with bleed and feed criteria being met. Refer to Attachment A for justification of incorporation of the bleed and feed condition threshold associated with loss of heat sink. FC RCS Activity/CMT Rad N/A N/A N/A P-Loss Not Applicable 3 FC CMT Integrity or Bypass N/A N/A N/A P-Loss Not Applicable 4 61 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP NEI Threshold Wording DCPP FPB Wording Difference Justification FPB# FPB #(s) FC Other Indications N/A N/A No other site-specific Fuel Clad Potential Loss indication has been P-Loss identified for DCPP. A. (site-specific as applicable) 5 FC Emergency Director FC Any condition in the opinion of None P-Loss Judgment P-Loss the SM/SEC/ED that indicates E.1 potential loss of the fuel clad 6 A. Any cond ition in the opinion barrier. of the Emergency Director that indicates Potential Loss of the Fuel Clad Barrier. 62 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP PWR RCS Fission Product Barrier Degradation Thresholds NEI DCPP FPB NEI IC Wording DCPP FPB Wording Difference Justification FPB# #(s) RCS RCS or SG Tube Leakage RCS Loss An automatic or manual None Loss ECCS (SI) actuation required A. An automatic or manual A.1 ECCS (SI) actuation is by EITHER: 1 required by EITHER of the

• UNISOLABLE RCS following : LEAKAGE.

1. UNISOLABLE RCS leakage

• SG tube RUPTURE .

OR

2. SG tube RUPTURE.

RCS Inadequate Heat Removal N/A NIA N/A Loss Not Applicable 2 RCS RCS Activity/CMNT Rad RCS Loss Containment radiation (RM-30 Containment radiation monitor readings greater than 40 R/hr Loss or RM-31) > 40 R/hr. indicate the release of reactor coolant to the Containment. The A. Containment radiation C.1 3 readings assume the instantaneous release and dispersal of the monitor reading greater than reactor coolant noble gas and iodine inventory associated with (site-specific value). normal operating concentrations (i.e., within Technical Specifications) into the Containment atmosphere. RCS CNMT Integrity or Bypass NIA N/A N/A Loss Not Applicable 4 RCS Other Indications N/A N/A No other site-specific RCS Loss indication has been identified for Loss DCPP. A. (site-specific as applicable) 5 63 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP FPB NEI IC W ording DCPP FPB Wording Difference Justification FPB# #(s) RCS Emergency Director Judgment RCS Loss Any condition in the opinion None Loss of the SM/SEC/ED that A. ANY condition in the opinion E.1 indicates loss of the RCS 6 of the Emergency Director that barrier. ind icates Loss of the RCS Barrier. RCS RCS or SG Tube Leakage RCS Operation of a standby None P-Loss A.1 charging pump is required by P-Loss 1 A. Operation of a standby charging (makeup) pump is EITHER: required by EITHER of the

• UNISOLABLE RCS following : LEAKAGE .

1. UNISOLABLE RCS

• SG tube leakage.

leakage OR RCS CSFST Integrity-RED path Consistent with the generic developers note options CSFST

2. SG tube leakage. P-Loss A.2 conditio ns met. Integrity Red Path is used .

OR B. RCS cooldown rate greater than (site-specific pressurized thermal shock criteria/limits defined by site-specific indications) . RCS Inadequate Heat Removal RCS CSFST Heat Sink-RED path Consistent with the generic developers note options CSFST Heat P-Loss B.1 conditio ns met. Sink Red Path is used . P-Loss 2 A. Inadequate RCS heat removal capability via steam AND For DCPP indicatio n that heat removal is extremely challenged is generators as ind icated by manifested by CSFST Heat Sink RED path conditions met in Bleed and feed criteria met. (site-specific indications). combi nation with bleed and feed criteria being met. Refer to Attachment A for justification of incorporation of the bleed and feed condition thresho ld associated with loss of heat sink. 64of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP FPS NEI IC Wording DCPP FPS Wording Difference Justification FPS# #(s) RCS RCS Activity/CMT Rad N/A N/A N/A P-Loss 3 Not Applicable RCS CMT Integrity or Bypass N/A N/A N/A P-Loss 4 Not Appl icable RCS Other Indications N/A N/A No other site-specific RCS Potential Loss indication has been identified for DCPP. P-Loss 5 A. (site-specific as applicable) RCS Emergency Director Judgment RCS Any condition in the opinion of None P-Loss E.1 the SM/SEC/ED that indicates P-Loss 6 A. ANY condition in the opinion potential loss of the RCS of the Emergency Director that barrier. indicates Potential Loss of the RCS Barrier. 65 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP PWR Containment Fission Product Barrier Degradation Thresholds NEI DCPP NEI IC Wording DCPP FPB Wording Difference Justification FPB# FPB #(s) CMT RCS or SG Tube Leakage CMT A leaking or RUPTURED SG is None Loss Loss FAULTED outside of containment. A. A leaking or RUPTURED SG is 1 FAUL TED outside of containment. A .1 CMT Inadequate Heat Removal N/A N/A N/A Loss Not Applicable 2 CMT RCS Activity/CMNT Rad N/A N/A N/A Loss Not applicable 3 CMT CMT Integrity or Bypass CMT Containment isolation is required . Changed the word "judgment" to "determination" as Loss Loss containment integrity is a determinant cond ition which A. Containment isolation is required AND EITHER: may include judgment. 4 D.1 AND

• Containment integrity has been EITHER of the following : lost based on SM/SEC/ED determination.

1. Containment integrity has been lost based on Emergency

• UNISOLABLE pathway from Director judgment. containment to the environment exists.

OR

2. UNISOLABLE pathway from CMT Indications of RCS LEAKAGE outside None the containment to the Loss of containment.

environment exists. D.2 OR B. Indications of RCS leakage outside of containment.

                                                                                                                                                         *I 66 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP NEI IC Wording DCPP FPB Wording Difference Justification FPB# FPB #(s) CMT Other Indications N/A N/A No other site-specific Containment Loss ind ication has Loss been identified for DCPP. A. (site-specific as applicable) 5 CMT Emergency Director Judgment CMT Any condition in the opinion of the None Loss Loss SM/SEC/ED that indicates loss of the ANY co ndition in the opinion of the 6 containment barrier. Emergency Director that indicates Loss E.1 of the Containment Barrier. CMT P- RCS or SG Tube Leakage N/A N/A N/A Loss Not Applicable 1 CMT Inadequate Heat Removal CMT CSFST Core Cooling-RED path Consistent with the generic developers note options P-Loss P-Loss conditions met. CSFST Core Cooling Red Path is used in lieu of CET A. 1. (Site-specific criteria for entry temperatures and RCS levels. 2 into core cooling restoration B.1 AND procedure) Added Note 1 consistent with other thresholds with a Restoration procedures not effective tim ing component. AND within 15 minutes. (Note 1)

2. Restoration procedure not effective within 15 minutes.

CMT P- RCS Activity/CMNT Rad CMT Containment radiation (RM-30 or RM- Containment radiation monitor readings greater than Loss P-Loss 31) > 5,000 R/hr. 5,000 R/hr indicate significant fu el damage well in A. Containment radiation monitor excess of that required for loss of the RCS barrier and 3 reading greater than (site-specific C.1 the Fuel Clad barrier. value). CMT P- CNMT Integrity or Bypass CMT CSFST Containment-RED path Consistent with the generic developers note options Loss P-Loss conditions met( ~ 47 psig). CSFST Containment Red Path is used in lieu of just A. Containment pressure greater than containment pressure. 4 (site-specific value) D.1 67 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP NEI DCPP NEI IC Wording DCPP FPB Wording Difference Justification FPB# FPB #(s) OR CMT Containment hydrogen concentration 4% hydrogen concentration in the presence of oxygen B. Explosive mixture exists inside P-Loss ~4%. represents a flammable mixture in containment. containment D.2 OR C. 1. Containment pressure greater than (site-specific pressure setpoint) CMT Containment pressure~ 22 psig. The containment pressure setpoint (22 psig) is the AND P-Loss pressure at which the equipment should actuate and AND begin performing its function.

2. Less than one full train of (site- D.3 Less than one full train of containment specific system or equipment) Added Note 1 consistent with other thresholds with a depressurization equipment operating is operating per design for 15 timing component.

per design for~ 15 minutes. (Note 1, 9) minutes or longer. Added Note 9 to specify what constitutes a full train of containment depressurization equipment. CMT Other Indications N/A N/A No other site-specific Containment Potential Loss P-Loss indication has been identified for DCPP. A. (site-specific as applicable) 5 CMT Emergency Director Judgment CMT Any condition in the opinion of the None P-Loss P-Loss SM/SEC/ED that indicates potential A. ANY condition in the opinion of the loss of the containment barrier. 6 Emergency Director that indicates E.1 Potential Loss of the Containment Barrier. 68 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category H Hazards a~d Other Conditions Affecting Plant Safety 69of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HU1 Confirmed SECURITY HU1 Confirmed SECURITY None CONDITION or threat CONDITION or threat. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 A SECURITY CONDITION that HU1.1 A SECURITY CONDITION that Example EALs #1, 2, and 3 have been combined into a single EAL does not involve a HOSTILE does not involve a HOSTILE for ease of presentation and use. ACTION as reported by the (site- ACTION as reported by the The Security Watch Commander is defined as the Security Shift specific security shift supervision). Security Watch Commander. Supervision. 2 OR Notification of a credible security threat directed at the site. Notification of a credible security threat directed at the site. 3 A validated notification from the OR NRC providing information of an aircraft threat. A validated notification from the NRC providing information of an aircraft threat. 70of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HU2 Seismic event greater than QBE HU2 Seismic event greater than An Operating Basis Earthquake (QBE) is referred to as Design level Design Earthquake (DE) level. Earthquake (DE) at DCPP, and a Safe Shutdown Earthquake (SSE) MODE: All is referred to as Double Design Earthquake (ODE) at DCPP. MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Seismic event greater than HU2.1 Seismic event > DE PGA as If the EFM indicator alarms (> 0.2 g on the "X" or "Y" axis or > Operating Basis Earthquake indicated by ground acceleration 0.133g on the "Z" axis) the DE has likely been exceeded. (QBE) as indicated by: > 0.2 g on the "X" or "Y" axis or

                                                > 0.133 g on the "Z" axis.

(site-specific indication that a (Note 11) seismic event met or exceeded QBE limits) N/A N/A N/A Note 11: If the Earthquake Force Added Note 11 to provide guidance for assessing earthquakes if the Monitor (EFM) is out of EFM is out of seNice. seNice, refer to CP M-4 A true determination of DE exceedance determination can take up Earthquake for to 4 hours, not 15 minutes (a more detailed explanation is in the alternative methods to Basis Background section). With this in mind, EAL declaration must assess earthquakes. be timely (within 15 minutes) and be based on the ground acceleration values from the EFM. 71of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HU3 Hazardous event. HU3 Hazardous event. None MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 A tornado strike within the HU3.1 A TORNADO strike within the Added the word "PLANT" to protected area to distinguish from the PROTECTED AREA. PLANT PROTECTED AREA. ISFSI protected area that is located outside the plant protected area. 2 Internal room or area flooding of a HU3.2 Internal room or area FLOODING Changed the word "needed" to "required." System/equipment magnitude sufficient to require of a magnitude sufficient to operability is defined by required components. manual or automatic electrical require manual or automatic Added Note 5 as EAL only applies to equipment required for the isolation of a SAFETY SYSTEM electrical isolation of a SAFETY current operating mode and would be adequately addressed by component needed for the current SYSTEM component required for Tech. Spec. operability requirements. operating mode. the current operating mode. (Note 5) 3 Movement of personnel within the HU3.3 Movement of personnel within the Added the word "PLANT" to protected area to distinguish from the PROTECTED AREA is impeded PLANT PROTECTED AREA is ISFSI protected area that is located outside the plant protected due to an offsite event involving IMPEDED due to an event area. hazardous materials (e.g., an involving hazardous materials Deleted the term "offsite" to preclude confusing areas outside the offsite chemical spill or toxic gas (e.g., a chemical spill or toxic gas Protected Area but on site. release). release from an area outside the plant PROTECTED AREA). Revised the example accordingly. 4 A hazardous event that results in HU3.4 A hazardous event that results in DCPP has a very large site (approximately 8 miles from gate to on-site conditions sufficient to conditions sufficient to prohibit plant Protected Area). Deleted the term "on-site" as site access prohibit the plant staff from the plant staff from accessing the could be precluded without adverse on-site conditions. accessing the site via personal site via personal vehicles. (Note Added reference to Note 7. vehicles. 7) 5 (Site-specific list of natural or N/A N/A No other site-specific hazard has been identified for DCPP. technological hazard events) 72of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Note EAL #3 does not apply to routine N/A Note 7: This EAL does not This note, designated Note #7, is intended to apply to generic traffic impediments such as fog, apply to routine traffic example EAL #4, not #3 as specified in the generic guidance. snow, ice, or vehicle breakdowns impediments such as or accidents. fog, snow, ice, or vehicle breakdowns or accidents. Note 5: If the equipment in the N/A N/A N/A Added Note 5 as EAL only applies to equipment required for the listed room or area was current operating mode and would be adequately addressed by already inoperable or Technical Specification operability requirements. out-of-service before the event occurred, then no emergency ~ classification is warranted. 73of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HU4 FIRE potentially degrading the HU4 FIRE potentially degrading the None* level of safety of the plant. level of safety of the plant. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. A FIRE is NOT extinguished HU4.1 A FIRE is not extinguished within Table H-1 provides a tabularized list of site-specific fire areas. with in 15-m in utes of ANY of the 15 minutes of any of the following FIRE detection following FIRE detection

        *indications:                                 indications (Note 1):

• Report from the field (i.e.,

visual observation)

• Report from the field (i.e.,

visual observation).

• Receipt of multiple (more than 1) fire alarms or
• Receipt of multiple (more than 1) fire alarms or indications indications.
• Field verification of a single fire alarm
• Field verification of a single fire alarm.

AND AND

b. The FIRE is located within The FIRE is located within any ANY of the following plant rooms Table H-1 area.

or areas: (site-specific list of plant rooms or areas) 2 a. Receipt of a single fire alarm HU4.2 Receipt of a single fire alarm Table H-1 provides a tabularized list of site-specific fire areas. (i.e., no other indications of a (i.e., no other indications of a Revised EAL wording, second conditional to read: FIRE). FIRE).

                                                                                             "The fire alarm is associated with any Table H-1 area" AND                                            AND The fire alarm is not, in and of itself, an indication of fire. The

b. The FIRE is located within The fire alarm is associated with existence of the fire must be verified. It is those fire alarms 74 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP ANY of the following plant rooms any Table H-1 area. associated with the Table H-1 fire areas that are of concern.

                                                                              /

or areas: AND A project to add National Fire Protection Association (NFPA) (site-specific list of plant rooms or Standard 805 Incipient Fire Detection is expected to be complete The existence of a FIRE is not areas) prior to PG&E implementation of NEI 99-01 Rev. 6. verified within 30 minutes of AND alarm receipt. (Note 1)

c. The existence of a FIRE is not verified within 30-minutes of alarm receipt.

3 A FIRE within the plant or ISFSI HU4.3 A FIRE within the ISFSI DCPP has an ISFSI PROTECTED AREA located outside the PLANT [for plants with an ISFSI outside PROTECTED AREA or PLANT PROTECTED AREA. the plant Protected Area] PROTECTED AREA not PROTECTED AREA not extinguished within 60 minutes of extinguished within 60-minutes of the initial report, alarm or the initial report, alarm or indication. (Note 1) indication. 4 A FIRE within the plant or /SFSI HU4.4 A FIRE within the ISFSI or DCPP has an ISFSI PROTECTED AREA located outside the PLANT [for plants with an ISFS/ outside PLANT PROTECTED AREA that PROTECTED AREA. thf) plant Protected Area] requires firefighting support by PROTECTED AREA that requires an offsite fire response agency to firefighting support by an offsite extinguish. fire response agency to extinguish. Note Note: The Emergency Director The classification timeliness note has been standardized across the N/A Note 1: The SM/SEC/ED should should declare the Unusual Event DCPP EAL scheme by referencing the "time limit" specified within declare the event promptly upon determining that the EAL wording. promptly upon the applicable time has been determining that time exceeded, or will likely be limit has been exceeded, exceeded. or will likely be exceeded. 75of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table H-1 Fire Areas

• Containment
• Auxiliary Building
• Fuel Handling Building
• Turbine Building
• Intake Structure Lower Levels
• Pipe Rack
• Main, Auxiliary & Startup Transformers 76 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HU7 Other conditions exist which in the HU7 Other conditions existing that in None judgment of the Emergency the judgment of the SM/SEC/ED Director warrant declaration of a warrant declaration of a UE. (NO)UE. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Other conditions exist which iii the HU7.1 Other conditions exist which in None judgment of the Emergency the judgment of the SM/SEC/ED Director indicate that events are in indicate that events are in progress or have occurred which progress or have occurred which indicate a potential degradation of indicate a potential degradation the level of safety of the plant or of the level of safety of the plant indicate a security threat to facility or indicate a security threat to protection has been initiated. No facility protection has been releases of radioactive material initiated. No releases of requiring offsite response or radioactive material requiring monitoring are expected unless offsite response or monitoring are further degradation of safety expected unless further systems occurs. degradation of SAFETY SYSTEMS occurs. 77 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HA1 HOSTILE ACTION within the HA1 HOSTILE ACTION within the None OWNER CONTROLLED AREA or OWNER CONTROLLED AREA airborne attack threat within 30 or airborne attack threat within 30 minutes. minutes. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 A HOSTILE ACTION is occurring or HA1.1 A HOSTILE ACTION is Example EALs #1 and #2 have been combined into a single EAL has occurred within the OWNER occurring or has occurred within for ease of use. CONTROLLED AREA as reported the OWNER CONTROLLED The Security Watch Commander is the site-specific security shift by the (site-specific security shift AREA as reported by the supervision. supervision). Security Watch Commander. OR 2 A validated notification from NRC of an aircraft attack threat within 30 A validated notification from minutes of the site. NRC of an aircraft attack threat within 30 minutes of the site. 78of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP I DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HA5 Gaseous release impeding HA5 Gaseous release IMPEDING Limited mode applicability to the modes specified in Table H-1. access to equipment necessary access to equipment necessary Added the following note to the HA5 bases: for normal plant operations, for normal plant operations, "NOTE: IC HAS mode applicability has been limited to the cooldown or shutdown. cooldown or shutdown. applicable modes identified in Table H-2 Safe Operation & MODE: All MODE: 2 - Startup, 3 - Hot Shutdown Rooms/Areas. If due to plant operating procedure or Standby, 4 - Hot Shutdown plant configuration changes, the applicable plant modes specified in Table H-2 are changed, a corresponding change to Attachment 3 'Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases' and to IC HAS mode aoo/icability is required." NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. Release of a toxic, HA5.1 Release of a toxic, corrosive, Table H-2 provides a list of safe shutdown rooms/areas and corrosive, asphyxiant or asphyxiant or flammable gas into applicable operating modes. flammable gas into any of the any Table H-2 rooms or areas. following plant rooms or areas: AND (site-specific list of plant rooms Entry into the room or area is or areas with entry-related prohibited or IMPEDED. (Note 5) mode applicability identified) AND

b. Entry into the room or area is prohibited or impeded.

Note Note: If the equipment in the Note 5 If the equipment in the listed None listed room or area was already room or area was already inoperable or out-of-service inoperable or out-of-service before the event occurred, then before the event occurred, then , no emergency classification is no emergency classification is warranted. warranted. 79of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table H-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode(s} Auxiliary Building - 115' - BASTs 2,3,4 Auxiliary Building - 100' - BA Pumps 2,3,4 Auxiliary Buildinq - 85' -Aux Control Board 2,3,4 Auxiliary Building - 64' - BART Tank area 2, 3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 80 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HA6 Control Room evacuation HA6 Control Room evacuation None resulting in transfer of plant resulting in transfer of plant control to alternate locations. control to alternate locations. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 An event has resulted in plant HA6.1 An event requiring plant control to Reworded EAL to express cause and effect for control room control being transferred from the be transferred from the Control evacuation. Control Room to (site-specific Room to the Hot Shutdown Panel The Hot Shutdown Panel area is the site-specific location of the remote shutdown panels and Q area. remote shutdown panels/local control stations. local control stations). 81of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HA? Other conditions exist which in the HA? Other conditions exist that in the None judgment of the Emergency Director judgment of the SM/SEC/ED warrant warrant declaration of an Alert. declaration of an ALERT. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Other conditions exist which, in the HA7.1 Other conditions exist which, in the None judgment of the Emergency Director, judgment of the SM/SEC/ED, indicate indicate that events are in progress or that events are in progress or have have occurred which involve an actual or occurred which involve an actual or potential substantial degradation of the potential substantial degradation of the level of safety of the plant or a security level of safety of the plant or a event that involves probable life SECURITY EVENT that involves threatening risk to site personnel or probable life threatening risk to site damage to site equipment because of personnel or damage to site equipment HOSTILE ACTION. Any releases are because of HOSTILE ACTION. Any expected to be limited to small fractions releases are expected to be limited to of the EPA Protective Action Guideline small fractions of the EPA PROTECTIVE exposure levels. ACTION GUIDELINE exposure levels. 82 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) -- HS1 HOSTILE ACTION within the HS1 HOSTILE ACTION within the PLANT Added the word "PLANT" to protected area to distinguish PROTECTED AREA PROTECTED AREA. from the ISFSI protected area that is located outside the MODE: All plant protected area. MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 A HOSTILE ACTION is occurring HS1.1 A HOSTILE ACTION is occurring or has The Security Watch Commander is the site-specific security or has occurred within the occurred within the PLANT shift supervision. PROTECTED AREA as reported PROTECTED AREA as reported by the Added the word "PLANT" to protected area to distinguish by the (site-specific security shift Security Watch Commander. from the ISFSI protected area that is located outside the supervision). plant protected area. 83of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HS6 Inability to control a key safety HS6 Inability to control a key safety function Deleted defueled mode applicability. Control of the cited function from outside the Control from outside the Control Room. safety functions are not critical for a defueled reactor as there Room. is no energy source in the reactor vessel or RCS. MODE: 1 - Power Operation, 2 - Startup, MODE: All 3 - Hot Standby, 4 - Hot Shutdown, 5 - This is an acceptable deviation from the generic NEI 99-Cold Shutdown, 6 - Refueling 01 Rev. 6 guidance. NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. An event has resulted in plant HS6.1 An event has resulted in plant control The Hot Shutdown Panel area are the site-specific remote control being transferred from the being transferred from the Control Room shutdown panels/local control stations. Control Room to (site-specific to the Hot Shutdown Panel area. The Mode applicability for the reactivity control safety remote shutdown panels and local control stations). AND function has been limited to Modes 1, 2, and 3 (hot operating conditions). In the cold operating modes adequate shutdown Control of any of the following key safety AND margin exists under all conditions. functions is not reestablished within 15

b. Control of ANY of the minutes (Note 1): This is an acceptable deviation from the generic NEI 99-following key safety functions is 01 Rev. 6 guidance.

not reestablished within (site-

• Reactivity (Modes 1, 2, and 3 only) specific number of minutes).
• Reactivity control
• Core cooling
• Core cooling [PWR] I RCP
• RCS heat removal water level [BWR]
• RCS heat removal 84of114

1 EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HS7 Other conditions exist which in HS7 Other conditions existing that in the None the judgment of the Emergency judgment of the SM/SEC/ED warrant Director warrant declaration of a declaration of a Site Area Emergency. Site Area Emergency. MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Other conditions exist which in HS7.1 Other conditions exist which in the None the judgment of the Emergency judgment of the SM/SEC/ED indicate that Director indicate that events are events are in progress or have occurred in progress or have occurred which involve actual or likely major which involve actual or likely failures of plant functions needed for major failures of plant functions protection of the public or HOSTILE needed for protection of the ACTION that results in intentional damage public or HOSTILE ACTION that or malicious acts, (1) toward site personnel results in intentional damage or or equipment that could lead to the likely malicious acts, (1) toward site failure of or, (2) that prevent effective personnel or equipment that could access to equipment needed for the lead to the likely failure of or, (2) protection of the public. Any releases are that prevent effective access to not expected to result in exposure levels equipment needed for the which exceed EPA PROTECTIVE protection of the public. Any ACTION GUIDELINE exposure levels releases are not expected to beyond the SITE BOUNDARY. result in exposure levels which

        . exceed EPA Protective Action Guideline exposure levels beyond the site boundary.

85of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification .

• IC#(s)

HG1 HOSTILE ACTION resulting in N/A N/A IC HG1 and associated example EAL are not implemented in loss of physical control of the the DCPP scheme. facility. ( There are several other ICs that are redundant with this IC, MODE: All and are better suited to ensure timely and effective emergency declarations. In addition, the development of new spent fuel pool level EALs, as a result of NRC Order EA-12-051, clarified the intended emergency classification level for spent fuel pool level events. This is an acceptable deviation from the generic NEI 99-01 Rev. 6 guidance. NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. A HOSTILE ACTION is N/A N/A IC HG1 and associated example EAL are not implemented occurring or has occurred within in the DCPP scheme. the PROTECTED AREA as There are several other ICs that are redundant with this IC, reported by the (site-specific and are better suited to ensure timely and effective security shift supervision). emergency declarations. In addition, the development of AND new spent fuel pool level EALs, as a result of NRC Order EA-12-051, clarified the intended emergency classification

b. EITHER of the following has level for spent fuel pool level events. This deviation is occurred:

justified because:

1. ANY of the following safety

1. Hostile Action in the Plant Protected Area is bounded by functions cannot be ICs HS1 and HS7. Hostile Action resulting in a loss of controlled or maintained.

physical control is bound by EAL HG7, as well as any

• Reactivity control event that may lead to radiological releases to the public in excess of EPA PAGs.
• Core cooling

[PWR]/RCP water a. If, for whatever reason, the CR must be evacuated, level [BWR] and control of safety functions (e.g., reactivity control, core cooling, and RCS heat removal) cannot be

• RCS heat removal reestablished, then IC HS6 would apply, as well as IC 86of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP OR HS7 if desired by the EAL decision-maker.

2. Damage to spent fuel has b. Also, as stated above, any event (including Hostile occurred or is IMMINENT. Action) that could reasonably be expected to have a release exceeding EPA PAGs would be bound by IC HG7.

c. From a Hostile Action perspective, ICs HS1, HS7 and HG7 are appropriate, and therefore, make this part of HG1 redundant and unnecessary.

d. From a loss of physical control perspective, ICs HS6, HS? and HG? are appropriate, and therefore, make this part of HG1 redundant and unnecessary.

2. Any event which causes a loss of spent fuel pool level will be bounded by ICs AA2, AS2 and AG2, regardless of whether it was based upon a Hostile Action or not, thus making this part of HG1 redundant and unnecessary.

a. An event that leads to a radiological release will be bounded by ICs AU1, AA1, AS1 and AG1. Events that lead to radiological releases in excess of EPA PAGs will be bounded by EALs AG1 and HG?, thus making this part of HG1 redundant and unnecessary.

ICs AA2, AS2, AG2, AS1, AG1, HS1, HS6, HS? and HG7 have been implemented consistent with NEI 99-01 Rev. 6 and thus HG1 is adequately bounded as described above. This is an acceptable deviation from the generic NEI 99-01 Rev. 6 guidance. 87 of 114

EAL. Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) HG? Other conditions exist which in HG? Other conditions exist which in the None the judgment of the Emergency judgment of the SM/SEC/ED warrant Director warrant declaration of a declaration of a General Emergency. General Emergency MODE: All MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Other conditions exist which in HG7.1 Other conditions exist which in the None the judgment of the Emergency judgment of the SM/SEC/ED indicate that Director indicate that events are events are in progress or have occurred in progress or have occurred which involve actual or IMMINENT which involve actual or substantial core degradation or melting IMMINENT substantial core with potential for loss of containment degradation or melting with integrity or HOSTILE ACTION that potential for loss of containment results in an actual loss of physical integrity or HOSTILE ACTION control of the facility. Releases can be that results in an actual loss of reasonably expected to exceed EPA physical control of the facility. PROTECTIVE ACTION GUIDELINE Releases can be reasonably exposure levels offsite for more than the expected to exceed EPA immediate site' area. Protective Action Guideline exposure levels offsite for more than the immediate site area. 88 of 114 ____J

EAL Comparison Matrix OSSI Project #14-0303 DCPP Category S System Malfunction 89 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SU1 Loss of all offsite AC power SU1 Loss of all offsite AC power The DCPP vital buses are the site-specific emergency buses. capability to emergency buses for capability to vital buses for 15 15 minutes or longer. minutes or longer. MODE: Power Operation, Startup, MODE: 1 - Power Operation, 2 - Hot Standby, Hot Shutdown Startup, 3 - Hot Standby, 4 - Hot Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of ALL offsite AC power SU1.1 Loss of all offsite AC power 4.16KV vital buses 1(2)F, 1(2)G, and 1(2)H are the site-specific capability to (site-specific capability, Table S-1, to Unit 1 or emergency buses. emergency buses) for 15 minutes Unit 2 vital 4.16KV buses F, G Site-specific AC power sources are listed in Table S-1. or longer. and H for ~ 15 minutes. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event DCPP EAL scheme by referencing the "time limit" specified within the promptly upon determining that 15 promptly upon EAL wording. minutes has been exceeded, or determining that time will likely be exceeded. limit has been exceeded, or will likely be exceeded. 90of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table S-1 AC Power Capability Unit 1 Unit2 Cl)

                     +'

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

                     ~

• Startup XFMR 1~2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator Cl)

                     +'
                     'iii

• DG1-1-BusH
• DG 2 Bus H c:
• 0 DG 1 Bus G
• DG 2 Bus G
• DG 1-3 --Bus F
• DG 2 Bus F
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie 91 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SU2 UNPLANNED loss of Control SU3 UNPLANNED loss of Control None ' Room indications for 15 minutes Room indications for 15 minutes or longer. or longer. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 An UNPLANNED event results in SU3.1 An UNPLANNED event results in The site-specific Safety System Parameters are listed in Table S-2. the inability to monitor one or the inability to monitor one or more of the following parameters more Table S-2 parameters from from within the Control Room for within the Control Room for~ 15 15 minutes or longer. minutes. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that promptly upon the EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. 92of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP [BWR parameter list] rPWR oarameter listl Reactor Power Reactor Power RCP Water Level RCS Level RCP Pressure RCS Pressure Primarv Containment Pressure In-Core/Core Exit Temoerature Suppression Pool Level Levels in at least (site-specific number) steam qenerators Suppression Pool Temperature Steam Generator Auxiliary or Emergency Feed Water Flow Table S-2 Safety System Parameters

• Reactor power
• RCS level
• RCS-pressure
• In-core TC temperature
• Level in at least one SG
• Auxiliary or emergency feed flow in at least oneSG 93 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording ' Difference Justification IC#(s) SU3 Reactor coolant activity greater SU4 RCS activity greater 'than Changed "reactor coolant activity" to "RCS activity" to conform to than Technical Specification Technical Specification site specific terminology. allowable limits. permissible limits. Changed the word "allowable" to "permissible" to be consistent with MODE: Power Operation, Startup, MODE: 1 - Power Operation, 2 - the.DCPP Tech. Spec. 3.4.16 terminology. Hot Standby, Hot Shutdown Startup, 3 - Hot Standby, 4 - Hot Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 (Site-specific radiation monifor) SU4.2 With letdown in service, Initial indication of Fuel Clad degradation can be determined by reading greater than (site-specific procedurally directed letdown measuring the external radiation dose* rate at a distance of one foot value). dose point radiation > 3 R/hr. from the center of the letdown line in the letdown heat exchanger room using the technique described in Attachment 7.1 of EP RB-14A, Initial Detection of Core Damage. An external radiation dose rate exceeding 3 R/hr indicates Fuel Clad degradation greater than Tech. Spec. allowable limits. 2 Sample analysis indicates that a SU4.1 RCS activity> Technical Deleted the words_'.'Sample analysis indicates ... " because reactor reactor coolant activity value is Specification Section 3.4.'16 coolant activity is only determined by sample analysis. greater than an allowable limit permissible limits. Changed 'reactor coolant activity" to "RCS activity" to conform to site specified in Technical specific terminology. Specifications. 1 DCPP Tech. Spec. Section 3.4.16 provides the Tech. Spec. permissible coolant activity limits. Changed the word "allowable" to "permissible" to be consistent with the DCPP Tech. Spec. 3.4.16 terminology.

                                           \

94of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SU4 RCS leakage for 15 minutes or SU5 RCS LEAKAGE for 15 minutes or None longer. longer. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 RCS unidentified or pressure SU5.1 RCS unidentified or pressure Example EALs #1, 2, and 3 have been combined into a single EAL boundary leakage greater than boundary leakage > 10 gpm for for usability. (site-specific value) for 15  ;::: 15 minutes. minutes or longer. OR 2 RCS identified leakage greater RCS identified leakage > 25 gpm than (site-specific value) for 15 for;::: 15 minutes. minutes or longer. OR 3 Leakage from the RCS to a Leakage from the RCS to a location outside containment location outside containment greater than 25 gpm for 15 > 25 gpm for;::: 15 minutes. minutes or longer. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that promptly upon the EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. 95 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SUS Automatic or manual (trip [PWR] SU6 Automatic or manual trip fails to None I scram [BWR]) fails to shut down the reactor. shutdown the reactor. MODE: 1 - Power Operation MODE: Power Operation NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. An automatic (trip [PWR] I SU6.1 An automatic trip did not shut As specified in the generic developers guidance "Developers may scram [BWR]) did not shutdown down the reactor as indicated by include site-specific EOP criteria indicative of a successful reactor the reactor. reactor power ;::: 5% after any shutdown in an EAL statement, the Basis or both (e.g., a reactor RTS setpoint is exceeded. power level)." Reactor power< 5% is the site-specific indication of a AND successful reactor trip.

b. A subsequent manual action AND Added the words" ... as indicated by reactor power;::: 5% after any taken at the reactor control A subsequent automatic trip or Reactor Trip System (RTS) setpoint is exceeded" to clarify that it is a consoles is successful in manual trip action taken at the failure of the automatic trip when a valid trip signal has been exceed.

shutting down the reactor. control room panels (CC1, VB2 or VB5) is successful in shutting CR panels CC1, VB2, or VB5 are the reactor control consoles where down the reactor as indicated by an immediate manual reactor trip can be initiated. reactor power< 5%. (Note 8) 2 a. A manual trip ([PWR] I SU6.2 A manual trip did not shut down As specified in the generic developers guidance "Developers may scram [BWR]) did not shutdown the reactor as indicated by include site-specific EOP criteria indicative of a successful reactor the reactor. reactor power ;::: 5% after any shutdown in an EAL statement, the Basis or both (e.g., a reactor manual trip action was initiated. power level)." Reactor power< 5% is the site-specific indication of a AND successful reactor trip.

b. EITHER of the following:

AND Added the words "... as indicated by reactor power;::: 5% after any A subsequent automatic trip or

1. A subsequent manual manual trip action was initiated" to clarify that it is a failure of any manual trip action taken at the action taken at the reactor manual trip when an actual manual trip signal has been inserted.

control room panels (CC1, VB2 control consoles is or VB5) is successful in shutting CR panels CC1, VB2, or VB5 are the reactor control consoles where successful in shutting down the reactor as indicated by an immediate manual reactor trip can be initiated. down the reactor. reactor power< 5%. (Note 8) Combined conditions b.1 and b.2 into a single statement to simplify OR 96of114

_ EAL Comparison Matrix OSSI Project #14-0303 DCPP 2 A subsequent automatic the presentation. (trip [PWR] I scram [BWR]) is successful in shutting down the reactor. Note: A manual action is any Notes N/A Note 8: A manual action is any None operator action, or set of actions, operator action, or set of which causes the control rods to actions, which causes be rapidly inserted into the core, the control rods to be and does not include manually rapidly inserted into the driving in control rods or core, and does not implementation of boron include manually driving injection strategies. in control rods or implementation of boron . injection strategies. 97of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SUB Loss of all onsite or offsite SU? Loss of all onsite or offsite None communications capabilities. communications capabilities. MODE: Power Opera~ion, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot . Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of ALL of the following SU7.1 Loss of all Table S-4 onsite Example EALs #1, 2, and 3 have been combined into a single EAL onsite communication methods: communication methods. for simplification of presentation. (site-specific list of OR Table S-4 provides a site-specific list of onsite, offsite (ORO), and communications methods) NRC communications methods. Loss of all Table S-4 offsite 2 communication methods. Loss of ALL of the following ORO communications methods: OR (site-specific list of Loss of all Table S-4 NRC communications methods) communication methods. 3 Loss of ALL of the following NRC communications methods: (site-specific list of communications methods) 98of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP Table S-4 Communication Methods System Onsite Offsite NRC Unit 1, Unit 2 and TSC Radio Consoles x x DCPP Telephone System (PBX) x x x Portable radio equipment (handie-talkies) x Operations Radio System x x Security Radio Systems x CAS and SAS Consoles x x x Fire Radio System x Hot Shutdown Panel Radio Consoles x x x Public Address System x NRC FTS x Mobile radios x Satellite phones x x x Direct line (ATL) to the County and State OES x 99of114

                                                                                                                           - - _____ J

j EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SU7 Failure to isolate containment or SU8 Failure to isolate containment or None loss of containment pressure loss of containment pressure control. [PWR] control. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. Failure of containment to EITHER: Example EALs #1 and #2 have been combined into a single EAL. isolate when required by an Any penetration is not Reworded EAL to better describe the intent. Penetrations cannot actuation signal. isolated within 15 minutes of close, but they can be isolated by closure of one or more isolation AND a VALID containment valves associated with that penetration. The revised wording isolation signal. (Note 1) maintains the generic example EAL intent while more clearly

b. ALL required penetrations describing failure to isolate threshold.

are not closed within 15 minutes OR of the actuation signal. The containment pressure setpoint (22 psig) is the pressure at Containment pressure ~ 22 which the containment depressurization equipment should actuate SU8.1 psig with < one full train of 2 a. Containment pressure and begin performing its function. containment depressurization greater than (site-specific equipment operating per Added Note 9 to specify what constitutes a full train of containment pressure). design for~ 15 minutes. depressurization equipment. AND (Notes 1, 9)

b. Less than one full train of (site-specific system or equipment) is operating per design for 15 minutes or longer.

N/A NIA N/A Note 1: The SM/SEC/ED should Added Note 1 to be consistent in its use for EAL thresholds with a declare the event timing component. promptly upon 100 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP determining that time limit has been exceeded, or will likely be exceeded. N/A N/A N/A Note 9: One Containment Spray Added Note 9 to specify what constitutes a full train of containment pump and two CFCUs depressurization equipment. comprise one full train of depressurization equipment. 101of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SA1 Loss of all but one AC power SA1 Leiss of all but one AC power The DCPP vital buses are the site-specific emergency buses. source to emergency buses for source to vital buses for 15 15 minutes or longer. minutes or longer. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. AC power capability to (site- SA1.1 AC power capability, Table S-1, 4.16KV vital buses 1(2)F, 1(2)G, and 1(2)H are the site-specific specific emergency buses) is to Unit 1 or Unit 2 vital 4.16KV emergency buses. reduced to a single power source buses F, G, and H reduced to a Site-specific AC power sources are listed in Table S-1. for 15 minutes or longer. single power source for ;:: 15 minutes. (Note 1) Reworded the second condition for clarity. AND AND

b. Any additional single power source failure will result in a loss A failure of that single power of all AC power to SAFETY source will result in loss of all AC SYSTEMS. power to SAFETY SYSTEMS.

Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Alert promptly upon declare the event DCPP EAL scheme by referencing the "time limit" specified within determining that 15 minutes has promptly upon the EAL wording. been exceeded, or will likely be determining that time exceeded. limit has been exceeded, or will likely be exceeded. 102 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SA2 UNPLANNED loss of Control SA3 UNPLANNED loss of Control None Room indications for 15 minutes Room indications for 15 minutes or longer with a significant or longer with a significant transient in progress. transient in progress. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 An UNPLANNED event results in SA3.1 An UNPLANNED event results in The site-specific Safety System Parameters are listed in Table the inability to monitor one or the inability to monitor one or S-2. more of the following parameters more Table S-2 parameters from from within the Control Room for The site-specific significant transients are listed in Table S-3. within the Control Room for;::-; 15 15 minutes or longer. minutes. (Note 1) DCPP is a PWR and thus does not include thermal power AND oscillations > 10%. AND ANY of the following transient Any significant transient is in events in progress. progress, Table S-3.

• Automatic or manual runback greater than 25%

thermal reactor power

• Electrical load rejection greater than 25% full electrical load
• Reactor scram [BWR] I trip

[PWR]

• ECCS (SI) actuation
• Thermal power oscillations 103of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP greater than 10% [BWR] Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that promptly upon the EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. fBWR parameter list] fPWR parameter list] Reactor Power Reactor Power RCP Water Level RCS Level RCP Pressure RCS Pressure Primary Containment Pressure In-Core/Core Exit Temperature Suppression Pool Level Levels in at least (site-specific number) steam aenerators Suppression Pool Temperature Steam Generator Auxiliary or Emergency Feed Water Flow Table S-2 Safety System Parameters

• Reactor power
• RCS level
• RCS pressure
• In-core TC temperature
• Level in at least one SG
• Auxiliary or emergency feed flow in at least one SG Table S-3 Significant Transients
• Reactor trip
• Runback > 25% thermal power
• Electrical load rejection > 25% electrical load
• ECCS actuation 104of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SA5 Automatic or manual (trip [PWR] SA6 Automatic or manual trip fails to shut down the None I scram [BWR]) fails to shutdown reactor and subsequent manual actions taken the reactor, and subsequent at the reactor control consoles are not manual actions taken at the successful in shutting down the reactor. reactor control consoles are not MODE: 1 - Power Operation successful in shutting down the reactor. MODE: Power Operation NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. An automatic or manual (trip SA6.1 An automatic or manual trip fails to shut down As specified in the generic developers guidance [PWR] I scram [BWR]) did not the reactor as indicated by reactor power "Developers may include site-specific EOP criteria shutdown the reactor.  ;::5%. indicative of a successful reactor shutdown in an EAL statement, the Basis or both (e.g., a reactor power AND AND level)." Reactor power< 5% is the site-specific

b. Manual actions taken at the Manual trip actions taken at the control room indication of a successful reactor trip.

reactor control consoles are not panels (CC1, VB2, or VB5) are not CR panels CC1, VB2, or VB5 are the reactor control successful in shutting down the successful in shutting down the reactor as consoles where an immediate manual reactor trip can reactor. indicated by reactor power;:: 5%. (Note 8) be initiated. Note: A manual action is any Notes N/A Note 8: A manual action is any operator None operator action, or set of action, or set of actions, which actions, which causes the causes the control rods to be rapidly control rods to be rapidly inserted into the core, and does not inserted into the core, and does include manually driving in control not include manually driving in rods or implementation of boron control rods or implementation injection strategies. of boron injection strategies. 105 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SA9 Hazardous event affecting a SAFETY SYSTEM SA9.1 Hazardous event affecting a None needed for the current operating mode. SAFETY SYSTEM needed for the current operating mode. MODE: Power Operation, Startup, Hot Standby, Hot Shutdown MODE: All NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. The occurrence of ANY of the following hazardous SA9.1 The occurrence of any Table S-5 The hazardous events have been listed in events: hazardous event. Table S-5.

• Seismic event (earthquake) AND EITHER: Tsunami has been added as a site-specific hazard for DCPP.
• lriternal or external flooding event
• Event damage has caused indications of degraded
• High winds or tornado strike performance in at least one
• FIRE train of a SAFETY SYSTEM needed for the current
• EXPLOSION operating mode.

        *   (site-specific hazards)
                                                                           *The event has caused VISIBLE

• Other events with similar hazard characteristics as DAMAGE to a SAFETY determined by the Shift Manager SYSTEM component or structure needed for the AND current operating mode.

b. EITHER of the following:

1. Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode.

OR

2. The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode.

106of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP

                                                                            /

Table S-5 Hazardous Events

• Seismic event (earthquake)
• Internal or external FLOODING event
• High winds or TORNADO strike
• FIRE
• EXPLOSION
• Tsunami
• Other events with similar hazard characteristics as determined by the SM/SEC/ED 107of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SS1 Loss of all offsite and all onsite SS1 Loss of all offsite and all onsite The DCPP vital buses are the site-specific emergency buses. AC power to emergency buses AC power to vital buses for 15 for 15 minutes or longer. minutes or longer. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Loss of ALL offsite and ALL SS1.1 Loss of all offsite and all onsite 4.16KV vital buses 1(2)F, 1(2)G, and 1(2)H are the site-specific onsite AC power to (site-specific AC power capability, Table S-1, emergency buses. emergency buses) for 15 minutes to Unit 1 or Unit 2 vital 4.16KV Site-specific AC power sources are listed in Table S-1. or longer. buses F, G, and H for;:: 15 . minutes. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED The classification timeliness note has been standardized across the declare the Unusual Event should declare the DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that event promptly upon the EAL wording. 15 minutes has been exceeded, determining that time or will likely be exceeded. limit has been exceeded, or will likely be exceeded. 108of114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SS5 Inability to shutdown the reactor SS6 Inability to shut down the None causing a challenge to (core reactor causing a challenge to cooling [PWR] I RCP water level core cooling or RCS heat [BWR]) or RCS heat removal. removal. MODE : Power Operation MODE : 1 - Power Operation NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. An automatic or manual (trip SS6.1 An automatic or manual trip fails As specified in the generic developers guidance "Developers may [PWR] I scram [BWR]) did not to shut down the reactor as include site-specific EOP criteria indicative of a successful reactor shutdown the reactor. indicated by reactor power shutdown in an EAL statement, the Basis or both (e.g., a reactor

                                                     ~ 5%.                              power level) ." Reactor power< 5% is the site-specific indication of AND a successful reactor trip .

AND

b. All manual actions to Indication that core cooling is extremely challenged is manifested shutdown the reactor have been All actions to shut down the by CSFST Core Cooling RED path conditions met.

unsuccessful. reactor are not successful as indicated by reactor power For DCPP indication that heat removal is extremely challenged is AND

                                                     ~5% .                              manifested by CSFST Heat Sink RED path conditions met in

c. EITHER of the following combination with bleed and feed criteria being met. Refer to AND EITHER:

conditions exist: Attachment A for justification of incorporation for the bleed and feed condition threshold associated with loss of heat sink.

            *    (Site-specific indication of

• CSFST Core Cooling an inability to adequately RED path conditions met.

remove heat from the core)

• CSFST Heat Sink RED path conditions met.

AND

            *    (Site-specific indication of Bleed and feed criteria an inability to adequately remove heat from the                         met.

RCS) 109 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SS8 Loss of all Vital DC power for 15 SS2 Loss of all vital DC power for 15 None minutes or longer. minutes or longer. MODE: Power Operation , MODE: 1 - Power Operation , 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 Indicated voltage is less than SS2.1 Loss of all 125 VDC power 105 VDC is the site-specific minimum vital DC bus voltage. (site-specific bus voltage value) based on battery bus voltage . on ALL (site-specific Vital DC indications < 105 voe on all busses) for 15 minutes or longer. Unit 1 or Unit 2 vital DC buses for~ 15 minutes. (Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event promptly upon DCPP EAL scheme by referencing the "time limit" specified within the promptly upon determining that determining that time limit has EAL wording . 15 minutes has been exceeded, been exceeded, or will likely be or will likely be exceeded. exceeded. 110 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SG 1 Prolonged loss of all offsite and SG1 Prolonged loss of all offsite and The DCPP vita l buses are the site-specific emergency buses. all onsite AC power to all onsite AC power to vital emergency buses. buses. MODE: Power Operation , MODE: 1 - Power Operation , 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Word ing Difference Justification EAL# EAL# 1 a. Loss of ALL offsite and ALL SG1 .1 Loss of all offsite and all onsite 4.16KV vital buses 1(2)F, 1(2)G, and 1(2)H are the site-specific onsite AC power to (site-specific AC power capability, Table S-1, emergency buses. emergency buses). to Unit 1 or Unit 2 vital 4.16KV Site-specific AC power sources are tabula rized in Table S-1. buses F, G, and H. AND 4 hours is the site-specific SBO coping analysis time. AND EITHER:

b. EITHER of the following : CSFST Core Cooling RED path conditions met indicates sign ificant

• Restoration of at least
• Restoration of at least one core exit superheating and core uncovery .

4.16KV vital bus in < 4 one AC em ergency bus in hours is not likely. (Note 1) less than (s ite-specific hours) is not likely.

• CSFST Core Cooling RED path conditions met.

             *   (Site-specific indication of an inability to adequately remove heat from the core)

Note The Emergency Director should N/A Note 1: The SM/SEC/ED The class ification timeliness note has been standardized across the declare the General Emergency should declare the DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that event promptly upon the EAL wording. (site-specific hours) has been determining that time exceeded , or will likely be limit has been exceeded . exceeded , or will likely be exceeded . 111 of 114

EAL Comparison Matrix OSSI Project #14-0303 DCPP DCPP NEI IC# NEI IC Wording DCPP IC Wording Difference Justification IC#(s) SG8 Loss of all AC and Vital DC SG2 Loss of all AC and vital DC NEI IC SG8 has been grouped under the loss of vital DC category 2. power sources for 15 minutes or power sources for 15 minutes or The DCPP vital buses are the site-specific emergency buses. longer. longer. MODE: Power Operation, MODE: 1 - Power Operation, 2 - Startup, Hot Standby, Hot Startup, 3 - Hot Standby, 4 - Hot Shutdown Shutdown NEI Ex. DCPP NEI Example EAL Wording DCPP EAL Wording Difference Justification EAL# EAL# 1 a. Loss of ALL offsite and ALL SG2.1 Loss of all offsite and all onsite 4.16KV vital buses 1(2)F, 1(2)G, and 1(2)H are the site-specific onsite AC power to (site-specific AC power capability, Table S-1, emergency buses. emergency buses) for 15 minutes to Unit 1 or Unit 2 vital 4.16KV Site-specific AC power sources are tabularized in Table S-1. or longer. buses F, G, and H for;:: 15 minutes. 105 VDC is the site-specific minimum vital DC bus voltage. AND AND

b. Indicated voltage is less than (site-specific bus voltage value) Loss of all 125 VDC power on ALL (site-specific Vital DC based on battery bus voltage busses) for 15 minutes or longer. indications < 105 voe on all Unit 1(2) vital DC buses for

                                                 ;:: 15 minutes.

(Note 1) Note The Emergency Director should N/A Note 1: The SM/SEC/ED should The classification timeliness note has been standardized across the declare the Unusual Event declare the event promptly upon DCPP EAL scheme by referencing the "time limit" specified within promptly upon determining that 15 determining that time limit has the EAL wording. minutes has been exceeded, or been exceeded, or will likely be will likely be exceeded. exceeded. 112of114

EAL Comparison Matrix Attachment A Bleed and Feed Condition Associated with CSFST Heat Sink Red Path Thresholds This discussion is to be used for the following EALs entry conditions:

• Table F-1 Fuel Clad Barrier Potential Loss B.2 "CSFST Heat Sink RED Path conditions met and Heat Sink required." * '
• Table F-1 Reactor Coolant System (RCS) Barrier Potential Loss B.12 "CSFST Heat Sink RED Path conditions met and Heat Sink required."
• SS6.1 "CSFST heat Sink RED Path conditions met."

The NEI 99-01 Rev. 6 document, in describing the entry condition of "CSFST Heat Sink RED Path conditions met," states that "This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink)." Merely meeting the CSFST Heat Sink Red Path for Loss of Heat Sink does not meet this condition. In order to do so, an additional trigger has been added that states "Bleed and feed conditions have been met." The Bleed and Feed entry condition is based on Westinghouse analysis, and detailed out in the Loss of Heat Sink procedure EOP FR H-1. At DCPP, the Bleed and Feed entry conditions are the indication of a loss of the effective secondary side heat sink that is stated in NEI 99-01 Rev. 6. The indication of a loss of the effective secondary side heat sink is continuously monitored as a fold out page item while in the Loss of Heat Sink procedure. Currently Bleed and Feed is initiated if the following condition is met:

• WR SG Level in any 3 SGs < 18%, AND 'all NR SG Levels are < 15%

This is the condition that meets NEI 99-1 Rev. 6 description of an "extreme challenge to the ability to remove RCS heat using the steam generators" wherein there is a "loss of an effective secondary-side heat sink." The procedure background document titled "Westinghouse Owners Group (WgG) Emergency Response Guideline (ERG) FR-H.1 "Response to Loss of Secondary Heat Sink, HP-Rev. 3, March 31, 2014"" was reviewed. This document states, in part, that "The objective of guideline FR-H.1 is to maintain reactor coolant . system (RCS) heat removal capability by establishing feed flow to a steam g~nerator or by establishing RCS bleed and feed heat removal. Guideline FR-H.1 is entered at the first indication that secondary heat

• removal capability may be challenged. This permits maximum time for operator action to restore feed water flow to at least one steam generator before secondary inventory is depleted and secondary heat removal capability is lost. Once secondary heat removal capability is lost, RCS bleed and feed must be established to minimize core uncovery and prevent an inadequate core cooling condition."

Note that the analysis is specifically devoid of verbiage that any fission product barriers are potentially or actually being challenged. The WOG ERG goes on to state that The initial RCS depressurization after reactor trip gives way to a quasi-steady state period characterized by core decay heat energy removal through the steam generators. As secondary side mass is depleted through the condenser steam dumps, steam generator PORVs or steam generator safety valves, the steam generators will slowly dry out. During this period the RCS pressure and temperature will be relatively constant as the steam gen~rator level continues to decrease and more of the steam generator tube heat transfer area uncovers. There will still be sufficient secondary heat removal capability, even with a portion of the tubes uncovered. to maintain relatively stable RCS conditions for pressure, temperature and pressurizer level." 113of114

EAL Comparison Matrix This methodology is acceptable based on NEI 99-01 Rev. 6 developer notes that state: From page 79 of NE/ 99-01 Rev. 6, in the Developer Notes:

3. The fission product barrier thresholds specified within a scheme are expected to reflect plant-specific design and operating characteristics. This may require that developers create different thresholds than those provided in the generic guidance.

From page 102 of NE/ 99-01 Rev. 6, in the Developer Notes: The CSFST thresholds may be addressed in one of 3 ways:

1) Not incorporated; thresholds will use parameters and values as discussed in the Developer Notes.

2) Incorporated along with parameter and value thresholds (e.g., a fuel clad loss would have 2 thresholds such as "CETs > 1200°F" and "Core Cooling Red entry conditions met."

3) Used in lieu of parameters and values for all thresholds.

114of114

Enclosure Attachment 2 PG&E Letter DCL-16-099 EAL Technical Basis Document Markup _ _ _J

Diablo Canyon Power Plant Emergency Plan Appendix D - Emergency Action Level Technical Basis Document 9/27/16 I [Document No.] Rev. [X] Page 1 of 3031

Diablo Canyon Power Plant Emergency Plan TABLE OF CONTENTS SECTION PAGE 1.0 PURPOSE .......................................... :................................................................................ 3 2.0 DISCUSSION ..................................................................-:... :................................................ 3 2.1 Background ............... : ............................................................................................................... 3 2.2 Fission Product Barriers ............................................................................................................ 4 2.3 Emergency Classification Based on Fission Product Barrier Degradation, ................................ 4 1 Emergency Action Level Technical Bases ................................................................ 31 Category R Abnormal Rad Release I Rad Effluent.. ........................................ 31 Category E ISFSI ............................................................................................72

                   *Category C           Cold Shutdown I Refueling System Malfunction ........................... 76 I

Category H Hazards ...................................................................................... 121 Category S System Malfunction ................. .' .................................................. 161 Category F Fission Product Barrier Degradation ........................................... 212 2 Fission Product Barrier Loss I Potential Loss Matrix and Bases ..................................................................................... ~ .............. 217 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases ................................. 275 I [Document No.] Rev. [X] Page 2 of 303 l

                                                                         /

1.0 PURPOSE This document provides an explanation and rationale for each Emergency Action Level (EAL) included in the EAL Upgrade Project for Diablo Canyon Power Plant (DCPP). It should be used to facilitate review of the DCPP EALs and provide historical documentation for future reference. Decision-makers responsible for implementation of EP G-1 Emergency Classification and Emergency Plan Activation, may use this document as a technical reference in support of EAL interpretation. This information may assist the SM/SEC/ED iri making classifications, particularly those involving judgment or multiple events. The basis information may also be useful in training and for explaining event classifications to off-site officials. Because the information in a basis document can affect emergency classification decision-making (e.g., the SM/SEC/ED refers to it during an event), the NRC staff expects that changes to the basis document will be evaluated in accordance with the provisions of 10 CFR 50.54(q). 2.0 DISCUSSION 2.1 Background EALs are the plant-specific indications, conditions or instrument readings that are utilized to classify emergency conditions defined in the DCPP Emergency Plan. In 1992, the NRC endorsed NUMARC/NESP-007 "Methodology for Development of Emergency Action Levels" as an alternative to NUREG-0654 EAL guidance. NEI 99-01 (NUMARC/NESP-007) Revisions 4 and 5 were subsequently issued for industry implementation. Enhancements over earlier revisions included:

• Consolidating the system malfunction initiating conditions and example emergency action levels which address conditions that may be postulated to occur during plant shutdown conditions.

I

• Initiating conditions and example emergency action levels that fully address conditions that may be postulated to occur at permanently Defueled Stations and Independent Spent Fuel Storage Installations (ISFSls).
• Simplifying the fission product barrier EAL threshold for a Site Area Emergency.

Subsequently, Revision 6 of NEI 99-01 has been issued which incorporates resolutions to numerous implementation issues including the NRC EAL Frequently Asked Questions (FAQs). Using NEI 99-01 Revision 6, "Methodology for the Development of Emergency Action Levels for Non-Passive Reactors," November 2012 (ref. 4.1.1), DCPP conducted an EAL implementation upgrade project that produced the EALs discussed herein. I [Document No.] Rev. [X] Pa~e 3 of 3031

2.2 Fission Product Barriers Fission product barrier thresholds represent threats to the defense in depth design concept that precludes the release of radioactive fission products to the environment. This concept relies on multiple physical barriers, any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. Many of the EALs derived from the NEI methodology are fission product barrier threshold based. That is, the conditions that define the EALs are based upon thresholds that represent the loss or potential loss of one or more of the three fission product barriers. "Loss" and "Potential Loss" signify the relative damage and threat of damage to the bafrier. A "Loss" threshold means the barrier no longer assures containment of radioactive materials. A "Potential Loss" threshold implies an increased probability of barrier loss and decreased certainty of maintaining the barrier. The primary fission product barriers are: A. Fu.el Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets. B. Reactor Coolant System (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves. ( C. Containment (GMT): The Containment Barrier includes the containment building and __ connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the EGL from Alert to a Site Area Emergency or a General Emergency 2.3 Fission Product Barrier Classification Criteria The following criteria arethe bases for event classification related to fission product barrier loss or potential loss: Alert: Any Joss or any potential Joss of either Fuel Clad or RCS barrier Site Area Emergency: Loss or potential Joss of any two barriers General Emergency: Loss of any two barriers and Joss or potential Joss of the third barrier i I [Document No.] I Rev. [X] Page 4 of 3031

2.4 EAL Organization The DCPP EAL scheme includes the following features:

• Division of the EAL set into three broad groups:

o EALs applicable under any plant operating modes - This group would be reviewed by the EAL-user any time emergency classification is considered. o EALs applicable only under hot operating modes - This group would only be reviewed by the EAL-user when the plant is in Hot Shutdown, Hot Standby, Startup, or Power Operation mode. o EALs applicable only under cold operating modes - This group would only be reviewed by the EAL-user when the plant is in Cold Shutdown, Refueling or DefUeled mode. The purpose of the groups is to avoid review of hot condition EALs when the plant is in a cold condition and avoid review of cold condition EALs when the plant is in a hot condition. This approach significantly minimizes the total number of EALs that must be reviewed by the EAL-user for a given plant condition, reduces EAL-user reading burden and, thereby, speeds identification of the EAL that applies to the emergency.

• Within each group, assignment of EALs to categories and subcategories:

Category and subcategory titles are selected to represent conditions that are operationally significant to the EAL-user. The DCPP EAL categories are aligned to and represent the NEI 99-01"Recognition Categories." Subcategories are used in the DCPP scheme as necessary to further divide the EALs of a category into logical sets of possible emergency classification

                                                                                            \

thresholds. The DCPP EAL categories and subcategories are listed below., j [Document No.] Rev. [X] Page 5 of 303 j

EAL Groups, Categories and Subcategories EAL Group/Category EAL Subcategory I Any Operating Mode:

 /    R - Abnormal Rad Levels I Rad Effluent    1 - Radiological Effluent 2 - Irradiated Fuel Event 3 - Area Radiation Levels H - Hazards and Other Conditions          1 - Security Affecting Plant Safety                2 - Seismic Event 3 - Natural or Technological Hazard 4-Fire 5 - Hazardous Gas 6 - Control Room Evacuation 7 - SM/SEC/ED Judgment                          -

E-ISFSI 1 - Confinement Boundary Hot Conditions: S -System Malfunction 1 - Loss of Emergency AC Power 2 - Loss of Vital DC Power

                               -                3 - Loss of Control Room Indications 4 - RCS Activity .

5 - RCS Leakage 6 - RTS Failure 7 - Loss of Communications 8 - Containment Failure 9 ..:. Hazardous Event Affecting Safety Systems F - Fission Product Barrier Degradation None Cold Conditions: C - Cold Shutdown I Refueling System 1- RCS Level Malfunction 2- Loss of Emergency AC Power 3- RCS Temperature 4- Loss of VitaLDC Power 5- Loss of Communications 6- Hazardous Event Affecting Safety Systems The primary tool for determining the emergency classification level is the EAL Classification Wall Chart. The user of the EAL Classification Wall Chart may (but is not required to) consult the EAL Technical Bases Document in order to obtain additional information concerning the EALs under classification consideration. The user should consult Section 3.0 and Attachments 1 & 2 of this document for such information. 2.5 Technical Bases Information EAL technical bases are provided in Attachment 1 for each EAL according to EAL group (Any, Hot, Cold), EAL category (R, C, H, S, E and F) and EAL subcategory. A summary explanation I [Document No.] Rev. [X] Page 6 of 3031

of each category and subcategory is given at the beginning of the technical bases discussions of the EALs included in the category. For each EAL, the following information is provided: Category Letter & Title Subcategory Number & Title Initiating Condition CIC) Site-specific description of the generic IC given in NEI 99-01 Rev. 6. EAL Identifier (enclosed in rectangle) Each EAL is assigned a unique identifier to support accurate communication of the e,mergency classification to onsite and offsite personnel. Four characters define each EAL identifier: ** -

1. First character (letter): Corresponds to the EAL category as described above (R, C, H, S, E or F)

2. Second character (letter): The emergency classification (G, S, A or U)

G = General Emergency S = Site Area Emergency A= Alert U =Unusual Event

3. Third character (number): Subcategory number within the given category.

Subcategories are sequentially numbered beginning with the number one (1). If a category does not have a subcategory, this character is assigned the number one (1 ).

4. Fourth character (number): The numerical sequence of the EAL within the EAL subcategory. If the subcategory has only one EAL, it is given the number one (1).

( Classification (enclosed in rectangle): Unusual Event (U), Alert (A), Site Area Emergency (S) or General Emergency (G)

                                                                                               )

EAL (enclosed in rectangle) Exact wording of the EAL as it appears in the EAL Classification Matrix* Mode Applicability One or more of the following plant operating conditions comprise the mode to which each EAL is applicable: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown, 5 - Cold Shutdown, 6 - Refueling, D - Defueled, or Any. (See Section 2.6 for operating mode definitions) Definitions: If the EAL wording contains a defined term, the definition of the term is included in this section. These definitions can also be found in Section 5.1. Basis: An EAL basis section that provides both generic and site-specific ERO decision making guidance as well as background information that supports the rationale for the EAL as provided in NEI 99-01 Rev. 6. I[Document No.] I Rev. [X] Page 7 of 3031

DCPP Basis Reference(s): Site-specific source documentation from which the EAL is derived 2.6 Operating Mode Applicability (ref. 4.1.7) 1 Power Operation Kett~ 0.99 and reactor thermal power > 5% 2 Startup Kett~ 0.99 and reactor thermal power:$ 5% 3 Hot Standby Kett< 0.99 and average coolant temperature~ 350°F 4 Hot Shutdown Kett< 0.99 and average coolant temperature 350°F > Tavg > 200 °F with all reactor vessel head closure bolts fully tensioned 5 Cold Shutdown Kett< 0.99 and average coolant temperature:$ 200°F with all reactor vessel head closure bolts fully tensioned 6 Refueling One or more reactor vessel head closure bolts are less than fully tensioned D Defueled Reactor vessel contains no irradiated fuel (full core off-load during refueling or extended outage). The plant operating mode that exists at the time that the event occurs (prior to any protective system or operator action being initiated in response to the condition) should be compared to the mode applicability of the EALs. If a lower or higher plant operating mode is reached before the emergency classification is made, the declaration shall be. based on the mode that existed at the time the event occurred. I[Document No.] Rev. [X] Page 8 of 3031

3.0 GUIDANCE ON MAKING EMERGENCY CLASSIFICATIONS 3.1 General Considerations When making an emergency classification, the Shift Manager/Site Emergency Coordinator/Emergency Director (SM/SEC/ED) must consider all information having a bearing on the proper assessment of an Initiating Condition (IC). This includes the Emergency Action Level (EAL) plus the associated Operating Mode Applicability, Notes, and the informing basis information. In the Recognition Category F matrices, EALs are based on loss or potential loss of Fission Product Barrier Thresholds. 3.1.1 Classification Timeliness NRG regulations require the licensee to establish and maintain the capability to assess, classify, and declar,e an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded and to promptly declare the emergency condition as soon as possible following identification of the appropriate emergency classification level (ref. 4.1.9). 3.1.2 Valid Indications All emergency classification assessments shall be based upon valid indicatio~s, reports or conditions. A valid indication, report, or condition, is one that has been verified through appropriate means such that there is no doubt regarding the indicator's operability, the condition's existence, or the report's accuracy. For example, verification could be accomplished through an instrument channel check, response on related or redundant indicators, or direct observation by plant personnel. The validation of indications should be completed in a manner that supports timely emergency declaration. An indication, report, or condition is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the con'dition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. 3.1.3 Imminent Conditions For ICs and EALs that have a stipulated time duration (e.g., 15 minutes, 30 minutes, etc.), the SM/SEC/ED should not wait until the applicable time has elapsed. The SM/SEC/ED should declare the event as soon as it is determined that the condition has exceeded, or will likely exceed, the applicable time. If an ongoing radiological release is detected and the release start time is cannot be determined, it should be assumed that the release duration specified in the IC/EAL has been exceeded, absent data to the contrary.

• 3.1.4 Planned vs. Unplanned Events A planned work activity that results in an expected event or condition which meets or exceeds an EAL does not warrant an emergency declaration provided that: 1) the activity proceeds as planned, and 2) the plant remains within the limits imposed by the operating license. Such activities include planned work to test, manipulate, repair, maintain or modify a system or component. In these cases, the controls associated with the planning, preparation and execution of the work will ensure that compliance is maintained with all aspects of the operating license provided that the activity proceeds and concludes as expected. Events or conditions of this type may be subject to the reporting requirements of 10 § CFR 50. 72 (ref.

4.1.4). I [Document No.] Rev. [X] Page 9 of 3031

3.1.5 Classification Based on Analysis The assessment of some EALs is based on the results of analyses that are necessary to ascertain whether a specific EAL threshold has been exceeded (e.g., dose assessments, chemistry sampling, RCS leak rate calculation, etc.). For these EALs, the EAL wording or the associated basis.discussion will identify the necessary analysis. In these cases, the 15-minute declaration period starts with the availability of the analysis results that show the threshold to be exceeded (i.e., this is the time that the EAL information is first available). The NRG expects licensees to establish the capability to initiate and complete EAL-related analyses within a reasonable period of time (e.g., maintain the necessary expertise on-shift). For example, a coolant activity sample is taken. Chemistry reports results indicate activity greater than Technical Specification limits. The classification clock begins when Chemistry reports the sample results. 3.1.6 SM/SEC/ED Judgment While the EALs have been developed to address a full spectrum of possible events and conditions which may warrant emergency classification, a provision for classification based on operator/management experience and judgment is still necessary. The NEI 99-01 EAL scheme provides the SM/SEC/ED with the ability to classify events and conditions based upon judgment using EALs that are consistent with the Emergency Classification Level (EGL) definitions (refer to Category H). The SM/SEC/ED will need to determine if the effects or consequences of the event or condition reasonably meet or exceed a particular EGL definition. A similar provision is incorporated in the Fission Product Barrier Tables; judgment may be used to determine the status of a fission product barrier. 3.2 Classification Methodology To make an emergency classification, the user will compare an event or condition (i.e., the relevant plant indications and reports) to an EAL(s) and determine if the EAL has been met or exceeded. The evaluation of an EAL must be consistent with the related Operating Mode Applicability and Notes. If an EAL has been met or exceeded, the associated IC is likewise I

                                                                                                     . I met, the emergency classification process "clock" starts; and the EGL must be declared in accordance with plant procedures no later than fifteen minutes after the process "clock" started.

When assessing an EAL that specifies a time duration for the off-normal condition, the "clock" for the EAL time duration runs concurrently with the emergency classification process "clock." (ref. 4.1.9). 3.2.1 Classification of Multiple Events and Conditions When multiple emergency events or conditions are present, the user will recognize all met or exceeded EALs. The highest applicable EGL identified during this review is declared. For example:

• If an Alert EAL and a Site Area Emergency EAL are met, whether at one unit or at two different units, a Site Area Emergency should be declared.

There is no "additive" effect from multiple EALs meeting the same EGL. For example:

• If two Alert EALs are met, whether at one unit or at two different units, an Alert should be declared.

j [Document No.] Rev. [X] Page 10 of 3031

Related guidance concerning classification of rapidly escalating events or conditions is provided in Regulatory Issue Summary (RIS) 2007-02, Clarification of NRG Guidance for Emergency Notifications During Quickly Changing Events (ref. 4.1.2).

• 3.2.2 Consideration of Mode Changes During Classification The mode in effect at the time that an event or condition occurred, and prior to any plant or operator response, is the mode that determines whether or not an IC is applicable. If an event or condition occurs, and results in a mode change before the emergency is declared, the emergency classification level is still based on the mode that existed at the time that the event or condition was initiated (and not when it was declared). Once a different mode is reached, any new event or condition, not related to the original event or condition, requiring emergency classification should be evaluated against the ICs and EALs applicable to the operating mode at the time of the new event or condition.

For events that occur in Cold Shutdown or Refueling, escalation is via EALs that are applicable in the Cold Shutdown or Refueling modes, even if Hot Shutdown (or a higher mode) is entered during the subsequent plant response. In particular, the fission product barrier EALs are applicable only to events that initiate in the Hot Shutdown mode or higher. For example, a loss of decay heat removal when in Mode 5 results in RCS temperature exceeding 200°F. Escalation of the loss of decay heat removal event will be via the cold condition mode EALs even though the plant is now in Mode 4 as a result of the RCS temperature increase.* However, any subsequent new event/condition must be assessed against the hot condition EALs (Mode 4 and above). 3.2.3 Classification of Imminent Conditions Although EALs provide specific thresholds, the SM/SEC/ED must remain alert to events or conditions that could lead to meeting or exceeding an EAL within a relatively short period of time (i.e., a change in the EGL is imminent). If, in the judgment of the SM/SEC/ED, meeting an EAL is imminent, the emergency classification should be made as if the EAL has been met.

• While applicable to. all emergency classification levels, this approach is particularly important at the higher emergency classification levels since it provides additional time for i111plementation of protective measures.

3.2.4 Emergency Classification Level Upgrading and Downgrading An EGL may be downgraded when the event or condition that meets the highest IC and EAL no longer exists, and other site-specific downgrading requirements are met. If downgrading the EGL is deemed appropriate, the new EGL would then be based on a lower applicable IC(s) and EAL(s). The EGL may also simply be terminated. Refer to EP G-1 Emergency Classification and Emergency Plan Activation for guidance on downgrading and terminating an EGL. Refer to EP OR-3 Emergency Recovery for guidance for entering long-term recovery. As noted above, guidance concerning classification of rapidly escalating events or conditions is provided in RIS 2007-02 (ref. 4.1.2). 3.2.5 Classification of Short-Lived Events Event-based ICs and EALs define a variety of specific occurrences that have potential or actual safety significance. By their nature, some of these events may be short-lived and, thus, over before the emergency classification assessment can be completed. If an event occurs that meets or exceeds an EAL, the associated EGL must be declared. regardless of its continued presence at the time of declaration. Examples of such events include an / [Document No.] Rev. [X] Page 11 of 3031

earthquake or a failure of the reactor protection system to automatically trip the reactor followed by a successful manual trip. 3.2.6 Classification of Transient Conditions Many of the ICs and/or EALs employ time-based criteria. These criteria will require that the IC/EAL conditions be present for a defined period of time before an emergency declaration is warranted. In cases where no time-based criterion is specified, it is recognized that some transient conditions may cause an EAL to be met for a brief period of time (e.g., a few.seconds to a few minutes). The following guidance should be applied to the classification of these conditions. EAL momentarily met during expected plant response - In instances where an EAL is briefly met during an expected (normal) plant response, an emergency declaration is not warranted provided that associated systems and components are operating as expected, and operator actions are performed in accordance with procedures. EAL momentarily met but the condition is corrected prior to an emergency declaration - If an operator takes prompt manual action to address a condition, and the action is successful in correcting the condition prior to the emergency declaration, then the applicable EAL is not considered met and the associated emergency declaration is not required. For illustrative purposes, consider the following example: An.ATWS occurs and the high pressure ECCS systems fail to automatically start. RPV level rapidly decreases and the plant enters an inadequate core cooling condition (a potential loss of both the fuel clad and RCS barriers). If an operator manually starts a high pressure ECCS system in accordance with an EOP step and clears the inadequate core cooling condition prior to an emergency declaration, then the classification should be based on the A TWS only. It is important to stress that the 15-min.ute emergency classification assessment period (process clock) is not a "grace period" during which a classification may be delayed to allow the performance of a corrective action that would preclude the need to classify the event. Emergency classification assessments must be deliberate and timely, with no undue delays. The provision discussed above addresses only those rapidly evolving situations when an operator is able to take a successful corrective action prior to the SM/SEC/ED completing the review and steps necessary to make the emergency declaration. This provision is included to ensure that any public protective actions resulting from the emergency classification are truly warranted by the plant conditions. 3.2.7 After-the-Fact Discovery of an Emergency Event or Condition In some cases, an EAL may be met but the emergency classification was not made at the time of the event or condition. This situation can occur when personnel discover that an event or condition existed which met an EAL, but no emergency was declared, and the event or condition no longer exists at the time of discovery. This may be due to the event or condition not being recognized at the time or an error that was made in the em'ergency classification process. In these cases, no emergency declaration is warranted; however, the guidance contained in NUREG-1022 (ref. 4.1.3) is applicable. Specifically, the event should be reported to the NRG in accordance with 10 CFR § 50.72 (ref. 4.1.4) within one hour of the discovery of the undeclared event or condition (refer to Xl1.ID2 Regulatory Reporting Requirements and I[Document No.] Rev. [X] Page 12 of 3031 L

Reporting Process (ref. 4.1.11 )). The licensee should also notify appropriate State and local agencies in accordance with the agreed upon arrangements. 3.2.8 Retraction of an Emergency Declaration Guidance on the retraction of an emergency declaration reported to the NRG is discussed in NUREG-1022 (ref. 4.1.3). / [Document No.] Rev. [X] Pag~ 13 of *303 /

4.0 , REFERENCES 4.1 Developmental 4.1.1 NEI 99-01 Revision 6, Methodology for the Development of EmergencyAction Levels for Non-Passive Reactors, ADAMS Accession Number ML12326A805 4.1.2 RIS 2007-02 Clarification of NRC Guidance for Emergency Notifications During Quickly Changing Events, February 2, 2007. 4.1.3 NUREG-1022 Event Reporting Guidelines: 10CFR50.72 and 50.73 4.1.4 10CFR 50. 72 Immediate Notification Requirements for Operating Nuclear Power Reactors 4.1.5 10CFR 50. 73 License Event Report System 4.1.6 Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points 4.1.7 Technical Specifications Table 1.1-1 Modes 4.1.8 Administrative Procedure AD8.DC54 "Containment Closure" 4.1.9 NSIR/DPR-ISG-01 Interim Staff Guidance, Emergency Planning for Nuclear Power Plants 4.1.10 DCPP Emergency Plan 4.1.11 Xl1.ID2 Regulatory Reporting Requirements and Reporting Process 4.1.12 DCPP Security and Safeguards Contingency Plan 4.2 Implementing 4.2.1 EP G-1 Emergency Classification ,and Emergency Plan Activation 4.2.2 NEI 99-01 Rev. 6 to DCPP EAL Comparison Matrix 4.2.3 DCPP EAL Wall Chart I [Document No.] Rev. [X] Page 14 of 3031

5.0 DEFINITIONS, ACRONYMS & ABBREVIATIONS 5.1 Definitions Selected terms used in Initiating Condition and Emergency Action Level statements are set in all capital letters (e.g., ALL CAPS). These words are defined terms that have specific meanings as used in this document. The definitions of these terms are provided below. Alert Events are in process, or have occurred, which involve an actual or potential substantial degradation of the level of safety of the plant OR A SECURITY EVENT that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be small fractions of the EPA PROTECTIVE ACTION GUIDELINE exposure level~. Confinement Boundary The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As applied to the DCPP ISFSI, the confinement boundary is defined to be the Multi-Purpose Canister (MPC). Containment Closure The proc~durally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 "Containment Closure" (ref. 4.1.8). Degraded Performance As applied to hazardous everit thresholds, damage significant enough to cause concern regarding the operability or reliability of the affected safety system train. Emergency Action Level A pre-determined, site-specific, observable threshold for an Initiating Condition that, when met or exceeded, places the plant in a given emergency classification level. Emergency Classification Level One of a set of names or titles established by the US Nuclear Regulatory Commissioh (NRC) for grouping off-normal events or conditions according to (1) potential or actual effects or consequences, and (2) resulting onsite and offsite response actions. The emergency classification levels, in ascending order of severity, are: Unusual Event (UE), Alert, Site Area Emergency (SAE) and General Emergency (GE). EPA Protective Action Guidelines (EPA PAG) The EPA PAGs are expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. I[Document No.] Rev. [X] Page 15 of 3031

Explosion A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A~release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present. Faulted The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. Fire Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. Fission Product Barrier Threshold A pre-determined, site-specific, observable threshold indicating the loss or potential loss of a fission product barrier. (refer to Section 2.2) Flooding A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. General Emergency Events are in process or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity OR HOSTILE ACTIONS that result in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA PROTECTIVE ACTION GUIDELINE exposure levels offsite for more than the immediate site area. Hostage A person(s) held as leverage against the station to ensure that demands will be met by the station. Hostile Action An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). I [Document No.] I Rev. [X] Page 16 of 3031

Hostile Force One or more individuals who are engaged in a determined ass'ault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. Imminent The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. lmpede(d) Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs. that is not routinely employed). Independent Spent Fuel Storage Installation (.ISFSI) A complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. ISFSI Protected Area Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan. Normal Levels

         ,A,s applied to radiological IC/EALs, the highest reading in the past twenty four hours excluding the current peak value.

Initiating Condition An event or condition that aligns with the definition of one of the four emergency classification levels by virtue of the potential or actual effects or consequences. I Intact (RCS) The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams) (ref. 4.1.8). Owner Controlled Area (OCA) For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan (ref. 4.1.12). Projectile An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety. Plant Protected Area Areas to which access is strictly controlled in accordance with the station's Security Plan. ~ Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the Plant Protected Area. j [Document No.] Rev. [X] Page 17 of 303 j

RCS Leakage RCS Leakage shall be:

a. Identified Leakage 1

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall. * * ,

d. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water. or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System. Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

Reduced Inventory Condition (RIC) The condition existing whenever RCS water level is lower than 3 feet below the reactor vessel flange (below 111-foot elevation) with fuel in.the core. Refueling Pathway The reactor refueling cavity, spent fuel pool and fuel transfer canal comprise th.e refueling pathway. *

• Ruptured The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.'

Safety System A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety~ related (as defined in 10CFR50.2): Those structures. systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result I in potential offsite exposures. I* j [Document No.] Rev. [X] Page 18 of 303 j

Security Condition Any SECURITY EVENT as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A security condition does not involve a HOSTILE ACTION. Security Event Any incident representing an attempted, threatened, or actual breach of the security system or reduction of the operational effectiveness of that system. A security event can result in either a SECURITY CONDITION or HOSTILE ACTION (ref. 4.1.12). Site Area Emergency Events are in process or have occurred which involve actual or likely major failures of plant functions needed for protection of the public OR HOSTILE ACTIONS that result in intentional damage or malicious acts; (1) toward site personnel or equipment that could lead to the likely failure of or; (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA PROTECTIVE ACTION GUIDELINES exposure levels beyond the SITE BOUNDARY. Site Boundary As depicted in the Final Safety Analysis Report Update (UFSAR). Figure 2.1-2,-Site Plan and Gaseous/Liquid Effluent Release Points (ref. 4.1.6). Tornado A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm. Unisolable An open or breached system line that cannot be*isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation. temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. Unplanned A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to .a transient. The cause of the parameter change or event may be known or unknown. Unusual Event Events are in process or have occurred which indicate a potential degradation in the level of safety of the plant OR Indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs. I[Document No.] Rev. [X] Page 19 of 3031

Valid An indication, report, or condition. is considered to be valid when it is verified by (1) an instrument channel check. or (2) indications on related or redundant indicators. or (3) by direct obser\tation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. Visible Damage Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. I [Document No.] Rev. [X] Page 20 of 3031

                                                                                 \
                                                                                   \
                                                                                     \
                                                                                       \
                                                                                         \
                                                                                           \
                                                                                             \
                                                                                               \
                                                                                                 \
                                                                                                   \
                 *-* 01 n~ ct1 N

• tn MT l'°""':i.o.* v

(;l(*VllOI*

• llt>-11).m!)AWr

                                 ... lttl   ~O M      .. ~llrt'
            ~
                             *~*
                                 ~-          ...   "'"'

l*t

                                          >"'1      ~

l tO l.. . *~ UolO

                                                            >   A c , c
                                ~
                                          ,....                                                     FSAR UPDA TE Jo*

m 1 U(ill

                                                                          ... --                     UNITS 1 ANO 2 DIABLO CAN.YON SITE
                                ..1       l.4       i, FIGURE 1-Z HO        UM                                                            SITE ~LAH AND
                           ..., uo 1'1tn UJ                  l . IW                                          GASEOUS.ILIOUIO El'FlUENT

• Ult R.Et.EASOOINlS

[Document No.] Rev. [X] Page 21 of 303

5.2 Abbreviations/Acronyms

 °F ............................................................. :................................................. Degrees Fahrenheit 0
   *********************************************************************************************************************************** Degrees AC ............................................................................................................... Alternating Current AFW............................................................................................................Auxiliary Feedwater AOP ......................................................................................... Abnormal Operating Procedure ATL ...................................*................................ ~ .......................................... Automatic Tie Line
*ATWS .............................................................................. A_nticipated Transient Without Scram BA .......................................................................................................................~ .. : ... B_oric Acid BART .................. '. ......................................................................-......... Boric Acid Reserve Tank BAST .................................................................................................. Boric Acid Storage Tank GAS ......................................................................................................... Central Alarm Station CCW ..........................................................................................:..... Component Cooling Water CC(#) ................................................................................................ Control Console (number)

COE .................................................................................................Committed Dose Equivalent CEDE. .................. ."........................................*.................. Committed Effective Dose Equivalent GET ..................................................................................................... Core Exit Thermocouple CFCU .......................................................................................... Containment Fan Cooling Unit CFR .............................................................................................. Code of Federal Regulations GMT .......................................................................................................................Containment CSFST ............................................................................... Critical Safety Function Status Tree CST ..................... *....... ;****************************************************:*************** Condensate Storage Tank OBA ......................................................................................................... Design Basis Accident DC .......................................................................................... .-............................. Direct Current DCPP ............................................................................................. Diablo Canyon Power Plant ODE ............ :................................................................................... Double Design Earthquake DE ................................................................................................................Design Earthquake EAL ............................................. :....................................................... Emergency Action Level ECCS .................................................. ,................................. Emergency Core Cooling System EGL ......................................................................................... Emergency Classification Level ED ..........................*.................................................................................. Emergency Director EDE .................................................................................................. Effective Dose Equivalent EFM ............ :..................................................................................... Earthquake Force Monitor ENF ............................................................................................. Emergency Notification Form EOF .......................................................................................... Emergency Operations Facility EOP ....................................................................................... Emergency Operating Procedure EPA ...................................................................................... Environmental Protection Agency ERG ........................................................................................ Emergency Response Guideline EPIP ........................................................................ Emergency Plan Implementing Procedure ESF ................................................................................................ Engineered Safety Feature l [Document No.] Rev. [X] I- Page 22 of 303. l

ERFDS .................... ,......................................... Emergency Response Facility Display System FAA ......................................................................................... Federal Aviation Administration FBI ........................................................................................... Federal Bureau of Investigation FEMA. ...................................................................... Federal Emergency Management Agency FSAR ............................................................................................ Final Safety Analysis Report ft ... :..................................................................................................................................... Feet FTS ................................................................................................. Federal Telephone System GDC ......................................................................................................General Design Criteria GE .................................................................... :........................................ General Emergency HASP .......................................................................................................... High Alarm Setpoint HOO ............................................................................... NRC Headquarters Operations Officer IC ..................................................................................................................Initiating Condition in .................................................................................................................................~ ... Inches IPEEE ......................... Individual Plant Examination of External Events (Generic Letter 88-20) Kett ................................................................................. Effective Neutron Multiplication Factor LCO .......................................................................................... Limiting Condition of Operation LER ....................................................................................................... Licensee Event Report LOCA ................................................................................................. Loss of Coolant Accident LWR ........................................................................................................... Light Water Reactor MEDT ............................................................................. Miscellaneous Equipment Drain Tank MPC ................................................................................. Maximum Permissible Concentration MPC .......................................................................................................Multi-Purpose Canister mR, mRem, mrem, mREM ...................................................... milli-Roentgen Equivalent Man MSL ................................................................................................................ Main Steam Line MW ............................................................................................................................ Megawatt NEI ...................................................................................................... Nuclear Energy Institute NEIC ........................................................................... National Earthquake Information Center NESP ........................................................................... National Environmental Studies Project NPP .......................................................................................................... Nuclear Power Plant NRC ........................................................................................ Nuclear Regulatory Commission NSSS ........................................................................................ Nuclear Steam Supply System NORAD ........................................................... North American Aerospace Defense Command (NO)UE ........................................................................................ Notification of Unusual Event NUREG ........................................................................................................Nuclear Regulation OBE ........................................................... *................................... Operating Basis Earthquake OCA .......................................................................................................Owner Controlled Area ODCM .................................................................................... Off-site Dose Calculation Manual OES ............................................................................................ Office of Emergency Services ORO ......................................................................................... Offsite Response Organization PA ..........................................................................................................*............ Protected Area j [Document No.] Rev. [X] Page 23 of 303 j

PAG .......................................................... :..................................... Protective Action Guideline PAM ...... i ................................................................ : ........................... Post ~ccid~nt Monitoring PAR ............................................................ ~ ...................... Protective Action Recommendation PBX ...................................................................................................Private Branch Exchange PGA ...................................,............................................................... Peak Ground Acceleration PPG ........................................................................ .'........................... Plant Process Computer PRA/PSA ........ ,..................... Probabilistic Risk Assessment I Probabilistic Safety Assessment PRT .......................'............................................................................... Pressurizer Relief Tank PSIG ........................................................................................ Pounds per Square Inch Gauge PTS ******************************~****************************************************************Pressurized Thermal Shock PWR ............... ., ......................... ~ ..........................,........................... Pressurized Water Reactor

.R .................................................-................................................................................ Roentgen RCC .................................................................................................... Reactor Control Console RCDT ............................................................................................. Reactor Coolant Drain Tank RCS ............................................,........................................................ Reactor Coolant System RHR ..................................................................................................... Residual Heat Removal Rem, rem, REM ............................................................................... Roentgen Equivalent Man RETS ................................................................. Radiological Effluent Technical Specifications RTS .......................................................................................................... Reactor Trip, System R(P)V ............................................................................................... Reactor (Pressure) Vessel RVLIS ........ *................................................................. Reactor Vessel Level Indicating System RVRLIS ....................................................... Reactor Vessel Refueling Level Indicating System RWST .:.............................. ; ....................................................... Refueling Water Storage Tank SAE ...............................*.......................................................................... Site Area Emergency SAMG .......................................................................... Sever Accident Management Guideline SAR ....................................................................................................... Safety Analysis_ Rep,ort SAS ............................................................................-........................ Secondary Alarm Station
                                                                                              /

SBO ...............-............................................................................. .'.................... Station Blackout SCBA ........................................................................._. ..... Self-Contained Breathing Apparatus SCMM ............................................................................................ Sub Cooled Margin Monitor SEC .............................................................................................. Site Emergency Coordinator SG, ............................. ,. ....................................................................................Steam Generator SI ...................................................................................................................... Safety Injection SM ......................................................-..............................................................*... Shift Manager SPDS .......................................................................: ........... Safety Parameter Display System SRO ............................................. '....................................................... Senior Reactor Operator SSF .......................................................................................................§>afe Shutdown Facility TC ................................... ~ ................................................................................... Thermocouple TEDE ....................................................................................... Total Effective Dose Equivalent TOAF .............................. : .........................,.... L .............................................. Top of Active Fuel I I [Document No.] Rev. [X] Page 24 of 3031

TSC ................................................................................................... Technical Support Center UE ...................................................................................................................... Unusual Event UFSAR ............................................................................ Updated Final Safety Analysis Report USGS .................................................................................... United States Geological Survey VB(#) ................................................................................................... Vertical Board (number) VDC ............................................................................................................Volts Direct Current WOG ........................................................................................... Westinghouse Owners Group WR .............................................................. *.......................................................... Wide Range XFMR .................................................................................................................... Transformer I [Document No.] Rev. [X] Page 25 of 3031

6.0 DCPP-TO-NEI 99-01 Rev. 6 EAL CROSS-REFERENCE This cross-reference is provided to facilitate association and location of a DCPP EAL within the NEI 99-01 IC/EAL identification scheme. Further information regarding the development of the DCPP EALs based on the NEI guidance can be found in the EAL Comparison Matrix. DCPP NEI 99-01 Rev. 6 Example EAL IC EAL RU1.1 AU1 1, 2 RU1.2 AU1 3 RU2.1 AU2 1 RA1.1 AA1 1 RA1.2 AA1 2 RA1.3_ AA1 3 RA1.4 AA1 4 RA2.1 AA2 1 RA2.2 AA2 2 RA2.3 AA2 3 RA3.1 AA3 1 RA3.2 AA3 2 RS1.1 AS1 1 RS1.2 AS1 2 RS1.3 AS1 3 RS2.1 AS2 1 RG1.1 AG1 1 RG1.2 AG1 2 RG1.3 AG1 3 RG2.1 AG2 1 CU1.1 CU1 1 I [Document No.] Rev. [X] Page 26 of 3031

                                                  )

DCPP NEI 99-01 Rev. 6 Example EAL IC EAL CU1.2 CU1 2 CU2.1 CU2 1 CU3.1 CU3 1 CU3.2 CU3 2 CU4.1 CU4 1 CU5.1 CU5 1, 2, 3 CA1.1 CA1 1 CA1.2 CA1 2 CA2.1 CA2 1 CA3.1 CA3 1, 2 CA6.1 CA6 1 CS1.1 CS1 1 CS1.2 CS1 2 CS1.3 CS1 3 CG1.1 CG1 1 CG1.2 CG 2 FA1.1 FA1 1 FS1.1 FS1 1 FG1.1 FG1 1 HU1.1 HU1 1, 2 3 HU2.1 HU2 1 HU3.1 HU3 1 HU3.2 HU3 2 HU3.3 HU3 3 HU3.4 - HU3 4 j [Document No.] Rev. [X] Page 27 of 303 j

                                                          - 1 DCPP   NEI 99-01 Rev. 6 Example EAL    IC EAL HU4.1  HU4           1 HU4.2  HU4           2 HU4.3  HU4           3 HU4.4  HU4           4 HU7.1  HU7           1 HA1.1  HA1         1, 2 HA5.1  HA5           1 HA6.1  HA6           1 HA7.1  HA7           1 HS1.1  HS1           1 HS6.1  HS6           1 HS7.1  HS7           1 HG7.1  HG7           1 SU1.1  SU1           1 SU3.1  SU2           1 SU4.1  SU3           1 SU4.2  SU3           2 SU5.1  SU4        1, 2, 3 SU6.1  SU5           1 SU6.2  SU5           2 SU7.1  SU6        1, 2, 3 SU8.1  SU7         1, 2 SA1.1  SA1           1 SA3.1  SA2           1 SA6.1  SA5           1 I [Document No.]       Rev. [X]            Page 28 of 3031

DCPP NEI 99-01 Rev. 6 Example EAL IC EAL SA9.1 SA9 1 SS1.1 SS1 1 SS2.1 SSS 1 SS6.1 SS5 1 SG1.1 SG1 1 SG2.1 SGS 1 EU1.1 E-HU1 1 I [Document No.] Rev. [X] Page 29 of 3031

7.0 ATTACHMENTS 7.1 Attachment 1, Emergency Action Level Technical Bases 7.2 Attachment 2, Fission Product Barrier Matrix and Basis I [Document No.] Rev. [X] Page 30 of 3031

r ATTACHMENT 1 EAL Bases Category R - Abnormal Rad Release I Rad Effluent EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.) Many EALs are based on actual or potential degradation of fission product barriers because of the elevated potential for offsite radioactivity release. Degradation of fission product barriers though is not always apparent via non-radiological symptoms. Therefore, direct indication of elevated radiological effluents or area radiation levels are appropriate symptoms for emergency classification. At lower levels, abnormal radioactivity releases may be indicative of a failure of containment systems or precursors to more significant releases. At higher release rates, offsite radiological conditions may result which require offsite protective actions. Elevated area radiation levels in plant may also be indicative of the failure of containment systems or preclude access to plant vital equipment necessary to ensure plant safety. Events of this category pertain to the following subcategories:

1. Radiological Effluent Direct indication of effluent radiation monitoring systems provides a rapid assessment mechanism to determine releases in excess of classifiable limits. Projected offsite doses, actual offsite field measurements or measured release rates via sampling indicate doses or dose rates above classifiable limits.

2. Irradiated Fuel Event Conditions indicative of a loss of adequate shielding or damage to irradiated fuel may preclude access to vital plant areas or result in radiological releases that warrant emergency classification.

3. Area Radiation Levels Sustained general area radiation levels which may preclude access to areas requiring.

continuous occupancy also warrant emergency classification. I [Document No.] Rev. [X] Page 31 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels f Rad Effluent Subcategory: 1 - Radiological Effluent 1 Initiating Condition: Release of gaseous or liquid ra dioactivity greater than 2 times the

• Offsite Dose Calculation Manual limits for 60 minutes or longer.

EAL: RU1.1 Unusual Event Reading on any Table R-1 effluent radiation monitor> column "UE" for ~ 60 minutes. (Notes 1, 2, 3) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be *.determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. Table R-1 Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm en

I 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc GJ en Plant Vent RI 1.9E-10 amps Cl 1(2)-RM-87 3.2E-1 µCi/cc Liquid Radwaste Effluent 'tl

• s Line O-RM-18 ----- ----- ----- 1.6E+5 cpm C'

i SGBDTank 1(2)-RM-23 ----- ----- ----- '

2.0E+4 cpm Mode Applicability: All Definition(s): VAL/9 -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or r~dundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's opera,bility, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. Basis: ( ERO Decision Making Information Classification based on effluent monitor readings assumes that a release path to the environ.ment is established. If the effluenfflow past an effluent monitor is known to have I [Document No.] Rev. [X] Page 32 of 3031

ATTACHMENT 1 EAL Bases stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Even if a release does not meet the levels of this EAL. a release may be reportable. In these cases, consult Admin Procedure Xl1.ID2. Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL. EAL #1 This EAL addresses normally occurring continuous radioactivity releases from monitored gaseous or liquid eff_luent pathways. Escalation of the emergency classification level would be via IC M-1-RA 1.

Background

The column "UE" gaseous and liquid release values in Table R-1 represent"two times the appropriate Offsite Dose Calculation Manual release rate limits associated with the specified monitors (ref. _1, 2). This IC addresses a potential decrease in the level of safety of the plant as indicated by a low-level radiological release that exceeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un-monitored, including those for which a radioactivity discharge permit is normally prepared. Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, u_ncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident ev_ents and conditions. EAL #2 This EAL addresses radioactivity releases that cause effluent radiation monitor readings to exceed 2 times the limit established by a radioactivity discharge permit. This EAL will typically be associated with planned batch releases from non continuous release path Nays 1 (e.g., radwaste, \Vaste gas). EAL #3 This EAL addresses uncontrolled gaseous or liquid releases that are detected by sample analyses or environmental surveys, particularly on unmonitored pathways (e.g., spills of radioactive liquids into storm drains, heat exchanger leakage in river vvater systems, etc.). J?CPP Basis Reference(s):

1. DCPP Radiological Effluent Technical Specifications

2. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

3. NEI 99-01 AU1 I [Document No.] Rev. [X] Page 33 of 303 l

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent . Initiating Condition: Release of gaseous or liquid radioactivity greater than 2 times the Offsite Dose Calculation Manual limits for 60 minutes or longer. EAL: RU1.2* Unusual Event Sample analysis for a gaseous or liquid release indicates a concentration or release rate

> 2 x Offsite Dose Calculation Manual limits for ~ 60 minutes . .(Notes 1, 2)
                                   /

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Defin ition(s): UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. Basis: ERO Decision Making Information EAL #3 This EAL addresses uncontrolled gaseous or liquid releases that are detected by sample analyses or environmental surveys, {particularly on unmonitored arid/or UNISOLABLE pathways... {e.g., spills of radioactive liquids into storm drains, heat exchanger leakage leaks into river water systems, etc.). Sample analysis results relative to Offsite Dose Calculation Manual limits are provided by Chemistry. Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL. Escalation of the emergency classification level would be via IC AA4RA 1.

Background

This IC addresses a potential decrease in the level of s~fety of the plant as indicat~d by a low-level radiological release that exceeds regulatory commitments for an .extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un'"monitored, including those for which a radioactivity discharge permit is normally prepared. Nuclear power plants incorporate 'design features intended to control the release of radioactive effluents to the. environment. Further, there are administrative controls established to prevent I[Document No.] . I Rev. [X] I Page 34 of 3031

ATTACHMENT 1 EAL Bases unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

• Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flov.' past an effluent monitor is knovm to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer valid for classification purposes.

EAL #1 This EAL addresses normally occurring continuous radioactivity releases from monitored gaseous or liquid effluent pathways. EAL #2 This El\L addresses radioactivity releases that cause effluent radiation monitor readings to exceed 2 times the limit established by a radioactivity discharge permit. This El\L will typically be associated with planned batch releases from non continuous release pathv:ays (e.g., rad*Naste, 'Nasta gas). DCPP Basis Reference(s):

1. DCPP R~diological Effluent Technical Specifications

2. NEI 99-01 AU1

/ [Document No.] Rev. [X] Page 35 of 3031

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent r lnitiatin~ Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid COE. EAL: RA1.1 Alert Reading on any Table R-1 effluent radiation monitor> column "ALERT" for;;?; 15 minutes. (Notes 1, 2, 3, 4) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. Note 4 The pre-calculated effluent monitor values presented in EALs RA1 .1; RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

                          )

Table R~1 ' Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm en

I 1(2).-RM-14/14R -----

0 5.6E-2 µCi/cc 5,6E-3 µCi/cc 1.8E-3 µCi/cc QI en Plant Vent ca 1.9E-10 amps Cl 1(2)-RM-87 ---- ---- --- 3.2E-1 µCi/cc Liquid Radwaste Effluent "'C

• 3 Line O-RM-18 ----- ----- ----- 1.6E+5 cpm er

J SGBDTank 1(2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode Applicability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. I [Document No.] Rev. [X] Page 36 of 3031

                                                                                                                            \.

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL address gaseous radioactivity releases, that for whatever reason, cause effluent radiation monitor readings corresponding to SITE BOUNDARY doses that exceed either:

• 10 mRem TEDE
• 50 mRem thyroid COE The results from a dose assessment are preferred using actual meteorology; when available.

Until available, the pre-calculated effluent monitor values presented in Table R-1 should be* used for emergency classification. Once an accurate dose assessment is performed. classification should be based on dose assessment only and not using the effluent monitor values in Table R-1. For example, a Table R-1 Alert effluent threshold is exceeded. However, real-time dose assessment results are available indicating offsite doses less than EAL RA 1.2 thresholds. Declaration of an Alert due to EAL RA 1.1 is not required. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Escalation of the emergency classification level would be via IC AS4RS1.

Background

The column "ALERT" gaseous effluent release values in Table R-1 correspond to calculated doses of 1% (10% of the SAE thresholds) of the EPA PROTECTIVE ACTION GUIDELINES (TEDE or COE Thyroid) (ref. 1). This IC addresses a release of -gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release).

• Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio .of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

2. NEI 99-01 AA 1 Rev. [X] Page 37 of 3031 J [Document No.] I

ATTACHMENT 1 EAL Bases* Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid COE. EAL: RA1.2 Alert Dose assessment using actual meteorology indicates doses > 10 mrem TEDE or 50 mrem thyroid COE at or beyond the SITE BOUNDARY. (Note 4) Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Mode AppUcability: All Definition(s): SITE BOUNDARY-As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Dose projections are performed by computer-based method (ref. 1. 2. 3). Dose assessments may utilize real-time dose projections and/or field monitoring results. Cl~ssification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Escalation of the emergency classification level would be via IC AS=t-RS1.

Background

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. I[Document No.] Rev. [X] Page 38 of 3031

ATTACHMENT 1 '\ EAL Bases DCPP Basis Reference(s):

1. EP RB-9, Calculation of Release Rate

2. EP RB-11, Emergency Offsite Dose Calculations

3. EP R-2, Release of Airborne Radioactive Materials Initial Assessment

4. NEI 99-01 AA1 I[Document No.]

• Rev. [X] Page 39 of 303 j

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid COE. EAL: RA1.3 Alert Analysis of a liquid effluent sample indicates a concentration or release rate that would result in doses > 10 mrem TEDE or 50 mrem thyroid COE at or beyond the SITE BOUNDARY for 60 minutes of exposure. (Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit.

• Mode Applicability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Escalation of the emergency classification level would be via IC AS4RS1.

Background

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flov.' past an effluent monitor is knovm to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer valid for classification purposes. J [Document No.] l Rev. [X] Page 40 of 3031

ATTACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. EP R-3 Release of Radioactive Liquids

2. NEI 99-01 AA 1 Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater t~an 10 mrem TEDE or 50 mrem thyroid COE.

EAL: RA1.4 Alert Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

• Closed window dose rates are > 10 mR/hr and are expected to continue for;:::: 60 minutes.
• Aoalyses of field survey samples indicate thyroid COE > 50 mrem for 60 minutes of inhalation.

(Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information EP RB-8, Instructions for Field Monitoring Teams provides guidance for emergency or post-accident radiological environmental monitoring (ref. 1). Escalation of the emergency classification level would be via IC AS4-RS1.

Background

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). I [Document No.] Rev. [X] Page 41 of 3031

ATTACHMENT 1 EAL Bases Radiolog.ical effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately Classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. Classification based. on effluent monitor readings assumes that a release path to the environment is established. If the effluent flmv past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer valid for classification purposes. DCPP Basis Reference(s):

1. EP RB-8, Instructions for Field Monitoring Teams

2. NEI 99-01 AA 1 I [Document No.] I Rev. [X] Page 42 of 303 j

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity. resulting in offsite dose greater than 100 mrem TEDE or 500 mrem thyroid COE. EAL: RS1.1 Si.te Area Emergency Reading on any Table R-1 effluent radiation monitor> column "SAE" for ~ 15 minutes. (Notes 1, 2, 3, 4) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Table R-1 Effluent Monitor Classification Thresholds I Release Point I Monitor I GE I SAE I Alert I UE I 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm U) 1(2)-RM-14/14R -----

I 0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc cu Plant Vent U) ra 1.9E-10 amps Cl 1(2)-RM-87 ---- ---- ----

3.2E-1 µCi/cc Liquid Radwaste Effluent

 *s"OC'               Line O-RM-18            -----              -----              -----        *1.6E+5 cpm

J SGBDTank 1(2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode AppUcability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. I[Document No.] Rev. [X] Page 43 of 303 *1.

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL address gaseous radioactivity releases. that for whatever reason, cause effluent radiation monitor readings corresponding to SITE BOUNDARY doses that exceed either:

• 100 mRem TEDE
• 500 mRem thyroid COE The results from a dose assessment are preferred using actual meteorology, when available.

Until available. the pre-calculated effluent monitor values presented in Table R-1 should be used for emergency classification. Once an accurate dose assessment is performed, classification should be based on dose assessment only and not using the effluent monitor values in Table R-1. For example. a Table R-1 SAE effluent threshold is exceeded. However. real-time dose assessment results are available indicating offsite doses less than EAL RS1 .2 thresholds. Declaration of a Site Area Emergency due to EAL RS1 .1 is not required. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have l stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Escalation of the emergency classification level would be via IC AG-1-RG1. BackgroundJ The column "SAE" gaseous effluent release value in Table R-1 corresponds to calculated doses of 10% of the EPA PROTECTIVE ACTION GUIDELINES (TEDE or thyroid COE) (ref. 11 This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone .. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and tbyroid COE.

                  ?

DCPP Basis Reference(s):

1. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

2. NEI 99-01 AS1 I [Document No.] Rev. [X] Page 44 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem thyroid COE. EAL: RS1.2 Site Area Emergency Dose assessment using actual meteorology indicates doses > 100 mrem TEDE or 500 mrem thyroid COE at or beyond the SITE BOUNDARY. (Note 4) Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Mode Applicability: All Definit.ion(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Dose projections are performed by computer-based method (ref. 1, 2, 3). Dose assessments may utilize real'"time dose projections and/or field monitoring results. Escalation of the emergency classification level would be via IC AG4RG1.

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and Un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem thyroid COE was established in .consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer valid for classification purposes. j [Document No.] Rev. [X] Page 45 of 303 j

ATTACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. EP RB-9, Calculation of Release Rate

2. EP RB-11, Emergency Offsite Dose Calculations

3. EP R-2, Release of Airborne Radioactive Materials Initial Assessment

4. NEI 99-01 AS1 I[Document No.J Rev. [X] Page 46 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent* Subcategory: 1 - Radiological Effluent Initiating Condition: Release otgaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem thyroid COE. EAL: RS1 .3 Si~e Area Emergency Field survey res wits indicate EITHER of the following at or beyond the SITE BOUNDARY:

• Closed window dose rates are > 100 mR/hr and are expected to continue for;::::: 60 minutes.
• Analyses of field survey samples indicate thyroid COE > 500 mrem for 60 minutes of inhalation.

(Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information EP RB-8. Instructions for Field Monitoring Teams provides guidance for emergency or post-accident radiological environmental monitoring (ref. 1). Escalation of the emergency classification level would be via IC AG4RG1.

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection oft~~ public. Radiological effluent EALs are also included to provide a basis for classifying ev-ents and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem thyroid COE I [Document No.] Rev. [X] Page .4 7 of 3031

ATTACHMENT 1 EAL Bases was established in consideration of the 1:5 ratio of the 'EPA PAG for TEDE and thyroid COE. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is knovm to have stopped due to actions to isolate the release path, then the pffluent monitor reading is no longer valid for classification purposes. DCPP Basis Reference(s):

1. EP RB-8, Instructions for Field Monitoring Teams

2. NEI 99-01 AS1 I[Document No.] Rev. [X] Page 48 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: . 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem thyroid COE. EAL: RG1.1 General Emergency Reading on any Table R-1 effluent radiation monitor> column "GE" for ;:: 15 minutes. (Notes 1, 2, 3, 4) Note 1: The SM/SEC/ED should declar.e the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

• Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit.

Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent mof)litor reading is no longer VALID for classification purposes. Note 4: The *pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Table R-:1 Effluent Monitor Classification Thresholds Release Point Monitor GE *SAE Alert UE

                                                              '              2.5E+6 cpm           2.5E+5 cpm       8.0E+4 cpm en

s 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc Cll en Plant Vent ca ' 1.9E-10 amps (!) 1(2)-RM-87 ---- ---- (. ---- 3.2E-1 µCi/cc Liquid Radwaste Effluent

• s"CC" Line O-RM-18 ----- ----- ----- 1.6E+5 cpm

i SGBDTank 1(2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode Applicability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. VALID -An indication, report, or condition, is considered to be valid when it is verified by {1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely, assessment. I[Document No.] Rev. [X] Page 49 of 3031

- -----------------------------------~ ATTACHMENT 1 EAL Bases I [Document No.] Rev. [X] Page 50 of 3031

ATTACHMENT 1

• EAL Bases Basis:

ERO Decision Making Information This EAL address gaseous radioactivity releases, that for whatever reason, cause effluent radiation monitor readings corresponding to SITE BOUNDARY doses that exceed either:

• 1000 mRem TEDE
• 5000 mRem thyroid COE The results from a dose assessment are preferred using actual meteorology, when available.

Until available, the pre-calculated'effluent monitor values presented in Table R-1 should be used for emergency classification. Once an accurate dose assessment is performed, classification should be based on dose assessment only and not using the effluent monitor values in Table R-1. For example, a Table R-1 GE effluent threshold is exceeded. However, real-time dose assessment results are available indicating offsite doses less than EAL RG1 .2 thresholds. Declaration of a General Emergency due to EAL RG1 .1 is not required. Classification based on effluent monitor readings assumes that a release path to the environment is establishiad. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Background

The column "GE" gaseous effluent release values in Table R-1 correspond to calculated doses of 100% of the EPA PROTECTIVE ACTION GUIDELINES (TEDE or thyroid COE) (ref. 1). This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. E,P-CALC-DCPP-1601 Radiological Effluent EAL Values

2. NEI 99-01 AG1 j [Document No.] Rev. [X] Page 51 of 303 j

ATTACHMENT 1 EAL Bases Category:

• R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release.of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem thyroid COE.

EAL: RG1.2 General Emergency Dose assessment using actual meteorology indicates doses > 1,000 mrem TEDE or 5,000 mrem thyroid COE at or beyol}d the SITE BOUNDARY. (Note 4) Note 4: The pre-calculated effluent monitor values presented in EALs RA1 .1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Dose projections are performed by computer-based method (ref. 1. 2. 3). Dose assessments may utilized real-time dose projections and/or field monitoring results.

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. Classifioation based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to aotions to isolate the release path, then the effluent monitor reading is no longer valid for olassifioation purposes. DCPP Basis Reference(s):

1. EP RB-9, Calculation of Release Rate I [Document No.] I Rev. [X] Page 52 of 3031

ATTACHMENT 1 EAL Bases

2. EP RB-11, Emergency Offsite Dose Calculations

3. EP R-2, Release of Airborne Radioactive Materials Initial Assessment

4. NEI 99-01 AG1 I[Document No.] Rev. [X] Page 53 of 3031

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem thyroid COE. EAL: RG1 .3 General Emergency Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

• Closed window dose rates are > 1,000 mR/hr and are expected to continue for;::: 60 minutes.
• Analyses of field survey samples indicate thyroid COE > 5,000 mrem for 60 minutes of inhalation.

(Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information EP RB-8, Instructions for Field Monitoring Teams provides guidance for emergency or post-accident radiological environmental monitoring (ref. 1).

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. I [Document No.] Rev. [X] Page 54 of 3031

ATTACHMENT 1 EAL Bases Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is knovm to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer valid for classification purposes. DCPP Basis Reference(s):

1. EP RB-8, Instructions for Field Monitoring Teams

2. NEI 99-01 AG1

                                  \

j [Document No.] Rev. [X] Page 55 of 303 j

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: UNPLANNED loss of water level above irradiated fuel. EAL: RU2.1 Unusual Event UNPLANNED water level drop in the REFUELING PATHWAY as indicated by low water level alarm or equivalent indication. AND UNPLANNED rise to low alarm setpoint in corresponding area radiation levels as indicated by any of the following radiation monitors:

• RM-58 Spent Fuel Pool Area
• RM-59 New Fuel Area
• RM-2 Containment Area (Mode 6 only)
• Any temporary installed monitor in vicinity of the REFUELING PATHWAY (when installed)

Mode Applicability: All Definition(s): UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. REFUELING PATHWAY-. The reactor refueling cavity, spent fuel pool and fuel transfer canal comprise the refueling pathway. Basis: ERO Decision Making Information Note that this EAL is applicable only in cases where the elevated reading is due to an UNPLANNED loss of water level. The Spent Fuel Pool (SFP) low water level alarm setpoint is 23 ft. 9 in. above the top of irradiated fuel seated in the SFP storage racks or 137 feet 4 inches elevation. The Refueling Cavity low water level alarm setpoint is at 138 feet elevation as measured on Reactor Vessel Refueling Level Indicating System (RVRLIS) (i.e., 24 feet above the top of reactor vessel flange). J [Document No.] Rev. [X] Page 56 of 303 J

ATTACHMENT 1 EAL Bases The reading on an area radiation monitor (permanently installed or temporary) located near the Reactor Cavity may increase due to planned evolutions such as head lift. or even a fuel assembly being raised in the manipulator mast. Elevated radiation monitor indications to the low alarm setpoint will need to be combined with another indicator (or personnel report) of water loss (ref. 5. 6) A water level decrease will be primarily determined by indications from available level instrumentation. Other sources of level indications may include reports from plant personnel (e.g., from a refueling crew) or video camera observations (if available). A significant drop in the water level may also cause an increase in the radiation levels of adjacent areas that can be detected by monitors in those locations. A drop in water level above irradiated fuel within the reactor vessel may be classified in accordance Recognition Category C during the Cold Shutdown and Refueling modes. Escalation of the emergency classification level would be via IC -AA'JRA2:

Background

SFP water level at 136 feet 7 inches elevation is the Technical Specification LCO limit (SR 3.7.15) that requires 23 ft. of water above irradiated fuel seated in the Spent Fuel Pool storage racks. A minimum depth of 23 feet of water over the irradiated fuel assemblies in the SFP and 23 feet of water over the reactor vessel flange in the refueling cavity is maintained to ensure sufficient iodine activity would be retained to limit offsite doses from the accident to < 25% of 10 CFR 100 limits and to ensure that the offsite dose consequences due to a postulated fuel handling accident are acceptable (ref. 1. 2. 3, 4). Loss of Spent Fuel Pool water inventory results from either a rupture of the pool or transfer canal liner. or failure of the spent fuel cooling system and the subsequent boil-off. Allowing SFP water level to decrease could result in spent fuel being uncovered. reducing spent fuel decay heat removal and creating an extremely hazardous radiation environment. The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 feet above the top of the reactor vessel flange. While a radiation monitor CRM-58. RM-59. RM-2 or temporarily installed monitors in the vicinity of the REFUELING PATHWAY) could detect an increase in dose due to a drop in the water level, it might not be a reliable indication. in and of itself. of whether or not there is adequate shielding from irradiated fuel (ref. 5, 6). When the spent fuel pool and reactor cavity are connected. there could exist the possibility of uncovering irradiated fuel. Therefore. this EAL is applicable for conditions in which irradiated fuel is being transferred to and from the reactor vessel and spent fuel pool. This IC addresses a decrease in water level above irradiated fuel sufficient to cause elevated radiation levels. This condition could be a precursor to a more serious event and is also indicative of a minor loss in the ability to control radiation levels within the plant. It is therefore a potential degradation in the level of safety of the plant.The effects of planned evolutions should be considered. For example, a refueling bridge area radiation monitor reading may increase due to planned evolutions such as lifting of the reactor vessel head or movement of a J [Document No.] Rev. [X] Page 57 of 303 J

ATTACHMENT 1 EAL Bases fuel assembly. Note that this E/\L is applicable only in cases 'Nhere the elevated reading is due to an unplanned loss of water level. DCPP Basis Reference(s):

1. Technical Specification 3.7.15, SFP Level

2. Technical Specification 3.9.7, Refueling Cavity Water Level

3. AR PK11-04 input 1064, Spent Fuel Pool Lvl/Temp

4. AR PK02-22 input 1185, Rx Vsl Refueling Lvl (red)

5. OP AP-22, Spent Fuel Pool Abnormalities

6. AR PK-11-10, FHB High Radiation

7. NEI 99-01 AU2 j [Document No.] Rev. [X] Page 58 of 303 j

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel. EAL: RA2.1 Unusual Event Uncovery of irradiated fuel in the REFUELING PATHWAY. Mode Applicability: All Definition(s): CONFINEMENT BOUNDARY - The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As applied to the DCPP ISFSI, the confinement boundary is defined to be the Multi-Purpose Canister (MPC). REFUELING PATHWAY-. The reactor refueling cavity, spent fuel pool and fuel transfer canal compris.e the refueling pathway. Basis: ERO Decision Making Information This .JG-EAL addresses events that have caused imminent or actual tlamage to an irradiated fuel assembly, or a significant lowering of water level within the spent fuel poolREFUELING PATHWAY (see De*l-eloperl\lotes). This .JG-EAL applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. Once sealed, damage to a loaded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance with ICE HU1 EU1 .1. While an area radiation monitor could detect an increase in a dose rate due to a lowering of water level in some portion of the REFUELING PATHWAY, the reading may not be a reliable indication of whether or not the fuel is actually uncovered. To the degree possible, readings should be considered in combination with other available indications of inventory loss. A drop in water level above irradiated fuel within the reactor vessel may be classified in accordance Recognition Category C during the Cold Shutdown and Refueling modes. Escalation of the emergency classification level would be via ICs AS1--RS1 or AS2 (see AS2 Dmieleper Notes).

Background

EAL #1 These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant. This EAL escalates from ~RU2.1 in that the loss of level, in the affected portion of the REFUELING PATHWAY, is of sufficient magnitude to have resulted in uncovery of irradiated I [Document No.] Rev. [X] Page 59 of 3031

ATTACHMENT 1 EAL Bases fuel. Indications of irradiated fuel uncovery may include direct or indirect visual observation (e.g., reports from personnel or camera images}, as well as significant changes in water and radiation levels, or other plant parameters. Computational aids may also be used (e.g., a boil-off curve). Classification of an event using this EAL should be based on the totality of available ind!cations, reports and observations. EAL#2 This EAL addresses a release of radioactive material caused by mechanical damage to irradiated fuel. Damaging events may include the dropping, bumping or binding of an assembly, or dropping a heavy load onto an assembly. A rise in readings on radiation monitors should be considered in conjunction with in plant reports or observations of a potential fuel damaging event (e.g., a fuel handling accident). EAL#3 Spent fuel pool water level at this value is within the lo'Ner end of the level range necessary to prevent significant dose consequences from direct gamma radiation to personnel performing operations in the vicinity of the spent fuel pool. This condition reflects a significant loss of spent fuel pool water inventory and thus it is also a precursor to a loss of the ability to adequately cool the irradiated fuel assembles stored in the pool. DCPP Basis Reference(s):

1. OP AP-21, Irradiated Fuel Damage

2. OP AP-22, Spent Fuel Pool Abnormalities

3. NEI 99-01 AA2 r

I[Document No.] Rev. [X] Page 60 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels i Rad Effluent Subcategory: 2 - Irradiated Fuel Event . Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel. EAL: RA2.2 Alert Damage to irradiated fuel resulting in a release of radioactivity. AND High alarm on any of the following radiation monitors:

• RM-59 New Fuel Storage Area
• RM-58 Spent Fuel Pool Area
• Any temporary installed monitor in vicinity of the REFUELING PATHWAY (when installed)
• RM-2 Containment Area (Mode 6 only)
• RM-44A/B Containment Ventilation Exhaust (Mode 6 only)

Mode Applicability: All Definition(s): CONFINEMENT BOUNDARY - The barrier(s) between spent fuel and the environment once

.the spent fuel is processed for dry storage. As applied to the DCPP ISFSI, the confinement boundary is defined to be the Multi-Purpose Canister (MPC).

Basis: ERO Decision Making Information This EAL addresses a release of radioactive material caused by mechanical damage to irradiated fuel. Damaging events may include the dropping, bumping or binding of an assembly, or dropping a heavy load onto an assembly. A rise in readings on radiation monitors should be considered in conjunction with in-plant reports or observations of a potential fuel damaging event (e.g., a fuel handling accident). This ~EAL applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. One~ sealed, damage to a lo?ded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance with ~EAL E-MU1 ..L Escalation of the emergency would be based on either Recognition Category A-B_or C ICs.

Background

The specified radiatfon monitors are those expected to see increase area radiation levels as a result of damage to irradiated fuel (ref. 1. 2). I [Document No.] Rev. [X] Page 61 of 3031

ATTACHMENT 1 EAL Bases The bases for the SFP area radiation high alarms and containment area and ventilation radiation high alarms are a spent fuel handling accident and are. therefore. appropriate for this EAL. In the fuel handling building, a -fuel assembly could be dropped in the fuel transfer canal or in the SFP. Should a fuel assembly be dropped in the fuel transfer canal or in the spent fuel pool and release radioactivity above a prescribed level. the area radiation monitors sound an alarm. alerting personnel to the problem. Area radiation monitors in the fuel handling building isolate the normal fuel handling building ventilation system and automatically initiate the recirculation and filtration systems. (ref. 1, 2, 3). This .J.G-EAL addresses events that have caused IMMINENT or actual damage to an irradiated. fuel assembly, or a significant lowering of v1ater level .vithin the spent fuel pool (see De'l-eloper 1 Notes).

---These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant.EAL #This EAL escalates from AU2 in that the loss of level, in the affected portion of the REFUELING Pl\THVVAY, is of sufficient magnitude to have resulted in uncovery of irradiated fuel. Indications of irradiated fuel uncovery may include direct or indirect visual observation (e.g., reports from personnel or camera images), as well as significant changes in ',uater _and radiation levels, or other plant parameters. Computational aids may also be us.ed (e.g., a _boil off curve). Classification of an event using this EAL should be based on the totdlity of available indications, reports and observations.

VV-hile an area radiation monitor could detect an increase in a dose rate due to a lowering of water level in some portion of the REFUELING PATHVVAY, the reading may not be a reliable indication of whether or not the fuel is actually uncovered. To the degree possible, readings should be considered in combination with other available indications of inventory loss. A drop in *.vater level above irradiated fuel within the reactor vessel may be classified in accordance Recognition Category C during the Cold Shutdovm and Refueling modes. EAL #3Spent fuel pool i,uater level at this value is .vithin the lov.i<er end of the level range 1 necessary to prevent significant dose consequences from direct gamma radiation to personnel performing operations in the vicinity of the spent fuel poo-1. This condition reflects a significant loss of spent fuel pool water inventory and thus it is also a precursor to a loss of the ability to adequately cool the irradiated fuel assembles stored in the pool. Escalation of the emergency classification level would be via ICs AS1 or AS2 (see AS2 De "e 1 t 1e.t::ie 1 , . ,...1"'etes) 1vti.

• DCPP Basis Reference(s):

1. OP AP-21, Irradiated Fuel Damage

2. OP AP-22, Spent Fuel Pool Abnormalities

3. l&C RMS Data Book

4. NEI 99-01 AA2 I [Document No.] Rev. [X] Page 62 of 3031

ATTACHMENT 1 EAL Bases Category: R*- Abnormal Rad Levels I Rad Effluent Subcategory: 2 - lrrad.iated Fuel Event

• Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel.

EAL: RA2.3 Alert Lowering of spent fuel pool level to 10 ft. above top of the fuel racks (Level 2).' Mode Applicability: All Definition(s): None Basis: ERO Decision Making Information This -IG-EAL addresses events that have caused imminent or actual damage to an irradiated fuel assembly,. or a significant lowering of water level within the spent fuel pool (see Developer ( l\lotes). For DCPP Plant SFP Level 2 is 10 ft. (plant El. 123' 11") as indicated on Ll-801. Backup indication is also available on Ll-802. The PPC point for SFP level is L0690A for both units. Main Annunciator window PK11-04 will alarm at SFP Level 2 (ref. 3). Escalation of the emergency classification level would be via one or more EALs under ICs As:t-RS1 or or A82RS2 (see AS2 De*1-eloper f\lotes) . .

Background

 --These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant.This IC applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. Once sealed, damage to a loaded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance *11ith ICE HU1.

Escalation of the emergency *11ould be based on either Recognition Category A or C EAL #This EAL escalates from AU2 in that the loss of level, in the affected portion of the REFUELING PATHVVJ\Y, is of sufficient magnitude to have resulted in uncover)' ofirradiated* fuel. Indications of irradiated fuel uncover)' may include ~irect or indirect visual observation (e.g., reports from pe.rsonnel or camera images), as *11ell a~ significant changes in water and radiation levels, or other plant parameters. Computational aids may also be used (e.g., a boil off curve). Classification of an event using this EAL should be based on the totality ofavailable indications, reports and observations.

• VVhile an area radiation monitor could detect an increase in a dose rate due to a I[Docu~ent No.] Rev. [X] Page 63 of 3031

ATTACHMENT 1 EAL Bases lowering of *.vater level in some portion of the REFUELING PATHVVAY, the reading may not be a reliable indication of whether or not the fuel is actually uncovered. To the degree possible, readings should be considered in combination 1.vith other available indications of inventory loss.

         /\ drop in *.vater level above irradiated fuel within the reactor vessel may be classified in accordance Recognition Category C during the Cold Shutdown and Refueling modes.

This EAL addresses a release of radioactive material caused by mechanical damage to irradiated fuel. Damaging events may include the dropping, bumping or binding of an assembly, or dropping a heavy load onto an assembly. /\ rise in readings on radiation monitors should be considered in conjunction \Mith in plant reports or observations of a potential fuel damaging event (e.g., a fuel handling accident). E/\L #3Spent fuel pool water level at this value is within the lower end of the level range necessary to prevent significant dose consequences from direct gamma radiation to personnel performing operations in the vicinity of the spent fuel pool. This condition reflects a significant loss of spent fuel pool water inventory and thus it is also a precursor to a loss of the ability to adequately cool the irradiated fuel assembles stored in the pool. Post-Fukushima order EA-12-051 (ref. 1) required the installation of reliable SFP level indication capable of identifying normal minimum level (Level 1 - 134' 5"), SFP level 10 ft. above the top of the fuel racks (Level 2 - 123' 11 ") and SFP level at the top of the fuel racks (Level 3 - 114' 11"). DCPP Basis Reference(s):

1. NRC EA-12-51 Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation

2. PG&E Letter DCL-13-073 Response to Request for Additional Information Regarding Overall Integrated Plan in Response to March 12, 2012, Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)

3.

• Procedure AR PK11-04

4. SAP documents 50808058 & 68039896 (Unit 1)

5. SAP documents 50808059 & 68039897 (Unit 2)

6. NEI 99-01 AA2 I [Document No.] Rev. [X] Page 64 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Spent fuel pool level at the top of the fuel racks. EAL: RS2.1 Site Area Emergency Lowering of spent fuel pool level to 1 ft. above top of the fuel racks (Level 3). Mode Applicability: All Definition(s): IMMINENT - The .trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corr~ctive actions. Basis: ERO Decision Making Information This .JG-EAL addresses a significant loss of spent fuel pool inventory control and makeup capability leading to IMMINENT fuel damage. For DCPP Plant SFP Level 3 is 1 ft. (plant El. 114' 11 ") as indicated on Ll-801 (includes 1 ft. instrument uncertainly). Backup indication is also available on Ll-802. The PPG point for SFP level is L0690A for both units. Escalation of the emergency classification level would be via one or more EALs under IC AG-* RG1 or~RG2.

Background

This condition entails major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. It is recognized that this -lG--EAL would likely not be met until well after another Site Area Emergency -lG--EAL was met; however, it is included to provide classification diversity. Post-Fukushima order EA-12-051 (ref. 1) required the installation of reliable SFP level indication capable of identifying normal minimum level (Level 1 - 134' 5"), SFP level 10 ft. above the top of the fuel racks (Level 2 - 123' 11 ") and SFP level at the top of the fuel racks (Level 3 - 114' 11").

• DCPP Basis Reference(s):

1. NRG EA-12-51 Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation

2. PG&E Letter DCL-13-073 Response to Request for Additional Information Regarding Overall Integrated Plan in Response to March 12, 2012, Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)

/ [Document No.] Rev. [X] Page 65 of 303 /

ATIACHMENT 1 EAL Bases

3. NEI 99-01 AS2 I [Document No.] Rev. [X] Page 66 of 3031

ATTACHMENT 1

• EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Spent fuel pool level cannot be restored to at least the top of the fuel racks for 60 minutes or longer.
• EAL:

RG2.1 General Emergency Spent fuel pool level cannot be restored to at least 1 ft. above top of the fuel racks (Level 3) for.~ 60 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: All Definition(s): None Basis: ERO Decision Making lnformatiori This .i.G--EAL addresses a significant loss of spent fuel pool inventory control and makeup capability leading to a prolonged uncovery of spent fuel. This condition will lead to fuel damage and a radiological release to the environment. For DCPP Plant SFP Level 3 is 1 ft. (plant El. 114' 11") as indicated on Ll-801 (includes 1 ft. instrument uncertainly). Backup indication is also available on Ll-802. The PPC point for SFP level is L0690A for both units. It is recognized that this .i.G-EAL would likely not be met until well after another General Emergency .i.G-EAL was met; however, it is included to provide classification diversity.

Background

Post-Fukushima order EA-12-051 (ref. 1) required the installation of reliable SFP level

. indication capable of identifying normal minimum level (Level 1 - 134' 5"), SFP level 10 ft.

above the top of the fuel racks (Level 2 - 123' 11 ") and SFP level -at the top of the fuel racks (Level 3 - 114' 11 "). DCPP Basis Reference(s):

1. NRC EA-12-51 Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation

2. PG&E Letter DCL-13-073 Response to Request for Additional Information Regarding Overall Integrated Plan in Response to March 12, 2012, Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)

3. NEI 99-01 AG2 I [Document No.] Rev. [X]

• Page 67 of 3031

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 3 - Area Radiation Levels Initiating Condition: Radiation levels that IMPEDE access to equipment necessary for normal plant operations, cooldown or shutdown EAL: RA3.1 Alert Dose rates > 15 mR/hr in EITHER of the following areas: Control Room (O-RM-1 or portable gamma radiation instrument) OR Central Alarm Station (by survey) Mode Applicability: All Definition(s): IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). Basis: ERO Decision Making Information Areas that meet this threshold include the Control Room and the Central Alarm Station (CAS). O-RM-1 monitors the Control Room for area radiation (ref. 1). A portable gamma radiation instrument may be installed if O-RM-1 is out of service. The CAS is included in this EAL because of its' importance to permitting access to areas required to assure safe plant operations. There is no permanently installed CAS area radiation monitor that may be used to assess this EAL threshold. Therefore this threshold must be assessed via local radiation surv.ey for the CAS (ref. 1). For this EAL the Secondary Alarm Station (SAS) is not considered. Escalation of the emergency classification level would be via Recognition Category AR, C or F ICs.

Background

This IC addresses elevated radiation levels in certain plant rooms/areas sufficient to preclude or IMPEDE personnel from performing actions necessary to maintain normal plant operation, or to perform a normal plant cooldown and shutdown. As such, it represents an actual or potential substantial degradation of the level of safety of the plant. The Emergency DirectorSM/SEC/ED should consider the cause of the increased radiation levels and determine if another IC may be applicable.For EAL #2, an Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during.the plant operating mode in I [Document No.] Rev. [X] Page 68 of 3031

ATTACHMENT 1 EAL Bases e:ffct at the time of the elevated radiation levels. The emergency classification is not contingent upon v1hether entry is actually necessary at the time of the increased radiation levels. Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the a:ffcted room/area (e.g., installing temporary shielding, requiring use of non routine protective equipment, requesting an extension in dose limits beyond normal administrative limits). An emergency declaration is not warranted if any of the following conditions apply.

• The plant is in an operating mode di:ffrent than the mode specified for the a:ffcted room/area (i.e., entry is not required during the operating mode in e:ffct at the time of the elevated _radiation levels). For example, the plant is in Mode 1 *.vhen the radiation increase occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the a:ffcted room until Mode 4.
• The increased radiation levels are a result of a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., radiography, spent filter or resin transfer, etc.).
• The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections). *
• The access control measures are of a conservative or precautionary nature, and would not actually prevent or impede a required action.

DCPP Basis Reference(s):

1. FSAR Table 11.4-1 Radiation Monitors and Readouts

2. NEI 99-01 AA3

                            )

I[Document No. ] Rev. [X] Page 69 of 303 L.

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 3 - Area Radiation Levels Initiating Condition: Radiation levels that IMPEDE access to equipment necessary for normal plant operations, cooldown or shutdown. EAL: RA3.2 Alert An UNPLANNED event results in raaiation levels that prohibit or IMPEDE access to any Table R-2 rooms or areas. (Note 5) Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted. Table R-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode(s) Auxiliary Building - 115' - BASTs 2, 3,4 Auxiliary Building - 100' - BA Pumps 2, 3,4 Auxiliary Building - 85' - Aux Control Board 2,3,4 Auxiliary Building - 64' - BART Tank area 2,3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 Mode Applicability: 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution .or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information The identified rooms are those where ah activity must be performed to borate to cold shutdown, isolate accumulators or cooldown using RHR. If the equipment in the listed room or area was already inoperable, or out-of-service. before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event. Rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, I [Document No.] Rev. [X] Page 70 of 3031

ATTACHMENT 1 EAL Bases corrective measures or emergency operations) are not included. In addition. the list specifies the plant mode(s) during which entrv would be required for each room or area (ref.. 1). For EAL #2RA3.2, an Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the elevated radiation levels. The emergency classification is not contingent upon whether entry is actually necessary at the time of the increased radiation levels. Access should be considered as IMPEDED if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., installing temporary shielding, requiring use of non-routine protective equipment, requesting an extension in dose limits beyond normal administrative limits). An emergency declaration is not warranted if any. of the following conditions apply:

    * *The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the elevated radiation levels). For example, the plant is in Mode 1 when the radiation increase occurs, and the procedures used for normal operation, cooldown and shutdown do riot require entry into the affected room until Mode 4.

• The increased radiation levels are a result of a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., radiography, spent filter or resin transfer, etc.).
• The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal* rounds or routine inspections).
• The access control measures are of a conservative or precautionary nature, and would not actually prevent or IMPEDE a required action.

Escalation of the emergency classification level would be via Recognition Category AR, C or F ICs. -

Background

The list of plant rooms or areas with entrv-related mode applicability identified specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation. cooldown and shutdown. This IC addresses~elevated radiation levels in certain plant rooms/areas sufficient to preclude or IMPEDE personnel from performing actions necessary to maintain normal plant operation, or to perform a normal plant cooldown and shutdown. As such, it represents an actual or potential substantial degradation of the level of safety of the plant. The SM/SEC/EDEmergency Director should consider the cause of the increased radiation levels and determine if another IC may be applicable. NOTE: EAL RA3.2 mode applicability has been limited to the applicable modes identified in , Table R-2 Safe Operation & Shutdown Rooms/Areas. If due to plant operating procedure or plant configuration changes, the applicable plant modes specified in Table R-2 are changed, a corresponding change to Attachment 3 'Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases' and to EAL RA.3.2 mode applicability is required." DCCP Basis Reference(s):

1. Attachment 3 Safe Operation & Shutdown Roon;is/Areas Table R-2 & H-2 Bases I[Document No.] Rev. [X] Page 71 of 3031

ATTACHMENT 1 EAL Bases

2. NEI 99-01 AA3 j [Document No.] Rev. [X] Page 72 of 303 j

ATTACHMENT 1 EAL Bases Category E - Independent Spent Fuel Storage Installation (ISFSI) EAL Group: Any (EALs* in this pategory are applicable to any plant condition, hot or cold.) An independent spent fuel storage installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials

*associated with spent fuel storage. A significant amount of the radioactive material contained within a canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from* an accident involving the dry storage of spent nuclear fuel.

• An Unusual Event is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask confinement boundary is damaged or violated.

The DCPP ISFSI is located within the OWNER CONTROLLED AREA but outside the PLANT PROTECTED AREA. Therefore SECURITY EVENTS related to the ISFSI are classified under either HU1.1 or HA1.1.

    /SFSI PROTECTED AREA -Areas within the ISFSI to which access is strictly controlled. in accordance with the station's Security Plan.

OWNER CONTROLLED AREA {OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. I [Document No.] Rev. [X] Page 73 of 3031

ATTACHMENT 1 EAL Bases Category: ISFSI Subcategory: Confinement Boundary Initiating Condition: Damage to* a loaded cask CONFINEMENT BOUNDARY. EAL: ' EU1.1 Unusual Event Damage to a loaded cask CONFINEMENT BOUNDARY as indicated by an on-contact radiation reading >Table E-1.

                                                                                                            .'.a.IIK
                                                                                                               !.1118Jl Table E-1 ISFSI Radiation Readings
                                                                                           /                4 Dose Point Location           Surface Dose Rate (see figure)                               3 t

• I ** ** ** B (mRem/hour) . *. *. \Iii!\\\\\\\\ ~

                                                             ..**.. **,.* :' .\~~\\\\\\\~\\\\f\\I .\\ "                                     * *., ** ..**..

1 Base vent 72  :. ,-.;*:-./;; £,A!' w~:r '!'TIT . *:* :. :*: ..*:

.-..-*** **;.;:: / I I ~ I I I I [ I :~* :::*=::~*::

I i I~ i I i I I 1' !.** .. ...*.. ... ~ Mid plane 80 ' . : * * : : " . : * ** I

.:::::::**::: t I i ~ i . I i :.**.. ...........

11 . . . . . . . . 2 3 Top vent 76 *::::::::::::" I j ~ i I i ' *::*::;::::". c

                                                             ..:::::::.::;-                 11 ~ i I i                                      ':*.:*.:~[...--!IP 4     Lid-center                    22                   **:::::::*:: *1
                                                               ........... I
                                                                                                 '1       r' r I     1' t
                                                                                                                                           -?.-:"." ... ;
                                                          *:... :~.: . ::-* . ::

• I '1 "' '1. '1 '1~!

                                                                                                                                               ~

4a Lid-over top vents 139

                                                          . , . : : , . : : ..: ; ,          '1 1'    V          1' 1'               . I
                                                                                                                                                                      -~**
                                                          .~.::::::*.;::,.                 1    i~ Il                                       *;\::;:*::                       .

Mode Applicability: 2 '":::::::*::. i r 1 , i ** *...... All

                                                          *::.:::-::~.:'

iI ii I l ..::*:::::::..

                                                                                                                                            !.**... ** ** **t
                                                          ...... :: ..... ::....:;r         '1 1'                1' 1*           1-         =*"**

Definition(s): ...........: l .

                                                          ***:::::;*;.:'.;*                J'   !'
                                                                                                                .i .! ,I I: .               :::.:;:::::

CONFINEMENT BOUNDARY-. The barrier(s) *::_:~;~:-~~:.::_.:* .!! II j ., ::=.:::::::.. WTER between spent fuel and the environment once

                                                                .'*"; ...*,;-.. !I !I II
                                                          **'..:**-...-::*                                      ! ! ! ! ~ ;:::::::::::: --SHELL I I I I I *:.**........

the spent fuel is processed for dry storage. As  :: * : : **** :.: I *~ I I I * ' i:::*.:::::::. . I, *' ' I I I' *:........ .*...*:***** I t

                                                           ***_:: **.* ::_,_.:;;*       .i I I, ~

applied to the DCPP ISFSI, the confinement  ::.:.. ::..::~* I r I I i I I I ' *:.****.... *~. boundary is defined to be the Multi-Purpose .... *-. . *::=:. '! '1 'I I '1 '1 i 'I .:::::**.:' *::*

.-.::~, ' i' ' j l ; l' ' l ' ** ** '* *

                                                           . .:::::::.*=:~: J_ ~                                                         . ~:**::~ **.:**:

I Canister (MPG). A  !

                                                            * ............. * ..  ~                                       '                  * : .. **............. t PLANT PROTECTED AREA - Areas to which                1~---1                           *;:~:~~=:~::~~*~lf.t~~:~2;~~~L~?~l *;:~:~:~:::~::

access is strictly controlled in accordance with the station's Security Plan. aAstPLAlE Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. I [Document No.] Rev. [X] Page 74 of 3031

I - ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information An Unusual Event is declared on the basis of the occurrence of any event of sufficient magnitude that a loaded cask confinement boundary is damaged or violated as indicated by external on-contact dose rates exceeding the maximum calculated levels of an overpack with a loaded MPC-32 canister. based on the locations in the ISFSI FSAR Figure 7.3-1 (ref. 1. 2. 3). This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a storage cask containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the load~d storage cask is sealed. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask. The existence of "damage" is determined by radiological survey. Exceedance of the maximum ISFSI FSAR dose rates. as noted 'in reference 1,The technical *specification multiple of "2 times", which is also used in Recognition Category l\ IC l\U1, is used here to distinguish between non-emergency and emergency conditions. The emphasis for this classification is the degradation in the level of safety of the* spent fuel cask and not the magnitude of the associated dose or dose rate. The DCPP ISFSI is located wholly outside the PLANT PROTECTED AREA. Security-related events for ISFSls are covered under ICs HU1 and HA1. ,

Background

The DCPP ISFSI Technical Specifications do not have maximum contact dose rate specified for the exterior of an overpack. The values in Table E-1 are derived from ISFSI FSAR Tables (ref 1. 2). Since the UFSAR Table 7.3-1A are the maximum calculated dose rate values. and are not expected to ever be exceeded. a conservative approach of exceeding the highest possible fuel value dose rates. plus 5 mRem/hour. was used as an indication of damage to an

     'overpack. Note: These values are approximately 2 times the maximum expected dose rate for low burn-up fuel (ref 2).

The ISFSI includes the dry-cask storage system. the cask transfer facility, onsite transporter. and the storage pads. The dry-cask storage *system is the HI-STORM 100 System. This is a canister-based storage system that stores spent nuclear fuel in a vertical orientation. It consists of three discrete components: the MPC. the HI-TRAC 125 Transfer Cask. and the HI-STORM 100 System Overpack (see pictures at end of section). The MPC provides the' confinement boundary for the stored fuel. The HI-TRAC 125 Transfer Cask provides radiation shielding and structural protection of the MPC during transfer operations. while the storage overpack provides radiation shielding and structural protection of the MPC during storage. The HI-STORM 100 System is passive and does not rely on any active cooling systems to remove spent fuel decay heat. After the storage casks are placed on the storage pad. the ISFSI Technical Specifications require that the casks be inspected periodically to ensure that the air vents are not blocked. Security personnel control access to the storage area and identify and assess off-normal and emergency events. Health physics personnel perform dose rate and contamination surveys to ensure that the appropriate regulatory limits are maintained. -

   ,I[Document No.]                   I            Rev. [X]                               Page 75 of 3031

ATIACHMENT 1 EAL Bases Maintenance personnel maintain the facilities including the storage casks, emergency equipment, and transport systems (ref. 4). The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors, and configuration changes which could cause challenges in removing the cask or fuel from storage. DCCP Basis Reference(s):

1. Diablo Canyon ISFSI FSAR Update, Chapter 7 Radiation Protection , Table 7.3-1A "Surface and 1 Meter Dose Rates for the Overpack with an MPC-32 69,000 MWD/MTU and 5-Year Cooling"

2. Diablo Canyon ISFSI FSAR Update, Chapter 7 Radiation Protection, Table 7.3-1 B "Surface and 1 Meter Dose Rates for the Overpack with an MPC-32 32 ,500 MWD/MTU and 5-Year Cooling"

3. Diablo Canyon ISFSI FSAR Update, Chapter 7, Figure 7.3-1 "Cross Section Elevation of the Generic Hi-Storm 1OOS Overpack with Dose Point Locations."

4. NRG Materials License No. SNM-2511 , LICENSE FOR INDEPENDENT STORAGE OF SPENT NUCLEAR FUEL AND HIGH-LEVEL RADIOACTIVE WASTE, Safety Evaluation Report

5. NEI 99-01 E-HU1 DCPP ISFSI HI-STORM 100 System HI-STORM Storage Casks (Overpack)

I [Document No.] Rev. [X] Page 76 of 3031

ATTACHMENT 1 EAL Bases Category C - Cold Shutdown I Refueling System Malfunction EAL Group: Cold Conditions (RCS temperature s 200°F); EALs in this category are applicable only in one or *more cold operating modes. Category C EALs are directly associated with cold shutdown or refueling system safety functions. Given the variability of plant configurations (e.g., systems out-of-service for maintenance, containment open, reduced AC power redundancy, time since shutdown) during these periods, the consequences of any given initiating event can vary greatly. For example, a loss of decay heat removal capability that occurs at the end of an extended outage has less significance than a similar loss occurring during the first week after shutdown. Compounding these ev~nts is the likelihood that instrumentation necessary for assessment may also be inoperable. The cold shutdown and refueling system malfunction EALs are based on performance capability to the extent possible with consideration given to RCS integrity, containment closure, and fuel clad integrity for the applicable operating modes (5 - Cold Shutdown, 6 - Refueling, D - Defueled). The events of this category pertain to the following subcategories:

1. RCS Level RCS water level is directly related to the status of adequate core cooling and, therefore, fuel clad integrity.

2. Loss of Emergency AC Power ,-

Loss of emergency plant electrical power can ~ompromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of onsite and offsite power sources for 4.16KV AC emergency buses.

3. RCS Temperature Uncontrolled or inadvertent temperature or pressure increases are indicative of a potential lo~s of safety functions.

4. Loss of Vital DC Power Loss of emergency plant electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling sys1tems which may be necessary to ensure fission product barrier integrity. This category includes loss of power to or degraded voltage on the 125V DC vital buses.

5. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.

6. Hazardous Event Affecting Safety Systems /

Certain hazardous natural and technological events may result in VISIBLE DAMAGE to or DEGRADED PERFORMANCE of SAFETY SYSTEMS warranting classification. j [Document No.] Rev. [X] Page 77 of 303 j

ATTACHMENT 1 EAL Bases DEGRADED PERFORMANCE - As applied to hazardous event thresholds, damage significant enough to cause concern regarding the operability or reliability of the affected safety system train. SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in t~e cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in. potential offsite exposures. VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. I [Document No.] Rev. [X] Page 78 of 3031 _ _ _ _ _j

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunctio.n Subcategory: 1 - RCS Level Initiating Condition: UNPLANNED loss of RCS inventory. EAL: CU1.1 Unusual Event UNPLANNED loss of RCS inventory results in RCS water level less than a procedurally designated lower limit for~ 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): REDUCED INVENTORY CONDITION (RIC) - The condition existing whenever RCS water level is lower than 3 feet below the reactor vessel flange (below 111-foot elevation) with fuel in the core.

• UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter chan*ge or event may be known or unknown.-

Basis: ERO Decision Making Information Refueling evolutions that d~crease RCS water inventory are carefully planned and controlled. An UNPLANNED event that results in water level decreasing below a procedurally required limit warrants the declaration of an Unusual Event due to the reduced water inventory that is available to keep the core covered. The 15-minute threshold duration allows sufficient time for prompt operator actions to restore and maintain the expected water level. This criterion excludes transient conditions causing a brief lowering of water level. Continued loss of RCS inventory may result in escalation to the Alert emergency classification level via either IC CA1 or CA3.

Background

With the plant in Cold Shutdown. RCS water level is normally maintained above 25% Cold Calibration Pressurizer level (-129 ft. elevation). However. if RCS level is being controlled below 25%, or if level is being maintained in a procedurally designated band in the reactor vessel it is the inability to maintain level above the low end of the designated control band due to a loss of inventory resulting from a leak in the RCS that is the concern (ref. 2). With the plant in Refueling mode. RCS water level is normally maintained at or above the reactor vessel flange (Technical Specifications requires at least 23 ft. of water above the top of the reactor vessel flange in the refueling cavity during refueling operations) (ref. 1). However, I [Document No.] Rev. [X] Page 79 of 3031

ATTACHMENT 1 EAL Bases RCS level may be maintained below the reactor vessel flange if in "lowered inventory" or "REDUCED INVENTORY" condition (ref. 2). This .f.G-EAL addresses the inability to restore and maintain water level to a required minimum level (or the lower limit of a procedurally specified level band), or a loss of the ability to monitor (reactor vessel/RCS [PINR] or RPV [Bl!'/R]) level concurrent with indications of coolant leakage. Either of these This conditions is considered to be a potential degradation of the level of safety of the plant. This EAL-#1- recognizes that the minimum required (reactor vessel/RCS [Pl!'/R] or RPV [Bl!'/R]) level can change several times during the course of a refueling outage as different plant configurations and system lineups are implemented. This EAL is met if the minimum level, specified for the current plant conditions, cannot be maintained for 15 minutes or longer. The minimum level is typically specified in the applicable operating procedure but may be specified in another controlling document. EAL #2 addresses a condition \Nhere all means to determine (reactor vessel/RCS [Pl!'/R] or RPV [Bl!'/R]) level have been lost. In this condition, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of \Nater flm.v to ensure they are indicative of leakage from the (reactor vessel/RCS [Pl!'/R] or RPV [Bl!'/R]). DCPP Basis Reference(s):

1. Technical Specification 3.9.7, Refueling Cavity Water Level

2. OP A-2: II, U1 Reactor Vessel - Draining tbe RCS to the Vessel Flange - With Fuel in Vessel

3. NEI 99-01 CU1 1

J [Document No.] Rev. [X] Page 80 of 303 J

ATTACHMENT 1 EAL Bases Categ~ry: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating C.o,ndition: UNPLANNED loss of RCS inventory. EAL: CU1.2 Unusual Event RCS water level cannot be monitored. AND EITHER

• UNPLANNED increase in any Table C-1 sump/tank level due to loss of RCS inventory.
• Visual observation of UNISOLABLE RCS LEAKAGE.

Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT
• RCDT
• CCW Surge Tank(s)
• Auxiliary Building Sump

                              *

• RWST
• RHR Room Sumps (alarm only)

                              *

• MEDT Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): INTACT (RCS) -The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operatiol) (e.g., no freeze seals or nozzle dams). RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor*coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment. atmosphere from sources that are both speqifically located and known either not to interfere with the operation of leakage detedion systems or not to be pressure. boundary leakage; I [Document No.] I Rev. [X] I Page 81 of 3031

ATTACHMENT 1 EAL Bases

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage)~

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

d. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

UN/SOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could nc;>t be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

                                                                              \.
                                                                                      ..J I

I [Document No.] Rev. [X] Page 82 of 3031

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information Refueling evolutions that decrease RCS water inventory are carefully planned and controlled. An UNPLANNED event that results in water level decreasing below a procedurally required limit warrants the declaration of an Unusual Event due to the reduced water inventory that is available to keep the core covered. The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e.g. camera) visual observation. This EAL-#2- addresses a condition where all means to determine (reactor vessel/RCS [PVVR] or RPV [BV\IR]) level have been lost. In this condition, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels (Table C-1). Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the (reactor vessel/RCS [P'A'R] or RPV [B""R]) vv . Continued loss of RCS inventory may result in escalation to the Alert emergency classification level via either IC CA 1 or CA3.

Background

In Cold Shutdown mode. the RCS will normally be INTACT and standard RCS level monitoring means are available. ' In this EAL, the ability to monitor RCS level is lost such that RCS inventory loss must be detected by indirect leakage indications. The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e. g. camera) visual observation. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS unexplainably rises above the pre-established rate to maintain RCS inventory, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. Visual observation of leakage from systems connected to the RCS that cannot be isolated could also be indicative of a loss of RCS inventory (ref. 1). This IC addresses the inability to restore and maintain water level to a required minimum level (or the lower limit of a level band), or a loss of the ability to monitor (reactor vessel/RCS [PVVR] or RPV [BVVR]) level concurrent with indications of coolant RCS LEAKAGE. Either of these conditions is considered to be a potential degradation of the level of safety of the plant. EAL #1 recognizes that the minimum required (reactor vessel/RCS [Pll'IR] or RPV [BV'IR]) level can change several times during the course of a refueling outage as different plant configurations and system lineups are implemented. This EAL is met if the minimum level, specified for the current plant conditions, cannot be maintained for 15 minutes or longer. The minimum level is typically specified in the applicable operating procedure but may be specified in another controlling document. The 15 minute threshold duration allows sufficient time for prompt operator actions to restore and maintain the expected water level. This criterion excludes transient conditions causing a brief lmvering of water level. DCPP Basis Reference(s):

1. OP AP SD-2, "Loss of RCS Inventory I [Document No.] I Rev. [X] Page 83 of 3031

ATTACHMENT 1 EAL Bases

2. NEI 99-01 CU1 I

I [Document No.] Rev. [X] Page 84 of 3031

ATIACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory. EAL: CA1.1 Alert Loss of RCS inventory as indicated by reactor vessel level < 107 ft. 6 in. (107.5 ft.) on RVRLIS, Ll-400 standpipe or ultrasonic sensor. OR

< 67.5% RVLIS full range (RVLIS equivalent to 107 ft. 6 in.).

Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): None Basis: ERO Decision Making Information When reactor vessel water level decreases to 107 ft. 6 in. el.. RCS level is -21 in. above the bottom of the RCS hot leg penetration. This is the minimum procedurally allowed RCS level to preclude vortexing of the RHR pumps while in Shutdown Cooling. This level can be monitored Qv.;.

• RVRLIS
• Ll-400 sta.ndpipe
• Ultrasonic sensor Although related, this EAL-#.:t- is concerned with the loss of RCS inventory and not the potential concurrent effects on systems needed for decay he~t removal (e.g., loss of a Residual Decay Heat Removal suction point). An increase in RCS temperature caused by a loss of decay heat removal capability is evaluated under IC CA3.

For this EAL-#.:t-, a lowering of RCS water level below the specified level (site specific level) ft. indicates that operator actions have not been successful in restoring and maintaining RCS (reactor vessel/RCS [PVVR] or RPV [BVVR]) water level. The heat-up rate of the coolant will increase as the available water inventory is reduced. A continuing decrease in water level will lead to core uncovery. *' If RCS the (reactor vessel/RCS [PVVR] or RPV [BVVR]) inventory water level continues to lower, then escalation to Site Area Emergency would be via IC CS1.

Background

The purpose of the Reactor Vessel Refueling Level Instrumentation System (RVRLIS) is to provide reactor vessel and refueling cavity level indication during refueling. when the vessel head will be removed. and during drainage to half loop. The system is designed to be used I[Document No.] I Rev. [X] I Page 85 of 3031

ATTACHMENT 1 EAL Bases only when the RCS is at near atmospheric pressure or when a vacuum is being established for refill operations. The wide range and narrow range RVRLIS (if required) and the Ll-400 standpipe systems remain in service from the time RCS level is lowered below 25% Cold Calibrated Pressurizer level until just prior to pressurizing the RCS. Narrow Range RVRLIS is

*required if reduced inventory conditions (below 111 ft. elevation) are planned.*

The Ll-400 standpipe is a magnetic level indicator (Ll-400A. B, C standpipe) and provides local indication of reactor vessel refueling level. The indicator is mounted on the outside of the secondary shield wall (crane wall) and can be viewed ftom the 91 ft. elevation of Containment. The indicator is composed of three mechanical flag indicator units. RVRLIS, Ll-400 standpipe and ultrasonic detectors are off-scale low (105 ft. 9 ih.) when reactor vessel water level drops below the elevation of the bottom of the RCS hot leg

. penetration. The ultrasonic sensor is installed during an outage and measures level on one of the hot legs.

The purpose of the Reactor Vessel Level Instrumentation System (RVLIS) is to measure the

• level of the water or the relative void content of the coolant in the reactor vessel. The RVUS setpoint corresponding to the minimum RHR pump operation limit was obtained as follows (ref.

2, 3, 4):

• Full range: \

o Per SC-1-878, span = 494.9 in. and 0% = 79.6536 feet o  % span/in. = 100 I 494.9 = 0.20206%/in. and minimum RCS level for RHR operation (from above)= 107.5 feet 0 (107.5 - 79.6536) x 12 x 0.20206 = 67.5% Thi.s IC addresses conditions that are precursors to a loss of the ability to adequately cool irradiated fuel (i.e., a precursor to a challenge to the fuel clad barrier). This condition represents a potential substantial redu'ction in the level of plant safety. For EAL #2, the inability to monitor (reactor vessel/RCS [P'NR] or RPV [BVVR]) level

• may be caused by* instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If 'Nater level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels.

Sump and/or tank level changes must be evaluated against other potential sources of 'Nater flm\' to ensure they are indicative of .leakage from the (reactor*vessel/RCS [PVVR] or RPV [B'MR])

• tr
• I The 15 minute duration for the loss of level indication was chosen because it is half of the EAL duration specified in IC CS1 DCPP Basis Reference(s):

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel - Draining to Half Loop/Half Loop Operations with Fuel in Vessel Drain-Down

3. Instrument Scaling Calculation SC-1-878, Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

4. OP AP SD-0 Loss of, or Inadequate Decay Heat Removal I[Document No.] Rev. [X] *. Page 86 of 3031

ATIACHMENT 1 EAL Bases

5. NEI 99-01 CA 1 I [Document No.] Rev. [X] Page 87 of 3031 L __ ------- -

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory. EAL: CA1.2 Alert RCS water level cannot be monitored for~ 15 minutes. (Note 1) AND EITHER

• UNPLANNED increase in any Table C-1 Sump I Tank level due to _loss of RCS inventory. *
• Visual observation of UNISOLABLE RCS LEAKAGE.

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT ./
• RCDT
• CCW Surge Tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT Mode Applicability:

5 - Cold Shutdown, 6 :-- Refueling Definition(s): INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the.cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). RCS LEAKAGE - RCS leakage shall be:

a. *Identified Leakage*

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank; I [Document No.] *Rev. [X] Page 88 of 3031

ATIACHMENT 1 EAL Bases

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

e. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information In this EAL, the ability to monitor RCS level would be unavailable for gre-ater than 15 minutes, and the RCS inventory loss must be detected by indirect leakage indications (Table C-1). The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e.g. camera) visual observation. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS unexplainably rises above the pre-established rate, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. Visual observation of leakage from systems connected to the RCS that cannot be isolated could also be indicative of a loss of RCS inventory (ref. 1, 2). If the (reactor vessel/RCS [PVVR] or RPV [BVVR]) inventory level continues to lower, then escalation to Site Area Emergency would be via IC CS1.

Background

For this EAL-#2, the inability to monitor_RCS (reactor vessel/RCS [PVVR] or RPV [BVVR]) level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored by direct or indirect I [Document No.] Rev. [X] Page 89 of 3031

ATTACHMENT 1 EAL Bases methods, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the (reactor vessel/RCS [PVVR] or RPV [BVVR]). In Cold Shutdown mode. the RCS will normally be INTACT and standard RCS level monitoring means are available. In the Refuel mode, the RCS is not INTACT and RPV level may be monitored by different means. including the ability to monitor level visually. This IC addresses conditions that are precursors to a loss of the ability to adequately cool irradiated fuel (i.e., a precursor to a challenge to the fuel clad barrier). This condition represents a potential substantial reduction in the level of plant safety. For E/\L #1, a lm.vering of v1ater level belmv (site specific level) indicates that operator actions have not been successful in restoring and maintaining (reactor vessel/RCS [Pv'IR] or RPV [BV'IR]) \Nater level. The heat up rate of the coolant will increase as the available water inventory* is reduced. /\continuing decrease in 'Nater level will lead to core uncovery. Although related, EAL #1 is concerned with the loss of RCS inventory and not the potential concurrent effe.cts on systems needed for decay heat removal (e.g., loss of a Residual Heat Removal suction point). An increase in RCS temperature caused by a loss of decay heat removal capability is evaluated under IC C/\3. The 15-minute duration for the loss of level indication was chosen because it is half of the EAL duration specified in IC CS1.:. DCPP Basis Reference(s):

1. OP AP SD-2, Loss of RCS Inventory

2. OP AP-1, Excessive Reactor Coolant System Leakage

3. NEI 99-01 CA 1 I [Document No.] Rev. [X] Page 90 of 303 j

ATIACHMENT 1

                                                  *EAL Bases Category:                  C - Cold Shutdown I Refueling System Malfunction Subcategory:               1 - RCS Level Initiating Condition:      Loss of RCS inventory affecting core decay heat removal capability.

EAL: CS1 .1 Site Area Emergency With CONTAINMENT CLOSURE not established, RVLIS full range< 62.1%. (Note 12) Note 12: With RVLIS out-of-service, classification shall be based on CS1 .3 or CG1 .2 .if RCS inventory cannot be monitored. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. Ba.sis: ERO Decision Making Information This EAL is only applicable when RVLIS is in service (see Note 12). When reactor vessel water level lowers to 62.1 %. water level is six inches below the elevafion of the bottom of the RCS hot leg penetration. Six inches below the elevation of the bottom of the RCS hot leg penetration can be monitored only by RVLIS. Other reactor vessel water level monitoring systems (e.g., RVRLIS, Ll-400 standpipe, ultrasonic sensor. RVLIS upper range) are downscale-low when water level drops below the elevation of the bottom of the RCS hot leg penetration. Escalation of the emergency classification level would be via IC CG1 or AG4RG1.

Background

When reactor vessel water level drops significantly below the elevation of the bottom of the RCS hot leg penetration. all sources of RCS injection have failed or are incapable of making up for the inventory loss. The RVLIS setpoint corresponding to six inches below the elevation of the bottom of the RCS hot leg penetration was obtained as follows (ref. 1. 2. 3. 4):

• Per SC-l-87B. span = 494.9 in. and 0% = 79.6536 feet

/ [Document No.] I Rev. [X] Page 91 of 303 /

ATTACHMENT 1 EAL Bases

        *   % span/in. = 100 I 494.9 = 0.20206%/in. and bottom bf the hot leg (from above) =

105.75 feet *

        *   (t05.75 79.6536) x 12 x 0.20206 = 62.1%

Under the conditions specified by this EAL, continued lowerihg of reactor vessel water level is indicative of a loss of inventory control. Inventory loss may be due to a vessel. breach. RCS pressure boundary leakage or continued boiling in the .reactor vessel. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further RCS or reactor vessel water level drop and potential core uncoverv. The inability to restore and maintain level after reaching this setpoint infers a failure of the RCS barrier and potential loss of the Fuel Clad barrier. ' The status of Containment closure is tracked if plant. c0nditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref. 5). This IC addresses a significant and prolonged loss of (reactor vessel/RCS_[PVVR] or RPV [BVVR]) inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant. These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. Following an eXtended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant bo.iling and a further reduction in reactor vessel level. If RCS/reactor , ves~el_RCS level cannot be restored, fuel damage is probable. 1. Outage/shutdown contingency plans typically provide for re-establishing or verifying CONTAINMENT CLOSURE following a loss of heat removal or RCS inventory control functions. The difference in the specified RCS/reactor vessel levels of EALs .:hbCS1 .1 and

    ~CS2.2 reflect the fact that with CONTAINMENT CLOSURE establi$hed, there is a lower probability of a fission product release to the environment.

In EAL 3.a, the 30 minute criterion is tied to a readily recognizable event start time (i.e., the

• total loss of ability to monitor fevel), and allmvs sufficient time to monitor, assess 'and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring.

The inability to monitor_RCS (reactor vessel/RCS [PVVR] or RPV [BVVR]) level may be caused

   .by instrumentation and/.or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against' other potential sources of *.vater flow to ensure they are indicative of leakage from the_RCS (reactor vessel/RCS [P'NR] or RPV [B\l'!R]).

• These This EALs addresses concerns raised by Generic Letter ss..:17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear* Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to* Assess Shutdown Management.

DCPP Basis Reference(s): I[Document No.] Rev. [X] Page 92 of 3031

                                     , ATTACHM,ENT 1 EAL Bases

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel - Oraining to Half Loop/Half Loop Operations with Fuel in Vessel

3. AP E-55, Equipment Elevations for RCS Flood-Up and Drain-Down

4. Instrument scaling calculation SC-1-878, "Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

5. AD8.DC54, Containment Closure

6. NEI 99-01 CS1

                    \

I[Document No.] Rev. [X] Pa~e 93 of 3031

I ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability. EAL: CS1 .2 Site Area Emergency With CONTAINMENT CLOSURE established, RVLIS full range< 56.6% (Top of Fuel). (Note 12) Note 12: With RVLIS out-of-service, classification shall be based on CS1 .3 or CG1 .2 if RCS inventory cannot be monitored. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. Bases: ERO Decision Making Information This EAL is only applicable when RVLIS is in service (see Note 12). When reactor vessel water level drops below RVLIS full range indication of 56.6% core uncovery is about to occur. This level drop can only be remotely monitored by reactor vessel Level Instrumentation System (RVLIS). Other reactor vessel water level monitoring systems (e.g., RVRLIS. Ll-400 standpipe, ultrasonic *sensor. RVLIS upper range) are downscale-low when water level drops below the elevation of the bottom of the RCS hot leg penetration:* Escalation of the emergency classification level would be via IC CG1 or AG:l-RG1.

Background

The RVLIS setpoint corresponding to the top of fuel was obtained as follows (ref. 1. 2. 3. 4):

• Per SC-l-87B. span= 494.9 in. and 0% = 79.6536 feet

     *   % span/in. = 100 I 494.9 = 0.20206%/in. and top of core = 103 feet
     *   (103 - 79.6536) x 12 x 0.20206 = 56.6%

Under the conditions specified by this EAL. continued lowering of reactor vessel water level is indicative of a loss of inventory control. Inventory loss may be due to a vessel breach. RCS pressure boundary leakage or continued boiling in the reactor vessel. The magnitude of this I [Document No.] Rev. [X] Page 94 of 3031

ATTACHMENT 1 EAL Bases loss of water indicates that makeup systems have not been effective and may not be capable of preventing further RCS or reactor vessel water level drop and potential core uncoverv. The inability to restore and maintain level after reaching this setpoint infers a failure of the RCS barrier and Potential Loss of the Fuel Clad barrier. The status of Containment closure is tracked if Plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref. 5). This IC addresses a significant and prolonged loss of (reactor vessel/RCS RCS_[PVVR] or RPV [BVVR]) inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant. These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS/reactor vessel_RCS level cannot be restored, fuel damage is probable. Outage/shutdown contingency plans typically provide for re-establishing or verifying CONTAINMENT CLOSURE following a loss of heat removal or RCS inventory control functions. The difference in the specified RCS/reactor vessel levels of EALs ~CS1 .1 and

 ~CS1 .2 reflect the fact that with CONTAINMENT CLOSURE established, there is a lower probability of a fission product release to the environment.

In EAL 3.a, the 30 minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allm.vs sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. The inability to monitor_RCS (reactor vessel/RCS [PWR] or RPV [B'NR]) level may be eaused by instrumentation and/or power failures, or 'Nater level dropping belmu the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of 'Nater flow to ensure they are indicative of leakage from the (reactor vessel/RCS [PWR] or RPV [BVVR]). These This EALs addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. DCPP Basis Reference(s):

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel - Draining to Half Loop/Half Loop Operations with Fuel in Vessel

3. AP E-55, Equipment Elevations for RCS Flood-Up and Drain-Down j [Document No.]

• Rev. [X] Page 95 of 303 j

ATTACHMENT 1 EAL Bases

4. Instrument scaling calculation SC-1-878, "Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

5. AD8.DC54, Containment Closure

6. NEI 99-01 CS1

                                                       ,/

I [Document No.] Rev. [X] Page 96 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1- RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability. EAL: CS1 .3 Site Area Emergency RCS water level cannot be monitored for;:::: 30 minutes. (Note 1) AND Core uncovery is indicated by any of the following:

• UNPLANNED increase in any Table C-1 sump/tank level of sufficient magnitude to indicate core uncover.
• Any Bridge (Manipulator) Crane Radiation Monitor > 9 R/hr.
• Erratic Source Range Monitor indication.

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT
• RCDT
• CCW Surge Tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal.condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended , , evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. ' j [Document No.] Rev. [X] Page 97 of 3031

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information In this EAL. the ability to monitor RCS level would be unavailable for greater than 30 minutes. and the RCS inventory loss must be detected by indirect leakage indications (Table C-1). The ability to monitor RCS leve.J includes level instrumentation as well as direct and indirect (e. g. camera) visual observation. The reactor vessel inventory loss may be detected by the radiation* monitors or erratic source range monitor indication. As water level in the reactor vessel lowers. the dose rate above the core will rise. The Bridge Crane Radiation Monitors can be monitored either locally, or remotely on the Viewpoint software. Post-TM I accident studies indicated that the installed PWR nuclear instrumentation will operate erratically when the core is uncovered and that this should be used as a tool for making such determinations (ref.1 ). The inability to monitor (reactor vessel/RCS [PVVR] or RPV [B'A'R]) level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS (reactor vessel/RCS [P'A'R] or RPV [BVVR]). Escalation of the emergency classification level would be via IC CG1 or AG-1-RG1.

Background

In Cold Shutdown mode, the RCS will normally be INTACT and standard RCS level monitoring means are available. In the Refueling mode, the RCS is not INTACT and RPV level may be monitored by different I means, including the ability to monitor level visually. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS unexplainably rises above the pre-established rate. a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. The dose rate due to this core shine should result in increased Bridge (Manipulator) Crane Radiation Monitor indication. A reading of 9 R/hr (90% of instrument scale) is indicative of core uncovery. There are a number of variables governing the projected dose rate from an actual core uncover (ref. 2). This IC addresses a significant and prolonged loss of (reactor vessel/RCS_[PVVR] or RPV [BWR]) inventory control and makeup capability leading to IMMINENT fuel damage. The lost inyentory may be due to a RCS component failure, a loss of co,nfiguration control or prolonged boiling of reactor coolant. These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS/reactor vessel level cannot be restored, fuel damage is probable. I [Document No.] Rev. [X] Page 98 of 3031

ATTACHMENT 1 EAL Bases Outage.tshutdovm contingency plans typically provide for re establishing or verifying CONTAINMENT CLOSURE follo 1Ning a loss of heat removal or RCS inventory control functions. The difference in the specified RCS.treactor vessel levels of EALs 1.b and 2.b reflect the fact that with CONTAINMENT CLOSURE established, there is a lower probability of a fission product release to the environment. In EAL 3.a, tihe 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time.for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. These This EALs addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. DCPP Basis Reference(s):

1. Nuclear Safety Analysis Center (NSAC), 1980, "Analysis of Three Mile Island - Unit 2 Accident," NSAC-1

2. EP-EALCALC-DCPP-1603 Radiation Monitor Readings for Core Uncovery During Refueling

3. NEI 99-01 CS1 j [Document No.] Rev. [X] Page 99 of 303 j

ATIACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting fuel clad integrity with containment cha_llenged. EAL: CG1 .1 General Emergency RVLIS full range< 56.6% (Top of Fuel) for?: 30 minutes. (Notes' 1, 12) AND Any Containment Challenge indication, Table C-2. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 6: If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, declaration of a General Emergency is not required. Note 12: With RVLIS out-of-service, classification shall be based on CS1 .3 or CG1 .2 if RCS inventory cannot be monitored. Table C-2 Containment Challenge Indications

• CONTAINMENT CLOSURE not established (Note 6)
• Containment hydrogen concentration?: 4%
• UNPLANNED rise in Containment pressure Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information This EAL is only applicable when RVLIS is in service (see Note 12). .1 [Document No.] Rev. [X] Page 100 of 3031

ATTACHMENT 1 EAL Bases When reactor vessel water level drops below RVLIS full range indication of 56.6% core uncoverv is about to occur. This level drop can only be remotely monitored by Reactor Vessel Level Instrumentation System (RVLIS). Other reactor vessel water level monitoring systems (e.g., RVRLIS. Ll-400 standpipe, ultrasonic sensor. RVLIS upper range) are downscale-low when water level drops below the elevation of the bottom of the RCS hot leg penetration. Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established

2. Containment hydrogen ;:::: 4%

3. UNPLANNED rise in Containment pressure (Containment pressure changes due to ventilation system changes do not constitute a containment challenge)

With CONTAINMENT CLOSURE not established, there is a high potential for a direct and unmonitored release of radioactivity to the environment. If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required. During periods when installed containment hydrogen gas monitors are out-of-service, operators may use the other listed indications to assess whether or not containment is challenged. In EAL 2.b, tihe 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. The inability to monitor(reactor vessel/RCS [PV1/R] o r RPV RCS_[BV1/R]) level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the (reactor vessel/ RCS [PV1/R] or RPV [BV1/R]).

Background

The RVLIS setpoint corresponding to the top of fuel was obtained as follows (ref. 1. 2. 3, 4):

• Per SC-l-87B. span =494.9 in. and 0% =79.6536 feet

     *   % span/in. = 100 I 494.9 = 0.20206%/in. and top of core = 103 feet
     *   (103 - 79.6536) x 12 x 0.20206 =56.6%

Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established - The status of Containment closure is tracked if plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref.5). If containment closure is re-established prior to exceeding the 30 minute core uncoverv time limit then escalation to GE would not be required.

I [Document No.] Rev. [X] Page 101 of 3031

ATTACHMENT 1 EAL Bases

2. Containment hydrogen;::: 4% - The 4% hydrogen concentration threshold is generally considered the lower limit for hydrogen deflagrations. To generate such levels -of combustible gas. loss of the Fuel Clad and RCS barriers are likely to have occurred.

Operation of the Containment Hydrogen Recombiner with Containment hydrogen concentrations above 4.0% could result in ignition of the hydrogen. If in operation. containment hydrogen can be monitored in the Control Room on ANR-82/ANR-83 and PAM1 following local equipment initialization (ref. 6. 7)

3. UNPLANNED rise in Containment pressure - In the operating modes associated with this EAL. Containment pressure is expected to remain very low; thus. an elevated Containment pressure resulting from an UNPLANNED rise above near-atmospheric pressure conditions may be indicative of a challenge to the Containment barrier. _,

Containment pressure changes due to ventilation system changes do not constitute a containment challenge. Under the conditions specified by this EAL. continued lowering of reactor vessel water level is indicative of a loss of inventory control with a challenge to the Containment. Inventory loss may be due to a vessel breach. RCS pressure boundary leakage or continued boiling in the reactor vessel. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further RCS or reactor vessel water level drop and potential core uncovery. The inability to restore and maintain level inventory within 30 minutes after reaching this condition in combination with a Containment challenge infers a failure of the RCS barrier. Loss of the Fuel Clad barrier and a Potential Loss of Containment. This IC addresses the inability to restore and maintain reactor vessel level above the top of active fuel with containment challenged. This condition represents actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS RCS/reactor vessel level cannot be restored, fuel damage is probable. The existence of an explosive mixture means,. at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e.' at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a challenge to Containment integrity. In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive gas mixture in containment. If all installed hydrogen gas monitors are out-of-service during an event leading to fuel cladding damage, it may not be possible to obtain a containment hydrogen gas concentration reading as ambient conditions within the containment will preclude personnel access. Thisese EALs addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SE:CY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear*Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. I [Document No.] Rev. [X] Page 102 of 3031

ATTACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel - Draining to Half Loop/Half Loop Operations with Fuel in Vessel

3. AP E-55, Equipment Elevations for RCS Flood-Up and Drain-Down

4. Instrument scaling calculation SC-1-878, "Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

5. AD8.DC54, Containment Closure

6. CA-3, Hydrogen Flammability in Containment

7. OP H-9, INSIDE CONT H2 RECOMB SYSTEM 8.. NEI 99-01 CG1

/ [Document No.] Rev. [X] Page 103 of 303 /

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling* System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory, affecting fuel clad integrity with containment challenged.

• EAL:

CG1 .2 , General Emergency RCS level cannot be monitored for ;::: 30 minu.tes. (Note 1) AND Core uncovery is indicated by any of the following:

• UNPLANNED increase in any Table C-1 sump/tank level of sufficient magnitude to indicate core uncover.
• Any Bridge (Manipulator) Crane Radiation Monitor > 9 R/hr.
• Erratic Source Range Monitor indication.

AND Any Containment Challenge indication, Table C-2 .. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely b'e exceeded. _ . . Note 6: If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, declaration of a General Emergency is not required. Table C-1 Sumps I Tanks

                                .*     Containment Structure  Sump~

• Reactor Cavity Sump
• PRT
• RCDT

                                  .~   CCW Surge Tank(s)

• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT I [Document No.] Rev. [XJ Page 104 of 3031

ATTACHMENT 1 EAL Bases Table C-2 Containment Challenge Indications II'

• CONTAINMENT CLOSURE not established (Note 6)
• Containment hydrogen concentration;::::: 4%
• UNPLANNED rise in containment pressure Mode Applicability:,

5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and comp6nents as a functional barrier to fission

• product release under shutdown conditions.

As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams).

• UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The. cause of the parameter change or event may be known or unknown.

Basis: ERO Decision Making Information In this EAL, the ability to monitor RCS level would be unavailable for greater than 30 minutes. and the RCS inventory loss must be detected by indirect leakage indications (Table C-1). The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e. g. camera) visual.observation. ' The reactor vessel inventory loss may be detected by the radiation monitors or erratic source range monitor indication .. As water level in the reactor vessel lowers. the dose rate above the core will rise. The Bridge Crane Radiation Monitors can be monitored either locally. or remotely on the Viewpoint software. Post-TMI accident studies indicated that the installed PWR nuclear instrumentation wiH operate erratically when the .core is uncovered and that this should be used as a tool for making such determinations (ref. 1).

• Source Range indication can be seen on Source Range Detectors Nl-31 & 32 as well as the Gammametrics detectors.

Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established I [Document No.] Rev. [X] Page 105 of 3031

                                                                                       / '

ATTACHMENT 1 EAL Bases

2. Containment hydrogen ;::: 4%

3. UNPLANNED rise in Containment pressure (Containment pressure changes due to ventilation system changes do not constitute a containment challenge)

During periods when installed containment hydrogen gas monitors are out-of-service. use the other listed indications to assess whether or not containment is challenged. The 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time.to monitor. assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e .. to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage. recover inventory control/makeup equipment and/or restore level monitoring. The inability to monitor RCS level may be caused by instrumentation and/or power failures. or water level dropping below the range of available instrumentation. If water level cannot be monitored. operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS.

Background

In Cold Shutdown mode. the RCS will normally be INTACT and standard RCS level monitoring means are available. In the Refueling mode, the RCS is not INTACT and RPV level may be monitored by different means. induding the ability to monitor level visually. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS unexplainably rises above the pre-established rate. a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified . . The dose rate due to this core shine should result in increased Bridge (Manipulator) Crane Radiation Monitor indication. A reading of 9 R/hr (90% of instrument scale) is indicative of core uncovery. There are a number of variables governing the projected dose rate from an actual core uncover (ref. 5). Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established - The status of Containment closure is tracked if plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref.2). If containment closure is re-established prior to exceeding the 30 minute core uncovery time limit then escalation to GE would not be required. *

2. Containment hydrogen ;::: 4% - The 4% hydrogen concentration threshold is generally considered the lower limit for hydrogen deflagrations; To generate such levels of combustible gas. loss of the Fuel Clad and RCS barriers are likely to have occurred.

Operation of the Containment Hydrogen Recombiner with Containment hydrogen concentrations above 4.0% could result in ignition of the hydrogen. Containment hydrogen can be monitored in the Control Room on ANR-82/ANR-83 and PAM1 following local equipment initialization (ref. 3, 4) I [Document. No_.] Rev. [X] Page 106 of 3031

ATTACHMENT 1 EAL Bases

3. UNPLANNED rise in Containment pressure - In the operating modes associated with this EAL. Containment pressure is expected to remain very low; thus. an elevated Containment pressure resulting from an UNPLANNED rise above near-atmospheric pressure conditions may be indicative of a challenge to the Containment barrier.

Containment pressure changes due to ventilation system changes do not constitute a containment challenge. This IC addresses the inability to restore and maintain reactor vessel level above the top of active fuel with containment challenged. This condition represents actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. lf_RCS RCS/reactor vessel level cannot be restored, fuel damage is probable. With CONTAINMENT CLOSURE not established, there is a high potential for a direct and unmonitored release of radioactivity to the environment. If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required. The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to,support a hydrogen burn (i.e., at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity.

• It therefore represents a challenge to Containment integrity.

In the early stages of a core uncovery event, it is unli~ely that hydrogen buildup due to a core uncovery could result in an explosive gas mixture in containment. If all installed hydrogen gas monitors are out-of-service during an event leading to fuel cladding damage, it may not be possible to obtain a containment hydrogen gas concentration reading as ambient conditions within the containment will preclude personnel access. During periods when installed containment hydrogen gas monitors are out of service, operators may use the other listed indications to assess whether or not containment is challenged. In EAL 2.b, tihe 30 minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. The inability to monitor (reactor vessel/RCS [PllVR] or RPV RCS_[BV1/R]) level may be caused by instrumentation and/or power failures, or \Nater level dropping belmv the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the (reactor vessel/RCS [PV1JR] or RPV [BV1/R]). Thisese EALs addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, I [Document No.] I Rev. [X] I Page 107 of 3031

ATIACHMENT 1 EAL Bases Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. , DCPP Basis Reference(s):

1. Nuclear Safety Analysis Center (NSAC), 1980, "Analysis of Three Mile Island - Unit 2 Accident," NSAC-1

2. AD8.DC54, Containment Closure

3. OP H-9, INSIDE CONT H2 RECOMB SYSTEM

4. CA-3, Hydrogen Flammability in Containment *

5. EP-EALCALC-DCPP-1603 Radiation Monitor Readings for Core Uncovery During Refueling

6. NEI 99-01 CG1 I [Documenl No.] Rev. [X] Page.108 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System. Malfunction Subcategory: 2 - Loss of Vital AC Power Initiating Condition: Loss of all but one AC power source to vital buses for 15 minutes or longer.

• EAL:

CU2.1. Unusual Event AC power capability, Table C-3, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H reduced to a single power source for ;?: 15 minutes. (Note 1) AND A failure of that single power source will result in loss of all AC power to SAFETY SYSTEMS. Note 1: . The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-3 AC Power ~apability Unit 1 Unit2 G)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

             ~

• Startup XFMR 1-2 via Startup XFMR 2-1 .. Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR

             - G)
             *u; 0

c DG 1 Bus H DG 1 BusG DG 1 Bus F DG 2-2-Bus H DG 2-1 -Bus G DG 2-3-Bus F -

• Other Unit via Startup Bus X-Tie Other Unit via Startup Bus X-Tie Mode Applicability:

I. 5 - Cold Shutdown, 6 - Refueling, D - Defueled Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it i.n the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary;

       * (2) The capability to shut down the reactor and maintain it in a sate. shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

I [Document No.] Rev. [X] Page 109 of 3031

ATTACHMENT 1 EAL Bases Basis: . ERO Decision Making Information For emergency classification purposes. "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path.

and

• Breakers and equipment are readily available to.power up the bus within the allotted time frame.

This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equ_ipment. An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to a-A essential vital bus. Some examples of this condition are presented below.

• A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).
• A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of emergency vital buses being back-fed from the unit main generator.
• A loss of ~mergency power sources (e.g., onsite diesel generators) with a single train of emergency vital buses being back-fed from an offsite power source.
• If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power. When filling out the ENF form. this event can be Unit 1. Unit 2 or Unit 1 and 2. The subsequent loss of the remaining single power source would escalate the event to .an Alert in accordance with IC CA2.

Background

The condition indicated by this EAL is the degradation of the offsite and onsite power sources such that any additional single failure would result in a loss of all AC power to the vital buses. 4.16KV buses F. G and Hare the emergency (vital) buses. Each bus has three sources of power (see figure below). _, One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). I [Document No.] Rev. [X] Page 110 of 3031 l __ _

ATIACHMENT 1 EAL Bases Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. In addition. each units vital buses F. G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). Refer to CP M-10 Fire Protection of Safe Shutdown Equipment for a list of SAFETY SYSTEMS. When in the cold shutdown, refueling, or defueled mode, this 1condition is not classified as an Alert because of the increased time available to restore another power source to service. Additional time is available due to the reduced core decay heat load, and the lower temperatures and pressures in various plant systems. Thus, when in these modes, this condition is considered to be a potential degradation of the level of safety of the plant.. This cold condition EAL is equivalent to the hot condition EAL SA 1.1. DCPP Electrical. Distribution System 500kV Switchyard 230kV Switchyard Midway 2+- Bus21~~~~

J&j 642 TX -----------~ Bus1E~~~ Mesa:......._...../- 282 Midway3+- ~T~T~ --~ t,....__ T0-i+ Morro

                                                                                                                                               ~fg_J            Bay
                      ~T~______;:
                                                                                                        ,---/--,      1---/----.---/.
                                                                 .----------r---

Gates 1 4 - Bus 1 u1 Main BankXfmr ~SU Xfmrs ~ J If ----1.'0/..1.......!.... 212 Bus 2 lr;- -)- SOOkV 230kV U2 Main Bank Xfmr 500kVl25kV 12kV _ Aux Xfmr 25kV Aux Xfmr I ) ( 11 Aux Xfmr .......J....., 25kV .......J....., Aux Xfmr 1-1 12kV 4kV(~ (;;f' 1-2U Main

                                                                        ,...       Ij    j _. I    U Main    2-~X) ~~kV                1 2 k V l 2-1 I I           1
                                                                  ) 12kV SU Bus (             @       2 I,, I',
                                                                                                                                       ==

Generator ( ( Generator

      ;f ;f
                        -)~)---------~SUXfmrs~

i_; :0J2 -~":! '" l"l L~ l"l ( ( -( 7 y [Ff~ c-1~~~ ~l=rf~ J

                      .Jl2 Bus D I) I) I)

Bus H I) I) I) Bus G I) I) I) Bus F cl cl c, Bus F cl c, cl Bus G t111 ~ cl cl c, Bus H

                                                                                                                                          ~

Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 CU2 I [Document No.] Rev. [X] Page 111 of 3031

I ATTACHMENT 1 EAL Bases ' Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 2 - Loss of Vital AC Power Initiating Condition: Loss of all offsite and all onsite AC power to vital buses for 15 minutes or longer. EAL: CA2.1 Alert Loss of all offsite and all onsite AC power capability, Table C-3, to Unit 1 or Unit 2 vital 4.16KVbuses F, G and H for;=:: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-3 AC Power Capability Unit 1 Unit2

           ~

Cl)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

           ~

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR Cl)
• DG 1 Bus H
• DG 2-2-Bus H

           ~

en

• DG 1 Bus G
• DG 2-1-Bus G c
• DG 1 Bus F
• DG 2-3-Bus F 0
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

5 - Cold Shutdown, 6 - Refueling, D - Defueled Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information For emergency classification purposes. "capability" means that. whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes: j [Document No.] Rev. [X] Page 112 of 303 j

ATTACHMENT 1 EAL Bases

• By a clear*procedure path.

and

• Breakers and equipment are readily available to power up the bus within the allotted time frame.*

This .J-G--EAL addresses a total loss of AC power for greater than 15 minutes that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. When filling out the ENF form. this event can be Unit 1. Unit 2 or Unit 1 and 2. Escalation of the emergency classification level would be via IC CS1 or AS4RS1.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F. G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. In addition. each units vital buses F. G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). When in the cold shutdown, refueling, or defueled mode, this condition is not classified as a Site Area Emergency because of the increased time available to restore aR emergency vital bus to service. Additional time is available due to the reduced core decay heat load, and the lower temperatures and pressures in various plant systems. Thus, when in these modes, this condition represents an actual or potential substantial degradation of the level of safety of the plc;tnt. This cold condition EAL is equivalent to the hot condition loss of all offsite AC power EAL SS1.1. DCPP Electrical Distribution System I [Document No.] Rev. [X] Page 113 of 3031

ATTACHMENT 1 EAL Bases 500kV Switchyard 230kV Switchyard Midway 2+-Bus21~~~~

                ~ 642 ~ ------------~                                                                  Bus 1 E:..--C::~~ Mesa
                ~T~T~ --~

.............-- 282 Midway3+- L__ T~-r+ Morro

                                                                                                 ,-/--, I--/~                        ~llLJ   Bay Gates 1    ~J~------1:

ff Bus 1 U1 Main ,....,--,..,-----..,..,--- __l'-Q-/..L.!...__J Bus 2 c - BankXfmr ~ SUXfmrs ~ J 212 l 230kV U2 Main Bank Xfmr 500kV/25kV I. 12kV (I

                                                                                         ~II     AuxXi~ r~r 4 k~5~~kV~l~-~xXfmr 1

AuxXtmr 25kV AuxXfmr I ) ,...., 1-1 12kV 4kV;J' (~ 1-2U1 Main ' j j U2 Main (X) (Y) I I Generator ) 12kV SU Bus ( ( ( Generator 7

                = ~-~ \";J~                                                                                                  ==

f) )- -)~)-----.-----~SUXfmrs.il: ( ( --(

      ..::f                                                    N 'I:: N     ~L~ ~

B lFFf= ~ ~~~~ ~f=rfi J tT=TI ~

                ~

Bus D I) I) I) Bus H I) 1) 1) Bus G I) I) I) Bus F c1 c1 c, Bus F; c, c1 c1 c1 c, c, Bus G Bus H

                                                                                                                                ~

Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD 1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 CA2 I [Document No.] Rev. [X] Page 114 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction

• Subcategory: 3 - RCS Temperature Initiating Condition: UNPLANNED increase in RCS temperature.

EAL: CU3.1 Unusual Event UNPLANNED increase in RCS temperature to> 200°F. (Note 10) Note 1O: Begin monitoring hot condition EALs concurrently. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition{s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functiorial barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Clo~ure is defined by Administrative Procedure AD8.DC54 "Containment Closure." INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision* Making Information In the absence of reliable RCS temperature indication caused by a loss of decay heat removal capability, classification should be based on EAL CU3.2 should RCS level indication be subsequently lost. A momentary UNP_LANNED excursion above the Technical Specification cold shutdown temperature limit of 200°F when the heat removal function is available does not warrant a classification. Escalation to Alert would be via IC CA 1 based on an inventory loss or IC CA3 based on exceeding plant configuration-specific time criteria.

Background

Numerous instruments are capable of providing indication of RCS temperature with respect to the Technical Specification cold shutdown temperature limit (200°F. ref. 1). These may include but are not limited to (ref. 2):

     *

• TR413 Loop 1 Wide Range Temperature
• TR423 Loop 2 Wide Range Temperature I [Document No.] Rev. [X] Page 115 of 3031

                                                                                                      -__ j

ATTACHMENT 1 EAL Bases

• TR433 Loop 3 Wide Range Temperature
• TR443 Loop 4 Wide Range Temperature
• WR T!J.Q! recorders 0-700°F
• WR Tcold recorders 0-700°F
• CETs
• RHR System temperatures (when RHR is in service)

This IC addresses an UNPLANNED increase in RCS_temperature above the Technical Specification cold shutdown temperature limit, or the inabili ty to determine RCS temperature and level,and represents a potential degradation of the level of safety of the plant. If the RGS RCS_is not INTACT and CONTAINMENT CLOSURE is not established during this event, the SM/SEC/EDEmergency Director_should also refer to IC CA3. EAL #1This EAL involves a loss of decay heat removal capability, or an addition of heat to the RCS in excess of that which can currently be removed, such that reactor coolant temperature cannot be maintained below the cold shutdown temperature limit specified in Technical Specifications. During this condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation. During an outage, the level in the reactor vessel will normally be maintained at or above the reactor vessel flange. Refueling evolutions thatI lower water level below the reactor vessel flange are carefully planned and controlled. A loss of forced decay heat removal at reduced inventory may result in a rapid increase in reactor coolant temperature depending on the time after shutdown. EAL #2 reflects a condition where there has been a significant loss of instrumentation capability necessary to monitor RCS conditions and operators would be unable to monitor key parameters necessary to assure core decay heat removal. During this condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of pmver operation. Fifteen minutes i.vas selected as a threshold to exclude transient or momentary losses of indication. DCPP Basis Reference(s):

1. DCPP Technical Specifications Table 1.1-1 Modes

2. OP L-1, Plant Heatup From Cold Shutdown to Hot Standby

3. NEI 99-01 CU3 I [Document No.] Rev. [X] Page 116 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: UNPLANNED increase in RCS temperature. EAL: , CU3.2 Unusual Event Loss of all RCS temperature and all RCS level indication for;:::: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded.* or will likely be exceeded. Mode Applicability: 5 - Cold Shutdown, 6- Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions.

• As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 "Containment Closure."

INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze s,eals or nozzle dams). Basis: ERO Decision Making Information This .JG-EAL addresses an UNPLANNED increase in RCS temperature above the Technical Specification cold shutdown temperature limit, or the inability to determine RCS temperature and level, and represents a potential degradation of the level of safety of the plant. If the RCS is not INTACT and CONTAINMENT CLOSURE is not established during this event, the

• SM/SEC/EDEmergency Director should also refer to IC CA3.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication. Escalation to Alert would be via IC CA 1 based on an inventory loss or IC CA3 based on exceeding plant configuration-specific time criteria.

Background

\ Reactor vessel water level is normally monitored using the following instruments (ref. 1):

• RVRLIS
• Ll-400 Standpipe
• RVLIS I[Document No.] I Rev. [X] Page 117 of 3031

ATTACHMENT 1 EAL Bases _*_Ultrasonic level detectors AP E-55, "Equipment Elevations for RCS Flood-Up and Drain-Down", provides a cross-reference of indicated water levels and key plant elevations Numerous instruments are capable of providing indication of RCS temperature with respect to the Technical Specification cold shutdown temperature limit (200°F. ref. 2). These may include but are not limited to (ref. 3):

• TR413 Loop 1 Wide Range Temperature

     *' TR423 Loop 2 Wide Range Temperature

• TR433 Loop 3 Wide Range Temperature
• TR443 Loop 4 Wide Range Temperature
• WR Th.Q!- recorders 0-700°F
• WR Tcold recorders 0-700°F
• CETs
• RHR System temperatures (when RHR is in service)

A momentaPJ UNPLANNED excursion above the Technical Specification cold shutdmvn temperature limit when the heat removal function is available does not warrant a classification. EAL #1 involves a loss of decay heat removal capability, or an addition of heat to the RCS in excess of that which can currently be removed, such that reactor coolant temperature cannot be maintained below the cold shutdovm temperature limit specified in Technical Specifications. During this condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation. During an outage, the level in the reactor vessel v.till normally be maintained above the reactor vessel flange. Refueling evolutions that Im.var water level below the reactor vessel flange are carefully planned and controlled. A loss of forced decay heat removal at reduced inventory may result in a rapid increase in reactor coolant temperature depending on the time after shutdovm. EAL #2This EAL reflects a condition where there has been a significant loss of instrumentation capability necessary to monitor RCS conditions and operators would be unable to monitor key parameters necessary to assure core decay heat removal. During tliis condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation. DCPP Basis Reference(s):

1. AP E-55, "Equipment Elevations for RCS Flood-Up and Drain-Down

2. D<;:;PP Technical Specifications Table 1.1-1

3. OP L-1, Plant Heatup From Cold Shutdown to Hot Standby

4. NEI 99-01 CU3 I [Document No.] Rev. [X] Page 118 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: Inability to maintain plant in cold shutdown. EAL: CA3.1 Alert \ UNPLANNED increase in RCS temperature to > 200°F for > Table C-4 duration. (Notes 1, 10) OR I UNPLANNED RCS pressure increase > 10 psig (this does not apply during water-solid plant conditions) . . Note 1: The SM/SEC/ED should declare the event promptly upon determining that the applicable time has been exceeded, o_r will likely be exceeded. ' . Note 10: Begin monitoring hot condition EALs concurrently. Table C-4: RCS Heat~up Duration Thresholds CONTAINMENT RCS ~tatus Heat-up Duration. CLOSURE Status INTACT (but not ' REDUCED NIA 60 minutes* INVENTORY) \ Not INTACT 20 minutes* established OR REDUCED INVENTORY not established ()minutes

• If an RCS heat removal system is in operation within this time frame and. RCS temperature is trending down, the EAL ls not applicable.

Mode Applicability: 5 - Cold Shutdown, 6 - :Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. INTACT (RCS) - The RCS should be considered INTACT when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). . J *_ I[Document No.] I Rev. [X] Page 119 of 3031

ATTACHMENT 1 EAL Bases UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. REDUCED INVENTORY - The condition existing whenever RCS water level is lower than 3 feet below the reactor vessel flange (below 111-foot elevation) with fuel in the core. Basis: ERO Decision Making Information In the absence of reliable RCS temperature indication caused by the loss of decay heat removal capability. classification should be based on the RCS pressure increase criteria when the RCS is INTACT in Mode 5 or based on time to boil data when in Mode,6 or the RCS is not INTACT in Mode 5. A momentary UNPLANNED excursion above the Technical Specification cold shutdown temperature limit when the heat removal function is available does not warrant a classification. The RGS-RCS_Heat-,up Duration Thresholds table addresses an increase in RCS temperature when CONTAINMENT CLOSURE is established but the RCS_is not INTACT, or RCS_inventory is reduced (e.g., mid-loop operation in PWRs). The 20-minute criterion was included to allow time for operator action to address the temperature increase. The RCS_Heat-up Duration Thresholds table also addresses an increase in RCS_temperature with the RCS_INTACT. The status of CONTAINMENT CLOSURE is not crucial in this condition since the INTACT RCS_is providing a high pressure barrier to a fission product release. The 60-minute time frame should allow sufficient time to address the temperature increase without a substantial degradation in plant safety. Escalation of the emergency classification level would be via IC CS1 or AS4RS1.

Background

Numerous instruments* are capable of providing indication of RCS temperature with respect to the Technical Specification cold shutdown temperature limit (200°F, ref. 1). These may include but are not limited to (ref. 2):

• TR413 Loop 1 Wide Range Temperature
• TR423 Loop 2 Wide Range Temperature
• TR433 Loop 3 Wide Range Temperature
• TR443 Loop 4 Wide 'Range Temperature
• WR That recorders 0-700°F
• WR Tcold recorders 0-700°F
• CETs
• RHR System temperatures (when RHR is in service)

Pl-403A. Pl-405 and Pl-405A display on VB2. with digital values available on PPC. SPDS and SCMM. Digital readouts can display changes of less than 10 psig. I[Document No.] Rev. [X] Page 120 of 3031

ATTACHMENT 1 EAL Bases This IC addresses conditions involving a loss of decay heat removal capability or an addition of. heat to the RCS in excess of that which can currently be removed. Either condition represents an actual or potential substantial degradation of the level of safety of the plant.

• Finally, in the case where there is an increase in RCS_temperature, the RCS_is not INTACT or is at reduced inventory [PINR], and CONTAINMENT CLOSURE is not established, no heat-up duration is allowed (i.e., 0 minutes). This is because 1) the evaporated reactor coolant may be released dir~ctly into the containment atmosphere and subsequently to the environment, and

2) there is reduced reactor coolant inventory above the top of irradiated fuel.

EAL #2The RCS pressure increase threshold provides a pressure-based indication of RCS heat-up in the absence of RCS temperature monitoring capabilitv. DCPP Basis Reference(s):

1. DCPP Technical Specifications Table 1.1-1

2. OP L-1, Plant Heatup From Cold Shutdown to Hot Standby

3. NEI 99-01 CA3 I [Document No.] Rev. [X] Page 121 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 4 - Loss of Vital DC Power Initiating Condition: Loss of Vital DC power for 15 minutes or long~r. EAL: CU4.1 Unusual Event

 < 105 VDC bus voltage indications on Technical Specification required 125 VDC vital buses for ;:: 15 minutes. (Note 1)

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): SAFETY SYSTEM - A system required for sate plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): . Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information Minimum battery voltage of 105 VDC is the voltage below which supplied loads may not function (ref. 2, 3, 4). As used in this EAL, "required" means the vital DC buses necessary to support operation of the in-service, or operable, train or trains of SAFETY SYSTEM equipment. For example, if Train A is out-of-service (inoperable) for scheduled outage maintenance work and Train Bis in-service (operable), then a loss of Vital DC power affecting Train B would require the declaration of an Unusual Event. A loss of Vital DC power to Train A would not warrant an emergency classification. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Depending upon the event, escalation of the emergency classification level would be via IC CA 1 or CA3, or an IC in Recognition Category AR.

Background

The vital 125 VDC system consists of three independent networks per unit. Each network contains the following components: I [Document No.] Rev. [X] Page 122 of 3031

ATTACHMENT 1 EAL Bases

• Battery
• Battery charger
• Standby battery charger to allow maintenance and/or testing
• Distribution panels
• Ground detector The vital 125 VDC batteries and distribution panels are located in Area "H" of the 115 feet elevation of the Auxiliary Building. There are a total of three batteries per unit, 11 (21 ), 12(22),

and 13(23). The batteries are sized to provide sufficient power to *operate the associated DC loads for the time necessary to safely shut down the unit, should a 480-VAC source to one or more battery chargers be unavailable (ref. 1, 2, 3). This IC addresses a loss of vital DC power which compromises the ability to monitor and control operable SAFETY SYSTEMS when the plant is in the cold shutdown or refueling mode. In these modes, the core decay heat load has been significantly reduced, and: coolant system temperatures and pressures are lower; these conditions increase the time available to restore a vital DC bus to service. Thus, this condition is considered to be a potential degradation of the level of safety of the plant. This EAL is the cold condition equivalent of the hot condition loss of DC power EAL SS7.1. DCPP Basis Reference(s):

1. UFSAR, Section 8.3.2.2.2

2. OP AP-23, Loss of Vital DC Bus

                                        \

3. ECA-0.0, Loss of All Vital AC Power

4. Notification 50804190 DC Bus Voltage Trigger for EALs

5. NEI 99-01 CU4 I [Document No;] Rev. [X] Page 123 of 3031

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 5 - Loss of Communications Initiating Condition: Loss of all onsite

                                      /

or offsite communications capabilities. EAL: CU5.1 Unusual Event Loss of all Table C-5 onsite communication methods. OR Loss of all Table C-5 offsite communication methods. OR Loss of all Table C-5 NRC communication methods. Table C-5 Communication* Methods System On site Offsite NRC Unit 1, Unit 2 and TSC Radio Consoles x x DCPP Telephone System (PBX) x x x Portable radio equipment (handie-talkies) x Operations Radio System . x x Security Radio Systems x CAS and SAS Consoles x x x Fire Radio,System x Hot Shutdown Panel Radio Consoles x x x Public Address System x NRC FTS x Mobile radios x Satellite phon'es x x x Direct line (ATL) to the County and State OES x I [Document No.] Rev. [X] Page 124 of 3031

ATTACHMENT 1 EAL Bases Mode Applicability: 5 - Cold Shutdown, 6 - Refueling, D - Defueled Definition(s): None Basis: ERO Decision Making Information Onsite, offsite and NRG communications include one or more of the systems listed in Table C-5 (ref. 1, 2, 3). This EAL is the cold condition equivalent of the hot condition EAL SU7.1. This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to Offsite Response Organizations (OROsl and the NRG.

Background

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

• EAL #1 The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

EAL #2The second EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are-fsee Developer Notes) the State and county EOCs"; EAL #3The third EAL condition addresses a total loss of the communications methods used to notify the NRG of an emergency declaration. DCPP Basis Reference(s):

1. UFSAR, Section 9.5.2

2. Emergency Plan Section- 7.2 Communications Equipment

3. AR PK15-23, Communications

4. NEI 99-01 CU5 j [Document No.] Rev. [X] Page 125 of 303 j

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 6 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode. EAL: CA6.1 Alert The occurrence of any Table C-6 hazardous event. AND EITHER:

• Event damage has caused indications of DEGRADED PERFORMANCE in at least one t~ain of a SAFETY SYSTEM needed for the current operating mode.
• The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode.

Table C-6 Hazardous Events

• Seismic event (earthquake)
• Internal or external FLOODING event
• High winds or TORNADO strike
• FIRE
• EXPLOSION
• Tsunami
• Other events with similar hazard characteristics as determined by the SM/SEC/ED Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): DEGRADED PERFORMANCE - As applied to hazardous event thresholds, event damage significant enough to cause concern regarding the operability or reliability of the affected safety system train. EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present. I [Document No.] Rev. [X] Page 126 of 3031 L _ _ _ __ _

ATTACHMENT 1 EAL Bases FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive

• belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-rel~ted (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. TORNADO - A violently rotating column of air in contact with the ground and extending from

• the base of a thunderstorm.

VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or ana.lysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability.of the affected 9omponent or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. Basis: ERO Decision Making Information This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. The indications of DEGRADED PERFORMANCE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. In modes 5. 6 and defueled. the appropriate plant configuration based Outage Safety Checklist in AD8.DC55 "Outage Safety Scheduling" should be consulted to identify required equipment supporting each of the specified safety functions (ref. 1). With respeCt to event damage caused by an equipment failure resulting in a FIRE or EXPLOSION, no emergency classification is required in response to a FIRE or EXPLOSION resulting from an equipment failure if the only safety system equipment affected by the event is that upon which the failure occurred. An emergency classification is required if a FIRE or EXPLOSION caused by an equipment failure damages safety system equipment that was otherwise functional or operable (i.e .. equipment that was not the source/location of the failure). For example. if a FIRE or EXPLOSION resulting from the failure of a piece of safety system equipment causes damage to the other train of the affected safety system or another safety system. then an emergency declaration is required in accordance with this IC and EAL. Escalation of the emergency classification level would be via IC CS1 or AS4RS1. / [Document No.] Rev. [X] Page 127 of 3031

ATTACHMENT 1 EAL Bases

Background

This condition represents an actual or potential substantial degradation of the level of safety of the plant. Due to this actual or potential substantial degradation. this condition can significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant EAL 1.b.1The first conditional addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. EAL 1.b.2The second conditional addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. DCPP Basis Reference(s): /

1. AD8.DC55'0utage Safety Scheduling

2. NEI 99-01 CA6

                                                            /

I [Document No.] Rev. [X] Page 128 of 3031

ATTACHMENT 1 EAL Bases . Category H - Hazards and Other Conditions Affecting Plant Safety EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.) Hazards are non-plant, system-related events that can directly or indirectly affect plant operation, reactor plant safety or personnel safety.

1. Security Unauthorized entry attempts into the PLANT PROTECTED AREA, bomb threats, sab.otage attempts, and actual security compromises threatening loss of physical control of the plant.

2. Seismic Event Natural events sue~ as earthquakes have potential to cause plant structure or equipment damage of sufficient magnitude to threaten personnel or plant safety.

3. Natural or Technology Hazard Other natural and non-naturally occurring events that can cause damage to plant facilities include TORNADOS, FLOODING, hazardous material releases and events restricting site access warranting classification.

4. Fire Fir~s can pose significant hazards to personnel and reactor safety. Appropriate for classification are fires within the ISFSI or PLANT PROTECTED AREA or which may affect operability of equipment needed for safe shutdown

5. Control Room Evacuation Events that are indicative of loss of Control Room habitability. If the Control Room must be evacuated, additional support for monitoring and controlling plant functions is necessary through the emergency response facilities.

6. SM/SEC/ED Judgment The EALs defined in other categories specify the predetermined symptoms or events that are indicative of emergency or potential emergency conditions and thus warrant classification. While these EALs have been developed to address the full spectrum of possible emergency conditions which may warrant classification and subsequent implementation of the Emergency Plan, a provision for classification of emergencies based I[Document No.] Rev. [X] Page 129 of 3031

(

ATTACHMENT 1 EAL Bases on operator/management experience and judgment is still necessary. The EALs of this category provide the SM/SEC/ED the latitude to classify emergency conditions consistent with the established classification criteria based upon SM/SEC/ED judgment. I [Document N~.] Rev. [X] Page 130 of 3031

ATTACHMENT 1 EAL Bases* Category: H - Hazards Subcategory: 1 - Security Initiating Condition: Confirmed SECURITY CONDITION or threat. EAL: HU1.1 Unusual Event A SECURITY CONDITION that does not involve a HOSTILE ACTION as reported by the Security Watch Commander.

• OR Notification of a credible security threat directed ~t the site.

OR A validated notification from the NRC providing information of an aircraft threat. Mode Applicability: All Definition(s): HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLL_ED AREA). OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and* maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

• SECURITY CONDITION - Any SECURITY EVENT as listed in the approved security contingency plan t~at constitutes a threaUcompromise to site security, threaUrisk to site personnel, or a potential degradation to the level of safety of the plant. A security condition does not involve a HOSTILE ACTJ.QN; I [Document No.] R~v. [X] Page 131 of 3031

ATIACHMENT 1 EAL Bases SECURITY EVENT -Any incident representing an attempted, threatened, or actual breach of the security system or reduction of the operational effectiveness of that system. A security event can result in either a SECURITY CONDITION or HOSTILE ACTION. Basis: ERO Decision Making Information The intent of the EAL is to ensure that appropriate notifications for the security threat are made in a timely manner. The DCPP Security and Safeguards Contingency Plan provides a description of SECURITY EVENTS indicative of a potential loss of the level of safety of the plant. Events at the Unusual Event level include credible threats to attack or use a bomb against the plant. or involve extortion. coercion or HOSTAGE threats. NOTE: DO NOT revise this Technical Basis Document to add anv identifying information to any SECURITY EVENT codes. and do not remove this note. Threats under this EAL include the following SECURITY EVENT categories:

• SE-1. SE-2. SE-3. SE-7. SE-9. SE-10. SE-11. SE-12, SE-13. SE-14. SE-15, SE-16. SE-17, SE-18. SE-19, SE-20 & SE-21 Security Watch Commanders are the designated on-site personnel qualified and trained to confirm that a SECURITY EVENT is occurring or has occurred. Training on SECURITY EVENT classification confirmation is closely controlled due to the strict secrecy controls placed on the DCPP Security and Safeguards Contingency Plan (Safeguards) information. (ref. 1).

EAL #1 The first threshold: The Security Watch Commanders. as the trained individualsreferences (site specific security shift supervision because these are the individuals trained to confirm that a SECURITY EVENT is occurring or has occurred, and whether or not the event is or is not a HOSTILE ACTION. Training on SECURITY EVENT confirmation and classification is controlled due to the nature of Safeguards and 10 CFR § 2.39 information. EAL #2The second threshold: addresses the receipt of a credible security threat. The receipt of a credibilcrediblefty ef tResecurity threat is assessed in accordance with (site specific procedure)the Security and Safeguards Contingency Plan (ref. 1). This EAL is met when the plant receives information from the NRG or other reliable source. such as the FBI. EAL #3The third threshold: addresses the threat from the impact of an aircraft on the plant. This EAL is met when the plant receives information regarding an aircraft threat from the NRG or other reliable source. such as the FBI, FAA, or NORAD, and the aircraft is more than 30 minutes away from the plant. In this EAL the threat from the impact of an aircraft on the plant is assessed. The NRG Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may also be provided by NORAD through the NRG. Validation of the threat is performed in accordance with the Security and Safeguards Contingency Plan(site specific procedure). Escalation of the emergency classification level would be via IC HA1. I [Document No.] Rev. [X] Page 132 of 3031

ATTACHMENT 1 EAL Bases

Background

The security shift supervision is defined as the Security Watch Commander. Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Classification of these events will initiate appropriate threat-related notifications to plant personnel and Offsite Response Organizations. Threat information may come from various sources. including the NRG or FBI. Only the plant to which the specific threat is made need declare the Unusual Event. This EAL is based on the DCPP Security and Safeguards Contingency Plan (ref. 1). This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment, and thus represent a potential degradation in the level of plant safety. SECURITY EVENTS which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR § 73.71or10 CFR § 50.72, as outlined in DCPP Administrative Procedure Xl1.ID2 (ref. 3). SECURITY EVENTS assessed as HOSTILE ACTIONS are classifiable under ICs HA1,- and HS1 and HG1. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan {and Independent Spent Fuel Storage Installation Security Program}. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be . advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the Security and Safeguards Contingency Plan. DCPP Basis Reference(s):

1. DCPP Security and Safeguards Contingency Plan

2. DCPP Procedures (Procedure names and designations are*controlled due to the nature of Safeguards and 10 CFR § 2.39 information.)

3. DCPP Administrative Procedure Xl1.ID2 "Regulatory Reporting Requirements and Reporting Process"

4. NEI 99-01 HU1 I [Document No.] Rev. [X] Page 133 of 3031

ATTACHMENT 1 EAL Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: HOSTILE ACTION within the OWNER CONTROLLED AREA or airborne attack threat within 30 minutes. EAL: HA1.1 Alert A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the Security Watch Commander. OR A validated notification from NRG of an aircraft attack threat within 30 minutes of the site. Mode Applicability: All Definition(s): HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). HOSTILE FORCE - One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. SITE BOUNDARY-As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making lnformationThis IC addresses the occurrence of a HOSTILE ACTION within the OVVNER CONTROLLED AREA or notification of an aircraft attack threat. This event will require rapid response and assistance due to the possibility of the attack progressing to the PROTECTED AREA, or the need to prepare the plant and staff for a potential aircraft impact. I[Document No.] Rev. [X] Page 134 of 3031

ATTACHMENT 1 EAL Bases The intent of the EAL is to ensure that appropriate notifications are made in a timely manner. The DCPP Safeguards Contingency Plan provides a description of SECURITY EVENTS indicative of a potential loss of the level of safety of the plant. NOTE: DO NOT revise this Technical Basis Document to add any identifying information to any SECURITY EVENT codes, and do not remove this note. Threats under this EAL include the following SECURITY EVENT categories:

• SE-1, SE-2, SE-5, SE-10, SE-16, SE-18 & SE-19 Security _Watch Commanders are the designated on-site personnel qualified and trained to confirm that a SECURITY EVENT is occurring or has occurred. Training on SECURITY EVENT classification confirmation is closely controlled due to the strict secrecy controls placed on the DCPP Security and Safeguards Contingency Plan (Safeguards) information. (ref. 1).

EAL #1The first threshold: lis applicable for any HOSTILE ACTION occurring, or that has occurred, in the OWNER CONTROLLED AREA (OCA). This includes any action directed against an ISFSI that is located outside the PLANT PROTECTED AREA. This event will require rapid response and assistance due to the possibility of the attack progressing to the PLANT PROTECTED AREA. EAL #2The OCA is the area and boundary contained in the DCPP Security and Safeguards Contingency Plan (ref. 1). Generally described, it is the area between Security Gate A (aka North Gate. and is located on the road located at the north edge of the exclusion area/SITE BOUNDARY) to Security Gate E (located on the main access road just north of Secondary (Backup) Met Tower and the SITE BOUNDARY), and extending eastward to encompass the 500 and 230kV switchyards. and bounded on the west by the Pacific Ocean. On UFSAR Figure 2.1-2 this is approximated as the "Exclusion Area Boundary". A copy of UFSAR Figure 2.1-2 is at the end of definitions section of this document. This IC does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between emplpyees, etc. Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR § 73.71 or 10 CFR § 50.72 as outlined in DCPP Administrative Procedure X11.ID2 (ref. 3).

• The second threshold:

An assessment of addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 3d minutes. The intent of this EAL is to ensure that threat-related notifications are made in a timely manner so that plant personnel and OROs are in a heightened state of readiness. This EAL is met when the threat-related information has been validated in accordance with fsite-specific security procedure.§} This event will require rapid response and assistance due fo the possibility of the need to prepare the plant and staff for a potential-aircraft impact. j [Document No.] Rev. [X] Page 135 of 303 j

ATTACHMENT 1 EAL Bases The NRC Headquarters Operations Officer (HOO) .will ,communicate to the licensee if the threat involves an aircraft. The status and size of the plane may be provided by NORAD through the NRC. * . In some cases, it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentiona' (i.e., a HOSTILE ACTION). It is expected, although not certain, that notification by an appropriate Federal agency to the site would clarify this point.. In this case, the appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. The emergency declaration, including one basecl on other ICs/EALs, ~hould not be unduly delayed while awaiting notification by a Federal agency.

Background

The security shift supervision is defined as the Security Watch Commander (ref. 1). Timely and accurate communications between the Security Shift Supervision Watch Commander and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security PlarJ, Training and Qualification Plan, Safeguards Contingency Plan {ancj Independent Spent Fuel Storage Installation Security Program}. As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering). The Alert declaration will also heighten the awareness of Offsite Response Organizations (OROs), allowing them to be better prepared should it be necessary to consid~r further actions.

          '\

Emergency plans and implementing procedures are public documents; therefore, EALs should , not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the DCPP Security and Safeguards Contingency PlanSecurity Plan. DCPP Basis Reference(s):

1. DCPP Security and Safeguards Contingency Plan

2. DCPP Procedures (Procedure names and designations are controlled due to the nature of Safeguards and 10 CFR § 2.39 information.)

3. DCPP Administrative Procedure Xl1.ID2 "Regulatory Reporting Requirements and Reporting Process"

4. NEI 99-01 HA1 I[Document No.] Rev. [X] Page 136 of 3031

ATTACHMENT 1 EAL Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: HOSTILE ACTION within the PLANT PROTECTED AREA. EAL: HS1 .1 Site Area Emergency A HOSTILE ACTION is occurring or has occurred within the PLANT PROTECTED AREA as reported by the Security Watch Commander. Mode Applicability: All Definition(s): HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). HOSTILE FORCE - One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. PLANT PROTECTED AREA -Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. Basis: ERO Decision Making Information The intent of this EAL is to address the potential for a very rapid progression of events due to a dedicated attack. It is not intended to address incidents that are accidental or acts of civil disobedience. such as physical disputes between employees within the OCA or PLANT PROTECTED AREA. Those events are adequately addressed by other EALs. HOSTILE ACTION identified above encompasses various acts including SECURITY EVENTS: NOTE: DO NOT revise this Technical Basis Document to add any identifying information to any SECURITY EVENT codes. and do not remove this note. Threats under this EAL include the following SECURITY EVENT categories: I [Document No.] I Rev. [X] I Page 137 of 3031 I L

ATTACHMENT 1 EAL Bases

• SE-2. SE-4. SE-5, SE-10. SE.:.15 This class of SECURITY EVENTS represents an escalated threat to plant safety above that contained in the Alert IC in that a hostile force has progressed from the OWNER CONTROLLED AREA (OCA) to the PLANT PROTECTED AREA (PA). Although DCPP security officers are well trained and prepared to protect against hostile action. it is appropriate for Offsite Response Organizations (OROs) to be notified and encouraged to begin preparations for public protective actions (if they do not normally) to be better prepared should it be necessary to consider further actions.

This IC addresses the occurrence of a HOSTILE ACTIQN within the PLANT PROTECTED AREA. This event will require rapid response and assistance due to the possibility for damage to plant equipment. This IC does not apply to a HOSTILE ACTION directed at an ISFSI PROTECTED AREA located outside the PLANT PROTECTED AREA; such an attack should be assessed using IC HA 1. It also does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR § 73.71 or 10 CFR § 50.72 as outlined in DCPP Administrative Procedure Xl1.ID2 (ref. 3). Security Watch Commanders are the designated on-site personnel qualified and trained to confirm that a SECURITY EVENT is occurring or has occurred. Training on SECURITY EVENT classification confirmation. is closely controlled due to the strict secrecy controls placed on the DCPP Security and Safeguards Contingency Plan (Safeguards) information. (ref. 1).

• Escalation of the emergency c!flssification level would be via IC HG1.

Background

The security shift supervision is defined as the Security Watch Commander. Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualific_ation Plan, Safeguards Contingency Plan {and Independent Spent Fuel Storage Installation Security Program}. As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering). The Site Area Emergency declaration will mobilize Offsite Response Organization (ORO) resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be* advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the DCPP Security and Safeguards Contingency PlanSecurity Plan. DCPP Basis Reference(s): I [Document No.] Rev. [X] Page 138 of 303 \

ATTACHMENT 1 EAL Bases

1. DCPP Security and Safeguards Contingency Plan

2. DCPP Procedures (Procedure names and designations are controlled due to the nature of Safeguards and 10 CFR §_2.39 information.)

3. DCPP Administrative Procedure Xl1.ID2 "Regulatory Reporting Requirements and Reporting Process"

4. NEI 99-01 HS1 I[Document No.] Rev. [X] Page 139 of 303 j

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 2 - Seismic Event Initiating Condition: Seismic event greater than Design Earthquake (DE} level. EAL: HU2.1 Unusual Event Seismic event> DE PGA as indicated by ground acceleration> 0.2 g on the "X" or "Y" axis or > 0.133 g on the "Z" axis. (Note 11) Note 11: If the Earthquake Force Monitor (EFM) is out of service, refer to CP M-4 Earthquake for alternative methods to assess ~arthquakes. Mode Applicability: All Definition(s): None Basis: ERO Decision Making Information Ground motion acceleration > 0.2 g on the "X" or "Y" axis or > 0.133g on the "Z" axis is the peak ground accelerafion (PGA) criterion for a Design Earthquake (DE) (ref. 3). If the EFM indicator alarms (> 0.2 g on the "X" or "Y" axis or > 0.133g on the "Z" axis) indicating the DE PGA has been exceeded, an Unusual Event should be declared. The "X" and "Y" axes correspond to horizontal peak acceleration values while the "Z" axis corresponds to vertical peak acceleration values .. If the EFM is not operable. the earthquake magnitude is determined by alternative methods in accordance with CP M-4. "Earthquake." If it is determined that any peak acceleration has exceeded 0.2 g on the "X" or "Y" axis or 0.133g on the "Z" axis. an Unusual Event should be declared (ref. 3). Event verification with external sources should not be necessary during or following aR Q.BEDE. Earthquakes of this magnitude should be readily felt by on-site personnel and recognized as a seismic event (e.g., lateral accelerations in excess of 0.08g). The .sf\.ifl: Manager or Emergency DirectorSM/SEC/ED may seek external verification if deemed appropriate (e.g., a call to the USGS, check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

In the event of an earthquake measuring greater than or equal to 0.01 g, the Seismic Instrumentation System annunciator PK15-24 will alert the control room and peak acceleration indications will be displayed on the EFM. The primary means for timely determination of the j [Document No.] Rev. [X] Page 140 of 303 j

ATTACHMENT 1 EAL Bases magnitude of an earthquake, and subsequently assessing emergency action levels, is using the EFM located in the control room (ref. 2).

• When the seismic monitoring system alarms, SM directs actions as defined in CP M-4,
• "Earthquake," and the seismic instrumentation system engineer is notified to coordinate post-earthquake activities including retrieval and analysis of the seismic event data. The purpose of the analysis is to determine within 4 hours whether the computed response spectra associated with any of the three directional components of the seismic event exceed the DE response spectra exceedance criterion (ref.4). -

It should be noted that the DE PGA values are-the zero period accelerations associated the DE response spectra. Since the DE PGA indications are available and displayed on the EFM within minutes. these are the indications used for timely emergency classification. The seismic monitoring system also stores the seismic event data and generates reports later used during the post-earthquake evaluation (ref.4} To avoid inappropriate emergency classification resulting from spurious actuation of the seismic instrumentation or felt motion notlattributable to seismic activity. an offsite agency (USGS, National Earthquake Information Center) can confirm that an earthquake has occurred in the area of the plant. Such confirmation should not. however. preclude a timely emergency declaration based on receipt of the EFM alert alarm. The NEIC can be contacted by calling (303) 273-8500. Select option #1 and inform the analyst you wish to confirm recent seismic activity in the vicinity of DCPP. Alternatively, near real-time seismic activity can be accessed via the NEIC website:- http://earthquake. usgs. govleqcenterl This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for aR Operating Basis Design Earthquake (~DE).* An earthquake greater . than aR GBe-DE but less than a Safe Shutdown Double Design Earthquake (SSEDDE) should have no significant impact on safety-related systems, structures and components; however, some time may be required for the plant staff to ascertain the actual post-event .condition of the plant (e.g., performs walk-downs and post-event inspections). Given the time necessary to perform walk-downs and inspections, and fully understand any impacts, this event represents a potential degradation of the level of safety of the plant. NOTE: An Operating Basis Earthquake (QBE) is referred to as Design Earthquake (DE) at . DCPP, and a Safe Shutdown Earthquake (SSE) is referred to as Double Design Earthquake (ODE) at DCPP (ref. 3). DCPP Basis Reference(s):

1. DCM T-6, Seismic Analysis of Structures

2. AR PK 15-24, Seismic Instr System

3. CP M-4, Earthquake

4. AWP E-017 Guidelines for Post-Earthquake Engineering Response

5. NEI 99-01 HU2 j [Document No.] Rev. [X] Page 141 of 3031

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: . Hazardous event. EAL: HU3.1 Unusual Event A TORNADO strike within the PLANT PROTECTED AREA. Mode Applicability: All Definition(s): PLANT PROTECTED AREA-Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. TORNADO -A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm. Basis: ERO Decision Making Information A TORNADO striking (touching down) within the PLANT PROTECTED AREA warrants - declaration of an Unusual Event regardless of the measured wind speed at the meteorological tower.* If damage is confirmed visually or by other in-plant indications. the event may be escalated to an Alert under EAL CA6.1 or SA9.1.

Background

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL #1 EAL HU3.1 addresses a TORNADO striking (touching down) within the PLANT PROTECTED AREA. EAL #2 addresses flooding of a building room or area that results in operators isolating pmver to a SAFETY SYSTEM component due to water level or other wetting concerns. Classification is also required if the 'llater level or related wetting causes an automatic isolation of a SAFETY SYSTEM component from its power souroe (e.g., a breaker or relay trip). To 'Jvarrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode. EAL #3 addresses a hazardous materials event originating at an offsite location and of sufficient magnitude to impede the movement of personnel within the PROTECTED AREA. EAL #4 addresses a hazardous event that causes an on site impediment' to vehicle movement and significant enough to prohibit the plant staff from assessing the site using personal I[Document No.] I Rev. [X] I Page 142 of 3031

ATTACHMENT 1 EAL Bases - vehicles. Examples of such an event include site flooding caused by a hurricane, heavy rains, up river 'Nater releases, dam failure, etc., or an on site train derailment blocking the access fea4 This EAL is not intended apply to routine impediments such as' fog, snow, ice, or vehicle breakdovms or accidents, but rather to more significant conditions such as the Hurricane l\ndrev1 strike on Turkey Point in 1992, the flooding around the Cooper Station during the Midv.*est floods of 1993, or the flooding, around Ft. Calhoun Station in 2011. , EAL #5 addresses (site specific description). Escalation of the emergency classification level would be based on ICs in Recognition Categories A, F, Sor C.

                                          \

DCPP Basis Reference(s):

1. CP M-16 Severe Weather

2. NEI 99-01 HU3

[Document No.] Page 143 of 303 j j I Rev. [X] L _ _ ___ ---

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.2 Unusual Event Internal room or area FLOODING of a magnitude sufficient to require manual or automatic electrical isolation of a SAFETY SYSTEM component required for the current operating mode. (Note 5) Note 5: If the equipment in the listed room or area was alr~ady inoperable or out-of-service before the event occurred, then no emergency classification is warranted. Mode_ Applicability: All Definition(s): FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor cc:)Qlant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitig?te the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information EAL #2 This EAL addresses FLOODING of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to water level or other wetting concerns. Classification is also required if the water level or related wetting causes an automatic isolation of a SAF.ETY SYSTEM component from its power source (e.g., a breaker or relay, trip). To warrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode. In modes 5, 6 and defueled, the appropriate plant configuration based Outage Safety Checklist in AD8.DC55 "Outage Safety Scheduling" should be consulted to identify required equipment supporting each of the specified safety functions (ref. 1). Refer to EAL CA6.1 or SA9.1 for internal flooding affecting one or more SAFETY SYSTEM trains. I[Document No.] Rev. [X] Page 144 of 3031

ATTACHMENT 1 EAL Bases Escalation of the emergency classification level would be based on ICs in Recognition Categories AR, F, Sor C.

Background

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL #1 addresses a tornado striking (touching down) *.vithin the PROTECTED AREA. EAL #3 addresses a hazardous materials event originating at an offsite location and of sufficient magnitude to impede the movement of personnel *.vithin the PROTECTED AREA. EAL #4 addresses a hazardous event that causes an on site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles. Examples of such an event include site flooding caused by a hurricane, heavy rains, up river water releases, dam failure, etc., or an on site train derailment blocking the access fGa4 This EAL is not intended apply to routine impediments such as fog, sno*.v, ice, or vehicle breakdovms or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the flooding around the Cooper Station during the Midwest floods of 1993, or the flooding around Ft. Calhoun Station in 2011. EAL #5 addresses (site specific description). DCPP Basis Reference(s):

1. AD8.DC55 Outage Safety Scheduling

2. NEI 99-01 HU3 j [Document No.] Rev. [X] Page 1'45 of 303 j

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditior:is Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.3 Unusual Event Movement of personnel within the PLANT PROTECTED AREA is IMPEDED due to an event involving hazardous materials (e.g., a chemical spill or toxic gas release from an area outside the PLANT PROTECTED AREA). Mode Applicability: All Definition(s):plant IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. Basis: ERO Decision Making Information This EAL is applicable to events in areas external to the DCPP PLANT PROTECTED AREA. EAL #3This EAL addresses a hazardous materials event originating at an offsite locationoutside the PLANT PROTECTED AREA and of sufficient magnitude to IMPEDE the movement of personnel within the PLANT PROTECTED AREA. Escalation of the emergency classification level would be based on ICs in Recognition Categories AR, F, Sor C.

Background

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL #1 addresses a tornado striking (touching down) within the PROTECTED AREA. This EAL addresses flooding of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to \Nater level or other '.\letting concerns. Classification is also required if the \'later level or related v.'etting causes an automatic isolation of a SAFETY SYSTEM component from its power source (e.g., a breaker or relay trip). To warrant classification, operability of the affected component must be required by Technical . . Specifications for the current operating mode. j [Document No.] Rev. [X] Page 146 of 303 j

ATTACHMENT 1 EAL Bases E/\L #4 addresses a hazardous event that causes an on site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles. Examples of such an event include site flooding caused by a hurricane, heavy rains, up river water releases, dam failure, etc., or an on site train derailment blocking the access m3h This E/\L is not intended apply to routine impediments such as fog, sno'A', ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the flooding around the Cooper Station during the Midwest floods of 1993, or the flooding around Ft. Calhoun Station in 2011. E/\L #5 addresses (site specific description). DCPP Basis Reference(s):

1. CP M-9A Hazardous Material Incident - Initial Emergency Response/Mitigation Procedure

2. NEI 99-01 HU3 j [Document No.] , Rev. [X] Page 147 of 303 j

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.4 Unusual Event A hazardous event that results in conditions sufficient to prohibit the plant staff from accessing the site via personal vehicles. (Note 7) Note 7: This EAL does not apply to routine traffic impediments such as fog, snow, ice, or vehicle breakdowns or accidents. Mode Applicability: All Definition(s): FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. Basis: ERO Decision Making Information EAL #4This EAL addresses a hazardous event that causes an on site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles. Examples of such an event include when both north and south access routes are unavailable due to site FLOODING caused by a hurricane, heavy rains, up river

.vater releases, dam failure, tsunami, mudslide, etc~. or an on site train derailment blocking the 1

access and egress roads (refer to CP M-12). This EAL is not intended apply to routine impediments such as fog, snow, ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the flooding around the Cooper Station during the Midwest floods of 1993, or the flooding around Ft. Calhoun Station in 2011. Escalation of the emergency classification level would be based on ICs in Recognition Categories AR, F, Sor C.

Background

Refer to CP M-12 Stranded Plant for conditions in which viable plant access routes are lost (ref. 1.). This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL #1 addresses a tornado striking (touching down) within the PROTECTED AREA. This EAL addresses flooding of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to V.'ater level or other wetting concerns. Classification is also required if the water level or related i,,vetting causes an automatic isolation I[Document No.] Rev. [X] Page 148 of 3031

ATTACHMENT 1 EAL Bases of a SAFETY SYSTEM component from its power source (e.g., a breaker or relay trip). To

 \\'arrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode.

DCPP Basis Reference(s):

1. CP M-12 Stranded Plant

2. NEI 99-01 HU3 l [Document No.] Rev. [X] Page 149 of 303 l

ATTACHMENT 1

                                                 . EAL Bases Category:                     H - Hazards and Other Conditions Affecting Plant Safety

• Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant.

EAL: HU4.1 Unusual Event A FIRE is not extinguished within 15 minutes of any of the following FIRE detection indications (Note 1):

• Report from the field (i.e., visual observation).
• Receipt of multiple (more than 1) fire alarms or indications.
• Field verification of a single fire alarm.

AND The FIRE is located within any Table H-1 area. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table H-1 Fire Areas

• Containment
• Auxiliary Building
• Fuel Handling Building
• Turbine Building
• Intake Structure Lower Levels
• Pipe Rack
• Main, Auxiliary & Startup Transformers Mode Applicability:

All Definition(s): FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not .constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain'functional during and following design .basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; j [Document No.] Rev. [X] Page 150 of 303 j

ATTACHMENT 1 EAL Bases (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information Multiple flow switches for the same general vicinity constitute a single alarm. This is because water flow in the sprinkler system can be seen on multiple switches for the same location. However. smoke and flame detectors are all individual alarms spaced far enough apart that each should be considered independent of each other.

+Re-For EAL HU4.1 the intent of the 15-minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc.

Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL HU4.1 assessment purposes. the emergency declaration clock starts at the time that multiple alarms or indications are received, the report was received, or the time that a single alarm is confirmed by subsequent verification action.For EAL assessment purposes, the* emergency declaration clock starts at the time that the initial alarm, indication, or report was received, and not the time that a subsequent verification action .vas performed. Similarly, the 1 fire duration clock also starts at the time of receipt of the initial alarm, indication or report. EAL#2 Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

Table H-1 Fire Areas are based on CP M-10, Fire Protection of Safe Shutdown Equipment. Table H-1 Fire Areas include those structures containing functions.and systems required for safe shutdown of the plant (SAFETY SYSTEMS) (ref. 1). This .IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. EAL#1 This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30 minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, the 30 minute clock starts at the time that the initial alarm \Vas received, and not the time that a subsequent verification action v.*as performed. A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30 minute period is a reasonable amount of time to determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress. I*[Document No.] Rev. [X] Page 151 of 3031

ATTACHMENT 1 EAL Bases , If an actual FIRE is verified by a report from the field, then EAL #1 is immedic~tely applicable, and the emergency must be declared if the FIRE is not extinguished within 15 minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs *.vithin 30 minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is \!Jarranted. EAL#3 In addition to a FIRE addressed by EAL #1 or EAL #2, a FIRE within the plant PROTECTED AREA not extinguished within 60 minutes may also potentially degrade the level of plant safety. This basis extends to a FIRE occurring within the PROTECTED AREA of an ISFSI located outside the plant PROTECTED AREA. [Sentence for plants with an ISFSI outside the plant Protected Area] EAL#4 If a FIRE within the plant or ISFSI [for plants with an ISFSI outside the plant Protected Area] PROTECTED AREA is of sufficient size to require a response qy an' offsite firefighting agensy (e.g., a losal tovm Fire Department), then the level of plant safety is potentially degraded. ,The dispatch of an offsite firefighting agency to the site requires an emergency deslaration only if it is needed to actively support firefighting efforts besause the fire is beyond the capability of the Fire Brigade to extinguish. Declaration is not necessary if the agency resources are plased on stand by, or supporting post extinguishment resovery or investigation actions. Basis Related Requirements from Appendix R Appendix R to 10 CFR 50, states in part: Criterion 3 of Appendix A to this part specifies that "Structures, systems, and components important to safety shall be designed and losated to minimize, sonsistent with other safety requirements, the probability and effect of fires and explosions."

         \A/hen con~idering the effects of fire, those systems associated with achieving and maintaining safe shutdown sonditions assume major importanse to safety besause damage to them san lead to sore damage resulting from loss of coolant through boil off.

Besause fire may affect safe shutdovm systems and because the loss of function of systems used to mitigate the consequenses of design basis assidents under post fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis acsidents. In addition, Appendix R to 10 CFR 50, requires, among other sonsiderations, the use of 1 hour fire barriers for the enclosure of sable and equipment and associated non safety sireµits of one redundant train (G.2.c). As used in EAL #2, the 30 minutes to verify a single alarm is well within this worst case 1 hour time period. DCPP Basis Reference(s):

\1. CP M-10, Fire Protection of Safe Shutdown Equipment I[Document No.]                                   Rev. [X]                         i  Page 152 of 3031

ATTACHMENT 1 EAL Bases

2. NEI 99-01 HU4 I [Document No.] Rev. [X] Page 153 of 3031

ATIACHMENT 1 EAL Bases

                                                              /

Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant. EAL: HU4.2 Unusual Event* Receipt of a single fire alarm (i.e., no other indications of a FIRE). AND The fire alarm is associated with any'Table H-1 area. AND The existence of a FIRE is not verified within 30 minutes of alarm receipt. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table H-1 Fire Areas

• Containment
• Auxiliary Building
• Fuel Handling Building
• Turbine Building
• Intake Structure Lower Levels
• Pipe Rack
• Main, Auxiliary & Startup Transformers Mode Applicability:

All Definition(s): FIRE - Combustion characterized by heat and light. . Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. SAFETY SYSTEM - A system required for safe plant operation, cooling down the* plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result 1 in potential offsite exposures. I [Document No.] Rev. [X] Page 154 of 3031

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information Multiple flow switches for the same general vicinity constitute a single alarm. This is because water flow in the sprinkler system can be seen on multiple switches for the same location. However, smoke and flame detectors are all individual alarms spaced far enough apart that each should be considered independent of each other. An "Incipient Alarm" meets the intent of a "single fire alarm." A "pre-alarm" does not meet the intent of a "single fire alarm." This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL HU4.2 assessment purposes, the 30-ininute clock starts at the time that the initial alarm was received, and not the time that a subsequent verification action was performed. If an actual FIRE is verified by a report from the field, then EAL #1 HU4.1 is immediately applicable, and the emergency must be declared it the FIRE 'is not eXtinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30-minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

Table H-1 Fire Areas are based on CP M-10. Fire Protection of Safe Shutdown Equipment. Table H-1 Fire Areas include those structures containing functions and systems required for safe shutdown of the plant (SAFETY SYSTEMS) (ref. 1). This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. EAL#1 The intent of the 15 minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering 'Naste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc. Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alarm, indication, or report 1.vas received, and not the time that a subsequent verification action 'Nas performed. Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report. EAL#2 A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of time to j [Document No.] Rev. [X] Page 155 of 303 j

ATTACHMENT 1 EAL Bases determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress. EAL #3 In addition to a FIRE addressed by EAL #1 or EAL #2, a FIRE within the plant PROTECTED

 /\REA not extinguished within 60 minutes may also potentially degrade the level of plant safety. This basis m<tends to a FIRE ooourring within the PROTECTED AREA of an JS.CS!
 .'eoated outside the pl-ant PROTECTED AREA. [Sentenoe for plants with an l-SFSl- outside the plant .Oroteoted Area]

EAL #4 Basis-Related Requirements from Appendix R Appendix R to 10 CFR 50, states in part: Criterion 3 of Appendix A to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions." When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance to safety because damage to them can lead to core damage resulting from loss .of coolant through boil-off. Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents. In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1-hour fire barriers for the enclosure. of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). As used in EAL #2HU4.2, the 30-minutes to verify a single alarm is well within this worst-case 1-hour time period. DCPP Basis Reference(s):

1. CP M-10, Fire Protection of Safe Shutdown Equipment

2. NEI 99-01 HU4 I [Document No.] Rev. [X] Page 156 ~f 3031

ATTACHMENT 1 EAL Bases Category: H .:... Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level.of safety of the plant. EAL: HU4.3 Unusual Event A FIRE within the ISFSI PROTECTED AREA or PLANT PROTECTED AREA not extinguished within 60 minutes of the initial report, alarm or indication. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceElded, or will likely: b.e exceeded. Mode Applicability: All Definition(s): FIRE - Combustion characterized by heat and .light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. ISFSI PRQTECTED AREA - Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan.' PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate.from the PLANT PROTECTED AREA. Basis: ERO Decision Making Information This IC addresses the magnitude and extent *of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

• In addition to a FIRE addressed by EAL #-1-HU4.1 or EAL #2HU4.2, a FIRE within the PLANT.

PROTECTED AREA not extinguished within 60-minutes m~y also potentially degrade the level of plant safety. This basis extends to a FIRE occurring within the Protected Area ofaR-the ISFSI located outside the PLANT PROTECTEQ AREA. [Sentence forp!ants 111ith an !SFS! outside tho plant Protected Area] Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

NoneEl\L #1 The intent of the 15 minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e~g., smoldering waste paper basket). In addition to I [Document No.] I* Rev. [X] Page 157 of 3031

ATTACHMENT 1 EAL Bases alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc. *

• Upon receipt, operators 'Nill take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alarm, indication, or report 'Nas received, and noUhe time that a subsequent verification action '.Vas performed.. Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report.

EAL#2 This EAL addresse.s receipt of a single fire alarm, and the existence ofa FIRE is not verified (i.e., proved or disproved) within 30 minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, tlie 30 minute clock starts at the time that the initial alarm 'Nas received, and not the time t~at a subsequent verification action '.vas performed. A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actu?I FIRE For this reason, additional time is allowed to verify the validity ofthe alarm. The 30 minute period is a reasonable amount of time to determine if an actual FIRE exists; hm\'ever, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress.

• If an actual FIRE is verified by a report from the field, then EAL #1 is immediately applicable, and the emergency must be declared iMhe FIRE is not extinguished v1ithin 15 minutes of the report.* If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30 minutes of the receipt of the alarm, then this EAL is not applicable and no emergency* declaration is \uarranted.

EAL#3 EAL#4 If a FIRE within the plant orlSFS! [forplants with an lSFSl outside the plant ProteotedArea] PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g:, a local tovm Fire Department), then the level of p,lant safety is potentially degraded. The. dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish. Declaration is not necessary if the agency resources are placed on stand by, OF supporting post extinguishment recovery rOF investigation actions. Basis Related Requirements from Appendix R Appendix R to 10 CFR 50, states in part: Criterion 3 of Appendix/\ to this part specifies that "Structures, systems, and components important to safety shall oe designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions." **

          \f\Jhen considering the effects of fire, those systems associated with achieving and maintaining safe shutdbwn conditions assume major importance to safety because damage to them ca*n lead to core damage resulting from loss of coolant through bojl off.

I[Document No.] Rev. [X] Page 158 of 3031

ATTACHMENT 1 EAL Bases Because fire may affect safe shutdovm systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post fire conditions does not per so impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdovm conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents. In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1 hour fire barriers for the enclosure of cable and equipment and associated non safety circuits of one redundant train (G.2.c). As used in EAL #2, the 30 minutes to verify a single alarm is 'A1ell within this worst case 1 hour time period. DCPP Basis Reference(s):

1. NEI 99-01 HU4 j [Document No.] Rev. [Xl Page 159 of 303 j

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant. EAL: HU4.4 Unusual Event A FIRE within the ISFSI PROTECTED AREA or PLANT PROTECTED AREA that requires firefighting support by an offsite fire response agency to extinguish. Mode Applicability: All Definition(s): FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. ISFSI PROTECTED AREA - Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. Basis: ERO Decision Making Information This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. If a FIRE within the plant or ISFSI [forplants with an ISFSI outside the plant ProteotedArea] or PLANT PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department, for DCPP this is normally CalFire), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts (engages in firefighting efforts or is needed to engage in firefighting efforts) because the fire is beyond the capability of the Fire Brigade (for DCPP. this is the DCPP Fire Department) to extinguish. Declaration is not necessary if the agency resources are placed on stand-by, or S\Jpporting post-extinguishment recovery or investigation actions. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

None EAL#1 J [Document No.] Rev. [X] Page 160 of 3031

ATTACHMENT 1 EAL Bases The intent of the 15 minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc. Upon receipt, operators 'Nill take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alarm, indication, or report was received, and not the time that a subsequent verification action was performed. Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report. EAL#2 This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30 minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, the 30 minute clock starts at the time that the initial alarm v1as received, and not the time that a subsequent verification action was performed. A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allo'Ned to verify the validity of the alarm. The 30 minute period is a reasonable amount of time to determine if an actual FIRE exists; hmvever, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress. If an actual FIRE is verified by a report from the field, then EAL #1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15 minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30 minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted. EAL#3 In addition to a FIRE addressed by EAL #1 or EAL #2, a FIRE within the plant PROTECTED AREA not extinguished within 60 minutes may also potentially degrade the level of plant safety. This basis e:xtends to a FIRE ooourring within the PROTECTED AREA of an !SFS! looated outside the p!-ant PROTECTED AREA. [Sentenoe for plants with an IS.CS! outside the plant Proteoted Area] EAL#4 Basis Related Reguirements from Appendix R Appendix R to 10 CFR 50, states in part: Criterion 3 of Appendix A to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions." V\lhen considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance to safety because damage to them can lead to core damage resulting from loss of coolant through boil off. I [Document No.] Rev. [X] Page 161 of 3031

ATTACHMENT 1 EAL Bases Because fire may affect safe shutdmvn systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents. In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1 hour fire barriers for the enclosure of cable and equipment and associated non safety circuits of one redundant train (G.2.c). /\s used in EAL #2, the 30 minutes to verify a single alarm is \vell within this worst case 1 hour time period. DCPP Basis Reference(s):

1. NEI 99-01 HU4 Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 5 - Hazardous Gases Initiating Condition: Gaseous release IMPEDING access to equipment necessary for normal plant operations, cooldown or shutdown.

EAL: HA5.1 Alert Release of a toxic, corrosive, asphyxiant or flammable gas into any Table H-2 rooms or areas. AND Entry into the room or area is prohibited or IMPEDED. (Note 5) Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted. Table H-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode(s) Auxiliary Building - 115' - BASTs 2,3,4 Auxiliary Building - 100' - BA Pumps 2,3,4 Auxiliary Building - 85' - Aux Control Board 2, 3,4 Auxiliary Building - 64' - BART Tank area 2,3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 Mode Applicability: 2- ~tartup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): j [Document No.] Rev. [X] Page 162 of 3031

ATTACHMENT 1 EAL Bases IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). Basis: ERO Decision Making Information The list of plant rooms or areas with entry-related mode applicability identified specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown. Specificaliy, the identified rooms are those where an activity must be performed to borate to cold shutdown, isolate accumulators or cooldown using RHR. If the equipment in the listed room or area was already inoperable. or out-of-service, before the event occurred. then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event. An Alert declaration is warranted if entry into the affected room/area is, or may. be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The . emergency classification is not contingent upon whether entry is actually necessary at the time of the release.

• Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the .

Emergency Dir'ectorSM/SAC/ED judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly IMPEDE procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter expert or operating experience with the same or similar hazards.' Access should be considered as IMPEDED if extraordinary measures are necessary to facilitate entry of personnel into the affected roomtarea (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely emp'loyed). An emergency declaration is not warranted if any of the following conditions apply:

• The plant is in an* operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release). For example, the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4.
• The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., fire suppression system testing).
• The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).
• The access control measures are of a conservative or precautionary nature, and would not actually prevent or IMPEDE a required action.

This EAL does not apply to firefighting activities that automatically or manually activate a fire suppression system in an area, or to intentional inerting of containment (BVVR only). Such events are classified per IC HU4 - Fire. \ [Document No.] Rev. [X] Page 163 of 303 \

ATTACHMENT 1 EAL Bases Escalation of the emergency classification level would be via Recognition Category AR, C or F ICs.

Background

Rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs. corrective measures or emergency operations) are not included. In addition, the list specifies the plant mode(s) during which entry would be required for each room or area (ref. 1). This G-EAL addresses an event involving a release of a hazardous gas that precludes or IMPEDES access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels. Most commonly, asphyxiants work by merely displacing air in an enclosed environment. This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness or even death. NOTE: JC HA5 mode applicability has been limited to the applicable modes identified in Table H-2 Safe Operation & Shutdown Rooms/Areas. If due to plant operating procedure or plant configuration changes, the applicable plant modes specified in Table H-2 are changed, a corresponding change to Attachment 3 'Safe Operation & Shutdown Areas Tables R-2 &'H-2 Bases' and to IC HA5 mode applicability is required. DCCP Basis Reference(s):

1. Attachment 3 Safe Operation & Shutdown Rooms/Areas Table R-2 & H-2 Bases

2. NEI 99-01 HA5 j [Document No.] Rev. [X] Page 164 of 303 j

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6 - Control Room Evacuation Initiating Condition: Control Room evacuation resulting in transfer of plant control to alternate locations. EAL: HA6.1 Alert An event requiring plant control to be transferred from the Control Room to the Hot Shutdown Panel area. Mode Applicability: All Definition(s): None Basis: ERO Decision Making Information For the purpose of this EAL the 15 minute classification clock starts when the last licensed operator leaves the Control Room. The Shift Manager (SM) determines if the Control Room requires evacuation and entry into OP AP-BA. Control Room inhabitability may be caused by fire, dense smoke, noxious fumes, bomb threat in or adjacent to the Control Room, or other life threatening conditions. OP AP-BA Control Room Inaccessibility - Establishing Hot Standby and OP AP-BB Control Room Inaccessibility - Hot Standby to Cold Shutdown provides the instructions establishing plant control from outside the Control Room (Ref. 1, 2). Inability to establish plant control from outside the Control Room escalates this event to a Site Area Emergency per EAL HS6. 1. Escalation of the emergency classification level would be via IC HS6.

Background

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety. Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations. The necessity to control a plant shutdown from outside the Control Room, in addition to responding to the event that required the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel. Activation of the ERO and emergency response facilities will assist in responding to these challenges. DCPP Basis Reference(s):

1. OP AP-BA Control Room Inaccessibility - Establishing Hot Standby j [Document No.] Rev. [X] Page 165 of 3031

ATTACHMENT 1 EAL Bases

2. OP AP-88 Control Room Inaccessibility - Hot Standby to Cold Shutdown

3. OP AP-34.5.1 Fire Response - Cable Spreading Room (FA 7-A)

4. OP AP-34.5.3 Fire Response - Control Room (CR-1)

5. NEI 99-01 HA6 I

I I [Document No.] Rev. [X] Page 166 of 3031

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety

                                                           \

Subcategory: 6 - Control Room Evacuation Initiating Condition: Inability to control a key safety function from outside the Control Room. EAL: HS6.1 Site Area Emergency An event has resulted in plant control being transferred from the Control Room to the Hot Shutdown Panel area. AND Control of any of the following key safety functions is not re-established within 15 minutes (Note 1):

• Reactivity (Modes 1, 2 and 3 only)
• Core Cooling
• RCS heat removal Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown, 5 - Cold Shutdown, 6 - Refueling Definition(s): None Basis: ERO Decision Making Information The Shift Manager (SM) determines if the Control Room requires evacuation per OP AP-BA. Control Room inhabitability may be caused by fire. dense smoke. noxious fumes. bomb threat in or adjacent to the Control Room. or other life threatening conditions. OP AP-BA Control Room Inaccessibility - Establishing Hot Standby and OP AP-BB Control Room Inaccessibility - Hot Standby to Cold Shutdown. provides the instructions establishing plant control from outside the Control Room (Ref. 1. 2). , The determination of whether or not "control" is established at the remote safe shutdown location(s) is based on Emergency DirectorSM/SEC/ED judgment. The Emergency DirectorSM/SEC/ED is expected to make a reasonable, informed judgment within (the site specific time f.or transf.er)J..§. minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s). The 15 minute clock starts once plant control has been transferred to the Hot Shutdown Area (OP AP-BA Attachment 4 4BOV Bus Alignment and Appendix F Electrical System Actions). I[Document No.]. Rev. [X] Page 167 of 3031

ATTACHMENT 1 EAL Bases Physical control of key safety functions by manipulation of controls is not required to verify control. rather. it is sufficient that control transfer is successful (i.e. light indication of applicable equipment). ' Escalation of the emergency classification level would be via IC FG1 or CG1

Background

Once the Control Room is evacuated. the objective is to establish control of important plant equipment and maintain knowledge of important plant parameters in a timely manner. Primary emphasis should be placed on components and instruments that supply protection for and information about safety functions. Typically, these safety functions are reactivity control (ability to shut down the reactor and maintain it shutdown). RCS inventory (ability to cool the core). and secondary heat removal (ability to maintain a heat sink). Hot Shutdown Panel (HSDP) indications for Reactivity. Core Cooling and RCS Heat Removal:

• Reactivity .

o Gamma Metrics indicators (Nl-53 & Nl-54)

• Core Cooling o Pressurizer Liquid Temperature (Tl-453B) o Pressurizer Pressure (Pl-455B) o RCS WR Pressure (Pl-406 at Dedicated Shutdown Panel) o RCS Temperatures (Loop 1 at Dedicated Shutdown Panel)
• RCS heat removal o AFWFlow Indicators (Fl-165 through 168) o AFW Pump discharge pressures (Pl-51 B through 53B) o SG WR Levels (Ll-501 through 504) o SG Pressures (Pl-514. 524. 534. 544)

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor tO a challenge to one or more fission product barriers within a relatively short period of time. DCPP Basis Reference(s):

1. OP AP-SA Control Room Inaccessibility - Establishing Hot Standby

2. OP AP-SB Control Room Inaccessibility - Hot Standby to Cold Shutdown

3. OP AP-34.5.1 Fire Response - Cable Spreading Room (FA 7-A)

4. OP AP-34.5.3 Fire Response - Control Room (CR-1)

5. NEI 99-01 HS6 I [Document No.] Rev. [X] Page 168 of 3031

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions existing that in the judgment of the SM/SEC/ED warrant declaration of a UE. EAL: HU7.1 Unusual Event Other conditions exist which in the judgment of the SM/SEC/ED indicate that events are in progress or have occurred which indicate a potential degrad;:ition of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs. Mode Applicability: All Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency DirectorSM/SEC/ED *to fall under the emergency classification level description for an NOUEUnusual Event.

Background

The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the SM/SEC/ED. emergency response personnel are notified and instructed to report to their emergency response locations. In this manner. the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response. but Plant Management is expected to manage the emergency response

• I[Document No.] . Rev. [X] Page 169 of 3031

ATTACHMENT 1 EAL Bases as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. Refer to CP M-10 Fire Protection of Safe Shutdown Equipment for a list of SAFETY SYSTEMS. DCPP Basis Reference(s):

1. NEI 99-01 HU7 I [Document No.] Rev. [X] Page 170 of 3031

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions exist that in the judgment of the SM/SEC/ED warrant declaration of an Alert. EAL: HA7.1 Alert Other conditions exist which, in the judgment of the SM/SEC/ED, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a SECURITY EVENT that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA PROTECTIVE ACTION GUIDELINE exposure levels. Mode Applicability: All Definition(s): EPA PROTECTIVE ACTION GUIDELINES (EPA PAG) - The EPA PAGs qre expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or_ other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should riot be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs . should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). OWNER CONTROLLED AREA {OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. SECURITY EVENT -Any incident representing an attempted, threatened, or actual breach of the security system or reduction of the operational effectiveness of that system. A security event can result in either a SECURITY CONDITION* or HOSTILE ACTION. Basis: ERO Decision Making Information This IC addresses _unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions. exist which are believed by the SM/SEC/EDEmergency Director to fall under the emergency classification level description for an Alert. I[Document No.] Rev. [X] Page 171 of 3031

ATTACHMENT 1 EAL Bases

Background

The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if . deemed appropriate by the SM/SEC/ED. emergency response personnel are notified and instructed to report to their emergency response locations. In this manner. the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response. but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. DCPP Basis Reference(s):

1. NEI 99-01 HA7 I [Document No.] Rev. [X]:. Page 172 ~f 3031 L

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety ( Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions existing that in the judgment of the SM/SEC/ED warrant deClaration of a Site Area Emergency. EAL: HS7.1 Site Area Emergency Other conditions exist which in the judgment of the SM/SEC/ED indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely failure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA PROTECTIVE ACTION GUIDELINE exposure levels beyond the SITE BOUNDARY. Mode Applicability: All Definition(s): EPA PROTECTIVE ACTION GUIDELINES (EPA PAG) - The EPA PAGs are expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or

 '  felonious acts that are not part qf a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA)

OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making l~formation This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SM/SEC/ED Emergency Director to fall under the emergency classification level description for a Site Area Emergency. I[Document No.] Rev. [X] Page 173 of 3031

ATTACHMENT 1 EAL Bases

Background

The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the SM/SEC/ED, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner. the individual usually in charge of activities in the Control Room is responsible for initiating the necessarv emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. I DCPP Basis Reference(s):

1. NEI 99-01 HS7 j [Document No.] Rev. [X] Page 174 of 303 j L ___ _

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions exist which in the judgment of the SM/SEC/ED warrant declaration of a General Emergency. EAL: HG7 .1 General Emergency Other conditions exist which in the judgment of the SM/SEC/ED indicate that events are in progress or have_ occurred which involve ~ctual or IMMINENT substantial core degradation

 . or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA PROTECTIVE ACTION GUIDELINE exposure levels offsite for more than the immediate site area.

Mode Applicability: All Definition(s): EPA PROTECTIVE ACTION GUIDELINES (EPA PAG) - The EPA PAGs are expressed in terms of dose _commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. HOSTILE ACTION-'An*act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be 1 included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same *area and boundary contained in the DCPP Security and Safeguards Contingency Plan. Basis: ERO Decision Making Information This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SM/SEC/EDEmergency Director to fall under the emergency classification level description for a General Emergency. j [Document No.] Rev. [X] Page 175 of 303 j

ATTACHMENT 1 EAL Bases Releases can reasonably be expected to exceed EPA PAG plume exposure levels outside the SITE BOUNDARY.

Background

The SM/SEC/ED is the designated onsite individual having the 'responsibility and authority for implementing the DCRP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if , deemed appropriate by tlie SM/SEC/ED, emergencyresponse personnel are notified and instructed to report to their emergency response locations: In this manner. the individual usually in charge of activities in the Control Room is responsible for initiating the necessary. emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. DCPP Basis Reference(s):

1. NEI 99-01 HG7 I [Document No.] . Rev. [X] Page 176 of 3031

ATIACHMENT 1 EAL Bases Category S - System Malfunction EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more .hot operating modes.* Numerous system-related equipment failure events that warrant emergency classification have been identified in this category. They may pose actual or potential threats to piant safety. The events of this category pertain to* the following subcategories:

1. *Loss of Vital AC Power Loss of vital electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of onsite and. offsite sources for 4.16KV AC vital buses.

2. Loss of Vital DC Power

  ~oss of vital electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fissidn product barrier integrity. This category includes loss of vital plant 145 VDC power sources.

3. Loss of Control Room Indications Certain events that degrade plant'operator ability to effectively assess plant conditions within the plant warrant emergency classification. Losses of indicators are in this subcategory. *

4. RCS Activity During normal operation, reactor coolant fission product activity is very low. Small

• concentrations of fission products in the coolant are primarily from the fission of tramp uranium in the fuel clad or minor perforations in the clad itself. Any significant increase from these base-line levels (2% - 5% clad failures) is indicative of fuel failures a*nd is covered under the Fission Product Barrier Degradation category .. However, lesser amounts of clad damage may result in coolant activity exceeding Technical Specification limits. These fission products will be circulated with the reactor coolant and can be detected by coolant sampling.

5. RCS LEAKAGE The reactor vessel provides a volume for the coolc;int that covers the reactor core. The reactor pressure vessel and associated pressure piping (reactor coolant system) together provide a barrier to limit the release of radioactive material should the reactor fuel clad integrity fail. Excessive RCS LEAKAGE greater than Technical Specification limits indicates potential pipe cracks that may propagate to an extent threatening fuel clad, RCS and containment integrity.

6. RTS Failure This subcategory includes events related to failure of the Reactor Trip System (RTS) to initiate and complete reactor trips. In the plant licensing basis, postulated failures of the RTS to com lete a reactor tri comprise a specific set of anal zed events referred to as

[Document No.] Rev. [X] Page 177 of 303

ATTACHMENT 1 EAL Bases Anticipated Transient Without Scram (ATWS) events. For EAL classification, however, ATWS is intended to mean any trip failure event that does not achieve reactor *shutdown. If RTS actuation fails to assure reactor shutdown, positive control of reactivity is at risk and could cause a threat to fuel clad, RCS and containment integrity.

7. Loss of Communications Certain events that degrade plant operator ability to effectively comr:nunicate with essential personnel within or external to the plant warrant emergency classification.

8. Containment Failure Failure of containment isolation capability (under conditions in which the containment is not .

currently challenged) warrants emergency classification. Failure of containment pressure control capability also warrants emergency classification.

9. Hazardous Event Affecting Safety Systems Various natural and technological events that result in degraded plant SAFETY SYSTEM performance or significant VISIBLE DAMAGE warrant emergency classification under this subcategory.

• SAFETY SYSTEM - A system required for safe plant operation, cooling down the plan.t and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could

• result in potential offsite exposures.

VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of.the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. I[Document No.] Rev. [X] Page 178 of 3031

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Loss of all offsite AC power capability to vital buses for 15 minutes or longer. EAL: SU1.1 Unusual Event Loss of all offsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H for ;::;: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

• Table S-1 AC Power Capability Unit 1 Unit2 4>

            ;:::

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

            ~

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator 4>

            ;:::

• DG 1 Bus H
• DG 2 Bus H 0

c

• DG 1 Bus G
• DG 2 Bus G
• DG 1 Bus F
• DG 2-3-Bus F
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information For emergency classification purposes. "capability" means that. whether or not the buses are actually powered from it. an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path.

and

• Breakers and equipment are readily available to power up the bus within the allotted time frame.

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). I [Document No.] I Rev. [X] Page 179 of 3031

ATTACHMENT 1 EAL Bases This !G--EAL addresses a prolonged (greater than 15 minutes) loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency buses. This condition represents a potential reduction in the level of safety of the plant. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power. When filling out the ENF form. this event can be Unit 1. Unit 2 or .Unit 1 and 2. Escalation of the emergency classification level would be via IC SA 1. Background / Unit 1(2) 4.16KV buses F, G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup tra'nsformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV uriit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations, vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition, each units vital buses F. G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). For emergenqy elassifieation purposes, "eapability" means that an offsite /\C power souree(s) is available to the emergeney buses, whether or not the buses are pmvered from it.

                                               /

I[Document No.] Rev. [X] Page 180 of 3031

ATTACHM.ENT 1 EAL Bases DCPP Electrical Distribution System 500kV Switchyard 230kV Switchyard Midwa/2~1~T~T'"£Y~----------~. Bus1E:..-i::::::~$ Mesa Midway 3 ._ ~T~T~  :..-i:::::: T~-,+ Morro

              ~ :\.{)/____/.                                                                ..-"---, ~----.---/.            ~ig__j    Bay Gates 1 4 122 J 622        Bus 1 u1 Main BankXfrnr
                                                     ~---~--- _____L'-0/.L...!...___J
                                                 ~SUXfrnrs ~                                    212 Bus 2 SOOkV        ~ ~~Ok~ ~                      ~ U2 Main BankXfrnr500kV/25kV AuxXfrnr       25kV            AuxXfmr            I)     ,....    ( '1       i~ l ljl    Aux  X~~rr
                                                                                                     .....:L:Jr 4k~S~~kVl   <:AL_., ~-rXfmr 1-1l12~V '4kV~ (~ 1-2U1 Main                                        j j          U2Main         (X)    (Y)

I I ) 12kV SU Bus (

                                                                                                                     =~

Generator ( ( Generator ["" - - -...-----------~SUXfrnrs~ ( ( --( 7 ll .:,01 \';  :;Jr.,':" ~u ~ y ~ IT11 Buse I) I) I) BusH l f¥1~~ ~f=rfi J I) I) I)

• BusG I) I) I)

BusF cl cl cl BusF cl cl cl BusG lTil ~ cl cl cl BusH U Buse DCPP Basis Refe.rence(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC .Power *

7. NEI 99-01 SU1 j [Document No.] Rev. [X] Page 181 of 303 j

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Loss of all but one AC power source to vital buses for 15 minutes or longer. EAL: SA1.1 Alert AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H reduced to a single power source for ~ 15 minutes. (Note 1)

• AND

. A failure of that single power source will result in loss of all AC power to SAFETY SYSTEMS. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

                            '            Table S-1     AC Power Capability Unit 1                                           Unit2 C1)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

         ~

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR * . Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator C1)

UJ

• DG 1 Bus H
• DG 2-2-Bus H c
• DG 1-2-Bus G
• DG 2 Bus G 0
• DG 1 Bus F
• DG 2-3-Bus F
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. I[Document No.] Rev. [X] Page t82 of 3031

ATTACHMENT '1 EAL Bases Basis: ERO Decision Making Information For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path.

and

• Breakers and equipment are readily available to power up the bus within the allotted time frame.

This .J.G-.EAL describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering* one, or more than one, train of safety-related equipment. This IC provides an escalation path from IC SU1.

• An "AC --power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.
• A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).
• A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being back-fed from the unit main generator.
• A loss of emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being bask-fed from an offsite power source.

                              \

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.

• When filling out the ENF form, this event can be Unit 1, Unit 2 or Unit 1 and 2.

Escalation of the emergency classification level would be via IC SS1.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F. G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations, vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition, each units vital buses F, G and H have j [Document No.] Rev. [X] Page 183 of 3031

ATTACHMENT 1 EAL Bases an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). If the capability of a second source of emergency bus power is not restored within 15 minutes, an Alert is declared under this EAL. Refer to CP M-10 Fire Protection of Safe Shutdown Equipment for a list of SAFETY SYSTEMS. I DCPP Electrical Distribution System 500kV Switchyard 230kV Switchyard Bus21~~~~ Midway 24- ~ 642 ~ ------------~ Bus 1 E~~_Q... Mesa

..._,......../- 282 Midway 34- ~T'£°"T~ - - - . L - T~,+ Morro

                                                                                                                                     ~ Bay
                  ~T'-£""____/.
                                                                                               ,......-/--, I-/--.--/.
                                                        ~---~--- ---1.'0/..l.......!....

If Gates 1 Bus 1 U1 Main Bus 2 4 - BankXfmr ~ SUX!mrs ~ 212

                                                    '""""I""' ~1oki:y '""""I""'               U2 Main Bank Xfmr 500kV/25kV I)                c'            I      AuxXfmr::::LV               25kV      ~AuxXfmr l l -~ U2 Main u
                                                                ,.....      ,                         2 - r r4kV 1 2 k V l 2-1 (X)     (Y) 12kV SU Bus (      (  (         Generator

.Jbs~i~"'~ ~c,~

U 4 BusE Bus D (X) kV (X) Bus_D BusE2 DG DG DG DG DG DG 1-1 1-2 1-3 2-3 2-1 2-2 UlFF1 ~~~~ Bus D I) I) I) Bus H l I) I) I) Bus G I) I) I) Bus F

                                                                        ~l=rf1 J fT-TI ~

cl cl cl Bus F cl cl cl Bus G cl cl cl Bus H

                                                                                                                                ~

Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 SA1 j [Document No.] Rev. [X] Page 184 of 303 j L_

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Loss of all offsite power and all onsite AC power to vital buses for 15 minutes or longer. EAL: SS1 .1 Site Area Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H for;:;:: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table S-1 AC Power Capability Unit 1 Unit2 G)

!::

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2-via Startup XFMR 1-1

                                                                         '         I
         ~

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• AuxXFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main 0

G)

         *u; c

Generator DG 1 Bus H DG 1-2-Bus G DG 1 Bus F Generator DG 2 Bus H DG 2-1-Bus G DG 2 Bus F

• other Unit via Startup Bus X~Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, syst~ms and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary;. (2) The capability to shut down the reactor and maintain it in a safe shutdown condition;

                                      )              .                                    .

(3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

• Basis:

ERO Decision Making Information I [Document No.] Rev. [X] Page 185 of 3031

ATTACHMENT 1 EAL Bases For emergency classification purposes. "capability" means that. whether or not the buses are actually powered from it. an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path.

and

• Breakers and equipment are readily available to power up the bus within the allotted time frame.

The 15-minute interval begins when both offsite and onsite AC power capability are lost. This .i.G-EAL addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. In addition, fission product barrier monitoring capabilities may be degraded under these conditions. This IC represents a condition that involves actual or likely major failures of plant functions neede9 for the protection of the public. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. When filling out the ENF form. this event can be Unit 1. Unit 2 or Unit 1 and 2. Escalation of the emergency classification level would be via ICs AG4RG1, FG1 or SG1.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F. G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1 or 2-1 transformer is unavailable. the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations. vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition. each units vital buses F. G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). -I [Document No.]. Rev. [X] Page 186 of 3031

ATTACHMENT 1 EAL Bases DCPP Electrical Distribution System 500kV Switchyard Bus21~~~~ Midway 2._ XI 642 ~ ------------~ Midway 3._ ~T~T~ ------.

  . Gates 1 c
              ~T~_____.;:

Bus 1 u1 Main BankXfmr 500kV BusE Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

 /

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 SS1 I[Document No.] Rev. [X] Page 187 of 3031

I . ATTACHMENT 1 EAL Bases Category: S -System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Prolonged loss of all offsite and all onsite AC power to vital buses. EAL: SG1 .1 General Emergency

                     .*                                             )

Loss of all offsite and all onsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H. AND EITHER:

• Restoration of at least one 4.16KV vital bus in < 4 hours is not likely. (Note 1)
• CSFST Core Cooling RED path conditions met.

   . Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-1 AC Power Capability Unit 1 Unit2 Cl.>

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

             ~

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• AuxXFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator Cl.>

!:::

• DG 1 Bus H
• DG 2-2-Bus H 0"'

c

• DG 1-2-Bus G
• DG 2-1-Bus G 2-3~
• DG 1 Bus F
• DG Bus F
• other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup, 3 ~ Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of 1accidents which could result in potential offsite exposures.

• I [Document No.] Rev. [X] Page 188 of 3031

                                                                                               \_

ATIACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL is indicated by the extended loss of all offsite and onsite AC power capability to 4.16KV vital buses F, G and Heither for greater then the DCPP Station Blackout (SBO) coping analysis time (4 hrs.) (ref. 1) or that has resulted in indications of an actual loss of adequate core cooling. Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED

'path conditions being met. (ref. 2).

For emergency classification purposes, "capability" means that. whether or not the buses are actually powered from it. an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG1. This will allow additional time for implementation of offsite protective actions. The estimate for restoring at least one emergency bus should be based on a realistic appraisal of the situation. Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public. The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core. When filling out the ENF form. this event can be Unit 1, Unit 2 or Unit 1 and 2.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). I [Document No.] Rev. [X] Page 189 of 3031

ATTACHMENT 1 EAL Bases Unit 1(2) 4.16KV buses F. G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1-1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations. vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition. each units vital buses F. G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 3-8). Four hours is the station blackout coping time (ref 1). Indication of continuing core cooling degradation must be based on fission product barrier monitoring with particular emphasis on SM/SEC/ED judgment as it relates to IMMINENT Loss of fission product barriers and degraded ability to monitor fission product barriers. Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED Path conditions being met (ref.2). Specifically, Core Cooling RED Path conditions exist if either:

• Core exit TCs are reading greater than or equal to 1200°F, or
• Core exit TCs are reading greater than or equal to 700°F with RCS subcooling less than or equal to 20°F. and RVLIS full range indication is less than or equal 32%.

This G--EAL addresses a prolonged loss of all power sources to AC emergency buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers. In addition, fission

,product barrier monitoring capabilities may be degraded under these conditions.

Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emergency bus by the end of the analyzed station blackout coping period. Beyond this time, plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges t~ multiple fission product barriers. DCPP Electrical Distribution System I [Document No.] Rev. [X] Page 190 of 3031

ATTACHMENT 1 EAL Bases 500kV Switchyard Bus2~~~~~ Midway 2..,. ~ 542 TX --------------~ Midway 3..,. ~T~T~ ------.

              ~T~------'-

Gates 1

• 122 622 Bus 1 Ba~1 ~~~

                                                                          .I I[Document No.]                                 Rev. [XJ  Page 191 of 3031

ATIACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. DCM T-42, Station Blackout

2. F-0, Critical Safety Function Status Trees Attachment 2, Core Cooling

3. UFSAR, Section 8.2.2

4. UFSAR, Section 8.3.1.6

5. OP AP SD-1, Loss of AC Power

6. OP AP-2, Loss of Offsite Power

7. OP J-2:V; Backfeeding the Unit From the 500kV System

8. ECA-0.0, Loss of All Vital AC Power

9. NEI 99-01 SG1 I [Document No.] Rev. [X] Page 192 of 3031

ATTACHMENT 1 EAL Bases Category: . S - System Malfunction Subcategory: 2 -:- Loss of Vital DC Power Initiating Condition: Loss of all vital DC power for* 15 minutes or longer. EAL: SS2.1 . Site Area Emergency Loss of all 125 VDC power based on battery bus voltage indications< 105 VDC on all Unit 1' or Unit 2 vital DC buses for~ 15 minutes. (Note 1) . Note 1: The SM/SEC/ED should declare the event promptly upon determining that time .limit has been exceeded, or will likely be exceeded. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby,A - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including th~ ECCS. These.are typically systems classified as safety-related (as defined in 10CFR50.2): - Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coola11t pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information Minimum battery voltage of 105 VDC is the voltage below which supplied loads may not function (ref. 1. 3. 4). This IC addresses a loss of vital DC power which compromises the ability to monitor and I control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public: Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Escalation of the emergency classification level would be via ICs AG:t-RG1, FG1 or WSSG1.

Background

The vital 125 VDC system consists of three independent networks per unit. Each network contains the following components:

• Battery
• Battery charger
• Standby battery charger to allow maintenance and/or testing j [Document No.] j Rev. [X] j Page 193 of 303 j

ATTACHMENT 1 EAL Bases

• Distribution panels
• Ground detector The vital 125 VDC batteries and distribution panels are located in Area "H" of the 115 feet elevation of the Auxiliary Building. There are a total of three batteries per unit. 11 (21 ), 12(22),

and 13(23). The batteries are sized to provide sufficient power to operate the associated DC loads for the time necessary to safely shut down the unit. should a 480-VAC source to one or more battery chargers be unavailable (ref. 1, 2, 3). DCPP Basis Reference(s):

1. ECA-0.0, Loss of All Vital AC Power

2. UFSAR, Section 8.3.2.2.*2

3. OP AP-23, Loss of Vital DC Bus

4. Notification 50804190 DC Bus Voltage Trigger for EALs

5. NEI 99-01 SSS

                                            \

/ [Document No.] Rev. [X] Page 194 of 303 j

ATTACHMENT 1 EAL Bases Category: S -System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all AC and vital DC power sources for 15 minutes or longer. EAL: SG2.1 General Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H for ~ 15 minutes. AND / Loss of all 125 VDC power based on battery bus voltage indications < 105 VDC on all Unit 1 or Unit 2 vital DC buses for~ 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that 'time limit has been exceeded, or will likely be exceeded. Table S-1 AC Power Capability Unit 1 Unit2 Cl)

!:::::

• Startup XFMR 1-2 via Startup XFMR 1-1 * . Startup XFMR 2-2.via Startup XFMR 1-1

          ~

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2:..2 backfed via Main XFMR
• AuxXFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator Cl)

(/)

• DG 1 Bus H
• DG 2-2-Bus H c
• DG 1 Bus G
• DG 2-1-Bus G 0 -
• DG 1-3-Bus F
• DG 2-3-Bus F
• Other Unit via Startup Bus X-Tie * 'Other Unit via Startup Bus X-Tie Mode Applicability:

1. - Power Operatio.n, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR5q.2): / Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; 1 (3) The capability to prevent or mitigate the consequences of accidents which could result

• in p9tential offsite exposures.

j [Document No.] Rev. [X] Page 195 of 3031

ATIACHMENT 1 EAL Bases Basis: ERO Decision Making Information For emergency classification purposes. "capability" means that. whether or ndt the buses are actually powered from it. an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path.

and

• Breakers and equipment are readily available to power up the bus within the allotted time frame.

Minimum battery voltage of 105 VDC is the voltage below which supplied loads may not function (ref.6. 8, 9). This IC addresses a concurrent and prolonged loss of both vital AC and Vital DC power. A loss of all vital AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both vital AC and vital DC power will lead to multiple challenges to fission product barriers. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.

Background

This EAL is indicated by the loss of all offsite and onsite vital AC power capability to 4.16KV vital buses F. G and H for greater than 15 minutes in combination with degraded vital DC power voltage. This EAL addresses operating experience from the March 2011 accident at Fukushima Daiichi. The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F. G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations. vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition. each units vital buses F. G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). The vital 125 VDC system consists of three independent networks per unit. Each network contains the following components: I [Document No.] Rev. [X] Page 196 of 3031

ATTACHMENT 1 EAL Bases

• Battery
• Battery charger
• Standby battery charger to allow maintenance and/or testing
• Distribution panels
• Ground detector The vital 125 VDC batteries and distribution panels are located in Area "H" of the 115 feet elevation of the Auxiliary Building. A total of three batteries per unit, 11(21), 12(22), and 13(23) are supplied for Units 1 and 2. The batteries are sized to provide sufficient power to operate the associated DC loads for the time necessary to safely shut down the unit, should a 480-VAC source to one or more battery chargers be unavailable (ref. 7, 8).

DCPP Electrical Distribution System 500kV Switchyard 230kV Switchyard Midway 2+- Bus21~~~~

                     ~ s42 ~ ------------~                                                                  Bus1E~~.Q.. Mesa

..._,......../- 282 Midway 3+- ~T'£°"T~ ----. L__ T~-,+ Morro

                                                                                                                                          ~l?L.J    Bay
                     ~T~_____/.
                                                                                                      ,.-/---, I--/----.--/.

Gates 1 Bus 1 u1 Main . . - - - - - - . - - - __J_'-0/,.L.!___J Bus 2 c - BankXfmr ~SUX!mrs ~ 212 500kV

                                                                                            ;:'"F lr;- -)-

l""V")V"' ~~0t::f l""V")V"' U2 Main Bank Xfmr 500kV/25kV Aux Xfmr 25kV Aux Xfmr I I) cII _l_~I Aux x~rr;:::::r::ur 4k~5~~kVl  ::::Lv ~-'1" Xfmr 1-1 12kV 4kV~ (~ 1-2U1 Main 12kV:i Bus i i -= U2 Main (X} (Y}

     == .                          I I       Generator
                      -)..,..)---------~SUX!mrsi.12
                                                        ~   (Yt oour oo)L_{
                                                                  )

(X?k~(X} CCC J(Y} [ Generator

                                                                                                                                 =

C C

                                                                                                                                                 =

C 7 B rr=rt r-{~{~ ~i=rf~ lTil ~ 00 00

                     ~            i) i) ,)         ,) ,) ,)  ,) ,) ,)         Ci Ci Ci       Ci Ci Ci J     Ci Ci Ci                ~

Bus D Bus H Bus G Bus F Bus F Bus G Bus H Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power I [Document No.] Rev. [X] Page 197 of 3031

ATTACHMENT 1 EAL Bases

7. UFSAR, Section 8.3.2.2.2

8. OP AP-23, Loss of Vital DC Bus *I

9. Notification 50804190 DC Bus Voltage Trigger for EALs

10. NEI 99-01 SGS

                                              /)

I[Document No.] Rev. [X] Page ,198 of 303 j

                                             ,A*"'ATIACHMENT 1 **

EAL Bases Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer. EAL: SU3.1 Unusual Event An UNPLANNED event results in the inability to monitor one or more Table S-2 parameters from within the Control Room for ~ 15 minutes. (Note 1) Note 1: 'The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table S-2 Safety System Parameters

• Reac~or p'Ower
• RCS level
• RCS pressure
• Core Exit TC temperature
• Level in at least one SG
• Auxiliary or emergency feed flow in at least one SG Mode Applicability:

1 - Power Operation, 2 - Startup, 3 ..: Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components"that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. UNPLANNED - A parameter change, or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information I[Document No.] Rev. [X] Page 199 of 3031

ATTACHMENT 1 EAL Bases SAFETY SYSTEM parameters listed in Table S-2 are monitored in the Control Room through

*a combination of hard control panel indicators as well as computer based information systems.

The Plant Computer (PPC). ERFDS and SPDS serve as a redundant compensatory indicators which may be utilized in lieu of normal Control Room indicators (ref. 1). As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication. , Escalation of the emergency classification level would be via IC ~SA3. Background ' This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant. An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making. This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [.011'/R] I RPV level [Bll'/R] and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWR] I RPV 1.vater level [B'A'R] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well. DCPP Basis Reference(s):

1. UFSAR Section 7.5 Safety-Related Display Instrumentation

2. NEI 99-01 SU2 I [Document No.] Rev. [X] Page 200 of 3031

ATIACHMENT 1 EAL Bases j Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress. EAL: SA3.1 Alert An UNPLANNED event results in the inability to monitor one or more Table S-2 parameters from within the Control Room for ;:;:; 15 minutes. (Note 1) AND Any significant transient is in progress, Table S-3 .. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table S-2 Safety System Paramete

• Reactor power
• RCS level
• RCS pressure
• Core Exit TC temperature
• Level in at least one SG
• Auxiliary or emergency feed flow in at least one SG Table S-3 Significant T1eu __ ~: .. ~-
• Reactor trip
• Runback ;:;:; 25% thermal power
• Electrical load rejection > 25%

electrical load

• ECCS actuation Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): j [Document No.] Rev. [X] Page 201 of 303 j

ATTACHMENT 1 EAL Bases Those structure.s, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressur:e boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. UNPLANNED - A parameter change or an E?Vent that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information SAFETY SYSTEM parameters listed in Table S-2 are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems. The Plant Computer (PPG), ERFDS and SPDS serve as a redundant compensatory indicator which may be utilized in lieu of normal Control Room indicators (ref. 1). Significant transients are listed in Table S-3 and include response to automatic or manually initiated functions such as reactor trips. runbacks involving greater than or equal to 25% thermal power change. electrical load rejections of greater than 25% full eledrical load or ECCS (SI) injection actuations. As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). f7or example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room. Fifteen minutes was selected as a threshold to exclude transient o'r momentary losses of indication. Escalation of the emergency classification-level would be via ICs FS1 or IC AS4RS1

Background

This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant. An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRG event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making. I [Document No.] Rev. [X] Page 202 of 3031

ATTACHMENT 1 EAL Bases This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [Pl/1/R] I RPV level [Bll'JR] and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PVVR] I RPV water level [Bll'JR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well. DCPP Basis Reference(s):

1. UFSAR Section 7.5 Safety-Related Display Instrumentation

2. NEI 99-01 SA2 I [Document No.] Rev. [X] Page 203 of 3031

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification permissible limits. EAL: SU4.1 Unusual Event RCS activity> Technical Specification Section 3.4.16 permissible limits. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This EAL would be met if TS 3.4.16 Required Action C.1 (place plant in Mode 3 in 6 hours) or C.2 (place plant in Mode 5 in 36 hours) were not met. Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category A-B_ICs.

Background

The specific iodine activity is limited to 1.0 µCi/gm Dose Equivalent 1-131. However. operation with iodine specific activity levels greater than the limit is permissible. if the activity levels do not exceed 60.0 µCi/gm Dose Equivalent 1-131. for more than 48 hours. The specific Xe-133 activity is limited to s; 600 µCi/gm Dose Equivalent XE-133(ref1). With the Dose Equivalent 1-131 greater than the LCO limit of 1 µCi/gm, samples at intervals of 4 hours must be taken to demonstrate that the specific activity is< 60.0 µCi/gm. Dose Equivalent 1-131 must be restored to within limits within 48 hours. This is acceptable since it is expected that. if there were an iodine spike. the normal RCS*iodine concentration(::;; 1 µCi/gm) would be restored within this time period (ref 2). This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. DCPP Technical Spedfications section 3.4.16 RCS Specific Activity

2. DCPP Technical Specifications Basis section 3.4.16 RCS Specific Activity

3. NEI 99-01 SU3 j [Document No.] Rev. [X] Page 204 of 303 j

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits. EAL: SU4.2 Unusual Event With letdown in service, procedurally directed letdown dose point radiation > 3 R/hr. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant. Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category A-B_ICs.

Background

Initial indication of Fuel Clad degradation can be determined by measuring the external radiation dose rate at a distance of one foot from the center of the letdown line in the letdown heat exchanger room using the technique described in Attachment 7.1 of EP RB-14A. Initial Detection of Core Damage. An external radiation dose rate exceeding 3 R/hr indicates Fuel Clad degradation greater than Technical Specification allowable limits. This value was determined by ratioing 15 R/hr which corresponds to coolant activity at 300 µCi/gm to the Technical Specification LCO coolant activity of 60 µCi/gm which includes iodine spike (see EAL SU4.1 ), or 15 R/hr x 60/300 =3 R/hr (ref 1, 2, 3). DCPP Basis Reference(s):

1. EP RB-14A, Initial Detection of Core Damage

2. DCPP Technical Specifications section 3.4.16 RCS Specific Activity

3. PG&E Calculation EP 95-02 Rev. 0, Letdown Heat Exchanger Rom Dose Rates Corresponding to EP G-1, Alert No. 2 RCS Activity

4. NEI 99-01 SU3 I [Document No.] Rev. [X] Page 205 of $031

ATIACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 5 - RCS Leakage Initiating Condition: RCS LEAKAGE for 15 minutes or longer. EAL: SU5.1 Unusual Event RCS unidentified or pressure boundary leakage > 10 gpm for.;:: 15 minutes. OR RCS identified leakage > 25 gpm for;:: 15 minutes. OR . . Leakage from the RCS to a location outside containment > 25 gpm for ;:: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

• Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): RCS LEAKAGE - RCS leakage shall. be:

a. Identified Leakage

1. Leakag~, such as that from pump seals or valve packing _(except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank; *

   . 2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage}.

b. Unidentified Leaka~e-All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

f. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outsiqe containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

Basis: I[Document No.] Rev. [X] Page 206 of 3031

A TTACHMENT 1 EAL Bases { ERO Decision Making Information These EALs conditions tffils-.apply to lea kage into the containment, a secondary-side system (e.g., steam generator tube leakage in a PVVR) or a location outside of containment. EAL #1 and EAL #2The first and second EAL conditions are focused on a loss of mass from the RCS due to "unidentified leakage", "p ressure boundary leakage" or "identified leakage" (as these leakage types are defined in the pl ant Technical Specifications) (ref. 2). EAL #3The third condition addresses an RCS mass loss caused by an UNISOLABLE leak through an interfacing system (ref. 3, 4, 5). The release of mass from the RCS_due t o the as-designed/expected operation of a relief valve does not warrant an emergency classification. Fer PVVRs, aAn emergency classification would

'be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sti cks open and the line flow cannot be isolated). ~

BVVRs, a st1::1sk e13en Safety Relief Valve (SRV) er SR\f leakage is net sensidered either identified er 1::1nidentified leakage by Tesh nisal S13esifisatiens and, therefore, is net a1313lisable te th is EAL. The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible. Escalation of the emergency classificatio n level would be via ICs of Recognition Category A-R or F. Below is a summary of classification guid ance for steam generator tube leaks: Affected SG is FAUL TED Outside of Containment? Primarv-to-Secondarl Leak Rate Less than or egual to 25 g12m No classification No classification Greater than 25 g12m unusual Event 12er SU5.1 Unusual Event 12er SU5.1 Reguires 012eration of a standby charging (makeu12) 12um12 (RCS s ite Area Emergency 12er Alert 12er FA 1.1 FS1.1 Barrier Potential Loss) Reguires an automatic or manual ECCS (SI) actuation (RCS Barrier s ite Area Emergency 12er Alert 12er FA 1.1 FS1.1 Loss)

Background

Manual or comQuter-based methods of Qerforming an RCS inventory balance are normally used to determine RCS LEAKAGE. STP R-1 OC 1 Reactor Coolant System Wa ter Inventory Balance 1 is Qerformed to determine the source and flow rate of the leakage. (ref. 1). I[Document No.] I Rev. [X] Page 207 of 303 j

ATTACHMENT 1 EAL Bases Escalation of this EAL to the Alert level is via Category F. Fission Product Barrier Degradation. EAL FA1.1. This IC addresses RCS_LEAKAGE which may be a precursor to a more significant event. In this case, RCS_LEAKAGE has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant. The leak rate values for each Ab-condition were selected because they are usually observable with normal Contra.I Room indications .. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). EAL #1 The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary lee;:tkage.

• DCPP Basis Reference(s):

1. STP R-10C, Reactor Coolant System Water Inventory Balance

2. DCPP Technical Specifications Definitions section 1.1

3. UFSAR Section 5.2.7 Reactor Coolant Pressure Boundary Leakage Detection System*

4. UFSAR Section 5.2.9 Leakage Prediction From Primary Coolant Sources Outside Containment

5. OP AP-1, Excessive Reactor Coolant System Leakage

6. NEI 99-01 SU4 I [Document No.] Rev. [X] Page 208 of 3031

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 6 - RTS Failure. Initiating Condition: Automatic or manual trip fails to shut down the reactor. EAL: SU6.1 Unusual Event An automatic trip did not shut down the reactor as indicated by reactor power ;::: 5% after any RTS setpoint is exceeded. AND A subsequent automatic trip or manual trip action taken at the control room panels (CC1, VB2 or VB5) is successful in shutting down the reactor as indicated by reactor power

 < 5%. (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. Mode Applicability: 1 - Power Operation Definition(s): None Basis: ERO Decision Making Information For the purposes of emergency classification. successful manual trip actions are those which - can be quickly performed from the control room panels (GC1. VB2 or VB5):

• Reactor trip switches (CC1 and VB2)
• Deenergization of 480V Buses 13D and 13E (23D and 23E) at the Control Room vertical board (VB5)

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/ATWS (such as locally opening the reactor trip beakers. local deenergization of 480V Buses 13D and 13E. emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4). Following any automatic RTS trip signal, E-0 (ref. 2) and FR-S.1 (ref. 4) prescribe insertion of redundant manual trip signals to back.up the automatic RTS trip function and ensure reactor shutdown is achieved. Even if the first subsequent manual trip signal inserts all control rods to the full-in position immediately after the initial failure of the automatic trip, the lowest level of classification that must be declared is an Unusual Event (ref. 4). A reactor trip resulting from actuation of the A TWS Mitigation System Actuation Circuitry CAMSAC) logic that results in full insertion of control rods and diminishing neutron flux is considered a successful reactor trip. AMSAC automatically initiates auxiliary feedwater and a

                                             /'

J [Document No.] Rev. [X] Page 209 of 303 J

ATTACHMENT 1 EAL Bases turbine trip under conditions indicative of an Anticipated Transient Without Scram (ATWS) event (ref. 5). In the event thatthe operator identifies a reactor trip is IMMINENT and initiates a successful manual reactor trip before the automatic RTS trip setpoint is reached. no declaration is required. The successful manual trip of the reactor before it reaches its automatic trip setpoint or reactor trip signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. However. if subsequent manual reactor trip actions fail to reduce reactor power below 5%. the event escalates to the Alert under EAL SA6.1. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles". Should a 'reactor {trip [PV'!R] I scram [B'NR])signal be generated as a result of plant work (e.g., RPS-RTS setpoint testing), the following classification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor {trip

[P'NR] I scram [B'NR])and the RPS-RTS fails to automatically shut down the reactor, then this IC and the EALs are applicable, and should be evaluated.

• If the signal does not cause a plant transient and the {trip [PVVR] I scram [BVVR])failure is dete'rmined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Background

The first condition of this EAL identifies the need to cease critical reactor operations by actuation of the automatic Reactor Trip System (RTS) trip function. A reactor trip is automatically initiated by the RTS when certain continuously monitored parameters exceed predetermined setpoints (ref. 1). Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative startup rate. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-trip response from an automatic reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful trip has therefore occurred when there is sufficient rod insertion from the trip of RTS to bring the reactor power below the immediate shutdown decay heat level of 5% (ref. 2. 3. 4). If by procedure. operator actions include the initiation of an immediate manual trip following receipt of an automatic trip signal and there are no clear indications that the automatic trip failed (such as a time delay following indications that a trip setpoint was exceeded), it may be difficult to determine if the reactor was shut down because of automatic trip or manual actions. If a subsequent review of the trip actuation indications reveals that the automatic trip did not cause the reactor to be shut down. then consideration shoula be given to evaluating the fuel for potential damage. and the reporting requirements of 50. 72 should be considered for the transient event. This IC addresses a failure of the RP-S-RTS to initiate or complete an automatic or manual reactor {trip [Pll'JR] /scram [Bll'JR])that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic {trip [Pll'IR] l j [Document No.] j Rev. [X] j Page 210 of 3031

ATTACHMENT 1 EAL Bases scram [BV'/R])is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant. Following the failure on an automatic reacfor ftrip[PV'/R] I scram [BV'/R]), operators will promptly initiate manual actions at the reactor control consoles 'to shut down the reactor (e.g., initiate a manual reactor ftrip[PV'/R] /scram [BV'/R])). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. If an initial manual reactor ftrip [PV'/R] I scram [BV'/R])is unsuccessful, operators will pror:nptly take manual action at another location(s) on the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor ftrip[PV'/R] I scram [BV'/R])) using a different switch). Depending upon several factors, the initial or subsequent effort to ma.nually ftrip [PV'/R] I scram [BV'/R])the reactor, or a .concurrent plant condition, may lead to the generation of an automatic reactor ftrip [PV'/R] I scram [BV'/R])signal. If a subsequent manual or automatic ftrip [PV'/R] / scram [Bll'IR])is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrip[PV'/R] I scram [BV'/R])). This action does not include manually driving in control rods or _ implementation of boron injection strategies. Taking the Reactor Mode Si..vitch to SHUTDOVVN is considered to be :;i manual scram action. [BV'/R] - The plant response to the -failure of an automatic or manual reactor ftrlp [PVVR] I scram [BVVR])will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SMSA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant.conditions needed to meet either IC SAa-SA6 or FA1, an un*usual event declaration is appropriate for this event. A reactor shutdown is determined in accordance with applicable emergency operating procedure criteria._ DCPP Basis Reference(s):

1. DCPP Technical Specifications Section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. E-0 Reactor Trip or Safety Injection

3. F-0 Critical Safety Function Status Trees - Subcriticality

4. FR-S.1 Response to Nuclear Power Generation/ATWS

5. UFSAR Section 7.6.2.3 ATWS Mitigation Actuation Circuitry (AMSAC) 6 NEI 99-01 SU5 I [Document No.] Rev. [X] Page 211 of 3031

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 6 - RTS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor. EAL: SU6.2 Unusual Event i

                                                                                        /

A manual trip did not s_hut down the reactor as indicated by reactor power~ 5% after any manual trip action was initiated. AND A subsequent automatic trip or manual trip action taken at the control room panels (CC1, VB2 or VB5) is successful in shutting down the reactor as indicated by reactor power

 < 5%. (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. Mode Applicability: 1 - Power Operation Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS: These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant*pressure boundary; (2) The capability to shut*down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information For the purposes of emergency classification. successful manual trip actions are those which can be quickly performed from the control room *panels (CC1, VB2 or VB5):

• Reactor trip switches (CC1 and VB2)
• Deenergization of 480V Buses 13D and 13E (23D and 23E) at the Control Room vertical board (VB5)

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/ATWS (such as locally opening the reactor trip beakers. local deenergization of 480V Buses 13D and 13E (23D and 23E), emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4). j [Document No.] Rev. [X] Page 212 of 303 j

ATTACHMENT 1 EAL Bases A reactor trip resulting from actuation of the A TWS Mitigation System Actuation Circuitry (AMSAC) logic that results in full insertion of control rods and diminishing neutron flux is considered a successful reactor trip. AMSAC automatically initiates auxiliary feedwater and a turbine trip under conditions indicative of an Anticipated Transient Without Scram (ATWS) event (ref. 5). If both subsequent automatic and subsequent manual reactor trip actions in the Control Room fail to reduce reactor power below the power associated with the SAFETY SYSTEM design (< 5%) following a failure of an initial manual trip, the event escalates to an Alert under EAL SA6.1. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles". Should a reactor ftrip [P'A'R] I scram [BV\JR])signal be generated as a result of plant work (e.g., RPS-RTS setpoint testing), the following classification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor ftrip

[PV\JR) I scram [BV\JR])and the RPS-RTS fails to automatically shut down the reactor, then this IC and the EALs are applicable, and should be evaluated.

• If the signal does not cause a plant transient and the ftrip [PV\JR] I scram [BWRfailure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Background

This EAL addresses a failure of a manually initiated trip in the absence of having exceeded an automatic RTS trip setpoint and a subsequent automatic or manual trip is successful in shutting down the reactor (reactor power< 5%). (ref. 1). Following *a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative startup rate. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to

*be observable. A predictable post-trip response from a manual reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful trip has therefore occurred when there is sufficient rod insertion from the trip of RTS to bring the reactor power below the immediate shutdown decay heat level of 5% (ref. 2. 3, 4).

This IC addresses a failure of the RPS-RTS to initiate or complete an automatic or manual reactor ftrip [Pl/1/R] I scram [Bl/1/R])that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic ftrip[Pll'./R) I scram [Bll'IR]) is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant. Following the failure on an automatic reactor ftrip[Pll'IR] I scram [Bll'IR]), operators will promptly initiate manual actions at the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor ftrip[Pll'IR] I scram [Bll'IR])). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. I [Document No.] I Rev. [X] Page 213 of 3031

ATTACHMENT 1 EAL Bases If an initial manual reactor ftrip [Pl/1/R] /scram [Bl/1/R])is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor ftrip[Pl/1/R] /scram [Bl/1/R])) using a different switch. Depending upon several factors, the initial or subsequent effort to manually (trip [Pl/1/R] I scramtrip[Bl/1/R]) the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor ftrip [Pl/1/R] I scram [Bl/1/R])signal. If a subsequent manual or automatic ftrip [Pl/1/R] / scram [Bll11R])is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrip[Pl/1/R] /scram [Bl/1/R])). This action does not include manually driving in control rods or implementation of boron injection strategies.

                       /

Taking the Reactor Mode S\uitch to SHUTDOVVN is considered to be a manual scram action. [Bl/1/R] The plant response to the failure of an automatic or manual reactor ftrip [PVVR] /scram [BVVR])will vary based upon s~veral factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operatbr manual 'actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SMSA6. Depending upon the plant I response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA9-SA6 or FA1, an unusual event declaratjon is appropriate for this event.

 . A reactor shutdown is determined in accordance with applicable emergency operating procedure criteria.

DCPP Basis Reference(s):

1. DCPP Technical Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. E-0 Reactor Trip or Safety Injection

3. F-0 Critical Safety Function Status Trees - Subcriticality

4. FR-S.1 Response to Nuclear Power Generation/AT,WS

5. UFSAR Section 7.6.2.3 ATWS Mitigation Actuation Circuitry (AMSAC)

6. NEI 99-01 SU5 I [Document No.] Rev. [X] Page 214 of 303 .j

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 -.RTS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor. EAL: SA6.1 Alert An automatic or manual trip fails to shut down the reactor as indicated by reactor power

 ~5%.

AND Manual trip actions taken at the control room panels (CC 1, VB2 or VB5) are not successful in shutting down the reactor as indicated by reactor power~ 5%. (Note 8) ) Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. Mode Applicability: 1 - Power Operation Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision *Making Information For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the control room panels (CC1, VB2 or VB5):

• Reactor trip switches (CC 1 and VB2)
• Deenergization of 480V Buses 13D and 13E (23D and 23E) at the Control Room vertical board (VB5)

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/ATWS (such as locally opening the reactor trip beakers. local I [Document No.] Rev. [X] Page 215 of 3031

ATTACHMENT 1 EAL Bases deenergization of 480V Buses 13D and 13E (23D and 23E), emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4). A reactor trip resulting from actuation of the A TWS Mitigation System Actuation Circuitry (AMSAC) logic that results in full insertion of control rods and diminishing neutron flux is considered a successful reactor trip. AMSAC .automatically initiates auxiliary feedwater and a turbine trip under conditions indicative of an Anticipated Transient Without Scram (ATWS) event (ref. 5). Escalation .of this event to a Site Area Emergency would be under EAL SS6.1 or SM/SEC/ED judgment. If the failure to shut_down the reactor is prolonged enough to cause a challenge to the core cooling [PVVR] I RPV v1ater level [BVVR] or RGS-RCS_heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS§e. Depending upon plant responses and symptoms, escalation is also possible via IC FS1.

Background

This EAL addresses any automatic or manual reactor trip signal that fails to shut down the reactor (reactor power < 5%) followed by a subsequent manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the SAFETY SYSTEMS were designed (ref. 1). On the power range scale 5% rated power is a minimum reading on the power range scale that indicates continued power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below 5%, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation can be used to determine if reactor power is greater than 5 % power (ref. 3, 4). This IC addresses a failure of the RPSRTS to initiate or complete an automatic or manual reactor ftrip [Pv'IR] I scram [Bll'JR]) that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shut down the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPSRTS. I A manual action* at the reactor control console is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrip[PV'JR] I scram [BV1/R])). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers). Actions taken at back-panels or other locations within the control room, or any location outside the control room, are not considered to be "at the reactor control consoles".Taking the Reactor Mode Switch to SHUTDOVVN is considered to be a manual soram aotion. [BV'IR] The plant response to the failure of an automatic or manual reactor ftrip [PV'/R] I soram [Blt'IR])will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other I [Document No.] Rev. [X] Page 216 of 3031

ATTACHMENT 1 EAL Bases concurrent plant conditions, etc. Absent the plant conditions needed to meet either IC SS§a or FS1, an Alert declaration is appropriate for this event. It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration. A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria. DCPP Basis Reference(s):

1. DCPP Technical Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. E-0 Reactor Trip or Safety Injection

3. F-0 Critical Safety Function Status Trees - Subcriticality

4. FR-S.1 Response to Nuclear Power Generation/ATWS

5. UFSAR Section 7.6.2.3 ATWS Mitigation Actuation Circuitry (AMSAC)

6. NEI 99-01 SA5 I [Document No.] Rev. [X] Page 217 of 3031

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - RTS Failure Initiating Condition: Inability to shut down the reactor causing a challenge to core cooling or RCS heat removal. EAL: SS6.1 Site Area Emergency An automatic or manual trip fails to shut down the reactor as indicated by reactor power

~5%.                                                                            .

AND All actions to shut down the reactor are not successful as indicated by reactor power

~5%.              '

AND EITHER: I

• CSFST Gore Cooling RED path conditionl5 met.
• CSFST Heat Sink RED path conditions met.

AND Bleed and feed criteria met. Mo,de Applicability:_ 1 - Power Operation Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, in~luding the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional 'during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it' in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information This EAL addresses the following:

• Any automatic reactor trip signal followed by a manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the SAFETY SYSTEMS were designed (EAL SA6.1), and I[Document No.]' Rev. [X] Page 218 of 3031

ATIACHMENT 1 EAL Bases

• Indications that either core cooling is extremely challenged or heat removal is extremely challenged.

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/ATWS (such as local deenergization of 480\/ Buses 13D and 13E (23D and 23E). emergency boration or manually driving control rods) are also credited as a successful manual trip provided reactor power can be reduced below 5% before indications of an extreme challenge to either core cooling or heat removal exist (ref. 1. 4). Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED path conditions being met (ref. 2). Indication of inability to adequately remove heat from the RCS is manifested by CSFST Heat Sink RED path conditions being met in combination With bleed and feed criteria being met (ref. ID.:. Heat Sink RED path conditions exist if:

• All SG n*arrow range levels less are than 15%. AND
• Less than 435 total AFW available to feed the SGs Bleed and feed criteria are met when:
• Wide range level in any three (3) SGs is less than 18% [26%1 AND
• All narrow range SG levels are less than 15% [25%1.

Parenthetical values are used during Adverse Containment Conditions. Escalation of the emergency classification level would be via IC AG..:t--RG1 or FG1.

Background

The combination of failure of both front line and backup protection systems to function in response to a plant transient. along with the continued production of heat. poses a direct threat to the Fuel Clad and RCS barriers. On the power range scale 5% rated power is a minimum reading on the power range scale that indicates continued power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below 5%. plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation can be used to determine if reactor power is greater than 5 % power (ref. 1. 4). This IC addresses a failure of the RPSRTS to initiate or complete an automatic or manual reactor ftrip [PV'IR] I scram [BV'IR]) that results in a reactor shutdown, all subsequent operator actions to manually shut down the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

• In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs. This is appropriate in that the Recognition Category .F ICs/EALs do not address the additional threat posed by a failure to shut_down the reactor. The I [Document No.] I Rev. [X] j' Page 219 of 303* I

ATTACHMENT 1 EAL Bases inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shut down the reactor. A reactor shutdown is determined in accordance with applicable Fmergency Operating Procedure criteria. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 1, Subcriticality

2. F-0 *critical Safety Function Status Tress -Attachment 2, Core Cooling

3. F-0 Critical Safety Function Status Tress - Attachment 3, Heat Sink

4. FR-S.1 Response to Nucl.ear Power Generation/ATWS

5. NEI 99-01 SS5 I [Document No.] Rev. [X] Page 220 of 3031

ATTACHMENT 1 EAL Bases Category: S - System. Malfunction Subcategory: 7 - Loss of Communications Initiating Cond~tion: Loss* of all onsite or offsite communications capabilities. EAL: SU7.1 Unusual Event Loss of all Table S-4 onsite communication methods. OR Loss of all Table S-4 offsite communication methods. OR Loss of all Table S-4 NRC communication methods.* Table S-4 Communication Methods System Onsite Offsite NRC Unit 1, Unit 2 and TSC Radio Consoles x x DGPP Telephone System (PBX) x x x Portable radio equipment (handie-talkies) x - Operations Radio System x x Security Radio Systems x CAS and SAS Consoles x x x Fire Radio System x Hot Shutdown Panel Radio Consoles x x x Public Address System x NRC FTS x Mobile radios x Satellite phones x x x Direct line (ATL) to the County and State OES x Mode Applicability: I[Document No.] Rev. [X] .I

• Page 221 of 3031

                                                                                                  )

ATTACHMENT 1 EAL Bases 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information Onsite, offsite and NRC communications include one or more of the systems listed in Table S-4 (ref. 1, 2. 3). This EAL is the hot condition equivalent of the cold condition EAL CU5.1. This IC addres.ses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to offsite response organizations (OROsl and the NRC. This IC should be assessed only when extraordinary means are b~ing utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

Background

EAL #1The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations. EAL #2The second EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are (see Developer Notes) the State and county EOCs. EAL #3The third EAL condition addresses a total loss of the communications methods used to notify the NRC of an emergency declaration. DCPP Basis Reference(s):

1. UFSAR, Section 9.5.2

2. Emergency Plan Section 7.2 Communications Equipment

3. AR PK15-23, Communications

4. NEI 99-01 SU6 j [Document No.] Rev. [X] Page 222 of 303 j

ATTACHMENT 1 EAL Bases Category: S :.... System Malfunction Subcategory: 8 - Containment Failure I Initiating Condition: Failure to isolate containment or loss of contaihment pressure control. EAL: SUB.1 Unusual Event Any penetration is not isolated within 15 minutes of a VALID containment isolation signal. (Note 1)

• OR Containment pressure ~ 22 psig with < one full train of containment depressurization equipment operating per design for ~-15 minutes. (Notes 1, 9)

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 9: One Containment Spray pump and two CFCUs comprise one full train *of depressurization equipment. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct obse.rvation by plant_ personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. ,-

• sasis:

ERO Decision Making Information This G-EAL addresses a failure of one or more containment penetrations to automatically isolate (close) when required by an actuation signal. It also addresses an event that results in high containment pressure with a concurrent failure of co"ntainment pressure control systems. Absent challenges to another fission product barrier, either condition represents potential

 *degradation of the level of safety of the plant.

For EAL #1the first condition, the containment isolation signal must be generated as the result on an off-normal/accident condition (e.g., a safety injection or high containment pressure); a failure resulting from testing or maintenance does not warrant classification. In order for a penetration to be considered isolated. a minimum of one valve in the flow path must be closed. The determination of containment and penetration status - isolated or not isolated - should be / made in accordance with the appropriate criteria contained in the plant AOPs and EOPs. The 15-minute criterion is included to allow operators time to manually isolate the required penetrations, if possible. EAL #2The second condition addresses a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automaticall actuate, and less than one full train of equipment is capable of o eratin er [Document No.] Rev. [X] Page 223 of 303

ATTACHMENT 1 EAL Bases design. The 15-minute criterion is included to allow operators time to manually start or restore equipment that may not have automatically started or actuated as required, if possible. The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g., containment sprays or ice condenser fans) are either lost or performing in a degraded manner. This ~vent would escalate to a Site Area Emergency in accordance with IC FS1 if there were a concurrent loss or potential loss of either the Fuel Clad or RCS fission product barriers.

Background

The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the design bases requirement. Each train includes a containment spray pump, spray headers. nozzles. valves. and piping. The Refueling Water Storage Tank (RWST) supplies borated water to the Containment Spray System during the injection phase of operation. In the recirculation mode of operation. Containment Spray, if needed, is transferred to the RHR Pumps and the Containment Spray Pumps are shut down(ref. ~ The Containment Cooling System consists of two trains of Containment cooling, each of sufficient capacity to supply 100% of the design cooling requirement. Each train, consisting of two Containment Fan Cooling Units (CFCU), is supplied with cooling water from a separate loop of Component Cooling Water (CCW). In post accident operation following an actuation signal, the Containment Cooling System fans are designed to start automatically if not already running (ref.5). The Containment pressure setpoint (22 psig, ref. 1, 2, 3, 4) is the pressure at which the equipment should actuate and begin performing its function. The design basis accident analyses and evaluations assume the loss of one Containment Spray System train and one Containment Cooling System train (ref. 5). Consistent with the design requirement. "one full train of depressurization equipment" is therefore defined to be the availability of one train of each system. If less than this equipment is operating and Containment pressure is above the actuation setpoint. the threshold is met if the required equipment cannot be started within 15 minutes. DCPP Basis Reference(s):

1. AR PK01-18, CONTMT SPRAY ACTUATION red

2. F-0 Critical Safety Function Status Trees - Attachment 6, Containment

3. FR-Z.1 Response to High Containment Pressure

4. Technical Specifications Table 3.3.2-1

5. Technical Specifications B3.6.6 Containment Spray and Cooling Systems

6. NEI 99-01 SU?

I [Document No.] Rev. [X] , Page 224 of 3031

ATTACHMENT :1 EAL Bases Category: S - System Malfunction Subcategory: 9 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode. EAL: SA9.1 Alert The occurrence of any Table S-5 hazardous event. AND EITHER:

• Event damage has caused indications of DEGRADED PERFORMANCE in at least one train o_f a SAFETY SYSTEM needed for the current operating mod~.

    * . The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operatinQ mode.

Table 5-5 Hazardous Events

• Seismic event (earthquake)
• Internal or external FLOODING event
• High winds or TORNADO strike
• FIRE
• EXPLOSION
• Tsunami
• Other events with similar hazard characteristics as determined by the SM/SEC/ED Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): DEGRADED PERFORMANCE - As applied to hazardous event thresholds, event damage significant enough to cause concern regarding the operability or reliability of the affected safety system train.

• EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpr~ssurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding,.

arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present. FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. I[Document No.] Rev. [X] Page.225 of 3031

ATTACHMENT 1 EAL Bases FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

• TORNADO - A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm.

VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. Basis: ERO Decision Making Information This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. With respect to event damage caused by an equipment failure resulting in a FIRE or EXPLOSION, no emergency classification is required in response to a FIRE or EXPLOSION resulting from an equipment failure if the only safety system equipment affected by the event is that upon which the failure occurred. An emergency classification is required if a FIRE or EXPLOSION caused by an equipment failure damages safety system equipment that was otherwise functional or operable (i.e., equipment that was not the source/location of the failure). For example, if a FIRE or EXPLOSION resulting from the failure of a piece of safety system equipment causes damage to the other train of the affected safety system or another safety system. then an emergency declaration is required in accordance with this IC and EAL. Escalation of the emergency classification level would be via IC FS1 or AS4RS1.

Background

This condition represents an actual or potential substantial degradation of the level of safety of the plant. Due to this actual or potential substantial degradation, this condition can significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore.:. represents an actual or potential substantial degradation of the level of safety of the plant. EAL 1.b.1The first condition addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of DEGRADED PERFORMANCE should be significant enough to cause concern regarding the operabili or reliabilit of the SAFETY SYSTEM train. [Document No.] Rev. [X] Page 226 of 303

ATTACHMENT 1 EAL Bases EAL 1.b.2The second condition addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. DCPP Basis Reference(s):

1. NEI 99-01 SA9 I [Document No.] Rev. [X] Page 227 of 3031

ATIACHMENT 1 EAL Bases Category F - Fission Product Barrier Degradation EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes. EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment. This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. The primary fission product barriers are: A Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets. B. Reactor Coolant System (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves. C: Containment (CMT): The Containment Barrier includes the containment building and connections up t<;> and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side containment isolation valve. Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to a Site Area Emergency or a General1 Emergency. The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-1 (Attachment 2). "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade. The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emergency classification level: Alert: Any loss or any potential loss of either Fuel Clad or RCS Site Area Emergency: Loss or potential loss of any two barriers General Emergency: Loss of any two barriers and loss or potential loss of third barrier The logic used for emergency classification based on fission product barrier monitoring should reflect the following considerations:

• The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Containment Barrier.
• Unusual Event ICs associated with RCS and Fuel Clad Barriers are addressed under System Malfur:iction ICs.

I [Document No.] Rev. [X] Page 228 of 3031

ATTACHMENT 1 EAL Bases

• For accident conditions involving a radiological release, evaluati.on of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to ensure correct and timely escalation of the emergency classification. For example, an evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC RG1 has been exceeded.
• The fission product barrier thresholds specified within a scheme reflect plant-specific DCPP design and operating characteristics.
• As used in this category, the term RCS LEAKAGE encompasses not just those types defined in Technical Specifications but also includes the loss of RCS mass to any location- inside the primary containment, an interfacing system, or outside of the primary containment. The release of liquid or steam mass from the RCS due to the as-designed/expected operation of a relief valve is not considered to be RCS LEAKAGE.
• At the Site Area Emergency level, EAL users should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration. For example, if the Fuel Clad and RCS fission product barriers were both lost, then there should be frequent assessments of containment radioaCtive inventory and integrity. Alternatively, if both the Fuel Clad and RCS fission product barriers were potentially lost, the SM/SEC/ED would have more assurance that there was no immediate need to escalate to a General Emergency.

I [Document N*o.] Rev. [X] I Page 229 of 3031

ATIACHMENT 1 EAL Bases Category: Fission Product Barrier Degraqation Subcategory: N/A Initiating Condition: Any loss or any potential loss of either Fuel Clad or RCS. EAL: FA1.1 Alert Any loss or any potential loss of either Fuel Clad or RCS. (Table F-1) Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: Fuel Clad. RCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references. ,

At the Alert classification level. Fuel Clad and RCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier. loss or potential loss of either the Fuel Clad or RCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability. Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or RCS barrier results in declaration of a Site Area Emergency under EAL FS1 .1 DCPP Basis Reference(s):

1. NEI 99-01 FA1 J [Document No.] Rev. [X] Page 230 of 303 J

ATTACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss or potential loss of any two barriers. EAL: FS1 .1 Site Area Emergency Loss or potential loss of any two barriers. (Table F-1) Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: Fuel Clad. RCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds. bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions:

• One barrier loss and a second barrier loss (i.e .. loss - loss)
• One barrier loss. and a second barrier potential loss (i.e., loss - potential loss)
• One barrier potential loss and a second barrier potential loss (i.e .. potential loss -

potential loss) At the Site Area Emergency classification level. the ability to dynamically assess the proximity of present conditions with respect to the threshold for a General Emergency is important. For example. the existence of Fuel Clad and RCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification. Alternatively. if both Fuel Clad and RCS potential loss thresholds existed. the SM/SEC/ED would have greater assurance that escalation to a General Emergency is less IMMINENT. DCPP Basis Reference(s):

1. r;.JEI 99-01 FS1

., [Document No.] Rev. [X] Page 231 of 3031

ATTACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss of any two barriers and loss or potential loss of third barrier. EAL: FG1.1 General Emergency Loss of any two barriers AND Loss or potential loss of third barrier. (Table F-1) Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: Fuel Clad. RCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds. bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions:

• Loss of Fuel Clad. RCS and Containment barriers
• Loss of Fuel Clad and RCS barriers with potential loss of Containment barrier
• Loss of RCS and Containment barriers with potential loss of Fuel Clad barrier
• Loss of Fuel Clad and Containment barriers with potential loss of RCS barrier DCPP Basis Reference(s):

1. NEI 99-01 FG1

                                       /

I[Document No.] Rev. [X] *Page 232 of 3031

ATTACHMENT 2

• Fission Product Barrier Loss/Potential Loss Matrix and Bases Introduction Table F-1 lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The table is structured so that each of the three barriers occupies adjacent columns. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds.

The first column of the table (to the left of the Fuel Clad Loss column) lists the categories (types) of fission product barrier thresholds. The fission product barrier categories are: A. RCS or SG Tube Leakage B. Inadequate Heat removal C. CMT Radiation I RCS Activity D. CMT Integrity or Bypass E. SM/SEC/ED Judgment Each category occupies a row iii Table F-1 thus forming a matrix defined by the categories. The intersection of each row with each Loss/Potential Loss column .forms a cell in which one or more fission product barrier thresholds appear. If NEI 99,-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None.. is entered in the cell. Thresholds are assigned sequential numbers within each 'Loss and Potential Loss column beginning with number one. In this manner, a threshold can be identified by its category title and number. For example, the first Fuel Clad barrier Loss in Category A would be assigned "FC Loss A.1," the third Containment barrier Potential Loss in Category C would be assigned "CMT P-Loss C.3," etc. If a cell in Table F-1 contains more than one numbered threshold, each of the numbered thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss. Subdivision of Table F-1 by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds. This structure promotes a systematic approach to assessing the classification status of the fission product barriers. When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-1, locates the likely category and then reads across the fission product barrier Loss and Potential Loss thresholds in that category to determine if a threshold has been exceeded. If a threshold has not been exceeded, the EAL-user proceeds to the next likely category and continues review of the thresholds in the new category

• If the EAL-user determines that any threshold has been exceeded, by definition, the barrier is lost or potentially lost - even if multiple thresholds in the same barrier column are exceeded, only that one barrier is lost or potentially lost. The EAL-user must examine each of the three fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if containment radiation is sufficiently high, a Loss of the Fuel Clad and RCS barriers and a Potential Loss of the Containment barrier can occur. Barrier
• 1[Document No.] Rev. [X] Page 233 of 3031

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Losses and Potential Losses are then applied to the algorithms given in EALs FG1 .1, FS1 .1, and FA1 .1 to determine the appropriate emergency classification. In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first, followed by the RCS barrier and finally the Containment barrier threshold bases. In e~ch barrier, the bases are given according category Loss followed by category Potential Loss beginning with Category A, then B, ... , E. I [Document No.] Rev. [X] Page 234 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Table F-1 Fission Product Barrier Threshold Matrix Fuel Clad (FC) Barrier Reactor Coolant System (RCS) Barrier Containment (CMT) Barrier Category Loss Potential Loss Loss Potential Loss Loss Potential Loss

1. Operation of a standby

1. An automatic or manual charging pump iHequired by EITHER:

A ECCS (SI) actuation required by EITHER:

• UNISOLABLE RCS 1. A leaking or RUPTURED SG RCS or None None LEAKAGE is FAULTED outside of None
• UNISOLABLE RCS SG Tube containment LEAKAGE
• SG tube leakage Leakage
• SG tube RUPTURE 2. CSFST Integrity-RED path conditions met

1. CSFST Core Cooling-MAGENTA path conditions 1. CSFST Core Cooling-RED 8 met 1. CSFST Heat Sink-RED path conditions met path conditions met

1. CSFST Core Cooling- 2. CSFST Heat Sink-RED path AND Inadequate None None RED path conditions met conditions met ' AND Restoration procedures not Heat Removal Bleed and feed criteria met effective within 15 minutes AND (Note 1)

Bleed and feed criteria met

1. Containment radiation c (RM-30 or RM-31) > 300 R/hr CMT ' 1. Containment radiation 1. Containment radiation None None None Radiation 2. Dose equivalent 1-131 (RM-30 or RM-31) > 40 R/hr (RM-30 or RM-31) > 5,000 R/hr

  /RCS        coolant activity> 300 Activity     µCi/gm

1. Containment isolation is required AND EITHER: 1. CSFST Containment-RED path

• Containment integrity conditions met (~ 47 psig) has been lost based on 2. Containment hydrogen D SM/SEC/ED concentration ~ 4%

CMT None None None None determination 3. Containment pressure ~ 22 Integrity

• UNISOLABLE pathway from psig with < one full train of or Bypass Containment to the depressurization equipment environmer:it exists operating per design for

2. Indications of RCS ~ 15 minutes (Note 1, 9)

LEAKAGE outside of Containment E 1. Any condition in the opinion 1. Any condition in the opinion 1. Any condition in the opinion 1. Any condition in the opinion 1. Any condition in the .opinion 1. Any condition in the opinion of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED fhat of the SM/SEC/ED that of the SM/SEC/ED that SM/SEC indicates loss of the fuel indicates potential loss of indicates loss of the RCS indicates potential loss of the indicates loss of the indicates potential loss of the

   /ED clad barrier                     the fuel clac;J barrier              barrier                          RCS barrier

• containment barrier containment barrier Judgment

[Document No.]

• Rev. [X] Page 235 of 303

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold: j None I [Document No.] Rev. [X] Page 236 of 3031 L

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: A RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold: I None I[Document No.] Rev. [X] Page 237 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold:

1. CSFST Core Cooling-RED path conditions met.

Definition(s): None Basis: ERO Decision Making Information Core Cooling RED path conditions exist if either (ref. 1. 2):

• Core exit TCs are reading greater than or equal to 1200°F. or
• Core exit TCs are reading greater than or equal to 700°F with RCS subcooling less than or equal to 20°F and RVLIS full range indication is less than or equal 32% with no RCPs running

Background

Critical Safety Function Status Tree (CSFST) Core Cooling-RED path indicates significant core

,exit superheating and core uncoverv. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPG. but the PPG is for information only (ref. 1, 2).

This reading indicates temperatures within the core are sufficient to cause significant superheating of reactor coolant. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 2, Core Cooling

2. FR-C.1 Response to Inadequate Core Cooling

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A I[Document No.] Rev. [X] Page 238 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. CSFST Core Cooling-MAGENTA path conditions met.

Definition(s): None Basis: ERO Decision Making Information Core Cooling MAGENTA path conditions exist if core exit subcooling margin is less than 20°F and any of the following (ref. 2, 3):

• RVLIS full range less than or equal to 32% with no RCPs running and less than 700°F, or

     * . Core exit TCs reading greater than or equal to 700°F with no RCPs running with greater than 32°io RVLIS full range, or

• RVLIS dynamic range level less than or equal to the specified dynamic head value with one or more RCPs running, Table F-2 Table F*2 RVLIS Values RVLIS No. RCPs Level Full Range None 32%

                                                   ~              44%,
                                                   ~               30%

Dynamic Head 2 20% 1 14%

Background

Critical Safety Function Status Tree (CSFST) Core Cooling-MAGENTA path indicates subcooling has been lost and that some fuel clad damage may potentially occur. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on 'the PPG, but the PPG is for information only (ref. 1).

• This reading indicates a reduction in reactor ves.sel water level sufficient to allow the onset of heat-induced cladding damage.

DCPP Basis Reference(s): j [Document No.] Rev. [X] Page 239 of 303 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

1. F-0 Critical Safety Function Status Trees - Attachment 2, Core Cooling

2. FR-C.1 Response to Inadequate Core Cooling

3. FR-C.2 Response to Degraded Core Cooling

4. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A I[Document No.] I Rev. [X] Page 240 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

2. CSFST Heat Sink-RED path conditions met.

AND Bleed and feed criteria met. Definition(s): None Basis: ERO Decision Making Information Heat Sink RED path conditions exist if:

• All SG narrow range levels less are than 15%. AND I .

I

• Less than 435 gpm total AFW available to feed the SGs Bleed and feed criteria are met when:.
• Wide range level in any three (3) SGs is less than 18% [26%1 AND
• All narrow range SG levels are less than 15% [25%].

Parenthetical values are used during Adverse Containment Conditions. In combination with RCS Potential Loss B.1. meeting this threshold results in a Site Area Emergency.

Background

This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the Fuel Clad Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPC. but the PPC is for Information only (ref. 1). DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 3, Heat Sink

2. FR-H .1 Response to Loss of .Secondary Heat Sink

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.B j [Document No.] Rev. [X] Page 241 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases j [Document No.] Rev. [X] Page 242 of 303 j I

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. GMT Radiation I RCS Activity Degradation Threat: Loss Threshold:

1. Containment radiation (RM-30 or RM-31) > 300 R/hr.

Definition(s):

• None Basis:

ERO Decision Making Information Containment radiation monitor readings greater than 300 R/hr (ref. 1) indicate the release of reactor coolant, with elevated activity indicative of fuel damage, into the Containment. This value is higher than that specified for RCS barrier Loss C.1. The radiation monitor reading in this threshold is higher than that specified for RCS_Barrier Loss threshold .J-AC.1 since it indicates a loss of both the Fuel Clad Barrier and the RCS Barrier. Note that a combination of the two monitor readings appropriately escalates the emergency classification levelECL to a Site Area Emergency.

Background

Monitors used for this fission product barrier loss threshold are the Containment High Range Radiation Monitors RM-30 and RM-3f These monitors provide.indication in the Control Room on PAM 2 with a range of 1R/hr to 1E? R/hr (ref. 1). The radiation monitor reading corresponds to an instantaneous,release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals 300 µCi/gm dose

• equivalent 1~131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate!Y range of 2% to 5%1.8% fuel clad damage .

. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

DCPP Basis Reference(s):

1. EP-CALC-DCPP-1602 Containment Radiation EAL Threshold Values

2. NEI 99-01 GMT Radiation I RCS Activity Fuel Clad Loss 3.A I[Document No.] Rev. [X] Page 243 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. GMT Radiation I RCS Activity Degradation Threat: Loss Threshold:

2. Dose equivalent 1-131 coolant activity> 300 µCi/cc.

Definition(s): None Basis: ERO Decision Making Information This threshold indicates that RCS radioactivity concentration is greater than 300 µCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier. This condition can be identified by either:

• RCS sample analysis
• EP RB-14A indications> 15 R/hr (ref. 1. 2)

There is no Potential Loss threshold associated with RCS_Activity I Containment Radiation.

Background

None DCPP Basis Reference(s):

1. EP RB-14A Initial Detection of Fuel Cladding Damage

2. SPG-11 Obtaining the EP RB-14A Dose Rate

3. NEI 99-01 GMT Radiation I RCS Activity Fuel Clad Loss 3.B j [Document No.] Rev. [X] Page 244 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. GMT Radiation I RCS Activity Degradation Threat: Potential Loss Threshold: None I . I[Document No.] Rev. [X] Page 245 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: D. GMT Integrity or Bypass Degradation Threat: Loss Threshold: I [Document No.] Rev. [X] Page 246 of 3031 L

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: D. GMT Integrity or Bypass Degradation Threat: Potential Loss Threshold: I None I [Document No.] Rev. [X] Page 24 7 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: E. SM/SEC/ED Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates loss of the Fuel Clad barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is lost. Such a determination should include IMMINENT barrier degradation. barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively

       , short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

I [Document No.] Rev. [X] Page 248 of 3031

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases This threshold addresses any other. factors that are to be used by the SM/SEC/EDEmergency Director in determining whether the Fuel Clad barrier is lost

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A j [Document No.] Rev. [X] Page 249 of 303 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: E. SM/SEC/ED Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates potential loss of the Fuel Clad barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:. (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down-the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is potentially lost. Such a determination should include IMMINENT barrier

 *degradation. barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns. readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses* any other factors that are to be used by the SM/SEC/EDEmergency Director in determining whether the Fuel Clad barrier is potentially lost. The j [D~cument No.] Rev. [X] Page 250 of 303 j _J

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases SM/SEC/EDE:mergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A

                                                                        /

I [Document No.] Rev. [X] Page 251 of 3031

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

1. An automatic or manual ECCS (SI) actuation required by EITHER:

• UNISOLABLE RCS LEAKAGE.
• SG tube RUPTURE.

Definition(s): . FAUL TED - The term applied to a steam generator that has a steam leak on the secondary

• side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized.

RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

• I

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

                                    \.

g. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Wate.r, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

RUPTURED - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection. UNlSOLABLE -An open or breached system line that qmnot be isolated, remotely or locally. j [Document No.] . Rev. [X] Page 252 of 303 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve c9uld isolate the leak. Basis: ERO Decision Making Information A steam generator with primary-to-secondary leakage of sufficient magnitude to require a safety injection is considered tci be RUPTURED. This threshold is based on an UNISOLABLE RCS leak of sufficient size to require an automatic or manual actuation of the Emergency Core Cooling System (ECCS). This condition clearly represents a loss of the RCS Barrier. *

• This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS LEAKAGE through an
• interfacing system. The mass loss may be into*any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside* of containment.

If a RUPTURED steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1.A will also be met. *

Background

None DCPP Basis Reference(s):

1. NEI 99-01 RC~ or SG Tube Leakage Reactor Coolant System Loss 1.A I[Document No.] Rev. [X] Page 253 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

1. Operation of a standby charging pump is required by EITHER:

• UNISOLABLE RCS LEAKAGE.
• SG tube leakage.

Definition(s): FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation 'of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage):

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

h. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. I[Document No.] Rev. [X] Page 254 .of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Basis: ERO Decision Making Information The need to start an additional charging pump due to RCS LEAKAGE is an indication that the leak is in excess of charging pump capacity. This threshold is not met when an additional charging pump is started as prudent action. Rather. the threshold is met when an additional charging pump is started per conditions outlined in procedures OP AP-1 or OP AP-3. wherein RCS LEAKAGE exceeds capacity of a single charging pump with letdown isolated (ref. 1, 2). This threshold is based on an UNISOLABLE RCS leak that results in the inability to maintain pressurizer level within specified limits by operation of a normally used charging (makeup) pump, but an ECCS (SI) actuation has not occurred. The threshold is met when an operating procedure, or operating crew supervision, directs that a standby charging (makeup) pump be placed iri service to restore and maintain pressurizer level. This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS LEAKAGE through an

     ' interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

i .* If a leaking steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1.A will also be met.

Background

None

    - DCPP Basis Reference(s):

1. OP AP-1 Excessive Reactor Coolant System Leakage

2. OP AP-3 Steam Generator Tube Failure I

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.A I [Document No.] Rev. [X] Page 255 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

2. CSFST Integrity-RED path conditions met.

Definition(s): None Basis: ERO Decision Making Information The "Potential Loss" threshold is defined by the CSFST Reactor Coolant Integrity - RED path.

• CSFST RCS Integrity - Red Path plant conditions and associated PTS Limit Curve A indicates an extreme challenge to the safety function when plant parameters are to the left of the limit curve following excessive RCS cooldown under pressure (ref. 1. 2).

This condition indicates an extreme challenge to the integrity of the RCS pressure boundary due to pressurized thermal shock (PTS). -PTS results from a transient that causes rapid RCS cooldown while the RCS_is in Mode 3 or higher (i.e., hot and pressurized).

Background

None DCPP .Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 4, Integrity and 4a Limit A Curve

2. FR-P.1 Response to Imminent Pressurized Thermal Shock Condition

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.B j [Document No.] Rev. [X] Page 256 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and 'Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold: I None I [Document No.] Rev. [X] Page 257 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category:

   /

B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. CSFST Heat Sink-RED path conditions met.

AND Bleed and feed criteria met. Definition(s): None Basis: ERO Decision Making Information Heat Sink RED path conditions exist if:

• All SG narrow range levels less are than 15%. AND
• Less than 435 gpm total AFW available to feed the SGs Bleed and feed criteria are met when:
• Wide range level in any three (3) SGs is less than 18% [26%1 AND
• All narrow range SG levels are less than 15% [25%1.

Parenthetical values are used during Adverse Containment Conditions. In combination with RCS Potential Loss B.1; meeting this threshold results in a Site Area Emergency.

Background

This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the RCS Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted. Meeting this threshold results in a Site Area Emergency because this threshold is identical to Fuel Clad Barrier Potential Loss threshold 2-:-B.2; both will be met. This condition warrants a Site Area Emergency declaration because inadequate RCS heat removal may result in fuel heat-up sufficient to damage the cladding and increase RCS pressure to the point where mass will be lost from the system. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPC. but the PPC is for information only (ref. 1). DCPP Basis* Reference(s): I [Document No.] I Rev. [XJ Page 258 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

1. F-0 Critical Safety Function Status Trees - Attachment 3, Heat Sink

2. FR-H.1 Response to Loss of Secondary Heat-Sink

3. NEI 99-01 Inadequate Heat Removal RCS Loss 2.B

                                        /

/ [Document No.] Rev. [X] Page 259 of 303 /

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: C. GMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

1. Containment radiation (RM-30 or RM-31) > 40 R/hr.

Definition(s): N/A Basis: ERO Decision Making Information Containment radiation monitor readings greater than 40 R/hr (ref. 1) indicate the release of reactor coolant to the Containment. The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold MC.1 since it indicates a loss of the RCS Barrier only. There is no Potential Loss threshold associated with RCS Activity I Containment Radiation.

Background

The readings assume the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory associated with normal coolant activity, with iodine spiking. discharged into containment (ref. 1). Monitors used for this fission product barrier loss threshold are the Containment High Range Radiation Monitors RM-30 and RM-31. These monitors provide indication in the Control Room on PAM 2 with a range of 1R/hr to 1E7 R/hr (ref. 1). DCPP Basis Reference(s):

1. EP-CALC-DCPP-1602 Containment Radiation EAL Threshold Values

2. NEI 99-01 GMT Radiation I RCS Activity RCS Loss 3.A

/ [Document No.] Rev. [X] Page 260 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. CMT Radiation/ RCS Activity Degradation Threat: Potential Loss Threshold: None I[Document No.] Rev. [X] Page 261 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: D. GMT Integrity or Bypass Degradation Threat: Loss Threshold: I None I[Document No.] Rev. [X] Page 262 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: D. GMT Integrity or Bypass Degradation Threat: Potential Loss Threshold: I None I[Document No.] Rev. [X] Page 263 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: E. SM/SEC/ED Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates loss of the RCS barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions: SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capa.bility to shut down the reactor and maintain it in a safe shutdown .condition; (3) The capability to prevent or mitigate the consequences of acciqents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the RCS barrier is lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks. I

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results. *

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that may be used by the SM/SEC/EDEmergency Director in determining whether the RCS Barrier is lost. I [Document No.]* Rev. [X] P~ge 264 of 303 l

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emerge_ncy Director Judgment RCS Loss 6.A I [Document No.] Rev. [X] Page 265 of 303. I

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: E. SM/SEC/ED Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates potential loss of the RCS barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the RCS barrier is potentially lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that may be used by the SM/SEC/EDEmergency Director in determining whether the RCS Barrier is potentially lost. The j [Document No.] I Rev. [X] I Page 266 of 303 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases SM/SEC/EDEmergeney Direetor should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored:

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Potential Loss 6.A I [Document No.] Rev. [X] Page 267 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: A RCS or SG Tube Leakage Degradation Threat: Loss Threshold:*

1. A leaking or RUPTURED SG is FAULTED qutside of containment.

Definition(s): FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressLirized. RUPTURED - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety" injection. Basis~ ERO Decision Making Information This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of containment. The condition of the SG, whether leaking or RUPTURED, is determined in accordance with the thresholds for RCS Barrier Potential Loss .:kA.J. and Loss

  .:kAj_,*respectively. This condition represents a bypass of the containment barrier.

This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldown the plant, or to drive an auxiliary (emergency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a FAULTED condition). The inability to isolate the steam flow without an adverse effect on plant cooldovm meets the intent of a loss of containment. Steam releases associated with the expected operation of a SG power operated relief valve or safety relief valve do not meet the intent of this threshold. Such releases may occur intermittently for a short period of time following a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown. Steam releases associated with the unexpected operation of a valve (e.g., a stuck-open safety valve) do meet this threshold. Following an SG tube leak or rupture, there may be minor radiological releases through a secondary-side system component (e.g., air ejectors, gland seal exhausters, valve packing, etc.). These types of releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-B__ICs.

• The emergency elassification levelECLs resulting from prim~ry-to-secondary leakage, with or without a steam release from the FAULTED SG,. are summarized below.

\ I[Document No.] Rev. [X] Page 268 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Affected SG is FAUL TED Outside of Containment? Primary-to-Secondary Yes No Leak Rate Less than or equal to 25 gpm No classification No classification Unusual Event per Unusual Event per Greater than 25 gpm W4SU5.1 W4SU5.1 Requires operation of a standby Site Area Emergency per charging (makeup) pump (RCS Alert per FA 1.:1 FS1.:1 Barrier Potential Loss) Requires an automatic or manual Site Area Emergency per ECCS (SI) actuation (RCS_Barrier Alert per FA 1.:1 FS1.:1 Loss)

Background

The FAULTED criterion establishes an appropriate lower bound on the size of a steam release that may require an emergency classification. Steam releases of this size are readily observable with normal Control Room indications. The lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC SU4 for the f4el clad barrier (i.e., RCS activity values) and IC SU5 for the RCS barrier (i.e., RCS leak rate values). FAULTED is a defined term within the NEI 99-01 methodology; this determination is not necessarily dependent upon entry into, or diagnostic steps within, an EOP. For example, if the pressure in a steam generator is decreasing uncontrollably ffpart of the FAULTED definition}} and the FAULTED steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher priority condition, the steam generator is still considered FAULTED for emergency classification purposes. There is no Potential Loss threshold associated with RCS or SG Tube Leakage. DCPP Basis Reference(s): 1

1. NEI 99-01 RCS or SG Tube Leakage Containment Loss 1.A I[Document No.] Rev. [X] . Page 269 of 3031

                                                                         \

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold: I None I [Document No.] Rev. [X] Page 270 of 3031

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

.Barrier:              Containment Category:             B. Inadequate Heat Removal Degradation Threat:   Loss Threshold:

j [Document No.] Rev. [X] Page 271 of 303 j _J

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: B.-1nadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. CSFST Core Cooling-RED path conditions met.

AND Restoration procedures not effective within 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. Basis: ERO Decision Making Information The 15 minute clock starts upon entry into FR-C.1 Response to Inadequate Core Cooling (ref.2). The restoration procedure is considered "effective" if core exit thermocouple readings are decreasing and/or if reactor vessel level is increasing. Whether or not the procedure(s) will be effective should be apparent within 15 minutes. The SM/SEC/EDEmergency Director should escalate the emergency classification level as soon as it is determined that the procedure(s) will not be effective.

Background

Critical Safety Function Status Tree (CSFST) Core Cooling-RED path indicates significant core exit superheating and core uncoverv. The CSFSTs are normally monitored using the dedicated SPDS display system (ref. 1). Some of the data is also available on the PPC. but the PPC is for information only The function restoration procedures are those emergency operating procedures that address the recovery of the core cooling critical safety functions. The procedure is considered effective if the temperature is decreasing or if the vessel water level is increasing (ref. 1. 2). A direct correlation to status trees can be made if the effectiveness of the restoration procedures is also evaluated. If core exit thermocouple (CET) readings are greater than 1.200°F, the Fuel Clad barrier is also lost (see Fuel Clad Loss B.1). This condition represents an IMMINENT core melt sequence which, if not corrected, could lead to vessel failure and an increased potential for containment failure. For this condition to occur, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. If implementation of a procedure(s) to restore adequate core cooling is not effective (successful) I [Document No.] Rev. [X] Page 272 of 3031

                                                                                                     './

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases within 15 minutes, it is assumed that the event trajectory will likely lead to core melting and a subsequent challenge of the Containment Barrier. Severe accident analyses (e.g., NUREG-1150) have concluded that function restoration procedures can arrest core degradation in a significant fraction of core damage scenarios, and that the likelihood of containment failure is very small in these events. Given this, it is appropriate to provide 15 minutes beyond the required entry point to determine if procedural actions can reverse the core melt sequence. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 2, Core Cooling . '

2. FR-C.1 Response to Inadequate Core Cooling

3. NEI 99-01 Inadequate Heat Removal Containment Potential Loss 2.A

                                                                                          '/

I[Document No.] Rev. [X] Page 273 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: C. CMT Radiation/RCS Activity Degradation Threat: Loss Threshold: I None I[Document No.] Rev. [X] Page 274 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: C. GMT Radiation/RCS Activity Degradation Threat: Potential Loss Threshold:

1. Containment radiation (RM-30 or RM-31) > 5,000 R/hr.

Definition(s): None Basis: ERO Decision Making Information The readings are higher than that specified for Fuel Clad barrier Loss C.1 and RCS barrier Loss C.1. Containment radiation readings at or above the containment barrier Potential Loss threshold. therefore. signify a loss of two fission product barriers and Potential Loss of a third. indicating the need to upgrade the emergency classification to a General Emergency.

Background

Containment radiation monitor readings greater than 5.000 R/hr (ref. 1) indicate significant fuel damage well in excess of that required for loss of the RCS barrier and the Fuel Clad barrier (ref. 1). Monitors used for this fission product barrier loss threshold are the Containment High Range Radiation Monitors RM-30 and RM-31. These monitors provide indication in the Control Room on PAM 2 with a range of 1R/hr to 1E7 R/hr (ref. 1). The radiation monitor reading corresponds to an instantaneous release of all reactor coolant niass into the containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous associated Fuel Clad Barrier Loss and RCS Barrier Loss thresholds. NUREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification levelECL to a General Emergency. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1602 Containment Radiation EAL Threshold Values

2. NEI 99-01 GMT Radiation I RCS Activity Containment Potential Lc;>ss 3.A I[Document No.] Rev. [X] Page 275 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. GMT Integrity or Bypass Degradation Threat: Loss Threshold:

1. Containment isolation is required.

AND EITHER:

• Containment integrity has been lost based on SM/SEC/ED determination.
• UNISOLABLE pathway from containment to the environment exists.

Definition(s): FAUL TED - The term 'applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. Basis: ERO Decision Making Information The status of the containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold ..'.h-A..L

• 4.A-1-First Bullet- Containment integrity has been lost, i.e., the actual containment atmospheric leak rate likely exceeds that associated with allowable leakage (or sometimes referred to as design leakage).

Recognizing the inherent difficulties in determining a containment leak rate during accident conditions, it is expected that the SM/SEC/EDEmergency Director will assess this threshold using judgment, and with due consideration given to current plant conditions, and available operational and radiological data (e.g., containment pressure, readings on radiation monitors outside containment, operating status of containment pressure control equipment, etc.).

 ~Second         Bullet- Conditions are such that there is an UNISOLABLE pathway for the migration of radioactive material from the containment atmosphere to the *environment. As used here, the term "environment" includes the atmosphere of a room or area, outside the containment, that may, in turn, communicate with the outside-the-plant atmosphere (e.g.,

through discharge of a ventilation system or atmospheric leakage). Depending upon a variety of factors, this condition may or may not be accompanied by a noticeable drop in containment pressure. The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or j [Document No.] j Rev. [X] j Page 276 of 303 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream. Leakage between two interfacing liquid systems, by itself, does not meet this threshold. Following the leakage of RCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable (design) containment leakage through various penetrations or system components. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-R ICs.

Background

These thresholds address a situation where containment isolation is required and one of two conditions exists as discussed below. Users are reminded that there may be accident and release conditions that simultaneously meet both bulleted thresholds 4 ./\.1 and 4 ./\.2. Following the release of RCS mass into containment, containment pressure will fluctuate based on a variety of factors; a loss of containment integrity condition may (or may not) be accompanied by a noticeable drop in containment pressure. Refer to the middle piping run of Figure 9+-41 on the following page. Two simplified examples are provided. One is leakage from a penetration and the other is leakage from an in-service system valve. Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure. Another example would be a loss or potential loss of the RCS barrier, and the simultaneous occurrence of two FAULTED locations on a steam generator where one fault is located inside containment (e.g., on a steam or feedwater line) and the other outside of containment. In this case, the associated steam line provides a pathway for the containment atmosphere to escape to an area outside the containment. Refer to the top piping run of Figure 9+-41 on the following page. In this simplified example, the inboard and outboard isolation. valves remained open after a containment isolation was required (i.e., containment isolation was not successful). There is now an UNISOLABLE pathway from the containment to the environment. Refer to the bottom piping run of Figure 9+-41 on the following page. In this simplified example, leakage in an RCP seal cooler is allowing radioactive material to enter the Auxiliary Building. The radioactivity would be detected by the Process Monitor. If there is no leakage from the closed water cooling system to the Auxiliary Building, then no threshold has been met. If the pump developed a leak that allowed steam/water to enter the Auxiliary Building, then the second threshold-4:-B would be met. Depending upon radiation monitor locations and sensitivities, this leakage could be detected by any of the four monitors depicted in the figure and cause the firstthreshold 4 ./\.1 to be met as well. Following the leakage of RCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable containment leakage through various penetrations or system components. Minor releases may also occur if a containment isolation valve(s) fails to close but the containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-B_ICs. DCPP Basis Reference(s): J [Document No.] J Rev. [X] Page 277 of 303 J

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

1. NEI 99-01 GMT Integrity or Bypass Containment Loss 4.A

                                          )

I [Document No.] Rev. [X] Page 278 of 3031

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Figure 1: Containment Integrity or Bypass Examples

Effluent I I . . . .

Auxiliary Building  : Monitor ' -:* **:- Inside CMT ,_ - - - - - - - - ... . . . Damper I I

Area

Monitor ,

I_ - - - - - - - - - - _ I 1 ---- - -----1

' Process :'

Monitor :~~H$~~~~~~~~~+

_______ I RCP Seal Cooling I [Document No.] Rev. [X] Page 279 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

2. Indications of RCS LEAKAGE outside of containment.

Definition(s): RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

d. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

Basis: ERO Decision Making Information The status of the**containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold A.1. , To ensure proper escalation of the emergency classification, the RCS LEAKAGE outside of containment must be related to the mass loss that is causing the RCS Loss and/or Potential Loss threshold -t.-AJ_ to be met. ECA-1.2 LOCA Outside Containment (ref. 1) provides instructions to identify and isolate a LOCA outside of the containment. Potential RCS leak pathways outside containment include (ref. 1. 2): j [Document No.] Rev. [X] Page 280 of 303 j L___

ATTACHMENT 2 Fission Product Barfier Loss/Potential Loss Matrix and Bases

• Residual Heat Removal
• Safety Injection
• Chemical & Volume Control
• RCP seals
• PZR/RCS Loop sample lines Containment sump, temperature, pressure and/or radiation levels will increase if reactor coolant mass is leaking into the containment. If these param'eters have not increased, then the reactor coolant mass may be leaking outside of containment (i.e., a containment bypass sequence). Increases in sump, temperature, pressure, flow and/or radiation level readings outside of the containment may indicate that the RCS mass is being lost outside of containment.

Unexpected elevated readings and alarms on radiation monitors with detectors outside containment should be corroborated with other available indications to confirm that the source is a loss of RCS mass outside of containment. If the fuel clad barrier has not been lost, radiation monitor readings outside of containment may not increase significantly; however, other unexpected changes in sump levels, area temperatures or pressures, flow rates, etc. , should be sufficient to determine if RCS mass- is being lost outside of the containment. j [Document No.] Rev. [X] Page 281 of 303 j

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases The ECLs resulting from primary leakage outside containment (without a Fuel Clad challenge) are summarized below. RCS LEAKAGE Outside Containment ECL

                     < 25 gpm                                          No ECL
     ;;:: 25 gpm - Charging Pump capacity                               SU5.1
            ;;:: Charging pump capacity                     Site Area Emergency based on:

RCS Potential Loss A 1

                                                                          +

Containment Loss D.2

Background

Refer to the middle piping run of Figure 94-41 on the following page. In this simplified example, a leak has occurred at a reducer on a pipe carrying reactor coolant in the Auxiliary Building. Depending upon radiatio)l monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure and cause threshold 4.AD.1 to be met as well. DCPP Basis Reference(s):

1. ECA-1.2 LOCA Outside Containment

2. E-1 Loss of Reactor or Secondary Coolant 3.. NEI 99-01 GMT Integrity or Bypass Containment Loss I [Document No.] Rev. [X] . Page 282 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Figure 1: Containment Integrity or Bypass Examples 2nd

                                                                                                         * :- -: Threshold- :- :- :- .

I- - - - - - - - - - - -

* : :

• Airborn e

__.-:--:-c~ * . *. * *

• release from * * *. *

Effluent ."" *:- :-:-:a"* *** -: : ::. _p9 t~l".ay . . : : :

• Auxiliary Building Inside CMT Damper RCP Seal Cooling

[Document No.] Rev. [X] Page 283 of 303 J

                                        , ATTACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier:                 Containment Category:                D. CMT Integrity or Bypass Degradation Threat:      Potential Loss Threshold:

1. CSFST Containment - RED path conditions met(;::: 47 psig).

Definition(s): None Basis: ERO Decision Making Information If containment pressure exceeds the design pressure, there exists a potential to lose the Containment Barrier. As noted in the WOG SAMG and related DCPP imp*lementation documents. t+o reach this level, there must be an inadequate core cooling condition for an extended period of time; therefore, the RCS and Fuel Clad barriers would already be lost. Thus, this threshold is a discriminator between a Site Area Emergency and General Emergency since there is now a potential to lose the third barrier.

Background

Critical Safety Function Status Tree (CSFST) Containment-RED path is entered if containment pressure is greater than or equal to 47 psig and represents an extreme challenge to safety function. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPC. but the PPC is for information only (ref. 1). Forty-seven psig is the containment design pressure (ref. 1. 2) and is the pressure used to define CSFST Containment RED path conditions. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Containment, Attachment 5

2. FSAR Appendix 6.2D

3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.A j [Document No.] Rev. [X] Page 284 of 303 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. GMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

2. Containment hydrogen concentration ;::: 4%.

Definition(s): None Basis: ERO Decision Making Information The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration flammability limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a potential loss of the Containment Barrier.

Background

After a LOCA. the containment atmosphere is a homogeneous mixture of steam. air. solid and gaseous fission products. hydrogen. and water droplets. During and following a LOCA, the hydrogen concentration in the containment results from radiolytic decomposition of water and metal-water reaction. If hydrogen concentration exceeds the lower flammability limit (4%) in an oxygen rich environment. a potentially explosive mixture exists. Operation of the Containment Hydrogen Recombiner with containment hydrogen concentrations greater than 4% could result in ignition of the hydrogen. If the combustible mixture ignites inside containment. loss of the containment barrier could occur. To generate such levels of combustible gas. loss of the Fuel Clad and RCS barriers must also have occurred. Since this threshold is also indicative of loss of both Fuel Clad and RCS barriers with the Potential Loss of the containment barrier. it therefore will likely warrant declaration of a General Emergency (ref. 1. 2. 3. 4). Containment hydrogen concentration is indicated in the Control Room on ANR-82/ANR-83 PAM1. (range: 1 - 10%). DCPP Basis Reference(s):

1. UFSAR Section 6.2.5 Combustible Gas Control In Containment

2. FR-Z.4 Response to High Containment Hydrogen Concentration

3. OP-H-9 INSIDE CONT H2 RECOMB SYSTEM

4. CA-3 Hydrogen Flammability in Containment

5. NEI 99-01 GMT Integrity or Bypass Containment Potential Loss 4.B

/ [Document No.] Rev. [X] Page 285 of 303 /

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

3. Containment pressure;::: 22 psig.

AND Less than one full train of containment depressurization equipment operating per design for;::: 15 minutes. (Note 1, 9) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 9: One Containment Spray pump and two CFCUs comprise one full train of depressurization equipment. Definition(s): None Basis: ERO Decision Making Information This threshold describes a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15-minute criterion is included to allow operators time to manually start or restore equipment that may not have automatically started or actuated as required, if possible. This threshold represents a potential loss of containment in that containment heat removal/depressurization systems (e.g., containment sprays, ice condenser fans, etc., but not including containment venting strategies) are either 1o*st or performing in a degraded manner. 1 Background The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the design bases requirement. Each train includes a containment spray pump, spray headers. nozzles. valves. and piping. The Refueling Water Storage Tank (RWST) supplies borated water to the Containment Spray System during the injection phase of operation. In the recirculation mode of operation, Containment Spray. if needed, is transferred to the RHR Pumps and the Containment Spray Pumps are shut down (ref. 5). The Containment Cooling System consists of two trains of Containment cooling. each of sufficient capacity to supply 100% of the design cooling requirement. Each train, consisting of two Containment Fan Cooling Units (CFCU), is supplied with cooling water from a separate loop of Component Cooling Water (CCW). In post accident operation following an actuation signal. the Containment Cooling System fans are designed to start automatically if not already running (ref.5). The Containment pressure setpoint (22 psig, ref. 1 2, 3, 4) is the pressure at which the I equipment should actuate and begin performing its function. The design basis accident I [Document No.] Rev. [X] Page 286 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases analyses and evaluations assume the loss of one Containment Spray System train and one Containment Cooling System train (ref. 5). Consistent with the design requirement. "one full train of depressurization equipment" is therefore defined to be the availabflity of one train of each system. If less than this equipment is operating and Containment pressure is above the actuation setpoint. the threshold is met if the required equipment cannot be started within 15 minutes. DCPP Basis Reference(s):

1. AR PK01-18, CONTMT SPRAY ACTUATION red

2. F-0 Critical Safety Function Status Trees - Attachment 6, Containment

3. FR-Z.1 Response to High Containment Pressure

4. Technical Specifications Table 3.3.2-1

5. Technical Specifications B3.6.6 Containment Spray and Cooling Systems

6. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.C I .

I[Document No.] Rev. [X] Page 287 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: E. SM/SEC/ED Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates loss of the containment barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: * (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the c'onsequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is lost. Such a determination should include IMMINENT barrier degradation. barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks. *

• Barrier monitoring capability is decreased if there is .a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns. readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that may be used by the SM/SEC/ED.Emergency Director in determining whether the Containment Barrier is lost. I[Document No.] Rev. [X] Page 288 of *303 j

ATTACHMENT 2 Fission Product Barrier loss/Potential Loss Matrix and Bases

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A j [Document No.] Rev. [X] Page 289 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: E. SM/SEC/ED Judgment Degradation Threat: Poten'tial Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates potential loss of the containment barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is potentially lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

j [Document No.] Rev. [X] Page 2_90 of 3031

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases This threshold addresses any other factors that may be used by the SM/SEC/EDEmergency Director in determining whether the Containment Barrier is lost.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Potential Loss 6.A I[Document No.] Rev. [X] Page 291 of 3031

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

Background

NEI 99-01 Revision 6 ICs AA3 and HAS prescribe declaration of an Alert based on IMPEDED access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal plant operations, cooldown or shutdown is located. These areas are intended to be plant operating mode dependent. Specifically the Developers Notes For AA3 and HAS states: The "site-specific list of plant rooms or areas with entry-related mode applicability identified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, coo/down and shutdown. Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be required for each room or area. The list should not include rooms or areas for which entry is required solely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections). Further, as specified in IC HAS: The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation. due to the release of a hazardous gas. Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope. Analysis OP L-4, Normal Operation at Power (rev 89/73) was reviewed to determine if any actions are "necessary" to maintain power operations. Over reasonable periods of time (days vice months or years) there are no actions outside the Control Room that are required to be performed to maintain normal operations. Eventually, you would have to shut down if Technical Specification surveillance testing was not completed and you complied with the associated LCOs or based on consumable supplies being depleted. For the purpose of this table, no actions were determined to be required. The following table lists the locations into which an operator may be dispatched in order perform a normal plant cool down and shutdown. The review was completed using the following procedures as the controlling documents: OP L-4, Normal Operation at Power (rev 89fi3) -

• Sections 6.3 (Instructions for Power Decreases from 100% to SO%)
• Section 6.4 (Instructions for Power Reduction From SO% to 20%)

OP L-S, Plant Cooldown From Minimum Lo'ad to Cold Shutdown (rev 100/83) OP L-7, Plant Stabilization Following Reactor Trip (rev 24/22) j [Document No.] j Rev. [X] j Page 292 of 303 j J

                                         /

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-~ Bases OP AP-25, Rapid Load Reduction or Shutdown (rev 25/12) In addition, the Residual Heat Removal System is aligned per OP B-2:V "RHR - Place In Service" (rev 37/36) which was also used to conduct this review. At DCPP, RCS Cooldown starts at OP L-5 step 6.2.3.m. Each step in the controlling procedures was evaluated to determine if the action was performed in the Control Room or in the plant. Each in-plant action listed below was evaluated and a determination made whether or not the actions, if not performed, would prevent achieving cold shutdown. The following generic assumptions were applied:

• Steps involving optional degassing of the RCS were not selected since degassing the **

RCS is not required to reach cold shutdown.

• Steps involving supplying Auxiliary Steam were not selected since AFW can be used to reach cold shutdown if Condenser vacuum is lost.
• Steps involving Main Feed Water Pumps were not selected since AFW can be used to reach cold shutdown if Main Feed Water is not available.
• Steps that are stated as needed when entering an outage are disregarded, as they are optional and not mandatory for placing plant in .Cold Shutdown.

Travel paths to the locations where the equipment is operated are not part of the determination of affected room/area, only the rooms/areas where the equipment is actually operated. Most locations can be reached via alternate travel paths if required due to a localized issue. No assumption is made about which RHR Train is aligned for operation. The minimum set of in-plant actions, associated locations, and operating modes to shut down and cool down the reactor are highlighted. The locations where those actions are performed comprise the rooms/areas to be included in EAL Tables R-2 and H-2. Specifically, the identified rooms are those where an activity must be performed to borate to cold shutdown, isolate accumulators or cooldown using RHR. UFSAR Page 6.4-1 states "The DCPP control room, located at elevation 140 feet of the auxiliary building, is common to Unit 1 and Unit 2. The associated habitability systems provide for access and occupancy of the control room during normal operating conditions, radiological emergencies, hazardous chemical emergencies, and fire emergencies." UFSAR Page 6.4-9 states "There are no offsite or onsite hazardous chemicals that would pose a credible threat to DCPP control room habitability. Therefore, engineered controls for the control room are not required to ensure habitability against a hazardous chemical threat and no amount of assumed unfiltered in-leakage is incorporated into PG&E's hazardous chemical assessment." Control room habitability relative to area radiation levels is adequately bounded by EAL RA2.3. I[Document No..] Rev. [X] Page 293 of 3031

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not

, Procedure and                                                  Building/          performed, does this Step Action                                 Mode Step                                                 Elevation/Room         prevent cool down/

shut down? OP L-4, Section 6.3: Instructions for Power Decreases from 100% to 50% OP L-4, Section G.4: Instructions for Power Redu.ction From 50% to 20% OP L-4 Initiate RCS degassing as directed Aux/1 OD/various 1 No 6.3.3.b.2 by chemistry PER OP B-1A:Vlll, "Reactor Coolant System Degassing During a Plant Shutdown" OR OP B 1A:X, "CVCS - VCT Degassing." ' OP L-4 IF either cylinder heating steam TB/104 1 No 6.3.3.I I 6.3.4.e pressure controller is in "MANUAL," THEN direct Turbine Building , Watch to maintain cylinder heating pressure during the ramp PER OP C-3A:I, "Sealing Steam System - Place In Service." OPL-4 As power decreases, direct Nuclear TB/119 1 No 6.3.3.n Operators to adjust SGBD flows PER OP D-2:V, "Steam Generator Slowdown System - Place in Service." OP L-4 Direct operator in the field to open TB/85 1 No 6.3.3.r.6 I discharge vent to condenser valve 6.3.4.n.4 on condensate pump that was just shut down:

• CND PP 1-1: CND-1-31
• CND PP 1-2: CND-1-32 .-

    \

• CND PP 1-3: CND-1-33 OP L-4 WHEN less than 60% power, AND Intake 1 No 6.3.3.s I 6.3.4.i IF desired, THEN shut down one of the two running Circulating Water Pumps PER OP E-4:111, "Circulating Water System Shutdown and

  -                 Clearing."

OP L-4 IF shutdown of MFW pump is TB/85 1 No 6.3.3.t.4 I required, 6.3.4.h.4 THEN complete shutdown PER OP C-8:111, "Shutdown and Clearing of a Main Feed Water Pump." I OP L-4 IF condenser is to be cleared upon TB/104 1 No 6.3.4.j reaching MODE 3, THEN consider AB/100/Pen 0 realigning TDAFWP steam traps PER appropriate steps in OP L-5, "Plant Cooldown from Minimum Load to Cold Shutdown," section for "Secondary Plant Shutdown." I[Document No.] Rev. [X] Page 294 of 303 l _ _J

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? OP L-4 Direct Aux Watch to transfer aux AB/140 1 No 6.3.4.k steam supply to U2 PER OP K-5: IV "Auxiliary Steam System - Change Over to Alternate Supply of Steam." OP L-4 IF NOT already performed, THEN TB/85 1 No 6.3.4.1 swap the Hydrazine injection points to the alternate alignment (downstream of FCV-232) per OP D-2:11, "Main Feed Water Chemical Injection System - Place in Service." OP L-4 IF unit is NOT being taken off line TB/104, 85 & 70 1 No 6.3.4.m.2.a for OP L-8, "Separating From the Grid While Maintaining Reactor Power Between 17% and 30%"), THEN shut down No. 2 Heater Drip Pump PER OP C-7B:ll, "No. 2 Heater Drip Pump Shutdown and Clearing." OP L-4 On the MFW pump in service, TB/85 1 No 6.3.4.t locally place the HP and LP Stop Valves Drain control switch to the "OPEN" position to open the before-seat drains. OP L-5 Section 6.1.3: Power Decrease from 20% to MODE 3 with Normal Shutdown OP L-5 Section 6.1.4: Power Decrease from 20% to MODE 3 with Planned Reactor Trip OP L-5 IF Containment is to be entered, Pen/100 1 .No 6.1.3.d.2 THEN Notify Chemistry to perform Containment air sampling. OP L-5 Place AFW chemical injection in AB/100 1 No 6.1.3.m.13/ service PER OP D-2:1, "Auxiliary 6.1.4.t Feed Water Chemical Injection System - Place In Service." OP L-5 IMPLEMENT Section 10 to open TB 1/2/3 See step by step 6.1.3.q FW-1-FCV-420 to prevent the FWH analysis of Section 10 outlet relief from lifting. OP L-5 IMPLEMENT step 11.5 for TB 1/2/3 See Jstep by step 6.1.3.s secondary shutdown. analysis of Section 11 OP L-5 Shut down both MFW pumps PER TB 2/3 No 6.1.3.w.8 I 6.1.4.u OP C-8:111, "Shutdown and Clearing of a Main Feed Water Pump." OP L-5 IF desired, THEN shut down the Area H/100 3 No 6.1.3.y.5 / 6.1.4.w MG sets PER OP A-3:111, "Control Rod System - Shutdown & Clearing." I [Document No.] Rev. [X] Page 295 of 3031

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? OP L-5 Initiate boration to the final AB 100/115/East 2/3 Yes - basis of location 6.1.3.aa I concentration for the mode to which End (BAST & BA is the ability to refill the 6.1.4.e.1 the plant is to be shut down PER Pumps), 85' (Aux BAST in order to have one of the following Control Board), 64' sufficient boric acid to

                     * (Preferred) OP B-1A:XIX, "CVCS       (BART Tank area)            reach CSD
                       - Borate the RCS to Refueling                                    concentration. Cool Concentration"                                                   down below 500°F
                     * (Alternate) OP B-1A:Vll, Section                                 requires 11000 gallons 6.12, "Emergency Boration using                                  of boric acid be added CVCS-1-8104"                                                     (see step 6.2.3.d)
                     * (Alternate) OP B-1A:Vll, Section 6.3, "Routine Boration" OP L-5              IF anticipated that the RCS will be     AB/100               2/3    No 6.1.3.bb I 6.1.4.x opened and degassing of the RCS has not been started, THEN initiate degassing of the RCS to reduce H2 concentration to 5 cc/kg or less PER OP B-1A:Vlll, "CVCS -

Reactor Coolant System Degassing During a Plant Shutdown." OP L-5 Maintenance to perform STP M- Various 1/2/3 No 6.1.3.ee I 6.1.4.z 17B2, "Functional Test of Emergency DC Lighting System in Containment." OP L-5 Ensure SGBD is maximized PER TB/119 1/2/3 No 6.1.3.gg I Chemistry direction and within the 6.1.4.bb ability to control RCS temperature. OP L-5 section 6.2: MODE 3 to Ready for RHR Operation OP L-5 Place the personnel airlock

                                                                                 -3 AB/140                      No 6.2.3.             automatic leak rate monitor (ALRM) in manual PER STP M-8F1, "ALRM Leak Rate Testing of Personnel Air Lock Seals," to avoid nuisance alarms in the Control Room.

OP L-5 Borate the RCS to meet STP R-19 AB 100/115/East 3/4 Yes - basis of location 6.2.3.e.2 COLD SHUTDOWN requirements. End (BAST & BA is the ability to refill the Pumps), 85' (Aux BAST in order to have Control Board), 64' sufficient boric acid to (BART Tank area) reach CSD I concentration. (See Caution prior to step). TS 3.1.1 OP L-5 Close the accumulator isolation Area H/100/480V 3/4 Yes - basis is that 6.2.3.s valve breakers Buses without closing _. Sl-1-8808A: breaker 52-1F-46 Accumulator outlet

• Sl-1-8808B: breaker 52-1G-07 valves, RCS pressure
• Sl-1-8808C: breaker 52-1 H~14 cannot go below -650 I[Document No.] Rev. [X] Page 296 of 3031

                                                                                                                     *- __J

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down?

• Sl-1-88080: breaker 52-1G-05 psig (procedure does not address alternate actions)

TS 3.5.1 OP L-5 WHEN desired, THEN secure the Area H/100/480V 3/4 No 6.2.3.y CROM fans PER OP H-6:11, "CROM Buses Fans - Shutdown and Clearing." OP L-5 Disable BOTH SI Pumps PER OP TB/119/4kV Vital 3/4 No - ECG 8.6 violation, 6.2.3.cc.1.b 0-32,"Control of Refueling Tags." Bus Rooms but does not prevent getting to CSD OP L-5 Disable ONE ECCS centrifugal TB/119/4kV Vital 3/4 No - ECG 8.6 'violation, 6.2.3.cc.2.b charging Bus Rooms but does not prevent pump PER OP 0-32, "Control of getting to CSD Refueling Tags." OP L-5 section 6.3: Placing RHR in Service to CSD, Bubble in PZR OP L-5 Place RHR system in service PER 3/4 See step by step 6.3.3.b.4 OP B-2:V, "RHR-Place in Service analysis of OP B-2:V During Plant Cooldown." OP L-5 Place tags on RHR suction valves Area H/100/480V 3/4 No - This is only a tag 6.3.3.b.6 (RHR-1-8701 and RHR-1-8702) Buses hanging step. Actual breakers PER OP 0-32, "Control of breaker manipulation is Refueling Tags." in OP B-2:V steps 6.2.12 I 6.3.12 OP L-5 Perform the following actions for AB/73/CCP3 room 4 No - ECG 8.1 violation, 6.3.3.d.1 CCP 1-3: Establish fire watch but does not prevent compensatory actions per ECG 8.1. getting to CSD OP L-5 Perform the following actions for TB/119/4kV Vital 4 No - ECG 8.1 violation, 6.3.3.d.2 CCP 1-3: No more than one hour Bus Rooms but does not prevent prior to reducing any WR RCS getting to CSD TCOLD to 283°F, make CCP 1-3 incapable of injecting. OP L-5 Hang the RCS Dilution Flow Path AB/100 4 No 6.3.3.h Boundary valve tags PER OP 0-32, "Control of Refueling Tags." OP L-5 Section 10: Condensate System Long Recirc 10.2 Ensure CLOSED FW-1-383, FCV- TB/85 3/4 No 420 Downstream Isolation. 10.3 Ensure CLOSED FW-1-384, FCV- TB/85 3/4 No 420 Downstream Isolation Bypass 10.4.1 Open FW-1-210, FW-1-211 TB/85 3/4 No Bypass. 10.4.2 Open FW-1-211 TB/85 3/4 No 10.4.3 Close FW-1-210 TB/85 3/4 No j [Document No.] Rev. [X] Page 297 of 3031 L_ -

                                                                                                         ------------i ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not
 *Procedure and                                                 Building/           performed, does this Step Action                                Mode Step                                                 Elevation/Room          prevent cool down/

shutdown? 10.6 Ensure a minimum of four polisher TB/85 3/4 No vessels in service until long recirc is established. 10.8.2 IF the temperature interlock is NOT TB/85 3/4 No made up, THEN contact Maintenance to open FW-1-FCV-420 by installing an air jumper with a 50 psig air supply connected to the vent side of SV1420. 10.9 Coordinate with the Control Room TB/85 3/4 No and very slowly open FW-1-384 u_ntil the onset of FWH flashing, then throttle closed until it stops 10.12 Slowly begin to open FW-1-383. If TB/85 3/4 No FWH flashing occurs, then throttle closed until it stops. 10.14 Close FW-1-384. TB/85 3/4 No OP L-5 Section 11: Secondary System Shutdown 11.2.2.a Perform the following to prepare TB/104 3/4 No - If steam traps steam line drains for closing the cannot be re-aligned MSIVs: Align valves for steam traps declare AFW Pump 1 1, 2, 3 and 5 steam line drains. INOPERABLE. 11.2.2.b Align AFW Pump 1-1 and Main TB/104 & Pen/100 3/4 No - If steam traps Steam Traps 1, 2, 3 and 5 to the cannot be re-aligned Outfall declare AFW Pump 1 INOPERABLE. 11.2.3 Connect hoses for AFW chemical AB/100/AFW room 3/4 No injection PER OP D-2:1V, "Adding Chemicals to Chemical Day Tanks-AFW System." 11.2.5 IF desired, THEN secure and clear Intake 3/4 No a CWP PER OP E-4:111, "Circulating Water System Shutdown and Clearing." 11.2.7 IF the Main Generator is to be TB/104 3/4 No depressurized and purged, THEN warm up the C02 vaporizer PER OP J-4C:lll, "Generator Hydrogen System-Remove From Service." 11.3 Just prior to separating from grid, TB/119 3/4 No drain MSR drain tanks and FW heaters PER OP C-7:111, "Condensate System - Shutdown and Layup." 11.5.2 IF relatching the Main Turbine is TB/140 3/4 No - If Cooldown I[Document No.] Rev. [X] Page 298 of 3031

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases ( If action not Procedure and Building/ perf9rmed, does this Step Action Mode / Step Elevation/Room prevent cool down/ snut down? needed to control plant cool down, control is an issue then THEN perform the following:T35016 MSIVs can be closed

a. Close AIR-1-1-2489, Air Supply to the Air/Oil Relay.

b. Isolate EH to the_ governor valves:

                      .. EH-1-518, for FCV-139 EH-1-519, for FCV-140 EH-1-520, for FCV-141 EH-1-521, for FCV-142 11.5.3.b       Align the MSRs as necessary PER          TB/119 & 104     3/4    No OP C-5:111, "Moisture Separator Reheaters - Shutdown."

11.5.5 IF desired, THEN back feed the unit Various 3/4 No from 500kV PER OP J-2:V, "Back feeding the Unit from the 500kV System." 11.5.7 Secure and drain SCCW PER OP TB/85

• 3/4 No J-4A:lll, "Generator Stator Cooling Water-Shutdown and Draining."

11.6.1 Depressurize and purge the Main TB/140 & 119 3/4 No Generator PER OP J-4C:lll, '"

                     "Generator Hydrogen System-Remove from Service."

11.6.2 Secure sew to exciter air coolers TB/104 3/4 No 11.7.6 Remove polishers from service TB/85 & 3/4 No PER OP C-7C:ll, "Condensate 104/Polishers Polishing System-Remove ' Demineralizers from Service," as directed by the Secondary Foreman. 11.7.8 Open CND-1-506 to break vacuum. TB/119 3/4 No 11.7.9 Maintenance to remove RM-15 and TB/104 3/4 No RM-15R from service. 11.7.10 Secure gland steam and cylinder TB/104 & 140 3/4 No heating steam PER OP C-3A:lll, "Sealing Steam System-Shutdown and Clearing. 11.7.11 Secure condenser air removal PER TB/104 3/4 No OP C-6:111, "Condenser and Air Removal System-Shutdown and ' Clearing." 11.7.12 Secure the following PER OP C- TB/119&140 3/4 No 6C:ll, "Condensate Air and Nitrogen Injection - Remove from Service:" j [Document No.] Rev. [X] Page 299 of 303 j L___

ATIACHMENT3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and , Building/ performed, does this. Step Action Mode Step ElevatiOn/Room prevent cool down/ . sh.ut down?

                      . N2 injection Air injection 11.7.14.b           Secure chemical injection PER OP        TB/85             3/4    No D-2:11, "Main Feed Water Chemical Injection-Place in Service."

11.7.15 Isolate condensate reject PER OP TB/85 3/4 No C-7:111, "Condensate System-Shutdown and Layup" (LCV-12). 11.11.1 Secure turning gear PER OP C- TB/140 3/4 No 3:1V, "Main Unit Turbine-Turbine Shutdown." 11.11.2 Shut down lube oil PER OP C- TB/85, 104 & 119 3/4 No 3B:lll, "Lube Oil Distribution System-Shutdown and Clearing." 11.11.4 Shut down H2 Seal Oil System TB/85 3/4 No PER OP J-4B:ll, "Hydrogen Seal Oil System-Shutdown and Drain." 11.12 WHEN the RCS is at or below TB/119 & AB/140 3/4 No '-.. 350°F, THEN remove locking devices on the following SGBD throttle valves and open them to achieve maximum blowdown OP B-2:V: RHR - Place In Service 6.1.5 Shift chemistry/radiation protection AB/100/PSSS 4. No - Basis is the system technician to sample RHR Loop 1-1 is aligned for ECCS to determine RHR Loop 1-1 boron Mode from the RWST. concentration. In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.10 Shift chemistry/radiation protection AB/100/PSSS 4 No - Basis is the system technician to sample RHR Loop 1-2 is aligned for ECCS to determine RHR Loop 1-2 boron Mode from the RWST. concentration. In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.13.b / 6.2.27 I Open RHR-1-8734A, RHR System Pen/85 4 No - Basis is the system 6.2.43 1-1 Bypass to Letdown Heat is aligned for. ECCS Exchanger Inlet (85' Containment Mode from the RWST. Penetration Area). In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.13.i Chemistry to sample RHR Loop 1-1 AB /100/PSSS 4 No - Basis is the system at approximately 10 minute is aligned for ECCS j [Document No.] *I Rev. [X] I Page 300 of 3031

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? intervals until the boron Mode from the RWST. concentration is equal to or greater In the event of an SI, we than that in the RCS. do not verify boron concentration prior to injecting. 6.1.13.1I6.2.36.b Close RHR-1-8734A, RHR System Pen/85 4 No 1-1 Bypass to Letdown Heat Exchanger Inlet. 6.1.13.q I Open RHR-1-8734B, RHR System Pen/85 4 No - Basis is the system 6.2.36.a / 6.3.8 1-2 Bypass to Letdown Heat is aligned for ECCS Exchanger Inlet (85'Containment Mode from the RWST. Penetration Area). In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.13.u Chemistry to sample the RHR loop AB /100/PSSS 4 No - Basis is the system at approximately 10 minute is aligned for ECCS intervals until the boron Mode from the RWST. concentration of RHR loop 1-2 is In the event of an SI, we equal to or greater than that in the do not verify boron RCS. concentration prior to injecting. 6.1.13.w I 6.2.18 Close RHR-1-8734B, RHR System Pen/85 4 No 1-2 Bypass to Letdown Heat Exchanger Inlet. 6.2.9 / 6.3.9 Open RHR-1-8726A, RHR Heat AB/64/RHR 4 No - This keeps the Exchanger 1-1 Bypass (64' pumps hallway RHR trains split but elevation Auxiliary Building). does not prevent cool - down. 6.2.10 I 6.3.10 Open RHR-1-8726B, RHR Heat AB/64/RHR 4 No - This keeps the Exchanger 1-2 Bypass (64' pumps hallway RHR trains split but elevation Auxiliary Building). does not prevent cool down. 6.2.12 / 6.3.12 . Ensure CLOSED the breakers for Area H/100/480V 4 Yes - required to align the following valves: Buses RHR system

• 52-1 F-31, MOV 8980
• 52-1 G-25, MOV 8701
• 52-1H-19, MOV 8702 OP L-7, Plant Stabilization Following Reactor Trip 6.5.2 lE a Circulating Water pump was tripped, Intake 3 No .

THEN REFER TO OP E-4:111, Circulating Water System.- Shutdown and Clearing, for cleanup actions. 6.5.3 lE no Circulating Water pump can TB/various 3 No be placed in service, THEN cool I [Document No.] Rev. [X] Page 301 of 303 j

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shutdown? down a hot condenser in accordance with AP-7, Attachment 1

                                                                                                                )

6.10.7

• Align SG Blowdown via the TB/119 & Pen/100 3 No Blowdown Tank per OP D-2:V for SG chemistry and RCS temperature control.

6.11.4 Condensate Polisher Beds aligned TB/104/Polisher 3 No per Secondary Foreman direction. 6.12.2.i Open FW-1-FCV-420 TB/104 3 No 6.12.2.j Coordinate with the Control Room TB/85 3 No and ver:y slowly OPEN FW-1-384 6.12.2.k Very slowly OPEN FW-1-383. TB/85 3 No 6.12.2.1 Close FW-1-384 TB/85 3 No 6.13.2.b Realign steam traps 1, 2, 3, and 5 I TB/104 3/4 No - If steam traps steam line drains cannot be re-aligned declare AFW Pump 1 INOPERABLE. 6.13.2.c & d Align AFW Pump 1-1 and Maih TB/104 & Pen/100 3/4 No - If steam traps Steam Traps 1, 2, 3 and 5 to the cannot be re-aligned Outfall declare AFW Pump 1 INOPERABLE. 6.13.3 Align Auxiliary and Gland Seal TB/104 & AB/100 3/4 No

                                                           \

steam as desired per OP C-3A:I. 6.14.2 If desired to control plant cool TB/140 3/4 No - If cooldown down, relatch the Main Turbine as control is an issue then follows: MSIVs can be closed

a. Close AIR-1-1-2489, Air Supply to the Air/Oil Relay.

b. Isolate EH to the governor valves:

                     .. EH-1-518,   for FCV-139
                      . EH-1-519,   for FCV-140
                      . EH-1-520, EH-1-521, for for FCV-141 FCV-142 6.15               IF desired, THEN back feed the unit    Various              3/4    No from 500kV PER OP J-2:V, "Back feeding the Unit from the 500kV System."

6.31 On the 4kV vital buses, reset TB/119/4kV Vital 3/4 No dropped flags on undervoltage Bus Rooms relays 27HFB1, 27HGB1 and 27HHB1. OP AP-,25, Rapid Load Reduction or Shutdown . I [Document No.] Rev. [X] Page 302 of 3031

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shutdown? 7.a RNO e/ WHEN plant conditions permit, TB/85 1/2/3 No 14.f.4 / 20.c.4 THEN swap Condensate Pump vents PER OP C-7A:I. Table R-2 & H-2 Safe Operation & Shutdown Rooms/Areas I Room/Area Mode(s) Auxiliary Building - 115' - BASTs 2,3,4 Auxiliary Building - 100' - BA Pumps 2, 3,.4 Auxiliary Building - 85' - Aux Control Board

• 2,3,4 Auxiliary Building - 64' - BART Tank area 2,3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 I[Document No.] Rev. [X] Page 303 of 3031

Enclosure Attachment 3 PG&E Letter DCL-16-099 EAL Technical Basis Document, Revised

Diablo Canyon Power Plant Emergency Plan Appendix D - Emergency Action Level Technical Basis Document 9/27/16 j (Document No.] Rev. [X] Page 1 of 289 j

Diablo Canyon Power Plant Emergency Plan TABLE OF CONTENTS SECTION PAGE 1.0 PURPOSE ........................................................................................................................... 3 2.0 DISCUSSION ...................................................................................................................... 3 2.1 Background ..........................................................,. ......................... ,. ..................................... 3 2.2 Fission Product Barriers ...................................................................................................... .4 2.3 Fission Product Barrier Classification Criteria ..................................................................... .4 2.4 EAL Organization .................................................................................................................5 2.5 Technical Bases Information ..............................................................................-.................. 6 2.6 Operating Mode Applicability ...............................................................................................8 3.0 GUIDANCE ON MAKING EMERGENCY CLASSIFICATIONS ........................................... 9 3.1 General Considerations .......................................................................................................9 3.2 Classification Methodology ................................................................................................ 10

4.0 REFERENCES

................................................. -................................................................. 14 4.1 - Developmental ..... -.............................................................................................................. 14 4.2 Implementing ..................................................................................................................... 14 5.0     DEFINITIONS, ACRONYMS &ABBREVIATIONS ............................................................ 15 6.0     DCPP TO NEI 99-01 Rev. 6 EAL CROSS-REFERENCE ................................................. 26 7.0     ATTACHMENTS ...................................-.........................................................................'... 30 1      Emergency Action Level Technical Bases ................................................................ 31 Category R Abnormal Rad Release I Rad Effluent.. ........................................ 31 Category E ISFSI ............................................................................................ 72 Category C Cold Shutdown I Refueling System Malfunction ........................... 76 Category H Hazards ...................................................................................... 121 Category S System Malfunction .................................................................... 161 Category F Fission Product Barrier Degradation .......................................... 212 2      Fission Product Barrier Loss I Potential Loss Matrix and Bases ..................................................................................................-.. 217 3      Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases ., ............................... 275 I [Document No.]                                          Rev. [X]                                                        Page 2 of 2891

1.0 PURPOSE This document provides an explanation and rationale for each Emergency Action Level (EAL) included in the EAL Upgrade Project for Diablo Canyon Power Plant (DCPP). It should be used to facilitate review of the DCPP EALs and provide historical documentation for future reference. Decision-makers responsible for implementation of EP G-1 Emergency Classification and Emergency Plan Activation, may use this document as a technical reference in support of EAL interpretation. This information may assist the SM/SEC/ED in making classifications, particularly those involving judgment or multiple events. The basis information may also be useful in training and for explaining event classifications to off-site officials. Because the information in a basis document can affect emergency classification decision-making (e.g., the SM/SEC/ED refers to it during an event), the NRC staff expects that changes to the basis document will be evaluated in accordance with the provisions of 10 CFR 50.54(q). 2.0 DISCUSSION 2.1 Background EALs are the plant-specific indications, conditions or instrument readings that are utilized to classify emergency conditions defined in the DCPP Emergency Plan. In 1992, the NRG endorsed NUMARC/NESP-007 "Methodology for Development of Emergency Action Levels" as an alternative to NUREG-0654 EAL guidance. NEI 99-01 (NUMARC/NESP-007) Revisions 4 and 5 were subsequently issued for industry implementation. Enhancements over earlier revisions included:

• Consolidating the system malfunction initiating conqitions and example emergency action levels which address conditions that may be postulated to occur during plant shutdown conditions.

I

• Initiating conditions and example emergency action levels that fully address conditions that may be postulated to occur at permanently Defueled Stations and Independent Spent Fuel Storage Installations (ISFSls).
• Simplifying the fission product barrier EAL threshold for a Site Area Emergency.

Subsequently, Revision 6 of NEI 99-01 has been-issued which incorporates resolutions to numerous implementation issues including the NRG EAL Frequently Asked Questions (FAQs). Using NEI 99-01 Revision 6, "Methodology for the Development of Emergency Action Levels for Non-Passive Reactors," November 2012 (ref. 4.1.1), DCPP conducted an EAL implementation upgrade project that produced the EALs discussed herein. I [Document No.] Rev. [X] Page 3 of 2891

2.2 Fission Product Barriers Fission product barrier thresholds represent threats to the defense in depth design concept that precludes the release of radioactive fissi_on products to the environment. This concept relies on multiple physical barriers, any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. Many of the EALs derived from the NEI methodology are fission product barrier threshold based. That is, the conditions that define the EALs are based upon thresholds that represent the loss or potential loss of one or more of the three fission product barriers. "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. A "Loss" threshold means the barrier no longer assures containment of radioactive materials. A "Potential Loss" threshold implies an increased probability of barrier loss and decreased certainty of maintaining the barrier. The primary fission product barriers are: A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets. B. Reactor Coolant System (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves. C. Containment (CMT): The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to a Site Area Emergency or a General Emergency 2.3 Fission Product Barrier Classification Criteria The following criteria are the bases for event classification related to fission product barrier loss or potential loss: Alert: Any Joss or any potential Joss of either Fuel Clad or RCS barrier Site Area Emergency: Loss or potential Joss of any two barriers General Emergency: Loss of any two barriers and loss or potential Joss of the third barrier . I [Document No.] Rev. [X] Page 4 of 2891

2.4 EAL Organization The DCPP EAL scheme includes the following features:

• Division of the EAL set into three broad groups:

o EALs applicable under any plant operating modes - This group would be reviewed by the EAL-user any time emergency classification is considered. o EALs applicable only under hot operating modes - This group would only be reviewed by the EAL-user when the plant is in Hot Shutdown, Hot Standby, Startup, or Power Operation mode. o EALs applicable only under cold operating modes - This group would only be reviewed by the EAL-user when the plant is in Cold Shutdown, Refueling or Defueled mode. The purpose of the groups is to avoid review of hot condition EALs when the plant is in a cold condition and avoid review of cold condition EALs when the plant is in a hot condition. This approach significantly minimizes the total number of EALs that must be reviewed by the EAL-user for a given plant condition, reduces EAL-user reading burden and, thereby, speeds identification of the EAL that applies to the emergency.

• Within each group, assignment of EALs to categories and subcategories: '

Category and subcategory titles are selected to represent conditions that are operationally significant to the EAL-user. The DCPP EAL categories are aligned to and represent the NEI 99-01"Recognition Categories." Subcategories are used in the D_CPP scheme as necessary to further divide the EALs of a category into logical sets of possible emergency classification thresholds. The DCPP EAL categories and subcategories are listed below. I [Document No.] Rev. [X] Page 5 of 2891

EAL Groups, Categories and Subcategories I EAL Group/Category EAL Subcategory I Any Operating Mode: R - Abnormal Rad Levels I Rad Effluent 1 - Radiological Effluent 2 - Irradiated Fuel Event 3 - Area Radiation Levels H - Hazards and Other Conditions 1 - Security Affecting Plant Safety 2 - Seismic Event 3 - Natural or Technological Hazard 4- Fire 5 - Hazardous Gas 6 - Control Room Evacuation 7 - SM/SEC/ED Judgment E-ISFSI I 1 - Confinement Boundary Hot Conditions: S - System Malfunction 1- Loss of Emergency AC Power 2- Loss of Vital DC Power

               -                                3-  Loss of Control Room Indications 4-  RCS Activity 5-  RCS Leakage 6-  RTS Failure 7-  Loss of Communications 8-  Containment Failure 9-  Hazardous_Event Affecting Safety Systems F - Fission Product Barrier Degradation   None Cold Conditions:

C - Cold Shutdown I Refueling System 1-RCS Level Malfunction 2 - Loss of Emergency AC Power 3 - RCS Temperature 4 - Loss of Vital DC Power 5 - Loss of Communications 6 - Hazardous Event Affecting Safety Systems The primary tool for determining the emergency classification level is the EAL Classification Wall Chart. The user of the EAL Classification Wall Chart may (but is not required to) consult the EAL Technical Bases Document in order to obtain additional information concerning the EALs under classification consideration. The user should consult Section 3.0 and Attachments 1 & 2 of this document for such information. 2.5 , Technical Bases Information EAL technical bases are provided in Attachment 1 for each EAL according to EAL group (Any, Hot, Cold), EAL category (R, C, H, S, E and F) and EAL subcategory. A summary explanation I [Document No.] Rev. [X] Page 6 of 2891

of each category and suQcategory is given at the beginning of the technical bases discussions of the EALs included in the category. For each EAL, the following information is provided: Category Letter & Title Subcategory Number & Title Initiating Condition (IC) Site-specific description of the generic IC given in NEI 99-01 Rev. 6. EAL Identifier (enclosed in rectangle) Each EAL is assigned a unique identifier to support accurate communication of the emergency classification to onsite and offsite personnel. Four characters define each EAL identifier:

1. First character (letter): Corresponds to the EAL category as described above (R, C, H, S, E or F)

2. Second character (letter): The emergency. classification (G, S, A or U)

G = General Emergency

                                                                                                   \

S = Site Area Emergency A= Alert U =Unusual Event

3. Third character (number): Subcategory number within the given category.

Subcategories are sequentially numbered beginning with the number one (1 ). If a category does not have a subcategory, this character is assigned the number one (1 ).

4. Fourth character (number): The numerical sequence of the EAL within the EAL subcategory. If the subcategory has only one EAL, it is given the number one (1).

Classification (enclosed in rectangle): Unusual Event (U), Alert (A), Site Area Emergency (S) or General Emergency (G) EAL (enclosed in rectangle) Exact wording of the EAL as it appears in the EAL Classification Matrix Mode Applicability One or more of the following plant operating conditions comprise the mode to which each EAL is applicable: 1 - Power Operation, 2 -'Startup, 3 - Hot Standby, 4 - Hot Shutdown, 5 - Cold Shutdown, 6 - Refueling, D - Defueled, or Any. (See Section 2.6 for operating mode definitions) ' Definitions: If the EAL wording contains a defined term, the definition of the term is included in this section. These definitions can also be found in Section 5.1. Basis: An EAL basis s.ection that provides both generic and site-specific ERO decision making guidance as well as background information that supports the rationale for the EAL as provided in NEI 99-01 Rev. 6. I[Document No.] Rev. [X] Page 7 of 2891

DCPP Basis Reference(s): Site-specific source documentation from which the EAL is derived 2.6 Operating Mode Applicability (ref. 4.1.7) 1 Power Operation Keff ~ 0.99 and reactor thermal power> 5% 2 Startup Keff ~ 0.99 and reactor thermal power:::; 5% 3 Hot Standby Keff < 0.99 and average coolant temperature~ 350°F 4 Hot Shutdown Keff < 0.99 and average coolant temperature 350°F > T avg > 200 °F with all reactor vessel head closure bolts fully tensioned 5 Cold Shutdown Keff < 0.99 and average coolant temperature :::; 200°F with all reactor vessel head closure bolts fully tensioned 6 Refueling One or more reactor vessel head closure bolts are less than fully tensioned D Defueled Reactor vessel contains no irradiated fuel (full core off-load during refueling or extended outage). The plant operating mode that exists at the time that the event occurs (prior to any protective system or operator action being initiated in response to the condition) should be compared to the mode applicability of the EALs. If a lower or higher plant operating mode is reached before the emergency classification is made, the declaration shall be based on the mode that existed at the time the event occurred. I [Document No.] Rev. [X] Page 8 of 2891

3.0 GUIDANCE ON MAKING EMERGENCY CLASSIFICATIONS 3.1 General Considerations When making an emergency classification, the Shift Manager/Site Emergency Coordinator/Emergency Director (SM/SEC/ED) must consider all information having a bearing on the proper assessment of an Initiating Condition (IC). This includes the Emergency Action Level (EAL) plus the associated Operating Mode Applicability, Notes, and the informing basis information. In the Recognition Category F matrices, EALs are based on loss or potential loss of Fission Product Barrier Thresholds. 3.1.1 Classification Timeliness NRC regulations require the licensee to establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded and to promptly declare the emergency condition as soon as possible following identification of the appropriate emergency classification level (ref. 4.1.9). 3.1.2 Valid Indications All emergency classification assessments shall be based upon valid indications, reports or conditions. A valid indication, report, or condition, is one that has been verified through appropriate means such that there is no doubt regarding the indicator's operability, the condition's existence, or the report's accuracy. For example, verification could be accomplished through an instrument channel check, response on related or redundant indicators, or direct observation by plant personnel. The validation of indications should be completed in a manner that supports timely emergency declaration. An indication, report, or condition is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the

. condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

3.1.3 Imminent Conditions For ICs and EALs that have a stipulated time duration (e.g., 15 minutes, 30 minutes, etc.), the SM/SEC/ED should not wait until the applicable time has elapsed. The SM/SEC/ED should declare the event as soon as it is determined that the condition has exceeded, or will likely exceed, the applicable time. If an ongoing radiological release is detected and the release start time is cannot be determined, it should be assumed that the release duration specified in theJC/EAL has been exceeded, absent data to the contrary. 3.1.4 Planned vs. Unplanned Events A planned work activity that results in an expected event or condition which meets or exceeds an EAL does not warrant an emergency declaration provided that: 1) the activity proceeds as planned, and 2) the plant remains within the limits imposed by the operating license. Such activities include planned work to test, manipulate, repair, maintain or modify a system or component. In these cases, the controls associated with the planning, preparation and execution of the work will ensure that compliance is maintained with all aspects of the operating license provided that the activity proceeds and concludes as expected. Events or conditions of this type may be subject to the reporting requirements of 10 § CFR 50. 72 (ref. 4.1.4). I [Document No.] Rev. [X] Page 9 of 2891

3.1.5 Classification Based on Analysis The assessment of some EALs is based on the results of analyses that are necessary to ascertain whether a specific EAL threshold has been exceeded (e.g., dose assessments, chemistry sampling, RCS leak rate calculation, etc.). For these EALs, the EAL wording or the associated basis discussion will identify the necessary analysis. In these cases, the 15-minute declaration period starts with the availability of the analysis results that show the threshold to

• be exceeded (i.e., this is the time that the EAL information is first available). The NRG expects licensees to establish the capability to initiate and complete EAL-related analyses within a reasonable period of time (e.g., maintain the necessary expertise on-shift). For example, a coolant activity sample is taken. Chemistry reports results indicate activity greater than Technical Specification limits. The classification clock begins when Chemistry reports the sample results.

3.1.6 SM/SEC/ED Judgment While the EALs have been developed to address a full spectrum of possible events and conditions which may warrant emergency classification, a provision for classification based on operator/management experience and judgment is still necessary. The NEI 99-01 EAL scheme provides the SM/SEC/ED with the ability to classify events and conditions based upon judgment using EALs that are consistent with the Emergency Classification Level (EGL) definitions (refer to Category H). The SM/SEC/ED will need to determine if the effects or consequences of the event or condition reasonably meet or exceed a particular EGL definition. A similar provision is incorporated in the Fission Product Barrier Tables; judgment may be used to determine the status of a fission product barrier. 3.2 Classification Methodology To make an emergency.classification, the user will compare an event or condition (i.e., the relevant plant indications and reports) to an EAL(s) and determine if the EAL has been met or exceeded. The evaluation of an EAL must be consistent with the related Operating Mode Applicability and Notes. If an EAL has been met or exceeded, the associated IC is likewise met, the emergency classification process "clock" starts, and the EGL must be declared in accordance with plant procedures no later than fifteen minutes after the process "clock" started. When assessing an EAL that specifies a time duration for the off-normal condition, the "clock" for the EAL time duration runs concurrently with the emergency classification process "clock." (ref. 4.1.9). 3.2.1 Classification of Multiple Events and Conditions When multiple emergency events or conditions are present, the user will recognize all met or exceeded EALs. The highest applicable EGL identified during this review is declared. For example:

• If an Alert EAL and a Site Area Emergency EAL are met, whether at one unit or at two different units, a Site Area Emergency should be declared. '

There is no "additive" effect from multiple EALs meeting the same EGL. For example:

• If two Alert EALs are met, whether at one unit or at two different units, an Alert should be declared.

j [Document No.] Rev. [X] Page 10 of 289 j

Related guidance concerning classification of rapidly escalating events or conditions is provided in Regulatory Issue Summary (RIS) 2007-02, Clarification of NRG Guidance for Emergency Notifications During Quickly Changing Events (ref. 4.1.2). 3.2.2 Consideration of Mode Changes During Classification The mode in effect at the time that an event or condition occurred, and prior to any plant or operator response, is the mode that determines whether or not an IC is applicable. If an event or condition occurs, and results in a mode change before the emergency is declared, the emergency classification level is still based on the mode that existed at the time that the event or condition was initiated (and not when it was declared). Once a different mode is reached, any new event or condition, not related to the original event or condition, requiring emergency classification should be evaluated against the ICs and EALs applicable to the operating mode at the time of the new event or condition. For events that occur in Cold Shutdown or Refueling, escalation is via EALs that are applicable in the Cold Shutdown or Refueling modes, even if Hot Shutdown (or a higher mode) is entered during the subsequent plant response. In particular, the fission product barrier EALs are applicable only to events that initiate in the Hot Shutdown mode or higher. For example, a loss of decay heat removal when in Mode 5 results in RCS temperature exceeding 200°F. Escalation of the loss of decay heat removal event will be via the cold condition mode EALs even though the plant is now in Mode 4 as a result of the RCS temperature increase. However, any subsequent new event/condition must be assessed against the hot condition EALs (Mode 4 and above). 3.2.3 Classification of Imminent Conditions Although EALs provide specific thresholds, the SM/SEC/ED must remain alert to events or - conditions that could lead to meeting or exceeding an EAL within a relatively short period of time (i.e., a change in the EGL is imminent). If, in the judgment of the SM/SEC/ED, meeting an EAL is imminent, the emergency classification should be made as if the EAL has been met. While applicable to all emergency classification levels, this approach is particularly important at the higher emergency classification levels since itprovides additional time for implementation of protective measures. 3.2.4 Emergency Classification Level Upgrading and Downgrading An EGL may be downgraded when the event or condition that meets the highest IC and EAL no longer exists, and other site-specific downgrading requirements are met. If downgrading the EGL is deemed appropriate, the new EGL would then be based on a lower applicable IC(s) and EAL(s). The EGL may also simply be terminated. Refer to EP G-1 Emergency Classification and Emergency Plan Activation for guidance on downgrading and terminating an EGL. Refer to EP OR-3 Emergency Recovery for guidance for entering long-term recovery. As noted above, guidance concerning classification of rapidly escalating events or conditions is provided in RIS 2007-02 (ref. 4.1.2). 3.2.5 Classification of Short-Lived Events Event-based ICs and EALs define a variety of specific occurrences that have potential or actual safety significance. By their nature, some of these events may be short-lived and, thus, over before the emergency classification assessment can be completed. If an event occurs that meets or exceeds an EAL, the associated EGL must be declared regardless of its -- continued presence at the time of declaration. Examples of such events include an I [Document No.] Rev. [X] Page 11 of 2891

earthquake or a failure of the reactor protection system to automatically trip the reactor followed by a successful manual trip. 3.2.6 Classification of Transient Conditions Many of the ICs and/or EALs employ time-based criteria. These criteria will require that the IC/EAL conditions be present for a defined period of time before an emergency declaration is warranted. In cases where no time-based criterion is specified, it is recognized that some transient conditions may cause an EAL to be met for a brief period of time (e.g., a few seconds to a few minutes). The following guidance should be applied to the classification of these conditions. EAL momentarily met during expected plant response - In instances where an' EAL is briefly met during an expected (normal) plant response, an emergency declaration is not warranted provided that associated systems and components are operating as expected, and operator actions are performed in accordance with procedures. EAL momentarily met but the condition is corrected prior to an emergency declaration - If an operator takes prompt manual action to address a condition, and the action is successful in correcting the condition prior to the emergency declaration, then the applicable EAL is not considered'met and the associated emergency declaration is not required. For illustrative* purposes, consider the following example: An A TWS occurs and the high pressure ECCS systems fail to automatically start. RPV level rapidly decreases and the plant enters an inadequate core cooling condition (a potential loss of both the fuel clad and RCS barriers). If an operator manually starts a high pressure ECCS system in accordance with an EOP step and clears the inadequate core cooling condition prior to an emergency declaration, then the classification should be based on the A TWS only. It is important to stress that the 15-minute emergency classification assessment period (process clock) is not a "grace period" during which a classification may be delayed to allow the performance of a corrective action that would preclude the need to classify the event. Emergency classification assessments must be deliberate and timely, with no undue delays. The provision discussed above addresses only those rapidly evolving situations when an operator is able to take a successful corrective action prior to the SM/SEC/ED completing the review and steps necessary to make the emergency declaration. This provision is included to ensure that any public protective actions resulting from the emergency classification are truly warranted by the plant conditions. 3.2.7 After-the-Fact Discovery of an Emergency Event or Condition In some cases, an EAL may be met but the emergency classification was not made at the time of the event or condition. This situation can occur when personnel discover that an event or condition existed which met an EAL, but no emergency was declared, and the event or condition no longer exists at the time of discovery. This may be due to the event or condition not being recognized at the time or an error that was made in the emergency classification process. In these cases, no emergency declaration is warranted; however, the guidance contained in NUREG-1022 (ref. 4.1.3) is applicable. Specifically, the event should be reported to the NRG in accordance with 10 CFR § 50.72 (ref. 4.1.4) within one hour of the discovery of the undeclared event or condition (refer to Xl1.ID2 Regulatory Reporting Requirements and I [Document No.] Rev. [X] Page 12 of 2891

Reporting Process (ref. 4.1.11)). The licensee should also notify appropriate State and local agencies in accordance witn the agreed upon arrangements. 3.2.8 Retraction of an Emergency Declaration Guidance on the retraction of an emergency declaration reported to the NRG is discussed in NUREG-1022 (ref. 4.1.3). I [Document No.] Rev. [X] Page 13 of 2891

4.0 REFERENCES

4.1 Developmental 4.1.1 NEI 99-01 Revision 6, Methodology for the Development of Emergency Action Levels for Non-Passive Reactors, ADAMS Accession Number ML12326A805 4.1.2 RIS 2007-02 Clarification of NRG Guidance for Emergency Notifications During Quickly Changing Events, February 2, 2007. 4.1.3 NUREG-1022 Event Reporting Guidelines: 10CFR50.72 and 50.73 4.1.4 10CFR 50.72 Immediate Notification Requirements for Operating Nuclear Power Reactors 4.1.5 10CFR 50.73 License Event Report System 4.1.6 Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points 4.1.7 Technical Specifications Table 1.1-1 ~odes 4.1.8 Administrative Procedure AD8.DC54 "Containment Closure" 4.1.9 NSIR/DPR-ISG-01 Interim Staff Guidance, Emergency Planning for Nuclear Power Plants 4.1.10 DCPP Emergency Plan 4.1.11 XI 1.1 D2 Regulatory Reporting Requirements and Reporting Process 4.1.12 DCPP Security and Safeguards Contingency Plan 4.2 Implementing *

• 4.2.1 EP G-1 Emergency Classification and Emergency Plan Activation 4.2.2 NEI 99-01 Rev. 6 to DCPP EAL Comparison Matrix 4.2.3 DCPP EAL Wall Chart I [Document No.] Rev. [X] Page 14 of 2891

5.0 DEFINITIONS, *ACRONYMS & ABBREVIATIONS 5.1 Definitions Selected terms used in Initiating Condition and Emergency Action Level statements are set in all capital letters (e.g., ALL CAPS). These words are defined terms that have specific meanings as used in this document. The definitions of these terms are provided below. Alert Events are in process, or have occurred, which involve an actual or potential substantial degradation of the level of safety of the_plant OR A SECURITY EVENT that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be small fractions of the EPA PROTECTIVE ACTION GUIDELINE exposure levels. Confinement Boundary The barrier(s) between spent fuel a*nd the environment once the spent fuel is processed for dry

• storage. As applied to the DCPP ISFSI, the confinement boundary is defined to be the Multi-Purpose Canister (MPG).

Containment Closure The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 "Containment Closure" (ref. 4.1.8) .. Degraded Performance As applied to hazardous everit thresholds, damage significant enough to cause concern regarding the operability or reliability of the affected safety system train. Emergency Action Level A pre-determined, site-specific, observable threshold for an Initiating Condition that, when met or exceeded, places the plant in a given emergency classification level. Emergency Classification Level One* of a set of names or titles established by the US Nuclear Regulatory Commission (NRG) for grouping off-normal events or conditions according to (1) potential or actual effects or consequences, and (2) resulting onsite and offsite response actions. The emergency classification levels, in ascending order of severity, are: Unusual Event (UE), Alert, Site Area Emergency (SAE) and General Emergency (GE). EPA Protective Action Guidelines (EPA PAG) The EPA PAGs are expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. I [Document No.] Rev. [X] Page 15 of 289 j

Explosion A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present. Faulted The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. Fire Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. Fission Product Barrier Threshold A pre-determined, site-specific, observable* threshold indicating the loss or potential loss of a fission product barrier. (refer to Section 2.2) Flooding A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. General Emergency Events are in process or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity OR HOSTILE ACTIONS that result in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA PROTECTIVE ACTION GUIDELINE exposure levels offsite for more than the immediate site area. Hostage A person(s) held as leverage against the station to ensure that demands will be met by the station. Hostile Action An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, tal<e HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). I [Document No.] Rev. [X] Page 16 of 2891

Hostile Force One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. Imminent The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. lmpede(d) Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely emp.loyed). Independent Spent Fuel Storage Installation (ISFSI) A complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. ISFSI Protected Area Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan. Initiating Condition An event or condition that aligns with the definition of one of the four emergency classification levels by virtue of the potential or actual effects or consequences. Intact (RCS) The RCS should be considered intact ~hen the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams) (ref. 4.1.8). Owner Controlled Area (OCA) For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan (ref. 4.1.12). Projectile An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety. Plant Protected Area Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the Plant Protected Area. I [Document No.] Rev. [X] Page 17 of 2891

RCS Leakage RCS Leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

(

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, o~ vessel wall.

d. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

Reduced Inventory Condition (RIC) The condition existing whenever RCS water level is lower than 3 feet below the reactor vessel flange (below 111-foot elevation) with fuel in the core. Refueling Pathway The refueling cavity, spent fuel pool and fuel transfer canal comprise the refueling pathway. Ruptured The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection. Safety System A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Security Condition j [Document No.] Rev. [X] Page 18 of 289 j

Any SECURITY EVENT as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A security condition does not involve a HOSTILE ACTION. Security Event. Any incident representing an attempted, threatened, or actual breach of the security system or reduction of the operational effectiveness of that system. A security event can result in either a SECURITY CONDITION or HOSTILE ACTION (ref. 4.1.12). Site Area Emergency Events are in process or have occurred which involve actual or likely major failures of plant functions needed for protection of the public OR HOSTILE ACTIONS that result in intentional damage or malicious acts; (1) toward site personnel or equipment that could lead to the likely failure of or; (2) that prevent effective access to equipment needed for the protection of the public.

• Any releases are riot expected to result in exposure levels which exceed EPA PROTECTIVE ACTION GUIDELINES exposure levels beyond the SITE BOUNDARY.

Site Boundary As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points (ref. 4.1.6). Tornado A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm.

• Unisolable An open or breached system line that cannot be isolated, remotely or locally.

NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak.

• Unplanned A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Unusual Event Events are in process or have occurred which indicate a potential degradation in the level of safety of the plant OR Indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs. Valid j [Document No.] Rev. [X] Page 19 of 289 j

An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel; such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. Visible Damage Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failurE? did not cause damage to a structure or any other equipment) is not visible damage. I[Document No.] Rev. [X] Page 20 of 289 j

I I \

                                                                                       \
                                                                                  **     \
                                                                                           \

llTt 1\ i 111

                         .)11
                                 "' .. ~
                           **            A c
                                             ' c:              0    (     A    ft FSAR UPDA TE
              ... ... m
                                                    . I

• t **

                                                                 ,..  ...                       UNITS 1 AND 2 OIABLO CANYON SITE
                 'JtUIU uo IOUA 21-2 SIT PLAN A 0 GASEOUSll.IOIJIO FFlU T

• RE LEASE P01Nl$

[Document No.] Rev. [X] Page 21 of 289

5.2 Abbreviations/Acronyms

°F ............................................................................................................... Degrees Fahrenheit 0
  *********************************************************************************************************************************** Degrees AC ............................................................................................................... Alternating Current AFW ............................................................................................................Auxiliary Feedwater AOP ......................................................................................... Abnormal Operating Procedure ATL .............................................................................................................. Automatic Tie Line A TWS .............................................................................. Anticipated Transient Without Scram BA .............................................................................................................................. Boric Acid BART .................................................................................................. Boric Acid Reserve Tank BAST .................................................................................................. Boric Acid Storage Tank GAS ................................................................. :....................................... Central Alarm Station CCW ................................................................................................ Component Cooling Water CC(#) ................................................................................................ Control Console (number)

COE ............................................................................................... Committed Dose Equivalent CEDE. ............................................................................. Committed Effective Dose Equivalent GET ................................................................................................... , Core Exit Thermocouple CFCU ......................................................................................... Containment Fan Cooling Unit CFR ............................................................................................. Code of Federal Regulations CMT .......................................................................................................................Containment CSFST ............................................................................... Critical Safety Function Status Tree CST ................................................................................................. Condensate Storage Tank OBA ....................................................................................................... Design Basis Accident DC ....................................................................................................................... Direct Current DCPP ............................................................................................. Diablo Canyon Power Plant DOE ................................................................................................ Double Design Earthquake DE ...............................................................................................................Design Earthquake EAL. .................................................................................................... Emergency Action Level ECCS .................................................................................... Emergency Core Cooling System EGL ......................................................................................... Emergency Classification Level ED ............................................................................................................. Emergency Director EDE .................................................................................................. Effective Dose Equivalent EFM .................................................................................................. Earthquake Force Monitor ENF ............................................................................................. Emergency Notification Form EOF .......................................................................................... Emergency Operations Facility EOP ....................................................................................... Emergency Operating Procedure EPA ............................................................................. .'........ Environmental Protection Agency ERG ........................................................................................ Emergency Response Guideline EPIP ........................................................................ Emergency Plan Implementing Procedure ESF ................................................................................................. Engineered Safety Feature I[Document No.] Rev. [X] Page 22 of 2891

ERFDS ............................................................. Emergency Response F~cility Display*System FAA..............................................*................. :.......................... Federal Aviation Administration FBI ........................................................................................... Federal Bureau of Investigation FEMA. ...................................................................... Federal Emergency Management Agency FSAR ............................................................................................ Final Safety Analysis Report ft ......................................................................................................................................... Feet FTS ................................................................................................. Federal Telephone System GDC ......................................................................................................General Design Criteria GE**************************************************'********************************************************** General Emergency HASP ......................................................................................................... High Alarm Setpoint HOO .............................................................................. NRC Headquarters Operations Officer IC ***********************************************************************************.***********************:*******Initiating Condition in ............................................ *......................................................................................... Inches IPEEE ......................... Individual Plant Examination of External Events (Generic Letter 88-20) l<eff ...................................................................:.............. Effective Neutron Multiplication Factor LCO ................................................................................... :...... Limiting Condition of Operation LER ....................................................................................................... Licensee Event Report LOCA ................................................................................................. Loss of Coolant Accident LWR ........................................................................................................... Light Water Reactor MEDT ................................................................. ~ ........... Miscellaneous Equipment Drain Tank MPC ................................................................................. Maximum Permissible Concentration MPC ....................................................................................................... Multi-Purpose Canister mR, mRem, mrem, mREM ......... ,,. ........................................... milli-Roentgen Equivalent Man MSL ............................................................................................ ;..................*.Main Steam Line MW ............................................................................................................................ Megawatt NEI ...................................................................................................... Nuclear Energy Institute NEIC ........................................................................... National Earthquake Information Center NESP ........................................................................... National Environmental Studies Project NPP .......................................................................................................... Nuclear Power Plant NRC ...................... :*****************************************************************Nuclear Regulatory Commission NSSS ........................................................................................ Nuclear Steam Supply System NORAD ........................................................... North American Aerospace Defense Command (NO)UE ........................................................................................ Notification of Unusual Event NUREG ........................................................................................................Nuclear Regulation QBE .............................................................................................. Operating Basis Earthquake OCA .......................................................................................................Owner Controlled Area ODCM .................................................................................... Off-site Dose Calculation Manual OES ............................................................................................ Office of Emergency Services ORO ......................................................................................... Offsite Response Organization PA ...................................................................................................................... Protected Area I[Document No.] Rev. [X] Page 23 of 2891

PAG ................................................................................................ Protective Action Guideline PAM ................................................................................................... Post Accident Monitoring PAR ................................................................................... Protective Action Recommendation PBX ................................................................................................... Private Branch Exchange PGA .................. ?...**.***.**.*.*.******..*.*..................**...***.**..................... Peak Ground Acceleration PPC .................................................................................................... Plant Process Computer PRA/PSA ............................. Probabilistic Risk Assessment I Probabilistic Safety Assessment PRT ...................................................................................................... Pressurizer Relief Tank PSIG ........................................................................................ Pounds per Square Inch Gauge PTS ................................................................................................ Pressurized Thermal Shock PWR ............................................................................................... Pressurized Water Reactor R .............................................................................-.................................................... Roentgen RCC ..................... : ......................... l .................................................... Reactor Control Console RCDT. ...................................... .-..................................................... Reactor Coolant Drain Tank RCS .................................................................................................... Reactor Coolant System RHR ..................................................................................................... Residual Heat Removal Rem, rem, REM ............................................................................... Roentgen Equivalent Man RETS ................................................................. Radiological Effluent Technical Specifications RTS ................. :............................................... *, ............... '. ........................ Reactor Trip System R(P)V ............................................................................................... Reactor (Pressure) Vessel RVLIS .................................................................... ,.... Reactor Vessel Level Indicating System RVRLIS ....................................................... Reactor Vessel Refueling Level Indicating System RWST .................. :******************** ................................................. Refueling Water Storage Tank SAE ........................'................................................................................. Site Area Emergency SAMG .......................................................................... Sever Accident Management Guideline SAR ....................................................................................................... Safety Analysis Report SAS ........................................................................... ,....................... Secondary Alarm Station SBO ................................................................................................................. Station Blackout SCBA ............................................................................... Self-Contained Breathing Apparatus SCMM ............................................................................................ Sub Cooled Margin Monitor SEC .............................................................................................. Site Emergency Coordinator SG ..................................................................................................................Steam Generator SI ........................................................................................ :............................. Safety Injection SM *****:******************************************************* .......................................................... Shift Manager SPDS ....................................................................................Safety Parameter Display System SRO .................................................................................................... Senior Reactor Operator SSF ........................................................................................................Safe Shutdown Facility TC ............................................................................................._. ......................... Thermocouple TEDE ....................................................................................... Total Effective Dose Equivalent TOAF ................................... ;........................................................................ Top of Active Fuel I[Document No.] Rev. [X] Page 24 of 2891

TSC .................................................................................................. Technical Support Center UE ...................................................................................................................... Unusual Event UFSAR ........................................................................... Updated Final Safety Analysis Report USGS .................................................................................... United States Geological Survey VB(#) ................................................................................................... Vertical Board (number) VDC ............................................................................................................Volts Direct Current WOG ........................................................................................... Westinghouse Owners Group WR ........................................................................................................................ Wide Range XFMR .................................................................................................................... Transformer I[Document No.] Rev. [X] Pag*e 25 of 2891

6.0 DCPP-TO-NEI 99-01 Rev. 6 EAL CROSS-REFERENCE This cross-reference is provided to facilitate association and location of a DCPP EAL within . the NEI 99-01 IC/EAL identification scheme. Further information regarding the development of the DCPP EALs based on the NEI guidance can be found in the EAL .Comparison Matrix. DCPP NEI 99-01 Rev. 6 Example EAL IC/ EAL RU1.1 AU1 1, 2 RU1.2 AU1 3 RU2.1 AU2 1 RA1.1 AA1 1 RA1.2 AA1 2

• RA1.3 AA1 3 RA1.4 AA1 4 RA2.1 AA2 1 RA2.2 AA2 2 RA2.3' AA2 3 RA3.1 AA3 1 RA3.2 AA3 2 RS1.1 AS1 1.

RS1.2 AS1 2 RS1.3 AS1 3 RS2.1 AS2 1 RG1.1 AG1 1 RG1.2 AG1 2 RG1.3 AG1 3 RG2.1 AG2 1 CU1.1 CU1 1 I [Document No.] Rev. [X] Page 26 of 2891

DCPP NEI 99-01 Rev. 6 Example EAL IC EAL CU1.2 CU1 2 CU2.1 CU2 1 CU3.1 CU3 1 CU3.2 CU3 2 CU4.1 CU4 1 CU5.1 CU5 1, 2, 3 CA1.1 CA1 1 CA1.2 CA1 2 CA2.1 CA2 1 CA3.1 CA3 1, 2-CA6.1 CA6 1 CS1.1 CS1 1 CS1.2 CS1 2 CS1.3 CS1 3 CG1.1 CG1 1 CG1.2 CG 2 FA1.1 FA1 1 FS1.1 FS1 1 FG1.1 FG1 1 HU1.1 HU1 1, 2 3 HU2.1 HU2 1

                .c HU3.1    HU3           1 HU3.2    HU3           2.

HU3.3 HU3 3 HU3.4 HU3 4 I [Document No.] Rev. [X] Page 27 of 2891

DCPP NEI 99-01 Rev. 6 Example EAL IC EAL HU4.1 HU4 1 HU4.2 HU4 2 HU4.3 HU4 3 HU4.4 HU4 4 HU7.1 HU? 1 HA1.1 HA1 1, 2 HA5.1 HA5 1 HA6.1 HA6 1 HA7.1 HA? 1 HS1.1 HS1 1 HS6.1 HS6 1 HS7.1 HS? 1 HG7.1 HG? 1 SU1.1 SU1 1 SU3.1 SU2 1 SU4.1 SU3 1 SU4.2 SU3 2 SU5.1 SU4 1, 2, 3 SU6.1 SU5 1 SU6.2 SU5 2 SU7.1 SU6 1,2,3 SU8.1 SU? 1, 2 SA1.1 SA1 1 SA3.1 SA2 1 SA6.1 SA5 1 I [Document No.] Rev. [X] Page 28 of 2891

DCPP NEI 99-01 Rev. 6 Example EAL IC EAL SA9.1 SA9 1 SS1.1 SS1 1 SS2.1 SSS 1 SS6.1 SS5 1 SG1.1 SG1 1 SG2.1 SGS 1 EU1.1 E-HU1 1 I [Document No.] Rev. [X] Page 29 of 2S9 I

7.0 ATTACHMENTS 7.1 Attachment 1, Emergency Action Level Technical Bases 7.2 Attachment 2, Fission Product Barrier Matrix and Basis I [Document No.] Rev. [X] Page 30 of 2891

ATTACHMENT 1 EAL Bases Category R - Abnormal Rad Release I Rad Effluent EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.) Many EALs are based on actual or potential degradation of fission product barriers because of the elevated potential for offsite radioactivity release. Degradation of fission product barriers though is not always apparent via non-radiological symptoms. Therefore, direct indication of elevated radiological effluents or area radiation levels are appropriate symptoms for emergency classification.

• At lower levels, abnormal radioactivity reJeases may be indicative of a failure of containment systems or precursors to more significant releases. At higher release rates, offsite radiological conditions may result which require offsite protective actions. Elevated area radiation levels in plant may also be indicative of the failure of containment systems or preclude access to plant vital equipment necessary to ensure plant safety.

Events of this category pertain to the following subcategories:

1. Radiological Effluent Direct indication of effluent radiation monitoring systems provides a rapid assessment mechanism to determine releases in excess of classifiable limits. Projected offsite doses, actual offsite field measurements or measured release rates via sampling indicate doses or dose rates above classifiable limits.

2. Irradiated Fuel Event Conditions indicative of a loss of adequate shielding or damage to irradiated fuel may I

preclude access to vital plant areas or result in radiological releases that warrant emergency classification.

3. Area Radiation Levels Sustained general area radiation levels which may preclude access to areas requiring continuous occupancy also warrant emergency classification.

I [Document No.] Rev. [X] Page 31 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity greater than 2 times the Offsite Dose Calculation Manual limits for 60 minutes or longer.

• EAL:

RU1.1 Unusual Event* Reading on any Table R-1 effluent radiation monitor> column "UE" for ~ 60 minutes. (Notes 1, 2, 3) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. Table R-1 Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm tn

i 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc Cll tn Plant Vent ttl (!) 1.9E-1 Oamps 1{2)-RM-87 ---- ---- ---- 3.2E-1 µCi/cc Liquid Radwaste Effluent "C ":i Line O-RM-18 ----- ----- ----- 1.6E+5 cpm C"

i SGBD Tank 1{2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode Applicability:

All Definition(s): VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. Basis: ERO Decision Making Information Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is knqwn to have I[Document No.] Rev. [X] Page 32 of 2891

ATTACHMENT 1 EAL Bases stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Even if a release does not meet the levels of this EAL, a release may be reportable. In these cases, consult Admin Procedure Xl1.ID2. Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL. This EAL addresses normally occurring continuous radioactivity releases from monitored gaseous or liquid effluent pathways. Escalation of the emergency classification level would be via IC RA 1.

Background

The column "UE" gaseous and liquid release values in Table R-1 represent two times the appropriate Offsite Dose Calculation Manual release rate limits associated with the specified monitors (ref. 1, 2). This IC addresses a potential decrease in the level of safety of the plant as indicated by a low-level radiological release that exceeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un-monitored, including those for which a radioactivity discharge permit is normally prepared. Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions, DCPP Basis Reference(s):

1. DCPP Radiological Effluent Technical Specifications

2. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

3. NEI 99-01 AU1 I [Document No.] Rev. [X]

• Page 33 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity greater than 2 times the Offsite Dose Calculation Manual limits for 60 minutes or longer. EAL: RU1.2 Unusual Event Sample analysis for a gaseous or liquid release indicates a concentration or release rate

 > 2 x Offsite Dose Calculation Manual limits for~ 60 minutes. (Notes 1, 2)

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. Basis: ERO Decision Making Information This EAL addresses uncontrolled gaseous or liquid releases that are detected by sample analyses or environmental surveys (particularly on unmonitored and/or UNISOLABLE pathways, e.g., spills of radioactive liquids into storm drains, heat exchanger leaks into river water systems, etc.). Sample analysis results relative to Offsite Dose Calculation Manual limits are provided by Chemistry. Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL. Escalation of the emergency classification level would be via IC RA 1.

Background

This IC addresses a potential decrease in the level of safety of the plant as indicated by a low-level radiological release that exceeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un-monitored, including those for which a radioactivity discharge permit is normally prepared. Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent j [Document No.] j Rev. [X] I Page 34 of 289 j

ATTACHMENT 1 EAL Bases unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. DCPP Basis Reference(s):

1. DCPP Radiological Effluent Technical Specifications

.2. NEI 99-01 AU1 I [Document No.]                               Rev. [X]                              Page 35 of 2891

ATTACHMENT 1 EAL Bases Category: R -Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid CDE. EAL: RA1.1 Alert Reading on any Table R-1 effluent radiation monitor> column "ALERT" for;::: 15 minutes. (Notes 1, 2, 3, 4) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. Note 4 The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Table R-1 Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm ~ 2.5E+5 cpm 8.0E+4 cpm Ill

J 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc Q) Ill Plant Vent ca 1.9E-1 O amps (!) 1{2)-RM-87 ---- ---- ---- 3.2E-1 µCi/cc Liquid Radwaste Effluent

• s"CC" Line O-RM-18 ----- ----- ----- 1.6E+5 cpm

J SGBDTank 1{2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode Applicability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. I[Document No.] 1 Rev. [X] Page 36 of 2891

~--------- -- ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL address gaseous radioactivity releases, that for whatever reason, cause effluent radiation monitor readings corresponding to SITE BOUNDARY doses that exceed either:

• 10 mRem TEDE
• 50 mRem thyroid COE The results from a dose assessment are preferred using actual meteorology, when available.

Until available, the pre-calculated effluent monitor values presented in Table R-1 should be used for emergency classification. Once an accurate dose assessment is performed, classifica~ion should be based on dose assessment only and not using the effluent monitor values in Table R-1. For example, a Table R-1 Alert effluent threshold is exceeded. However, real-time dose assessment results are available indicating offsite doses less than EAL RA 1.2 thresholds. Declaration of an Alert due to EAL RA 1.1 is not required. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to .have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Escalation of the emergency classification level would be via IC RS1.

Background

The column "ALERT" gaseous effluent release values in Table R-1 correspond to calculated doses of 1% (10% of the SAE thresholds) of the EPA PROTECTIVE ACTION GUIDELINES (TEDE or COE Thyroid) (ref..1): This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of p~ssible accident events and conditions. The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

2. NEI 99-01 AA 1 I [Document No.] Rev. [X] Page 37 of 2891

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid COE. EAL: )' RA1.2 Alert Dose assessment using actual meteorology indicates doses > 10 mrem TEDE or 50 mrem thyroid CDE at or beyond the SITE BOUNDARY. (Note 4) Note 4: The pre-calculated effluent monitor values presented in EALs RA1 .1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available .. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Dose projections are performed by computer-based method (ref. 1, 2, 3). Dose assessments may utilize real-!ime dose projections and/or field monitoring results. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Escalation of the emergency classification level would be via IC RS1.

Background

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). a Radiological effluent EALs are also included to provide basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses

'the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid CDE. I [Document No.] Rev. [X] Page 38 of 2891

ATTACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. EP RB-9, Calculation of Release Rate

2. EP RB-11, Emergency Offsite Dose Calculations

3. EP R-2, Release of Airborne Radioactive Materials Initial Assessment

4. NEI 99-01 AA 1 I [Document No.] Rev. [X] Page 39 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid COE. EAL: RA1.3 Alert Analysis of a liquid effluent sample indicates a concentration or release rate that would result in doses > 10 mrem TED_E or 50 mrem thyroid COE at or beyond the SITE BOUNDARY for 60 minutes of exposure. (Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Escalation of the emergency classification level would be via IC RS1.

Background

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP R-3 Release of Radioactive Liquids

2. NEI 99-01 AA 1 I[Document No.] Rev. [X]

• Page 40 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than .10 mrem TEDE or 50 mrem thyroid COE. EAL: RA1.4 Alert Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

• Closed window dose rates are > 10 mR/hr and are expected to continue for~ 60 minutes.
• Analyses of field survey samples indicate thyroid COE > 50 mrem for 60 minutes of intfalation.

(Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified .time limit. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information EP RB-8, Instructions for Field Monitoring Teams provides guidance for emergency or post-accident radiological environmental monitoring (ref. 1). Escalation of the emergency classification level would be via IC RS1.

Background

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. I [Document No.] Rev. [X] Page 41 of 2891

ATIACHMENT 1 EAL Bases The TEOE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEOE and thyroid COE. DCPP Basis Reference(s):

1. EP RB-8, Instructions for Field Monitoring Teams

2. NEI 99-01 AA 1 I.roocument No.] Rev. [X] Page 42 of 2891

ATTACHMENT 1 EAL Bases Category: R-Abnormal Rad Levels I Rad Effluent Subcategory: 1 '.'""" Radiological Effluent I lnitiating,Condition: Release of gaseous radioactivity resulting in offsite dose greater than *.I 100 mrem TEDE or 500 mrem thyroid CDE. EAL: RS1.1 Site Area Emergency Reading on any Table R-1 effluent radiation monitor> column "SAE" for ;;::: 15 minutes. (Notes 1, 2, 3, 4) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. N,ote 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should only be used for emergency classification assessm~nts until the results from a dose assessment using actual meteorology are available. - Table R-1 Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm UI

l 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc Cl) UI Plant Vent ca 1.9E-10 amps (!) 1{2)-RM-87 ---- ---- ---- 3.2E-1 µCi/cc Liquid Radwaste Effluent "l::I

• Line O-RM-18 ----- ----- ----- 1.6E+5 cpm tr

J SGBDTank 1{2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode Applicability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. I[Document No.] Rev. [X] Page 43 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL address gaseous radioactivity releases, that for whatever reason, cause effluent radiation monitor readings corresponding to SITE BOUNDARY doses that exceed either:

• 100 mRem TEDE
• 500 mRem thyroid COE The results from a dose assessment are preferred using actual meteorology, when available.

Until available, the pre-calculated effluent.monitor values presented in Table R-1 should be used for emergency classification. Once an accurate dose assessment is performed, classification should be based on dose assessment only and not using the effluent monitor values in Table R-1. For example, a Table R-1 SAE effluent threshold is exceeded. However, real-time dose assessment results are available indicating offsite doses less than EAL RS1 .2 thresholds. Declaration of a Site Area Emergency due to EAL RS1 .1 is not required. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes. Escalation of the emergency classification level would be via IC RG1.

Background

The column "SAE" gaseous effluent release value in Table R-1 corresponds to calculated doses of 10% of the EPA PROTECTIVE ACTION GUIDELINES (TEDE or thyroi~ COE) (ref. / 1). - , This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

2. NEI 99-01 AS1 I[Document No.] Rev. [X] Page 44_ of 2891

ATTACHMENT 1 EAL Bases Category: R -Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem thyroid COE. EAL: RS1.2 Site Area Emergency Dose assessment using actual meteorology indicates doses > 100 mrem TEDE or 500 mrem thyroid COE at or beyond the SITE BOUNDARY. (Note 4) Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RGf .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points.

• Basis:

ERO Decision Making Information Dose projections are performed by computer-based method (ref. 1, 2, 3). Dose assessments may utilize real-time dose projections and/or field monitoring results. Escalation of the emergency classification level would be via IC RG1.

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are

• associated with the failure of plant systems needed for the protection of the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that .cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE. and thyroid COE. I [Document No.] Rev. [X] Page 45 of 2891

ATTACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. EP RB-9, Calculation of Release Rate

2. EP RB-11, Emergency Offsite Dose Calculations

3. EP R-2, Release of Airborne Radioactive Materials Initial Assessment

4. NEI 99-01 AS1 I [Document No.] Rev. [X] Page 46 of 2891

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem thyroid COE. EAL: RS1 .3 Site Area Emergency Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

• Closed window dose rates are > 100 mR/hr and are expected to continue for ;: : : 60 minutes.
• Analyses of field survey samples indicate thyroid COE > 500 mrem for 60 minutes of inhalation.

(Notes 1, 2)

• 1 Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information EP RB-8, Instructions for Field Monitoring Teams provides guidance for emergency or post-accident radiological environmental monitoring (ref. 1). Escalation of the emergency classification level would be via IC RG1.

Background

This IC' addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem thyroid COE I [Document No.] Rev. [X] Page 47 of 2891

ATTACHMENT 1 EAL Bases was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP RB-8, Instructions for Field Monitoring Teams

2. NEI 99-01 AS1 I [Document No.] Rev. [X] Page 48 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem thyroid COE. EAL: RG1 .1 General Emergency Reading on any Table R-1 effluent radiation monitor> column "GE" for =:: 15 minutes. (Notes 1, 2, 3, 4). Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Note 3: If the effluent flow past an effluent monitor is known to have stopped, indicating that the release path is isolated, the effluent monitor reading is no longer VALID for classification purposes. Note 4: The pre-calculated effluent monitor values presented in EALs RA1 .1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment U?ing actual meteorology are available. Table R-1 Effluent Monitor Classification Thresholds Release Point Monitor GE SAE Alert UE 2.5E+6 cpm 2.5E+5 cpm 8.0E+4 cpm UI

i 1(2)-RM-14/14R -----

0 5.6E-2 µCi/cc 5.6E-3 µCi/cc 1.8E-3 µCi/cc QI UI Plant Vent ca 1.9E-10 amps (!) 1(2)-RM-87 ---- ---- ---- 3.2E-1 µCi/cc Liquid Radwaste Effluent "C

• sC" Line O-RM-18 ----- ----- ----- 1.6E+5 cpm

J SGBD Tank 1(2)-RM-23 ----- ----- ----- 2.0E+4 cpm Mode Applicability:

All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. , I [Document No.] Rev. [X] Page 49 of 2891

ATTACHMENT 1 EAL Bases I [Document No.] Rev. [X] Page 50 of 2891

r ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL address gaseous radioactivity releases, that for whatever reason, cause effluent radiation monitor readings corresponding to SITE BOUNDARY doses that exceed either:

• 1000 mRem TEDE
• 5000 mRem thyroid COE The results from a dose assessment are preferred using actual meteorology, when available.

Until available, the pre-calculated effluent monitor values presented in Table R-1 should be used for emergency classification. Once an accurate dose assessment is performed, classification should be based on dose assessment only and not using the effluent monitor values in Table R-1. For example, a Table R-1 GE effluent threshold is exceeded. However, real-time dose assessment results are available indicating offsite doses less than EAL RG1 .2 thresholds. Declaration of a General Emergency due to EAL RG1 .1 is not required. Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Background

The column "GE" gaseous effluent release values in Table R-1 correspond to calculated doses of 100% of the EPA PROTECTIVE ACTION GUIDELINES (TEDE or thyroid COE) (ref. 1). This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more_ fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1601 Radiological Effluent EAL Values

2. NEI 99-01 AG1 I [Document No.] Rev. [X] Page 51 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem thyroid COE. EAL: RG1.2 General Emergency Dose assessment using actual meteorology indicates doses > 1,000 mrem TEDE or 5,000 mrem thyroid COE at or beyond the SITE BOUNDARY. (Note 4) Note 4: The pre-calculated effluent monitor values presented in EALs RA1 .1, RS1 .1 and RG1 .1 should only be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available. Mode Applicability: All Definition(s): SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information Dose projections are performed by computer-based method (ref. 1, 2, 3). Dose assessments may utilized real-time dose projections and/or field monitoring results.

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions. The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. DCPP Basis Reference(s):

1. EP RB-9, Calculation of Release Rate

2. EP RB-11, Emergency Offsite Dose Calculations

3. EP R-2, Release of Airborne Radioactive Materials Initial Assessment

4. NEI 99-01 AG1 I [Document No.] Rev. [X] . Page 52 of 2891

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem thyroid COE. EAL: RG1 .3 General Emergency Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

• Closed window dose rates are > 1,000 mR/hr and are expected to continue for;::: 60 minutes.
• Analyses of field survey samples indicate thyroid COE > 5,000 mrem for 60 minutes of inhalation.

(Notes 1, 2) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 2: If an ongoing release is detected and the release start time cannot be determined, assume that the release duration has exceeded the specified time limit. Mode Applicability: All Definition(s): SITE BOUNDARY-As depicted in the Final Safety Analysis Report Update (UFSAR), Figure'2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information EP RB-8, Instructions for Field Monitoring Teams provides guidance for emergency or post-accident radiological environmental monitoring (ref. 1).

Background

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA PROTECTIVE ACTION GUIDES (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public. Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions

• alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem thyroid COE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid COE. I [Document No.] Rev. [X] Page 53 of 2891

ATIACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. EP RB-8, Instructions for Field Monitoring Teams

2. NEI 99-01 AG1 I[Document No.] Rev. [X] Page 54 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: UNPLANNED loss of water level above irradiated fuel~ EAL: RU2.1 Unusual Event UNPLANNED water level drop in the REFUELING PATHWAY as indicated by low water level alarm or equivalent indication. AND UNPLANNED rise to low alarm setpoint in corresponding area radiation levels as indicated by any of the following radiation monitors:

• RM-58 Spent 1Fuel Pool Area
• RM-59 New Fuel Area
• RM-2 Containment Area (Mode 6 only)
• Any temporary installed monitor in vicinity of the REFUELING PATHWAY (when installed)

Mode Applicability: All Definition(s): UNPLANNED-..A parameter change ~x an event that is not 1) the result of an intended

• evolution or 2) an expected plant response to a tra.nsient. The cause of the parameter change or event may be known or unknown.

REFUELING PATHWAY-. The reactor refueling cavity, spent fuel pool and fuel transfer canal comprise the refueling pathway. Basis: ERO Decision Making Information Note that this EAL is applicable only in cases where the elevated reading is due to an UNPLANNED loss of water level. The Spent Fuel Pool (SFP) low water level alarm setpoint is 23 ft. 9 in. above 'the top of irradiated fuel seated in the SFP storage racks or 137 feet 4 inches elevation. The Refueling Cavity low water level alarm setpoint is at 138 feet elevation as measured on Reactor Vessel Refueling Level Indicating System (RVRLIS) (i.e., 24 feet above the top of reactor vessel flange). I [Document No.] Rev. [X] Page 55 of 2891

ATTACHMENT 1 EAL Bases The reading on an area radiation monitor (permanently installed or temporary) located near the Reactor Cavity may increase due to planned evolutions such as head lift, or even a fuel assembly being raised in the manipulator mast. Elevated radiation monitor indications to the low alarm setpoint will need to be combined with another indicator (or personnel report) of water loss (ref. 5, 6) A water level decrease will be primarily determined by indications from available level instrumentation. Other sources of level indications may include reports from plant personnel (e.g., from a refueling crew) or video camera observations (if available). A significant drop in the water level may also cause an increase in the radiation levels of adjacent areas that can be detected by monitors in those locations. A drop in water level above irradiated fuel within the reactor vessel may be classified in accordance Recognition Category C during the Cold Shutdown and Refueling modes. Escalation of the emergency classification level would be via IC RA2.

Background

SFP water level at 136 feet 7 inches elevation is the Technical Specification LCO limit (SR

3. 7.15) that requires 23 ft. of water above irradiated fuel seated in the Spent Fuel Pool storage racks.

A minimum depth of 23 feet of water over the irradiated fuel assemblies in the SFP and 23 feet of water over the reactor vessel flange in the refueling cavity is maintained to ensure sufficient iodine activity would be retained to limit offsite doses from the. accident to < 25% of 10 CFR 100 limits and to ensure that the offsite dose consequences due to a postulated fuel handling accident are acceptable (ref. 1, 2, 3, 4). Loss of Spent Fuel Pool water inventory results from either a rupture of the pool or transfer canal liner, or failure of the spent fuel cooling system and the subsequent boil-off. Allowing SFP water level to decrease could result in spent fuel being uncovered, reducing spent fuel decay heat removal and creating an extremely hazardous radiation environment. The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 feet above the top of the reactor vessel flange. While a radiation monitor (RM-58, RM-59, RM-2 or temporarily installed monitors in the vicinity of the REFUELING PATHWAY) could detect an increase in dose due to a drop in the water level, it might not be a reliable indication, in and of itself, of whether or not there is adequate shielding from irradiated fuel (ref. 5, 6). When the spent fuel pool and reactor cavity are connected, there could exist the possibility of

• uncovering irradiated fuel. Therefore, this EAL is applicable for conditions in which irradiated fuel is being transferred to and from the reactor vessel and spent fuel pool.

This IC addresses a decrease in water level above irradiated fuel sufficient to cause elevated~ radiation levels. This condition could be a precursor to a more serious event and is also indicative of a minor loss in the ability to control radiation levels within the plant. It is therefore a potential degradation in the level of safety of the plant. DCPP Basis Reference(s):

1. Technical Specification 3.7.15, SFP Level I[Document No.] Rev. [X] Page 56 of 289 j

ATIACHMENT 1 EAL Bases

2. Technical Specification 3.9.7, Refueling Cavity Water Level

3. AR PK11-04 input 1064, Spent Fuel Pool Lvlffemp

4. AR PK02-22 input 1185, Rx Vsl Refueling Lvl (red)

5. OP AP-22, Spent Fuel Pool Abnormalities

6. AR PK-11-10, FHB High Radiation

7. NEI 99-01 AU2 I [Document No.] Rev. [X] Page 57 of 2891

AITACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel. EAL: RA2.1 Unusual Event Uncovery of irradiated fuel in the REFUELING PATHWAY. Mode Applicability: All Definition(s): CONFINEMENT BOUNDARY - The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As applied to the DCPP ISFSI, the confinement boundary is defined to be the Multi-Purpose Canister (MPG). REFUELING PATHWAY-. The reactor refueling cavity, spent fuel pool and fuel transfer canal comprise the refueling pathway. Basis: ERO Decision Making Information This EAL addresses events that have caused a significant lowering of water level within the REFUELING PATHWAY. This EAL applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. Once sealed, damage to a loaded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance with EU1 .1. While an area radiation monitor could detect an increase in a dose rate due to a lowering of water level in some portion of the REFUELING PATHWAY, the reading may not be a reliable indication of whether or not the fuel is actually uncovered. To the degree possible, readings should be considered in combination with other available indications of inventory loss. A drop in water level above irradiated fuel within the reactor vessel may be classified in accordance Recognition Category C during the Cold Shutdown and Refueling modes. Escalation of the emergency classification level would be via IC RS1.

Background

These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant. This EAL escalates from RU2.1 in that the loss of level, in the affected portion of the REFUELING PATHWAY, is of sufficient magnitude to have resulted in uncovery of irradiated fuel. Indications of irradiated fuel uncovery may include direct or indirect visual observation (e.g., reports from personnel or camera images), as well as significant changes in water and radiation levels, or other plant parameters. Computational aids may also be used (e.g., a boil-I [Document No.] Rev. [X] Page 58 of 2891

ATTACHMENT 1 EAL Bases off curve). Classification of an event using this EAL should be based on the totality of available indications, reports and observations. DCPP Basis Reference(s):

1. OP AP-21, Irradiated Fuel Damage

2. OP AP-22, Spent Fuel Pool Abnormalities

3. NEI 99-01 AA2 I [Document No.] Rev. [X] Page 59 of 2891

ATIACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel. EAL: RA2.2 Alert Damage to irradiated fuel resulting in a release of radioactivity. AND High alarm on any of the following radiation monitors:

• RM-59 New Fuel Storage Area
• RM-58 Spent Fuel Pool Area
• Any temporary installed monitor in vicinity of the REFUELING PATHWAY (when installed)
• RM-2 Containment Area (Mode 6 only)
• RM-44A/B Containment Ventilation Exhaust (Mode 6 only)

Mode Applicability: All Definition(s): CONFINEMENT BOUNDARY - The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As applied to the DCPP ISFSI, the confinement boundary is defined to be the Multi-Purpose Canister (MPC). Basis: ERO Decision Making Information This EAL addresses a release of radioactive material caused by mechanical damage to irradiated fuel. Damaging events may include the dropping, bumping or binding of an assembly, or dropping a heavy load onto an assembly. A rise in readings on radiation monitors should be considered in conjunction with in-plant reports or observations of a potential fuel damaging event (e.g., a fuel handling accident). This EAL applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. Once sealed, damage to a loaded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance with EAL EU1 .1. Escalation of the emergency would be based on either Recognition Category R or C ICs.

Background

The specified radiation monitors are those expected to see increase area radiation levels as a result of damage to irradiated fuel (ref. 1, 2). I [Document No.] Rev. [X] Page 60 of 2891

ATIACHMENT 1 EAL Bases The bases for the SFP area radiation high alarms and containment area and ventilation radiation high alarms are a spent fuel handling accident and are, therefore, appropriate for this EAL. In the fuel handling building, a fuel assembly could b_e dropped in the fuel transfer canal or in the SFP. Should a fuel assembly be dropped in the fuel transfer canal or in the spent fuel pool and release radioactivity above a prescribed level, the area radiation monitors sound an alarm, alerting personnel to the problem. Area radiation monitors in the fuel handling building isolate the normal fuel handling building ventilation system and automatically initiate the recirculation and filtration systems. (ref. 1, 2, 3). This EAL addresses events that have caused IMMINENT or actual damage to an irradiated fuel assembly. These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. OP AP-21, Irradiated Fuel Damage

2. OP AP-22, Spent Fuel Pool Abnormalities

3. l&C RMS Data Book

4. NEI 99-01 AA2 I [Document No.] Rev. [X] Page 61 of 2891

ATTACHMENT 1 EAL Bases

                                                     /

Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damage to,. irradiated fuel. EAL: ' RA2.3 Alert Lowering of spent fuel pool level to 10 ft. above top of the fuel racks (Level 2). Mode Applicability: All Definitiori(s): None Basis: ERO Decision Making Information This EAL addresses a significant lowering of water level within the spent fuel pool. For DCPP Plant SFP Level 2 is 10 ft. (plant El. 123' 11 ") as indicated on Ll-801. Backup indication is also available on Ll-802. The PPC point for SFP level is L0690A for both units. Main Annunciator window PK1'1-04 will alarm at SFP Level 2 (ref. 3) .. Escalation of the emergency classification level would be via one or more EALs under IC RS1 or RS2.

Background

These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant. Spent fuel pool water level at this value is within the lower end of the level range necessary to prevent significant dose consequences from direct gamma radiation to personnel performing operations in the vicinity of the spent fuel pool. This condition reflects a significant loss of spent fuel pool water inventory and thus it is also a precursor to a loss of the ability to adequately cool the irradiated fuel assembles stored in the pool. Post-Fukushima order EA-12-051 (ref. 1) required the installation of reliable SFP level indication capable of identifying normal minimum level (Level 1 - 134' 5"), SFP level 10 ft. above the top of the fuel racks (Level 2 - 123' 11 ") and SFP level at the top of the fuel racks (Level 3 - 114' 11 "). DCPP Basis Reference(s):

1. NRC EA-12-51 Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation

2. PG&E Letter DCL-13-073 Response to Request for Additional Information Regarding Overall Integrated Plan in Response to March 12, 2012, Commission Order to Modify I [Document No.] Rev. [X] Page 62 of 2891

ATTACHMENT 1 EAL Bases Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)

3. Procedure AR PK11-04

4. SAP documents 50808058 & 68039896 (Unit 1)

5. SAP documents 50808059 & 68039897 (Unit 2)

6. NEI 99-01 AA2 I [Document No.] Rev. [X] Page 63 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Spent fuel pool level at the top of the fuel racks. EAL: RS2.1 Site Area Emergency Lowering of spent fuel pool level to 1 ft. above top of the fuel racks (Level 3). Mode Applicability: All Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a . relatively short period of time regardless of mitigation or corrective actions. Basis: ERO Decision Making Information This EAL addresses a significant loss of spent fuel pool inventory control leading to IMMINENT fuel damage. For DCPP Plant SFP Level 3 is 1 ft. (plant El. 114' 11") as indicated on Ll-801 (includes 1 ft. instrument uncertainly). Backup indication is also availablE? on Ll-802. The PPC point for SFP level is L0690A for both units. Escalation of the emergency classification level would be via one or more EALs under IC RG1 or RG2. *

Background

This condition entails major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. It is recognized that this EAL would likely not be met until well after another Site Area Emergency EAL was met; however, it is included to provide classification diversity. Post-Fukushima order EA-12-051 (ref. 1) required the installation of reliable SFP level indication capable of identifying normal minimum level (Level 1 - 134' 5"), SFP level 10 ft. above the top of the fuel racks (Level 2 - 123' 11 ") and SFP level at the top of the fuel racks (Level 3 - 114' 11"). DCPP Basis Reference(s):

1. NRC EA-12-51 Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation

2. PG&E Letter DCL-13-073 Response to Request for Additional Information Regarding Overall Integrated Plan in Response to March 12, 2012, Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)

I[Document No.] Rev. [X] Page 64 of 2891

ATTACHMENT 1 EAL Bases

3. NEI 99-01 AS2 I [Document No.] Rev. [X] Page 65 of 2891

ATTACHMENT 1 EAL Bases Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Spent fuel pool level cannot be restored to at least the top of the fuel racks for 60 minutes or longer. EAL: RG2.1 General Emergency Spent fuel pool level cannot be restored to at least 1 ft. above top of the fuel racks (Level 3) for ;::: 60 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: All Definition(s): None Basis: ERO Decision Making Information This EAL addresses a significant loss of spent fuel pool inventory control and makeup capability leading to a prolonged uncovery of spent fuel. This condition will lead to fuel damage and a radiological release to the environment. For DCPP Plant SFP Level 3 is 1 ft. (plant El. 114' 11 ") as indicated on Ll-801 (includes 1 ft. instrument uncertainly). Backup indication is also available on Ll-802. The PPG point for SFP level is L0690A for both units. It is recognized that this EAL would likely not be met until well after another General Emergency EAL was met; however, it is included to provide classification diversity.

Background

Post-Fukushima order EA-12-051 (ref. 1) required the installation of reliable SFP level indication capable of identifying normal minimum level (Level 1 - 134' 5"), SFP level 10 ft. above the top of the fuel racks (Level 2 - 123' 11 ") and SFP level at the top of the fuel racks (Level 3-114' 11"). DCPP Basis Reference(s):

1. NRG EA-12-51 Issuance of Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation

2. PG&E Letter DCL-13-073 Response to Request for Additional Information Regarding Overall Integrated Plan in Response to March 12, 2012, Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA 051)

3. NEI 99-01 AG2 I [Document No.] Rev. [X] Page 66 of 2891

ATIACHMENT 1 EAL Bases _) Category:

• R - Abnormal Rad Levels I Rad Effluent Subcategory: 3 - Area Radiation Levels Initiating Condition: Radiation levels that IMPEDE access to equipment necessary for normal plant operations, cooldown or shutdown EAL:

RA3.1 Alert Dose rates > 15 mR/hr in EITHER of the following areas: Control Room (O-RM-1 or portable gamma radiation instrument) OR Central Alarm Station (by survey) Mode Applicability: All Definition(s): JMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected ro6m/area (e.g:, requiring use of protective equipment; such as SCBAs, that is not routinely employed). Basis: ERO Decision Making Information Areas that meet this threshold include the Control Room and the Central Alarm Station (GAS). O-RM-1 monitors the Control.Room for area radiation (ref. 1). A portable gamma radiation instrument may be installed if O-RM-1 is out of service. The GAS is included in this EAL because of its' importance to permitting access to areas required to assure safe plant operations. There is no permanently installed GAS area radiation monitor that may be used to assess this EAL threshold. Therefore this threshold must be assessed via local radiation survey for the GAS (ref. 1). For this EAL the Secondary Alarm Station (SAS) is not considered. Escalation of the emergency classification level would be via Recognition Category R, C or F ICs.

Background

This IC addresses elevated radiation levels in certain plant rooms/areas sufficient to preclude or IMPEDE personnel from performing actions necessary to maintain normal plant operation, or to perform a normal plant cooldown and shutdown. As such, it represents an actual or potential substantial degradation of the level of safety of the plant. The SM/SEC/ED should consider the cause of the increased radiation levels and determine if another IC may be applicable. DCPP Basis Reference(s): I [Document No.] Rev. [X] Page 67 of 289 I

ATTACHMENT 1 EAL Bases

1. FSAR Table 11.4-1 Radiation Monitors and Readouts

2. NEI 99-01 AA3 I [Document No.] Rev. [X] Page 68 of 2891

ATIACHMENT 1 EAL Bases

                                              ~

Category: R - Abnormal Rad Levels I Rad Effluent Subcategory: 3 - Area Radiation Levels Initiating Condition: Radiation levels that IMPEDE access to equipment necessary for normal plant operations, cooldown or shutdown. EAL: RA3.2 Alert An UNPLANNED event results in radiation levels that prohibit or IMPEDE access to any Table R-2 rooms or areas. (Note 5) Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted.

                       , Table R-2          Safe Operation & Shutdown Rooms/Areas 11------

Room/Area Mode(s) Auxiliary Building - 115' - BASTs 2, 3, 4 Auxiliary Building - 100' - BA Pumps 2, 3,4 Auxiliary Building - 85' - Aux Control Board 2, 3,4

               - Auxiliary Building - 64' - BART Tank area                                              2, 3,4 Area H (below Control Room) - 100'. 480V Bus area/rooms                                3,4 Mode Applicability:

2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): ( IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information The identified rooms are those where an activity must be performed to borate to cold shutdown, isolate accumulators or cooldown using RHR. If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event. Rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, I [Document No.] Rev. [X] Page 69 of 2891

ATIACHMENT 1 EAL Bases corrective measures or emergency operations) are not included. In addition, the list specifies the plant mode(s) during which entry would be required for each room or area (ref. 1). For RA3.2, an Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the elevated radiation levels. The emergency classification is not contingent upon whether entry is actually necessary at the time of the increased radiation levels. Access should be considered as IMPEDED if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., installing temporary shielding, requiring use of non-routine protective equipment, requesting an extension in dose limits beyond normal administrative limits). An emergency declaration is not warranted if any of the following conditions apply:

• The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the elevated radiation levels). For example, the plant is in Mode 1 when the radiation increase occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4.
• The increased radiation levels are a result of a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., radiography, spent filter or resin transfer, etc.).
• The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).
• The access control measures are of a conservative or precautionary nature, and would not actually prevent or IMPEDE a required action.

Escalation of the emergency classification level would be via Recognition Category R, C or F ICs.

Background

The list of plant rooms or areas with entry-related mode applicability identified specify those rooms or areas that contain equipment which require 'a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown. This IC addresses elevated radiation levels in certain plant rooms/areas sufficient to preclude or IMPEDE personnel from performing actions necessary to maintain normal plant operation, or to perform a normal plant cooldown and shutdown. As such, it represents an actual or potential substantial degradation of the level of safety of the plant. The SM/SEC/ED should consider the cause of the increased radiation levels and determine if another IC may be applicable. NOTE: EAL RA3.2 mode applicability has been limited to the applicable modes identified in Table R-2 Safe Operation & Shutdown Rooms/Areas. If due to plant operating procedure or, plant configuration changes, the applicable plant modes specified in Table R-2 are changed, a corresponding change to Attachment 3 'Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases' and to EAL RA3.2 mode applicability is required." DCCP Basis Reference(s):

1. Attachment 3 Safe Operation & Shutdown Rooms/Areas Table R-2 & H-2 Bases I [Document No.] Rev. [X]

I Page 70 of 289 I

ATTACHMENT 1 EAL Bases

2. NEI 99-01 AA3 I [Document No.] Rev. [X] ~I Page 71 of 2891

ATTACHMENT 1 EAL Bases Category E - Independent Spent Fuel Storage Installation (ISFSI) EAL Group: Any (EALs in this category are applicable to any plant condition, hot or cold.) An independent spent fuel storage installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. A significant amount of the radioactive material contained within a canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from an accident involving the dry storage of spent nuclear fuel. An Unusual Event is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask confinement boundary is damaged or violated. The DCPP ISFSI is located within the OWNER CONTROLLED AREA but outside the PLANT PROTECTED AREA. Therefore SECURITY EVENTS related to the ISFSI are classified under either HU1.1 or HA1.1.

    !SFSI PROTECTED AREA - Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan.

OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA .. J [Document No.] Rev. [X] Page 72 of 289 J

ATTACHMENT 1 EAL Bases Category: ISFSI Subcategory: Confinement Boundary Initiating Condition: Damage to a loaded cask CONFINEMENT BOUNDARY. EAL: EU1.1 Unusual Event Damage to a loaded cask CONFINEMENT BOUNDARY as indicated by an on-contact radiation reading> Table E-1. SHJl:LU Table E-1 ISFSI Radiation Readings rn..mx 4 Surface Dose 4A I=:*::* ;;:;~::~ : ::.~~:~.- :-.*~; ::~.:--.::.\*~'" .:. . ::::[ Dose Point Location Rate * (see figure ) (mRem/hour) Base vent 72 1 Mid plane 80 2 3 Top vent 76 4 Lid-center 22 4a Lid-over top vents 139 Mode Applicability: All Definition(s): CONFINEMENT BOUNDARY-. The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As applied to the DCPP ISFSI , the confinement boundary is defined to be the Multi-Purpose Canister (MPC) . PLANT PROTECTED AREA -Areas to which access is strictly controlled in accordance with the station's Security Plan . BASEPLAl E Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. I [Document No.] Rev. [X] Page 73 of 2891

ATIACHMENT 1 EAL Bases Basis: ERO Decision Making Information An Unusual Event is declared on the basis of the occurrence of any event of sufficient magnitude that a loaded cask confinement boundary is damaged or violated as indicated by external on-contact dose rates exceeding the maximum calculated levels of an overpack with a loaded MPC-32 canister, based on the locations in the ISFSI FSAR Figure 7.3-1 (ref. 1, 2, 3). This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a storage cask containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the loaded storage cask is sealed. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask. The existence of "damage" is determined by radiological survey. Exceedance of the maximum ISFSI FSAR dose rates , as noted in reference 1,, is used here to distinguish between non-emergency and emergency conditions. The emphasis for this classification is the degradation in the level of safety of the spent fuel cask and not the magnitude of the associated dose or dose rate. The DCPP ISFSI is located wholly outside the PLANT PROTECTED AREA. Security-related events for ISF Sis are covered under ICs HU 1 and HA 1.

Background

The DCPP ISFSI Technical Specifications do not have maximum contact dose rate specified for the exterior of an overpack. The values in Table E-1 are derived from ISFSI FSAR Tables * (ref 1, 2). Since the UFSAR Table 7.3-1A are the maximum calculated dose rate values, and are not expected to ever be exceeded, a conservative approach of exceeding the highest possible fuel value dose rates, plus 5 mRem/hour, was used as an indication of damage to an overpack. Note: These values are approximately 2 times the maximum expected dose rate for low burn-up fuel (ref 2). The ISFSI includes the dry-cask storage system, the cask transfer facility, onsite transporter, and the storage pads. The dry-cask storage system is the HI-STORM 100 System. This is a canister-based storage system that stores spent nuclear fuel in a vertical orientation. It consists of three discrete components: the MPC, the HI-TRAC 125 Transfer Cask, and the HI-STORM 100 System Overpack (see pictures at end of section). The MPC provides the confinement boundary for the stored fuel. The HI-TRAC 125 Transfer Cask provides radiation shielding and structural protection of the MPC during transfer operations, while the storage overpack provides radiation shielding and structural protection of the MPC during storage. The HI-STORM 100 System is passive and does not rely on any active cooling systems to remove spent fuel decay heat. After the storage casks are placed on the storage pad , the ISFSI Technical Specifications require that the casks be inspected periodically to ensure that the air vents are not blocked. Security personnel control access to the storage area and identify and assess off-normal and emergency events. Health physics personnel perform dose rate and contamination surveys to ensure that the appropriate regulatory limits are maintained. Maintenance personnel maintain the facilities including the storage casks , emergency equipment, and transport systems (ref. 4). I [Document No.] I Rev. [X] Page 74 of 2891

ATTACHMENT 1 EAL Bases The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors , and configuration changes which could cause challenges in removing the cask or fuel from storage . DCCP Basis Reference(s):

1. Diablo Canyon ISFSI FSAR Update, Chapter 7 Radiation Protection , Table 7.3-1A "Surface and 1 Meter Dose Rates for the Overpack with an MPC-32 69,000 MWD/MTU and 5-Year Cooling"

2. Diablo Canyon ISFSI FSAR Update, Chapter 7 Radiation Protection, Table 7.3-1 B "Surface and 1 Meter Dose Rates for the Overpack with an MPC-32 32 ,500 MWD/MTU and 5-Year Cooling"

3. Diablo Canyon ISFSI FSAR Update, Chapter 7, Figure 7.3-1 "Cross Section Elevation of the Generic Hi-Storm 1OOS Overpack with Dose Point Locations. "

4. NRG Materials License No. SNM-2511 , LICENSE FOR INDEPENDENT STORAGE OF SPENT NUCLEAR FUEL AND HIGH-LEVEL RADIOACTIVE WASTE , Safety Evaluation Report

5. NEI 99-01 E-HU1 DCPP ISFSI HI-STORM 100 System HI-STORM Storage Casks (Overpack)

I [Document No.] Rev. [X] Page 75 of 2891

ATIACHMENT 1 EAL Bases Category C - Cold Shutdown I Refueling System Malfunction EAL Group: Cold Conditions (RCS temperature ::; 200°F); EALs in this category are applicable only in one or more cold operating modes. Category C EALs are directly associated with cold shutdown or refueling system safety functions. Given the variability of plant configurations (e.g., systems out-of-service for maintenance, containment open, reduced AC power redundancy, time since shutdown) during these periods, the consequences of any given initiating event can vary greatly. For example, a loss of decay heat removal capability that occurs at the end of an extended outage has less significance than a similar loss occurring during the first week after shutdown. Compounding these events is the likelihood that instrumentation necessary for assessment may also be inoperable. The cold shutdown and refueling system malfunction EALs are based on performance capability to the extent possible with consideration given to RCS integrity, containment closure, and fuel clad integrity for the applicable operating modes (5 - Cold Shutdown, 6 - Refueling, D - Defueled). The events ot'this category pertain to the following subcategories:

1. RCS Level RCS water level is directly related to the status of adequate core cooling and, therefore, fuel clad integrity.

2. Loss of Emergency AC Power Loss of emergency plant electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may .

be necessary to ensure fission product barrier integrity. This category includes loss of

• onsite and offsite power sources for 4.16KV AC emergency buses.

3. RCS Temperature Uncontrolled or inadvertent temperature or pressure increases are indicative of a potential loss of safety functions.

4. Loss of Vital DC Power

• Loss of emergency plant electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of power to or degraded voltage on the 125V DC vital buses.

5. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.

6. Hazardous Event Affecting Safety Systems Certain hazardous natural and technological events may result in VISIBLE DAMAGE to or DEGRADED PERFORMANCE of SAFETY SYSTEMS warranting classification.

I [Document No.] Rev. [X] Page 76 of 2891

ATTACHMENT 1 EAL Bases. DEGRADED PERFORMANCE - As applied to hazardous event thresholds, damage significant enough to cause concern regarding the operability or reliability of the affected safety system train. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. I [Document No.] . Rev. [X] Page 77 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: UNPLANNED loss of RCS inventory. EAL: CU1.1 Unusual Event UNPLANNED loss of RCS inventory results in RCS water level less than a procedurally designated lower limit for ;::: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determin'ing that time limit has been exceeded, or will likely be exceeded. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): REDUCED INVENTORY CONDITION (RIC) - The condition existing whenever RCS water level is lower than 3 feet below the reactor vessel flange (below 111-foot elevation) with fuel in the core. UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unk_nown. Basis: ERO Decision Making Information Refueling evolutions that decrease RCS water inventory are carefully planned and controlled. An UNPLANNED event that results in water level decreasing below a procedurally required limitwarrants the declaration of an Unusual Event due to the reduced water inventory that is available to keep the core covered. The 15-minute threshold duration allows sufficient time for prompt operator actions to restore and maintain the expected water level. This criterion excludes transient conditions causing a brief lowering of water level. Continued loss of RCS inventory may result in escalation to the Alert emergency classification level via either IC CA 1 or CA3.

Background

With the plant in Cold Shutdown, RCS water level is normally maintained above 25% Cold Calibration Pressurizer level (-129 ft. elevation). However, if RCS level is being controlled below 25%, or if level is being maintained in a procedurally designated band in the reactor vessel it is the inability to maintain level above the low end of the designated control band due to a loss of inventory resulting from a leak in the RCS that is the concern (ref. 2). With the plant in Refueling mode, RCS water level is normally maintained at or above the reactor vessel flange (Technical Specifications requires at least 23 ft. of water above the top of the reactor vessel flange in the refueling cavity during refueling operations) (ref. 1). However, I [Document No.] Rev. [X] Page 78 of 2891

ATTACHMENT 1 EAL Bases RCS level may be maintained below the reactor vessel flange if in "lowered inventory" or "REDUCED INVENTORY" condition (ref. 2). This EAL addresses the inability to restore and maintain water level to a required minimum level (or the lower limit of a procedurally specified level band). This condition is considered to be a potential degradation of the level of safety of the plant. This EAL recognizes that the minimum required RCS level can change several times during the course of a refueling outage as different plant configurations and system lineups are implemented .. This EAL is met if the minimum level, specified for the current plant conditions, cannot be maintained for 15 minutes or longer. The minimum level is typically specified in the applic~ble operating procedure but may be specified in- another controlling document. DCPP Basis Reference(s): r*

1. Technical Specification 3.9.7, Refueling Cavity Water Level

2. OP A-2: II, U1 Reactor Vessel - Draining the RCS to the Vessel Flange -With Fuel in Vessel

3. NEI 99-01 CU1 I [Document No.] Rev. [X] Page 79 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: UNPLANNED loss of RCS inventory. EAL: CU1.2

• Unusual Event RCS water level cannot be monitored.

AND EITHER

• UNPLANNED increase in any Table C-1 sump/fank level due to loss of RCS inventory.
• Visual observation of UNISOLABLE RCS LEAKAGE.

Table C-1 Sumps I Tanks,

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT

                              *. RCDT

• CCW Surge Tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT Mode Applicability:

5 - Cold Shutdown, 6 - Refueling

                                                                                     /

Definition(s):

• INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams).

RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank; /

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to -interfere with the operation of leakage detection systems or not to be pressure boundary leakage; I [Oocument No.] Rev. [X] Page 80 of 2891

ATIACHMENT 1 EAL Bases

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

d. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. ' UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. I [Document No.] Rev. [X] Page 81 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information Refueling evolutions that decrease RCS water inventory are carefully planned and controlled. An UNPLANNED event that results in water level decreasing below a procedurally required limit warrants the declaration of an Unusual Event due to the reduced water inventory that is available to keep the core covered. The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e. g. camera) visual observation. This EAL addresses a condition where all means to determine RCS level have been lost. In this condition, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels (Table C-1). Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS. Continued loss of RCS inventory may result in escalation to the Alert emergency classification level via either IC CA1 or CA3.

Background

In Cold Shutdown mode, the RCS will normally be INTACT and standard RCS level monitoring means are available. In this EAL, the ability to monitor RCS level is lost such that RCS inventory loss must be detected by indirect leakage indications. The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e. g. camera) visual observation. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS unexplainably rises above the pre-established rate to maintain RCS inventory, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. Visual observation of leakage from systems connected to the RCS that cannot be isolated could also be indicative of a loss of RCS inventory (ref. 1). This IC addresses the loss of the ability to monitor RCS level concurrent with indications of RCS LEAKAGE. Either of these conditions is considered to be a potential degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. OP AP SD-2, "Loss of RCS Inventory

2. NEI 99-01 CU1 j [Document No.] Rev. [X] Page 82 of 289 j

ATIACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory. EAL: CA1.1 Alert Loss of RCS inventory as indicated by reactor vessel level< 107 ft. 6 in. (107.5 ft.) on RVRLIS, Ll-400 standpipe or ultrasonic sensor. OR

< 67.5% RVLIS full range (RVLIS equivalent to 107 ft. 6 in.).

Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): None Basis: ERO Decision Making Information When reactor vessel water level decreases to 107 ft. 6 in. el., RCS level is -21 in. above the bottom of the RCS hot leg penetration. This is the minimum procedurally allowed RCS level to preclude vortexing of the RHR pumps while in Shutdown Cooling. This level can be monitored by:

• RVRLIS
• Ll-400 standpipe
• Ultrasonic sensor Although related, this EAL is concerned with the loss of RCS inventory and not the potential concurrent effects on systems needed for decay heat removal (e.g., loss of a Decay Heat Removal suction point). An increase in RCS temperature caused by a loss of decay heat removal capability is evaluated under IC CA3.

For this EAL; a lowering of RCS water level below the specified level indicates that operator actions have not been successful in restoring and maintaining RCS water level. The heat-up rate of the coolant will increase as the available water inventory is reduced. A continuing decrease in water level will lead to core uncovery. If RCS water level continues to lower, then escalation to Site Area Emergency would be via IC CS1.

Background

The purpose of the Reactor Vessel Refueling Level Instrumentation System (RVRLIS) is to provide reactor vessel and refueling cavity level indication during refueling, when the vessel head will be removed, and during drainage to half loop. The system is designed to be used only when the RCS is at near atmospheric pressure or when a vacuum is being established for I[Document No.] I Rev. [X] I Page 83 of 2891

ATTACHMENT 1 EAL Bases refill operations. The wide range and narrow range RVRLIS (if required) and the Ll-400 standpipe systems remain in service from the time RCS level is lowered below 25% Cold Calibrated Pressurizer level until just prior to pressurizing the RCS. Narrow Range RVRLIS is required if reduced inventory conditions (below 111 ft. elevation) are planned. The Ll-400 standpipe is a magnetic level indicator (Ll-400A, B, C standpipe) and provides local indication of reactor vessel refueling level. The indicator is mounted on the outside of the secondary shield wall (crane wall) and can be viewed from the 91 ft. elevation of Containment. The Indicator is composed of three mechanical flag indicator units. - RVRLIS, Ll-400 standpipe and ultrasonic detectors are off-scale low (105 ft. 9 in.) when reactor vessel water level drops below the elevation of the bottom of the RCS hot leg penetration. The ultrasonic sensor is installed during an outage and measures level on one of the hot legs. The purpose of the Reactor Vessel Level Instrumentation System (RVLIS) is to measure the level of the water or the relative void content of the coolant in the reactor vessel. The RVLIS setpoint corresponding to the minimum RHR pump operation limit was obtained as follows (ref. 2, 3, 4):

• Full range:

o Per SC-1-878, span = 494.9 in. and 0% = 79.6536 feet o  % span/in. = 100 I 494.9 = 0.20206%/in. and minimum RCS level for RHR operation (from above)= 107.5 feet 0 (107.5 - 79.6536) x 12 x 0.20206 = 67.5% This IC addresses conditions that are precursors to a loss of the ability to adequately cool irradiated fuel (i.e., a precursor to a challenge to the fuel clad barrier). This condition represents a potential substantial reduction in the level of plant safety. DCPP Basis .Reference(s):

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel - Draining to Half Loop/Half Loop Operations with Fuel in Vessel Drain-Down -

3. Instrument Scaling Calculation SC-1-878, Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

4. OP AP SD-0 Loss of, or Inadequate Decay Heat Removal

5. NEI 99-01 CA 1 I [Doc~ment No.] Rev. [X] Page 84 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory. EAL: CA1.2 Alert RCS water level cannot be monitored for ~ 15 minutes. (Note 1) AND EITHER

• UNPLANNED iricreas~ in any Table C:-1 Sump I Tank level due to loss of RCS inventory.
• Visual observation of UNISOLABLE RCS LEAKAGE.

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT
• RCDT
• CCW Surge Tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT Mode Applicability:

5 - Cold Shu_tdown, 6 - Refueling Definition(s): INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e:g., no freeze seals or nozzle dams). RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank; I [Document No.] Rev. [X] Page 85 of 2891

ATTACHMENT 1 EAL Bases

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage '

Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

e. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that djrectly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information In this EAL, the abllity to monitor RCS level would be unavailable for greater than 15 minutes, and the RCS inventory loss must be detected by indirect leakage indications (Table C-1). The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e.g. camera) visual observation. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the

• make-up rate to the RCS unexplainably rises above the pre-established rate, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified.

Visual observation of leakage from systems connected to the RCS that cannot be isolated could also be indicative of a loss of RCS inventory (ref. 1, 2). If the RCS inventory level continues to lower, then escalation to Site Area Emergency would be via IC CS1.

Background

For this EAL, the inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored by direct or indirect methods, operators may determine that an j [Document No.] Rev. [X] Page 86 of ,289 j

ATIACHMENT 1 EAL Bases inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS.

• In Cold Shutdown mode, the RCS will normally be INTACT and standard RCS level monitoring means are available.

In the Refuel mode, the RCS is not INTACT-and RPV level may be monitored by different means, including the ability to monitor level visually. This IC addresses conditions that are precursors to a loss of the ability to adequately cool irradiated fuel (i.e., a precursor to a challenge to the fuel clad barrier). This condition represents a potential substantial reduction in the level of plant safety. The 15-minute duration for the loss of level indication was chosen because it is half of the EAL duration specified in IC CS1. DCPP Basis Reference(s):

1. OP AP SD-2, Loss of RCS Inventory

2. OP AP-1, Excessive Reactor Coolant System Leakage

3. NEI 99-01 CA 1 I [Document No.] Rev. [X] Page 87 qf 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability. EAL: CS1 .1 Site Area Emergency With CONTAINMENT CLOSURE not established, RVLIS full range< 62.1 %. (Note 12) Note 12: With RVLIS out-of-service, classification shall be based on CS1 .3 or CG1 .2 if RCS inventory cannot be monitored. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling

. Definition(s):

CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown co11ditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. Basis: ERO Decision Making Information This EAL is only applicable when RVLIS is in service (see Note 12). When reactor vessel water level lowers to 62.1 %, water level is six inches below the elevation of the bottom of the RCS hot leg penetration. Six inches below the elevation of the bottom of the RCS hot leg penetration can be monitored only by RVLIS. Other reactor vessel water level monitoring systems (e.g., RVRLIS, Ll-400 standpipe, ultrasonic sensor, RVLIS upper range) are downscale-low when water level drops below the elevation of the bottom of the RCS hot leg penetration. Escalation of the emergency classification level would be via IC CG1 or RG1.

Background

When reactor vessel water level drops significantly below the elevation of the bottom of the RCS hot leg penetration, all sources of RCS injection have failed or are incapable of making up for the inventory loss. The RVLIS setpoint corresponding to six inches below the elevation of the bottom of the RCS hot leg penetration was obtained as follows (ref. 1, 2, 3, 4):

• Per SC-l-87B, span = 494.9 in. and 0% = 79.6536 feet I [Document No.] Rev. [X] Page 88 of 2891

ATIACHMENT 1 EAL Bases

      *   % span/in. = 100 / 494.. 9 = 0.20206%/in. and bottom of the hot leg (from above) =

105.75 feet

      *   (105. 75 79.6536) x 12 x 0.20206 = 62.1 %

Under the conditions specified by this EAL, continued lowering of reactor vessel water level is indicative of a loss of inventory control. Inventory loss may be due to a vessel breach, RCS pressure boundary leakage or continued boiling in the reactor vessel. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further RCS or reactor vessel water level drop and potential core uncovery. The . inability to restore and maintain level after reaching this setpoint infers a failure of the RCS barrier and potential loss of the Fuel Clad barrier. * ' The status of Containment closure is tracked if plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref. 5). This IC addresses a significant and prolonged loss of RCS inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant. These conditions entail major failures of plant functions needed for protection of the public and a thus warrant Site Area Emergency declaration. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable. Outage/shutdown contingency plans typically provide for re-establishing or verifying CONTAINMENT CLOSURE following a loss of heat removal or RCS inventory control functions. The difference in the specified RCS/reactor vessel levels of EALs CS1 .1 and CS2.2 reflect the fact that with CONTAINMENT CLOSURE established, there is a lower probability of a fission product release to the environment. This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Pow~ff Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. DCPP Basis Reference(s):

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel - Draining to Half Loop/Half Loop Operations with Fuel in Vessel

3. AP E-55, Equipment Elevations for RCS Flood-Up and Drain-Down

4. Instrument scaling calculation SC-1-878, "Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

5. AD8.DC54, Containment Closure

6. NEI 99-01 CS1 I [Document No.] Rev. [X] Page 89 of 2891

ATIACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability. EAL: CS1 .2 . Site Area Emergency With CONTAINMENT CLOSURE established, RVLIS full range< 56.6% (Top of Fuel). (Note 12)

• Note 12: With RVLIS out-of-service, classification shall be based on CS1 .3 or CG1 .2 if RCS inventory cannot be monitored.

Mode Applicability: 5- Cold Shutdown, 6- Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DC.PP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. Bases: ERO Decision Making Information This EAL is only applicable when RVLIS is in service (see Note 12). When reactor vessel water level drops below RVLIS full range indication of 56.6% core uncovery is about to occur. This level drop can only be remotely monitored by reactor vessel Level Instrumentation System (RVLIS).

• Other reactor vessel water level monitoring systems (e.g., RVRLIS, Ll-400 standpipe, ultrasonic sensor, RVLIS upper range) are downscale-low when water level drops below the elevation of the bottom of the RCS hot leg penetration.

Escalation of the emergency classification level would be via IC CG1 or RG1.

Background

The RVLIS setpoint corresponding to the top of fuel was obtained as follows (ref. 1, 2, 3, 4):

      *                         =

Per SC-l-87B, span 494.9 in. and 0% 79.6536 feet=

      *   % span/in. = 100 I 494.9 = 0.20206%/in. and top of core = 103 feet
      *   (103 - 79.6536) x 12 x 0.20206 = 56.6%

Under the conditions specified by this EAL, continued lowering of reactor vessel water level is indicative of a loss of inventory control. Inventory loss may be due to a vessel breach, RCS pressure boundary leakage or continued boiling in the reactor vessel. The magnitude of this I [Document No.] Rev. [X] Page 90 of 2891

ATTACHMENT 1 EAL Bases loss of water indicates that makeup systems have not been effective and may not be capable of preventing further RCS or reactor vessel water level drop and potential core uncovery. The inability to restore and maintain level after reaching this setpoint infers a failure of the RCS barrier and Potential Loss of the Fuel Clad barrier. The status of Containment closure is tracked if plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref. 5). This IC addresses a significant and prolonged loss of RCS inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant. These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable. Outage/shutdown contingency plans typically provide for re-establishing or verifying CONTAINMENT CLOSURE following a loss of heat removal or RCS inventory control functions. The difference in the specified RCS/reactor vessel levels of EALs CS1 .1 and CS1 .2 reflect the fact that with CONTAINMENT CLOSURE established, there is a lower probability of a fission product release to the environment. This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial .Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. ( DCPP Basis Reference(s):

1. Plant Drawing No. 57729

2. OP A-2:111, Reactor Vessel -*Draining to Half Loop/Half Loop Operations with Fuel in Vessel

3. AP E-55, Equipment Elevations for RCS Flood-Up and Drain-Down

4. Instrument scaling calculation SC-1-878, "Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

5. AD8.DC54, Containment Closure

6. NEI 99-01 CS1 I [Document No.] I* Rev. [X] Page 91 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability. EAL: CS1.3 Site Area Emergency RCS water level cannot be monitored for~ 30 minutes. (Note 1). AND Core uncovery is indicated by any of the following:

• UNPLANNED increase in any Table C-1 sump/tank level of sufficient magnitude to indicate core uncover.
• Any Bridge (Manipulator) Crane Radiation Monitor > 9 R/hr.
• Erratic Source Range Monitor indication.

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded .. Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor_ Cavity Sump
• PRT
• RCDT
• CCW Surge Tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., rio freeze seals or nozzle dams). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. I [Document No.] Rev. [X] Page 92 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information In this EAL, the ability to monitor RCS level would be unavailable for greater than 30 minutes, and the RCS inventory loss must be detected by indirect leakage indications (Table C-1). The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e.g. camera) visual observation. - " The reactor vessel inventory loss may be detected by the radiation monitors or erratic source range monitor indication. As water level in the reactor :vessel lowers, the dose rate above the core will rise. The Bridge Crane Radiation Monitors can be monitored either locally, or remotely on the Viewpoint software. Post-TM I accident studies indicated that the installed PWR nuclear instrumentation will operate erratically when the core is uncovered and that this should be used as a tool for making such determinations (ref.1 ). The inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instru\llentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tan~ levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS . Escalation of the emergency classification level would be via IC CG1 or RG1.

Background

In Cold Shutdown mode, the RCS will normally be INTACT and standard RCS level monitoring means are available. In the Refueling mode, the RCS is not INTACT and RPV level may be monitored by different means, including the ability to monitor level visually. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS ur'lexplainably rises above the pre-established rate, a loss of RCS inventory may be occurring even if the source of the leakage cann_ot be immediately identified. The dose rate due to this core shine should result in increased Bridge (Manipulator) Crane Radiation Monitor indication. A reading of 9 R/hr (90% of instrument scale) is indicative of core uncovery. There are a number of variables 'governing the projected dose rate from an actual core uncover (ref. 2).

• This IC addresses a significant and prolonged loss of RCS inventory control and makeup capability leading to IMMINENT fuel damage. The lost i_nventory may be due to a RCS a

component failure, loss of configuration control or prolonged boiling of reactor coolant. These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable. I[Document No.] Rev. [X] Page 93 of 2891

ATIACHMENT 1 EAL Bases . The 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. DCPP Basis Reference(s}:

1. Nuclear Safety Analysis Center (NSAC), 1980, "Analysis of Three Mile Island - Unit 2 Accident," NSAC-1

2. EP-EALCALC-DCPP-1603 Radiation Monitor Readings for Core Uncovery During Refueling

3. NEI 99-01 CS1 I [Document No.] Rev. [X] Page 94 of 2891

ATIACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting fuel clad integrity with containment challenged. EAL: CG1 .1 General Emergency RVLIS full range< 56.6% (Top of Fuel) for;::: 30 minutes. (Notes 1, 12) AND Any Containment Challenge indication, Table C-2. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 6: If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, declaration of a General Emergency is not required. Note 12: With RVLIS out-of-service, classification shall be based on CS1 .3 or CG1 .2 if RCS inventory cannot be monitored. Table C-2 Containment Challenge Indications

• CONTAINMENT CLOSURE not established (Note 6)

                             * . Containment hydrogen concentration ;::: 4%

• UNPLANNED rise in Containment pressure Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, ~ontainment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

 *Basis:

ERO Decision Making Information This EAL is only applicable when RVLIS is in service (see Note 12). j [Document No.] Rev. [X] Page 95 of 289 j

ATIACHMENT 1 EAL Bases When reactor vessel water level drops below RVLIS full range indication of 56.6% core uncovery is about to occur. This level drop can only be remotely monitored by Reactor Vessel Level Instrumentation System (RVLIS). Other reactor vessel water level monitoring systems (e.g., RVRLIS, Ll-400 standpipe, ultrasonic sensor, RVLIS upper range) are downscale-low when water level drops below the elevation of the bottom of the RCS hot leg penetration. Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established

2. Containment hydrogen ;:::: 4%

3. UNPLANNED rise in Containment pressure (Containment pressure changes due to ventilation system changes do not constitute a containment challenge)

With CONTAINMENT CLOSURE not established, there is a high potential for a direct and unmonitored release of radioactivity to the environment. If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required .

. During periods when installed containment hydrogen gas monitors are out-of-service, use the other listed indications to assess whether or not containment is challenged.

The 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. The inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS.

Background

The RVLIS setpoint corresponding to the top of fuel was obtained as follows (ref. 1, 2, 3, 4):

• Per SC-l-87B, span = 494.9 in. and 0% = 79.6536 feet

      *   % span/in.= 100 / 494.9 = 0.20206%/in. and top of core= 103 feet
      *   (103 - 79.6536) x 12 x 0.20206 =56.6%

Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established - The status of Containment closure is tracked if plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref.5). If containment closure is re-established prior to exceeding the 30 minute core uncovery time limit then escalation to GE would not be required.

2. Containment hydrogen;:::: 4% - The 4% hydrogen concentration threshold is generally considered the lower limit for hydrogen deflagrations. To generate such levels of I [Document No.] I Rev. [X] I Page 96 of 2891

ATTACHMENT 1 EAL Bases combustible gas, loss of the Fuel Clad and RCS barriers are likely to have occurred. Operation of the Containment Hydrogen Recombiner with Containment hydrogen concentrations above 4.0% could result in ignition of the hydrogen. If in operation, containment hydrogen can be monitored in the Control Room on ANR-82/ANR-83 and PAM1 following local equipment initialization (ref. 6, 7)

3. UNPLANNED rise in Containment pressure - In the operating modes associated with this EAL, Containment pressure is expected to remain very low; thus, an elevated Containment pressure resulting from an UNPLANNED rise above near-atmospheric pressure conditions may be indicative of a challenge to the Containment barrier.

Containment pressure changes due to ventilation system changes do not constitute a containment challenge. Under the conditions specified QY this EAL, continued lowering of reactor vessel water level is indicative of a loss of inventory control with a challenge to the Containment. Inventory loss may be due to a vessel breach, RCS pressure boundary leakage or continued boiling in the reactor vessel. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further RCS or reactor vessel water level drop and potential core uncovery. The inability to restore and maintain level inventory within 30 minutes after reaching this condition in combination with a Containment challenge infers a failu~e of the RCS barrier, Loss of the Fuel Clad barrier and a Potential Loss of Containment. This IC addresses the inability to restore and maintain reactor vessel level above the top of active fuel with containment challenged. This condition represents actual or IMMINENT substantial core degradation or melting with potential for loss of containment. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area. Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable. The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a challenge to Containment integrity. I In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive gas mixture in containment. If all installed hydrogen gas monitors are out-of-service during an event leading to fuel cladding damage, it may not be possible to obtain a containment hydrogen gas concentration reading as ambient conditions within the containment will preclude personnel access. This EAL addresses concerns r~ised by Generic Letter 88-17, Loss of Decay Heat Removal; _SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. DCPP Basis Reference(s):

1. Plant Drawing No. 57729 I [Document No.] Rev. [X] Page 97 of 2891

ATIACHMENT 1 EAL Bases

2. OP A-2:111, Reactor Vessel - Draining to Half Loop/Half Loop Operations with Fuel in Vessel

3. AP E-55, Equipment Elevations for RCS Flood-Up and Drain-Down

4. Instrument scaling calculation SC-1-878, "Reactor Vessel Level Instrumentation System and Subcooled Margin Monitor

5. AD8.DC54, Containment Closure

6. CA-3, Hydrogen Flammability in Containment

7. OP H-9, INSIDE CONT H2 RECOMB SYSTEM

8. NEI 99-01 CG1 I [Document No.] Rev. [X] Page 98 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting fuel clad integrity with containment challenged. EAL: CG1 .2 General Emergency RCS level cannot be monitored for~ 30 minutes. (Note 1) AND Core uncovery is indicated by any of the following:

• UNPLANNED increase in any Table C-1 sump/tank level ofsufficient magnitude to indicate core uncover.
• Any Bridge (Manipulator) Crane Radiation Monitor > 9 R/hr.
• Erratic Source Range Monitor indication.

AND Any Containment Challenge indication, Table C-2. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

• Note 6: If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, declaration 1

of a* General Emergency is not re.quired. Table C-1 Sumps I Tanks

• Containment Structure Sumps
• Reactor Cavity Sump
• PRT
• RCDT
• CCW Surge Tank(s)
• Auxiliary Building Sump
• RWST
• RHR Room Sumps (alarm only)
• MEDT I [Document No.] Rev. [X] Page 99 of 2891

ATTACHMENT 1 EAL Bases Table C-2 Containment Challenge Indications

• CONTAINMENT CLOSURE not established (Note 6)
• Containment hydrogen concentration;::; 4%
• UNPLANNED rise in containment pressure Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant respon~e to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information In this EAL, the ability to monitor RCS level would be unavailable for greater than 30 minutes, and the RCS inventory loss must be detected by indirect leakage indications (Table C-1). The ability to monitor RCS level includes level instrumentation as well as direct and indirect (e.g. camera) visual observation. The reactor vessel inventory loss may be detected by the radiation monitors or erratic source range monitor indication. As water level in the reactgr vessel lowers, the dose rate above the core will rise. The Bridge Crane Radiation Monitors can be monitored either locally, or remotely on the Viewpoint software. Post-TM! accident studies indicated that the installed PWR nuclear instrumentation will operate erratically when the core is uncovered and that this should be used as a tool for making such determinations (ref. 1). Source Range indication can be seen on Source Range Detectors Nl-31 & 32 as well as the Gammametrics detectors. Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established I [Document No.] Rev. [X] Page 100 of 2891

     . J ATIACHMENT 1 EAL Bases

2. Containment hydrogen ~ 4%

3. UNPLANNED rise in Containment pressure (Containment pressure changes due to ventilation system changes do not constitute a containment challenge)

I During periods when installed containment hydrogen gas monitors are out-of-service, use the other listed indications to assess whether or not containment is challenged. The 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of a_bility to monitor level), and allows sufficient time to monitor, assess and correlate' reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring. The inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels. Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS.

Background

In Cold Shutdown mode, the RCS will normally be INTACT and standard RCS level monitoring means are available. In the Refueling mode, the RCS is not INTACT and RPV level may be monitored by different means, including the ability to monitor level visually. Level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS LEAKAGE. If the make-up rate to the RCS unexplainably rises above the pre-established rate, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. The dose rate due to this core shine should result in increased Bridge (Manipulator) Crane Radiation Monitor indication. A reading of 9 R/hr (90% of instrument scale) is indicative of core uncovery. There are a number of variables governing the projected dose rate from an actual core uncover (ref. 5). Three conditions are associated with a challenge to Containment:

1. CONTAINMENT COSURE not established - The status of Containment closure is tracked if plant conditions change that could raise the risk of a fission product release as a result of a loss of decay heat removal (ref.2). If containment closure is re-established prior to e'xceeding the 30 minute core uncovery time limit then escalation to GE would not be required.

2. Containment hydrogen ~ 4% - The 4% hydrogen concentration threshold is generally considered the lower limit for hydrogen deflagrations. To generate such levels of combustible gas, loss of the Fuel Clad and RCS barriers are likely to have occurred.

Operation of the Containment Hydrogen Recombiner with Containment hydrogen concentrations above 4.0% could result in ignition of the hydrogen. Containment hydrogen can be monitored in the Control Room on ANR-82/ANR-83 and PAM1 following local equipment initialization (ref. 3, 4) I [Document No.] Rev. [X] Page 101 of 2891

ATTACHMENT 1 EAL Bases

3. UNPLANNED rise in Containment pressure - In the operating modes associated with this EAL, Containment pressure is expected to remain very low; thus, an elevated Containment pressure resulting from an UNPLANNED rise above near-atmospheric pressure conditions may be indicative of a challenge to the Containment barrier.

Containment pressure changes due to ventilation system changes do not constitute a containment challenge. ' This IC addresses the inability to restore and maintain reactor vessel level above the top of active fuel with containment challenged. This condition represents actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area.

• Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable.

With CONTAINMENT CLOSURE not established, there is a high potential for a direct and unmonitored release of radioactivity to the environment. If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required. The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a challenge to Containment integrity. In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive gas mixture in containment. If all installed hydrogen gas monitors are out-of-service during an event leading to fuel cladding damage, it may not be possible to obtain a containment hydrogen gas concentration reading as ambient conditions within the containment will preclude personnel access.

• This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

DCPP Basis Reference(s):

1. Nuclear Safety Analysis Center (NSAC), 1980, "Analysis of Three Mile Island - Unit 2 Accident," NSAC-1

2. AD8.DC54, Containment Closure

3. OP H-9, INSIDE CONT H2 RECOMB SYSTEM

4. CA-3, Hydrogen Flammability in Containment

5. EP-EALCALC-DCPP-1603 Radiation Monitor Readings for Core Uncovery During Refueling

6. NEI 99-01 CG1 I [Document No.] Rev. [X] Page 102 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 2 - Loss of Vital AC Power Initiating Condition: Loss of all but one AC power source to vital buses for 15 minutes or longer. - EAL: CU2.1 Unusual Event AC power capability, Table C-3, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H reduced to a single power source for ~ 15 minutes. (Note 1) AND A failure of that single power source will result in loss of all AC power to SAFETY SYSTEMS. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-3 AC Power Capability Unit 1 Unit2 CD

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

t::::

          ~

• Startup XFMH 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR CD
• DG1-1-BusH
• DG 2 Bus H

t::::

• DG 1-2-Bus G
• DG 2 Bus G U) c:
• DG 1 Bus F
• DG 2-3-Bus F 0
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

5 - Cold Shutdown, 6- Refueling, D - Defueled Definition(s): I SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. I [Document No.] . Rev. [X] Page 103 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equipment. An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to a vital bus. Some examples of this condition are presented below.

• A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).
• A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of vital buses being back-fed from the unit main generator.
• A loss of emergency power sources (e.g., onsite diesel generators) with a single train of vital buses being back-fed from an offsite power source.
• If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1or1-1) can be used to supply the startup bus through the startup bus cross tie breaker.

Fifteen mi.nutes was selected as a threshold to exclude transient or momentary losses of power. When filling out the ENF form, this event can be Unit 1, Unit 2 or Unit 1 and 2. The subsequent loss of the remaining single power source would escalate the event to an Alert in accordance with IC CA2. *

Background

                                                                                \

The condition indicated by this EAL is the degradation of the offsite and onsite power sources such that any additional single failure would result in a loss of all AC power to the vital buses. 4.16KV buses F, G and H are the emergency (vital) buses. Each bus has three sources of power (see figure below). One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2).

• I [Document No.] Rev. [X] Page 104 of 2891

ATTACHMENT 1 EAL Bases Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. In addition, each units vital buses F, G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). Refer to CP M-10 Fire Protection of Safe Shutdo,wn Equipment for a list of SAFETY 1 SYSTEMS. ' When in the cold shutdown, refueling, or defueled mode, this condition is not classified as an Alert because ofthe increased time available to restore another power source to service. Additional time is available due to the reduced core decay heat load, and the lower temperatures and pressures in various plant systems. Thus, when in these modes, this condition is considered to be a potential degradation of the level of safety of the plant. This cold condition EAL is equivalent to the hot condition EAL SA 1.1. DCPP Electrical Distribution System 500kV Switch yard 230kV Switch yard MidwayB2'~1~T'-£YT~~ Bus1E :  :~$Mesa Midway3~ i?'T~T~ ~-"-,...Morro

                  '-f'L/.
                           *T*'-f'L/.~.
                               '-'

• U1 Main r----, I-/~

                                                                                                            ------1..'-f'\./..!.......:____

61......J Bay Ga tes 1 E L '-' Bus 1 BankXfmr * '-' 212

• Bus 2 l

722 622 11-1 SU Xfmrs 2-1 I 500W ~ 230W ~ U2MainBankXfmr500W/25W AuxX~~l~.--:2_0_5W-4W_'_f=i:::::-.-,f-)_A_1_';~~fm-k\r-li-~+-11-. I , 1: Tl - 2-r ~ 4W 12W ~-'fXfmr U1 Main - I I - U2 Main (X) (Y)

• _ . Generator ) 12kV SU Bus ( ( ( Generator _

r;- ) ) ~ s~~rs :iL: c._s. ( 7

                                                                                   '".., '" J"'              ,                                                 ~

!i:f J.. Oi 00 , {

OGur O~LJOG OC '""

      ~ ITTf: s ~D~4) (~~17cj; =ic~l,D ~
                  .i.;...i.

Bus D I I I Bus H I I I Bus G

                                                                      .i.;...i.;..i.

Bus F J...,;,l..,J. Bus F I I I* Bus G I I Bus H 1 J..,;,I. Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power 4 .. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 CU2 I [Docum~nt No.] Rev. [X] Page 105 of 2891

ATIACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 2 - Loss of Vital AC Power Initiating Condition: Loss of all offsite and all onsite AC power to vital buses for 15 minutes

                                                                                     \

or longer. EAL: CA2.1 Alert Loss of all offsite and all onsite AC power capability, Table C-3, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H for;;::: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table C-3 AC Power Capability , Unit 1 Unit2 Cl)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

         ~
         'I-

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR Cl)
• DG1-1-BusH
• DG 2 Bus H

!:::::

• DG 1 Bus G
• DG 2 Bus G fl) c:
• DG 1 Bus F ,
• DG 2 Bus F 0
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

5 - Cold Shutdown, 6 - Refueling, D - Defueled Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes: , j [Document No.] Rev. [X] Page 106 of 289 j

ATTACHMENT 1 EAL Bases

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

This EAL addresses a total loss of AC power for greater than 15 minutes that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. Fifteen minutes was selected as a threshold to exclude transient or momenta~ power losses. When filling out the ENF form, this event can be Unit 1, Unit 2 or Unit 1 and 2. Escalation of the emergency classification level would be via IC CS1 or RS1.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F, G and H are the emergency {vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. In addition, each units vital buses F, G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). When in the cold shutdown, refueling, or defueled mode, this condition is not classified as a Site Area Emergency because of the increased time available to restore a vital bus to service. Additional time is available due to the reduced core decay heat load, and the lower temperatures and pressures in various plant systems. Thus, when in these modes, this condition represents an actual or potential substantial degradation of the level of safety of the plant. This cold condition EAL is equivalent to the hot condition loss of all offsite AC power EAL ss1.1.' DCPP Electrical Distribution System I [Document No.] Rev. [X] Page 1071 of 2891

ATTACHMENT 1 EAL Bases 500kV Switchyard 230kV Switchyard MidwayB2'~1~J'-£"J~~----------~ Bus1E :  :~$Mesa Midway 3 +- ~-g--y-~yf-g~ --~ T~,.+ Morro Gates 1 ~J~---./. 722 622 Bus1 u1 Main ---~---

                                                                             ~                                  ~- l-/----.----/.Bus2~lg_J

__j_'-Q/..L...:......._ Bay

• BankXfmr I i=1 SU Xfmrs i i i 212 5001N ~ 2301N ~ U2 Main BankXfmr 5001Nf251N Auxx~~ . . . . L. .,l 1 2~s~w (f7f ~-~x1mr ~11

                   ~---~-""""25k\,._/_~-+--.

J_-=-

                                                                      ' - 121N
                                                                              )
                                                                                             ~

c II I 1 Aux~r T' 4Jsi;v21N l ~-'fx1mr U L (. . . . U1 Main r-. U2 Mam (X) (Y) Generator ) 12kV SU Bus ( ( ( Generator r:- - ---.--------------'~s~;:r* £----=========:::::;--( -( (l Bus..EJ}

       .JJ             Jl..)

Bus D 4 (X) 1N (X) (Y) Bus D Bus E2 DG DG DG DG DG DG

       ~ ITT(~ ~T=l;,4) (~~~f; ~ ~nJ ~
                       .i.;..i.

Bus D I I I Bus H

                                                  .i.;....i.;...i Bus G
                                                                     .i.;....i.;...i Bus F I I I Bus F I I I Bus G I I I Bus H
                                                                                                                                            .i...;.i.

Bus D DCPP Basis Reference(s): 1.. UFSAR, Section 8 . 2 . 2 2.. UFSAR, Section 8 . 3 . 1 . 6 3 . OP AP SD 1, Loss of AC Power 4.. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the SOOkV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 CA2 I [Document No.] Rev. [X] Page 108 of 289 j

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: UNPLANNED increase in RCS temperature. EAL: CU3.1 Unusual Event UNPLANNED increase in RCS temperature to> 200°F. (Note 10) Note 1O: Begin monitoring hot condition EALs concurrently. Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown condition~. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 "Containment Closure." INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information In the absence of reliable RCS temperature indication caused by a loss of decay heat removal capability, classification should be based on EAL CU3.2 should RCS level indication be subsequentlylost. , A momentary UNPLANNED excursion above the Technical Specification cold shutdown temperature limit of 200°F when the heat removal function is available does not warrant a classification. Escalation to Alert would be via IC CA 1 based on an inventory loss or IC CA3 based on exceeding plant configuration-specific time criteria.

Background

Numerous instruments are capable of providing indication of RCS temperature with respect to the Technical Specification cold shutdown temperature limit (200°F, ref. 1). These may include but are not limited to (ref. 2):

• TR413 Loop 1 Wide Range Temperature
• TR423 Loop 2 Wide Range Temperature I [Document No.] I Rev. [X] Page 109 of 2891

ATTACHMENT 1 EAL Bases

• TR433 Loop 3 Wide Ran'ge Temperature
• TR443 Loop 4 Wide Range Temperature
• WR Thot recorders 0-700°F
• WR Tcold recorders 0-700°F
• CETs
• RHR System temperatures (when RHR is in service)

This IC addresses an UNPLANNED increase in RCS temperature above the Technical Specification cold shutdown temperature limit and represents a potential degradation of the level of safety of the plant. If the RCS is not INTACT and CONTAINMENT CLOSURE is not established during this event, the SM/SEC/ED should also refer to IC CA3. This* EAL involves a loss of decay heat removal capability, or an addition of heat to the RCS in excess of that which can currently be removed, such that reactor coolant temperature cannot be maintained below the cold shutdown temperature limit specified in Technical Specifications. During this condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation. During an outage, the level in the reactor vessel will normally be maintained at or above the reactor vessel flange. Refueling evolutions that lower water level below the reactor vessel flange are carefully planned and controlled. A loss of forced decay heat removal at reduced inventory may result in a rapid increase in reactor coolant temperature depending on the time after shutdown. DCPP Basis Reference(s):

1. DCPP Technical Specifications Table 1.1-1 Modes

2. OP L-1, Plant Heatup From Cold Shutdown to Hot Standby

3. NEI 99-01 CU3 I [Document No.] Rev. [X] Page 110 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: UNPLANNED increase in RCS 'temperature. EAL: CU3.2 Unusual Event Loss of all RCS temperature and all RCS level indication for ;::: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: 5 - Cold Shutdown, 6- Refueling Definition(s): CONTAINMENT CLOSl/RE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 "Containment Closure." INTACT (RCS) - The RCS should be considered intact when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). Basis: ERO Decision Making Information This EAL addresses the inability to determine RCS temperature and level, and represents a potential degradation of the level of safety of the plant. If the RCS is not INTACT and CONTAINMENT CLOSURE is not established during ttiis event, the SM/SEC/ED should also refer to IC CA3. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication. Escalation to Alert would be via IC CA 1 based on an inventory loss or IC CA3 based on exceeding plant configuration-specific time criteria.

Background

Reactor vessel water level is normally monitored using the following instruments (ref. 1):

• RVRLIS
• Ll-400 Standpipe
• RVLIS
• Ultrasonic level detectors j [Document No.] Rev. [X] Page 111 of 289 j

ATTACHMENT 1 EAL Bases AP E-55, "Equipment Elevations for RCS Flood-Up and Drain-Down", provides a cross-reference of indicated water levels and key plant elevations Numerous instruments are capable of providing indication of RCS temperature with respect to the Technical Specification cold shutdown temperature limit (200°F, ref. 2). These may include but are not limited to (ref. 3):

• TR413 Loop 1 Wide Range Temperature
• TR423 Loop 2 Wide Range Temperature
• TR433 Loop 3 Wide Range Temperature
• TR443 Loop 4 Wide Range Temperature
• WR Thot recorders 0-700°F
• WR Tcold recorders 0-700°F
• CETs
• RHR System temperatures (when RHR is in service)

This EAL reflects a condition where there has been a significant loss of instrumentation capability necessary to monitor RCS conditions and operators would be unable to monitor key parameters necessary to assure core decay heat removal. During this condition, there is no immeaiate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation. DCPP Basis Reference(s):

1. AP E-55, "Equipment Elevations for RCS Flood-Up and Drain-Down

2. DCPP Technical Specifications Table 1.1-1

3. OP L-1, Plant Heatup From Cold Shutdown to Hot Standby

4. NEI 99-01 CU3 J [Document No.] Rev. [X] Page 112 of 289 J

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: Inability to maintain plant in cold shutdown. EAL: CA3.1 Alert UNPLANNED increase in RCS temperature to> 200°F for> Table C-4 duration. (Notes 1, 10) OR UNPLANNED RCS pressure increase > 10 psig (this does not apply during water-solid plant conditions). Note 1: The SM/SEC/ED should declare the event promptly upon determining that the applicable time has been exceeded, or will likely be exceeded. Note 1O: Begin monitoring hot condition EALs concurrently. Table C-4: RCS Heat-up Duration Thresholds CONTAINMENT RCS Status Heat-up Duration CLOSURE Status INTACT (but not REDUCED N/A 60 minutes* INVENTORY) Not INTACT 20 minutes* established OR REDUCED INVENTORY not established 0 minutes

• If an RCS heat removal system is in operation within this time frame and RCS temperature is trending down, the EAL is not applicable.

Mode Applicability: 5 - Cold Shutdown, 6 - Refueling Definition(s): CONTAINMENT CLOSURE - The procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under shutdown conditions. As applied to DCPP, Containment Closure is defined by Administrative Procedure AD8.DC54 Containment Closure. INTACT (RCS) - The RCS should be considered INTACT when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). I [Document No.] Rev. [X] Page 113 of 2891

ATTACHMENT 1 EAL Bases UNPLANNED -. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. REDUCED INVENTORY - The condition existing whenever RCS water level is lower than 3 \ feet below the reactor vessel flange (below 111-foot elevation) with fuel in the core. Basis: ERO Decision Making Information In the absence of reliable RCS temperature indication caused by the loss of decay heat removal capability, classification should be based on the RCS pressure increase criteria when the RCS is INTACT in Mode 5 or based on time to boil data when in Mode 6 or the RCS is not INTACT in Mode 5. A momentary UNPLANNED excursion above the Technical Specification cold shutdown temperature limit when the heat removal function is available does not warrant a classification. The RCS Heat-up Duration Thresholds table addresses an inerease in RCS temperature when CONTAINMENT CLOSURE is established but the RCS is not INTACT, or RCS inventory is reduc~d (e.g., mid-loop operation). The 20-mihute criterion was included to allow time for operator action to address the temperature increase. The RCS Heat-up Duration Thresholds table also addresses an increase in RCS temperature with the RCS INTACT. The status of CONTAINMENT CLOSURE is not crucial in this condition since the INTACT RCS is providing a high pressure barrier to a fission product ' release. The 60-minute time frame should allow suffiCient time to address the temperature increase without a substantial degradation in plant safety.

                           \
                                                                                      )

Escalation of the emergency classification level would be via IC CS1 or RS1.

Background

Numerous instruments are capable of providing indication of RCS temperature with respect to the Technical Specification cold shutdown temperature limit (200°F, ref. 1). These may include but are not limited to (ref. 2):

• TR413 Loop 1 Wide Range Temperature
• TR423 Loop 2 Wide Range Temperature
• TR433 Loop 3 Wide Range Temperature
• TR443 Loop 4 Wide Range Temperature
• WR Thot recorders 0-700°F
• WR Tcold recorders 0-700°F
• CETs
• RHR System temperatures (when RHR is in service)

Pl-403A, Pl-405 and Pl-405A display on VB2, with digital values available on PPC, SPDS and SCMM. Digital readouts can display changes of less than 10 psig. j [Document No.] Rev. [X] Page 114 of 289 j

ATTACHMENT 1 EAL Bases This IC addresses conditions involving a loss of decay heat removal capability or an addition of heat to the RCS in excess of that which can currently be removed. Either condition represents an actual or potential substantial degradation of the level of safety of the plant. Finally, in the case where there is an increase in RCS temperature, the RCS is not INTACT or is at reduced inventory, and CONTAINMENT CLOSURE is not established, no heat-up duration is allowed (i.e., 0 minutes). This is because 1) the evaporated reactor coolant may be released directly into the containment atmosphere and subsequently to the environment, and

2) there is reduced reactor coolant inventory above the top of irradiated fuel.

The RCS pressure increase threshold provides a pressure-based indication of RCS heat-up in the absence of RCS temperature monitoring capability. DCPP Basis Reference(s):

1. DCPP Technical Specifications Table 1.1-1

2. OP L-1, Plant Heatup From Cold Shutdown to Hot Standby

3. NEI 99-01 CA3 I [Document No.] Rev. [X] Page 115 of 289 I

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 4 - Loss of Vital DC Power Initiating Condition: Loss of Vital DC power for 15 minutes or longer. EAL: CU4.1 Unusual Event

 < 105 VDC bus voltage indications on Technical Specification required 125 VDC vital buses for ;:::: 15 minutes. (Note 1)

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: 5 -. Cold Shutdown, 6 - Refueling Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: .I (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information

              /

Minimum battery voltage of 105 VDC is the voltage below which supplied loads may not function (ref. 2, 3, 4). As used in this EAL, "required" means the vital DC buses necessary to support operation of the in-service, or operable, train or trains of SAFETY SYSTEM equipment. For example, if Train A is out-of-service (inoperable) for scheduled outage maintenance work and Train B is in-service (operable), then a loss of Vital DC power affecting Train B would require the declaration of an Unusual Event. A loss of Vital DC power to Train A would not warrant an emergency classification. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Depending upon the event, escalation of the emergency classification level would be via IC CA 1 or CA3, or an IC in Recognition Category R.

Background

The vital 125 VDC system consists of three independent networks per unit. Each network contains the following components: I [Document No.] I Rev. [X] Page 116 of 2891

ATTACHMENT 1 EAL Bases

• Battery
• Battery charger
• Standby battery charger to allow maintenance and/or testing
• Distribution panels
• Ground detector The vital 125 VDC batteries and distribution panels are located in Area "H" of the 115 feet elevation of the Auxiliary Building. There are a total of three batteries per unit, 11 (21 ), 12(22),

and 13(23). The batteries are sized to provide sufficient power to operate the associated DC loads for the time necessary to safely shut down the unit, should a 480-VAC source to one or more battery chargers be unavailable (ref. 1, 2, 3). This IC addresses a loss of vital DC power which compromises the ability to monitor and control operable SAFETY SYSTEMS when the plant is in the cold shutdown or refueling mode. In these modes, the core decay heat load has been significantly reduced, and coolant system temperatures and pressures are lower; these conditions increase the time available to restore a vital DC bus to service. Thus, this condition is considered to be a potential degradation of the level of safety of the plant. This EAL is the cold condition equivalent of the hot condition loss of DC power EAL SS7.1. ( DCPP Basis Reference(s):

1. UFSAR, Section 8.3.2.2.2

2. OP AP-23, Loss of Vital DC Bus

3. ECA-0.0, Loss of All Vital AC Power

4. Notification 50804190 DC Bus Voltage Trigger for EALs

5. NEI 99-01 CU4 I[Document No.] Rev. [X] Page 117 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 5 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities. EAL: CU5.1 Unusual Event Loss of all Table C-5 onsite communication methods. OR Loss of all Table C-5 offsite communication methods. OR Loss of all Table C-5 NRG communication methods. Table C-5 Communication Methods System Onsite Offsite NRC Unit 1, Unit 2 and TSC Radio Consoles x x

                                                                                    ~

DCPP Telephone System (PBX) x x x Portable radio equipment (handie-talkies) x Operations Radio System x x Security Radio Systems x GAS and SAS Consoles x x x Fire Radio System x Hot Shutdown Panel Radio Consoles x x x Public Address System x NRG FTS x Mobile radios x Satellite phones x x x Direct line (ATL) to the County and State OES x I [Document No.] Rev. [X] Page 118 of 2891 J

ATTACHMENT 1 EAL Bases Mode Applicability: 5 - Cold Shutdown, 6 - Refueling, D - Defueled Definition(s): None Basis: ERO Decision Making Information Onsite, offsite and NRG communications include one or more of the systems listed in Table C-5 (ref. 1, 2, 3). This EAL is the cold condition equivalent of the hot condition EAL SU7.1. This IC addresses a significant loss of onsite or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to Offsite Response Organizations (OROs) and the NRG.

Background

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.). The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations. The !?econd EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are the State and county EOCs The third EAL condition addresses a total loss of the communications methods used to notify the NRG of an emergency declaration. DCPP Basis Reference(s):

1. UFSAR, Section 9.5.2

2. Emergency Plan Section 7.2 Communications Equipment

3. AR PK15-23, Communications

4. NEI 99-01 CU5 I [Document No.] I Rev. [X] Page 119 of 2891

ATTACHMENT 1 EAL Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 6 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode. EAL: CA6.1 Alert The occurrence of any Table C-6 hazardous event. AND EITHER:

• Event damage has caused indications of DEGRADED PERFORMANCE in at least one train of a SAFETY SYSTEM needed for the current operating mode.
• The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode.

Table C-6 Hazardous Events

• Seismic event (earthquake)
• Internal or external FLOODING event
• High winds or TORNADO strike
• FIRE
• EXPLOSION
• Tsunami
• Other events with similar hazard characteristics as determined by the SM/SEC/ED Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s): DEGRADED PERFORMANCE - As applied to hazardous event thresholds, event damage significant enough to cause concern regarding the operability or reliability of the affected safety system train. EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present. I [Document No.] Rev. [X] Page 120 of 2891

ATTACHMENT 1 EAL Bases FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or ove~heated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. _FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. TORNADO - A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm. VISIBLE DAMAGE - Damage to a component or structure that is readily observable without* measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. Basis: ERO Decision Making Information This IC addresses a* hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. The indications of DEGRADED PERFORMANCE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. In modes 5, 6 and defueled, the appropriate plant configuration bc;ised Outage Safety Checklist in AD8.DC55 "Outage Safety Scheduling" should be consulted to identify required equipment supporting each of the specified safety functions (ref. 1). With respect to event damage caused by an equipment failure resulting in a FIRE or EXPLOSION, no emergency classifica~ion is required in response to a FIRE or EXPLOSION resulting from an equipment failure if the only safety system equipment affected by the event is that upon which the failure occurred. An emergency classification is required if a FIRE or EXPLOSION caused by an equipment failure damages safety system equipment that was otherwise functional or operable (i.e., equipment that was not the source/location of the failure). For example, if a FIRE or EXPLOSION resulting from the failure of a piece of safety system equipment causes damage to the other train of the affected safety system or another safety system, then an emergency declaration is required in accordance with this IC and EAL. Escalation of the emergency classification level would be via IC CS1 or RS1. I[Document No.] Rev. [X] Page 121 of 2891

ATTACHMENT 1 EAL Bases

Background

This condition represents ah actual or potential substantial degradation of the level of safety of the plant. Due to this actual or potential substantial degradation, this condition can significantly reduce the margin to a loss of pote'ntial loss of a fission product barrier. The first conditional addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The second conditional addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this dete_rmination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. DCPP Basis Reference(s):

1. AD8.DC55 Outage Safety Scheduling

2. NEI 99-01 CA6 I [Document No.] Rev. [X]

• Page 122 of 2891

ATIACHMENT 1 EAL Bases Category H - Hazards and Other Conditions Affecting Plant Safety EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.) Hazards are non-plant, system-related events that can directly or indirectly affect plant operation, reactor plant safety or personnel safety. 1: Security Unauthorized entry attempts into the PLANT PROTECTED AREA, bomb threats, sabotage attempts, and actual security compromises threatening loss of physical control of the plant.

2. Seismic Event Natural events such as earthquakes have potential to cause plant structure or equipment damage of sufficient magnitud,e to threaten personnel or plant safety.

3. Natural or Technology Hazard Other natural and non-naturally occurring events that can cause damage to plant facilities include TORNADOS, FLOODING, hazardous material releases and events restricting site access warranting classification.

4. Fire Fires can pose significant hazards to personnel and reactor safety. Appropriate for classification are fires within the ISFSI or PLANT PROTECT~D AREA or which may affect operability of equipment needed for safe shutdown

5. Control Room Evacuation Events that are indicative of loss of Control Room habitability. If the Control Room must be evacuated, additional support for monitoring and controlling plant functions is necessary through the emergency response facilities.

6. SM/SEC/ED Judgment The EALs defined in other categories specify the predetermined symptoms or events that are indicative of emergency or potential emergency conditions and thus warrant classification. While these EALs have been developed to address the full spectrum of possible emergency conditions which may warrant classification and subsequent implementation of the Emergency Plan, a provision for classification of emergencies based I [Document No.] Rev. [X] ,Page 123 of 2891

ATTACHMENT 1 EAL Bases on operator/management experience and judgment is still necessary. The EALs of this category provide the SM/SEC/ED the latitude.to classify emergency conditions consistent with the established classification criteria based upon SM/SEC/ED judgment. I [Document No.] Rev. [X] Page 124 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: Confirmed SECURITY CONDITION or threat. EAL: HU1.1 Unusual Event A SECURITY CONDITION that does not involve a HOSTILE ACTION as reported by the Security Watch Commander. OR Notification of a credible security threat directed at the site. OR A validated notification from the NRC providing information of an aircraft threat. Mode Applicability: All Definition(s): HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts thatare not part of a concerted ati:ack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:. (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. SECURITY CONDITION - Any SECURITY EVENT as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A security condition does not involve a HOSTILE ACTION. I [Document No.] Rev. [X] Page 125 of 2891

AITACHMENT 1 EAL Bases SECURITY EVENT - Any incident representing an attempted, threatened, or actual breach of the security system or reduction of the operational effectiveness of that system. A security event can result in either a SECURITY CONDITION or HOSTILE ACTION. Basis: ERO Decision Making Information The intent of the EAL is to ensure that appropriate notifications for the security threat are made in a timely manner. The DCPP Security and Safeguards Contingency Plan provides a description of SECURITY EVENTS indicative of a potential loss of the level of safety of the plant. Events at the Unusual Event level include credible threats to attack or use a bomb against the plant, or involve extortion, coercion or HOSTAGE threats. NOTE: DO NOT revise this Technical Basis Document to add any identifying information to any SECURITY EVENT codes, and do not remove this note. Threats under this EAL include the following SECURITY EVENT categories:

• SE-1, SE-2, SE-3, SE-7, SE-9, SE-10, SE-11, SE-12, SE-13, SE-14, SE-15, SE-.16, SE-17, SE-18, SE-19, SE-20 & SE-21 Security Watch Commanders are the designated on-site personnel qualified and trained to confirm that a SECURITY EVENT is occurring or has occurred. Training on SECURITY EVENT classification confirmation is closely controlled due to the strict secrecy controls placed on the DCPP Security and Safeguards Contingency Plan (Safeguards) information. (ref. 1).

The first threshold: The Security Watch Commanders, as the trained individuals confirm that a SECURITY EVENT is occurring or has occurred, and whether or not the event is or is not a HOSTILE ACTION. Training on SECURITY EVENT confirmation and classification is controlled due to the nature of Safeguards and 10 CFR § 2.39 information. The second threshold: The receipt of a credible security threat is assessed in accordance with the Security and Safeguards Contingency Plan (ref. 1). This EAL is met when the plant receives information from the NRC or other reliable* source, such as the FBI. / The third threshold: This EAL is met when the plant receives information regarding an aircraft threat from the NRC or other reliable source, such as the FBI, FAA, or NORAD, and the aircraft is more than 30 minutes away from the plant. In this EAL the threat from the impact of an aircraft on the plant is assessed. The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may also be provided by NORAD through the NRC. Validation of the threat is performed in accordance with the Security and Safeguards Contingency Plan. Escalation of the emergency classification level would be via IC HA 1.

Background

The security shift supervision is defined as the Security Watch Commander. Timely and accurate communications between Security Shift Supervision and the Control J [Document No.] J Rev. [X] J . Page 126 of 289 J

ATTACHMENT 1 EAL Bases Room is essential for proper classification of a security-related event. Classification of these events will initiate appropriate threat-related notifications to plant personnel and Offsite Response Organizations. Threat information may come from various sources, including the NRC or FBI. Only the plant to which the specific threat is made need declare the Unusual Event. This EAL is based on the DCPP Security and Safeguards Contingency Plan (ref. 1). This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment, and thus represent a potential degradation in the level of plant safety. SECURITY EVENTS which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR § 73.71or10 CFR § 50.72, as outlined in DCPP Administrative Procedure Xl1.ID2 (ref. 3). SECURITY EVENTS assessed as HOSTILE ACTIONS are classifiable under 1Cs.HA1 and HS1. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the Security and Safeguards Contingency Plan. DCPP Basis Reference(s):

1. DCPP Security and Safeguards Contingency Plan

2. DCPP Procedures (Procedure names and designations are controlled due to the nature of Safeguards and 10 CFR § 2.39 information.)

3. DCPP Administrative Procedure Xl1 JD2 "Regulatory Reporting Requirements and Reporting Process" *

4. NEI 99-01 HU1 I [Document No.] Rev. [X] Page 127 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: HOSTILE ACTION within the OWNER CONTROLLED AREA or airborne attack threat within 30 minutes. EAL: HA1.1 Alert A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the Security Watch Commander. OR A validated notification from NRC of an aircraft attack threat within 30 minutes of the site. Mode Applicability: All Definition(s): HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall int,~mt may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). HOSTILE FORCE - One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with

• the station's Security Plan.

Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points.

• Basis:

ERO Decision Making Information The intent of the EAL is to ensure that appropriate notifications are made in a timely manner. The DCPP Safeguards Contingency Plan provides a description of SECURITY EVENTS indicative of a potential loss of the level of safety of the plant. I.[Document No.] I Rev. [X] Page 128 of 2891

ATTACHMENT 1 EAL Bases NOTE: DO NOT revise this Technical Basis Document to add any identifying information to any SECURITY EVENT codes, and do not remove this note. Threats under this EAL include the following SECURITY EVENT categories:

• SE-1, SE-2, SE-5, SE-10, SE-16, SE-18 & SE-19 Security Watch Commanders are the designated on-site personnel qualified and trained to confirm that a SECURITY EVENT is occurring or has occurred. Training on SECURITY EVENT classification confirmation is closely controlled due to the.strict secrecy controls placed on the DCPP Security and Safeguards Contingency Plan (Safeguards) information. (ref. 1).

The first threshold: Is applicable for any HOSTILE ACTION occurring, or that has occurred, in the OWNER CONTROLLED AREA (OCA). This includes any action directed against an ISFSI that is located outside the PLANT PROTECTED AREA. This event will require rapid response and assistance due to, the possibility of the attack progressing to the PLA~T PROTECTED AREA. The OCA is the area and boundary contained in the DCPP Security and Safeguards Contingency Plan (ref. 1). Generally described, it is the area between Security Gate A (aka North Gate, and is located on the road located at the north edge of the exclusion area/SITE BOUNDARY) to Security Gate E (located on the main access road just north of Secondary (Backup) Met Tower and the SITE BOUNDARY), and extending eastward to encompass the 500 and 230kV switchyards, and bounded on the west by the Pacific Ocean. On UFSAR Figure 2.1-2 this is approximated as the "Exclusion Area Boundary". A copy of UFSAR Figure 2.1-2 is at the end of definitions section of this document. This IC does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs, or tHe requirements of 10 CFR § 73.71or10 CFR § 50.72 as outlined in DCPP Administrative Procedure Xl1.ID2 (ref. 3). , The second threshold: An assessment of the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat-related notifications are made in a timely manner so that plant personnel and OROs are in a heightened state of readiness. This EAL is met when the threat-related information has been validated in accordance with site-specific security procedures. This event will require rapid response and assistance due to the possibility of th'e need to prepare the plant and staff for a potential aircraft impact. The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may be provided by NORAD through the NRC.

• In some cases, it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is expected, although not j [Document No.] Rev. [X] Page 129 of 289 j

ATIACHMENT 1 EAL Bases certain, that notification by an appropriate Federal agency to the site would clarify this point. In this case, the appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. The emergency declaration, including one based on other ICs/EALs, should not be unduly delayed while awaiting notification by a Federal agency.

Background

The security shift supervision is defined as the Security Watch Commander (ref. 1). Timely and accurate communications between the Security Watch Commander and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program. As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering). The Alert declaration will also heighten the awareness of Offsite Response Organizations (OROs), allowing them to be better prepared should it be necessary to consider further actions. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the DCPP Security and Safeguards Contingency Plan. DCPP Basis Reference(s):

1. DCPP Security and Safeguards Contingency Plan

2. DCPP Procedures (Procedure names and designations are controlled due to the nature of Safeguards and 10 CFR § 2.39 information.)

3. DCPP Administrative Procedure Xl1.ID2 "Regulatory Reporting Requirements and Reporting Process"

4. NEI 99-01 HA 1 j [Document No.] Rev. [X] Page 130 of 289 j

ATTACHMENT 1 EAL Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: HOSTILE ACTION within the PLANT PROTECTED AREA. EAL: HS1.1 Site Area Emergency A HOSTILE ACTION is occurring or has occurred within the PLANT PROTECTED AREA as reported by the Security Watch Commander. Mode Applicability: All Definition(s): HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include vJolent acts between individuals in the OWNER CONTROLLED AREA). HOSTILE FORCE - One or nfore individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. OWNER CONTROLLE{J AREA (OCA) - For purpose of HOSTILE ACTION classifications, in . accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. Basis: ERO Decision Making Information The intent of this EAL is to address the potential for a very rapid progression of events due to a dedicated attack. It is not intended to address incidents that are accidental or acts of civil disobedience, such as physical disputes between employees within the OCA or PLANT PROTECTED AREA. Those events are adequately addressed by other EALs. HOSTILE ACTION identified above encompasses various acts including SECURITY EVENTS: NOTE: DO NOT revise this Technical Basis Document to add any identifying information to any SECURITY EVENT codes, and do not remove this note. Threats under this EAL include the following SECURITY EVENT categories: I [Document No.] I Rev. [X] I Page 131 of 2891

ATTACHMENT 1 EAL Bases

• SE-2,. SE-4, SE-5, SE-10, SE-16 This class of SECURITY EVENTS represents an escalated threat to plant safety above that contained in the Alert IC in that a hostile force has progressed from the OWNER CONTROLLED AREA (OCA) to the PLANT PROTECTED AREA (PA). Although DCPP security officers are well trained and prepared to protect against hostile action, it is appropriate for Offsite Response Organizations (OROs) to be notified and encouraged to begin preparations for public protective actions (if they do not normally) to be better prepared should it be necessary to consider further actions.

This IC addresses the occurrence of a HOSTILE ACTION within the PLANT PROTECTED AREA. This event will require rapid response and assistance due to the possibility for damage to plant equipment. This IC does not apply to a HOSTILE ACTION directed at an ISFSI PROTECTED AREA located outside the PLANT PROTECTED AREA; such an attack should be assessed using IC HA1. It also does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical "disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR § 73.71 or 10 CFR § 50.72 as outlined in DCPP Administrative Procedure Xl1.ID2 (ref. 3). / Security Watch Commanders are the designated on-site personnel qualified and trained to confirm that a SECURITY EVENT is occurring or has occurred. Training on SECURITY EVENT classification confirmation is closely controlled due to the strict secrecy controls pla9ed on the DCPP Security and Safeguards Contingency Plan (Safeguards) information. (ref. 1).

Background

The security shift supervision is defined as the Security Watch Commander. Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program. As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering). The Site Area Emergency declaration will mobilize Offsite Response Organization (ORO) resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the DCPP Security and Safeguards Contingency Plan. DCPP Basis Reference(s): )

1. DCPP Security and Safeguards Contingency Plan I [Document No.] I Rev. [X] Page 132 of 2891

ATIACHMENT 1 EAL Bases

2. DCPP Procedures (Procedure names and designations are controlled due to the nature of Safeguards and 10 CFR § 2.39 information.)

3. DCPP Administrative Procedure Xl1.ID2 "Regulatory Reporting Requirements and Reporting Process"

4. NEI 99-01 HS1 I [Document No.] Rev. [X] Page 133 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 2 - Seismic Event Initiating Condition: Seismic ~vent greater than Design Earthquake (DE) level. EAL: HU2.1 Unusual Event Seismic event > DE PGA as indicated by ground acceleration > 0.2 g on the "X" or "Y" axis or >0.133 g on the "Z" axis. (Note 11) Note 11: If the Earthquake Force Monitor (EFM) is out of service, refer to CP M-4 Earthquake for alternative 1 methods to assess earthquakes. Mode Applicability: All Definition(s): None Basis: ERO Qecision Making Information Ground motion acceleration > 0.2 g on the "X" or "Y" axis or > 0.133g on the "Z" axis is the peak ground acceleration (PGA) criterion for a Design Earthquake (DE) (ref. 3). If the EFM indicator alarms(> 0.2 g on the "X" or "Y" axis or> 0.133g on the "Z" axis) indicating the DE PGA has been exceeded, an Unusual Event should be declared. The "X" and "Y" axes correspond to horizontal peak acceleration values while the "Z" axis corresponds to vertical peak acceleration values. If the EFM is not operable, the earthquake magnitude is determined by alternative methods in accordance with CP M-4, "Earthquake." If it is determined that any peak acceleration has exceeded 0.2 g on the "X" or "Y" axis or 0.133g on the "Z" axis, an Unusual Event should be de9lared (ref. 3). ' Event verification with external sources should not be necessary during or following a DE. Earthquakes of this magnitude should be readily felt by on-site personnel and recognized as a seismic event (e.g., lateral accelerations in excess of 0.08g). The SM/SEC/ED may seek external verification if deemed appropriate (e.g., a call to the USGS, check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9. Background , In the event of an earthquake measuring greater than or equal to 0.01 g, the Seismic Instrumentation System annunciator PK15-24 will alert the control room and peak acceleration indications will be displayed on the EFM. The primary means for*timely determination of the I [Document Nd.] Rev. [X] Page 134 of 2891

ATIACHMENT 1 EAL Bases magnitude of an earthquake, and subsequently assessing emergency action levels, is using the EFM located in the control room (ref. 2). When the seismic monitoring system alarms, SM directs actions as defined in CP M-4, "Earthquake," and the seismic instrumentation system engineer is notified to coordinate post-earthquake activities including retrieval and analysis of the seismic event data. The purpose of the analysis is to determine within 4 hours whether the computed response spectra associated with any of the three directional components of the seismic event exceed the DE response spectra exceedance criterion (ref.4). It should be noted that the DE PGA values are the zero period accelerations associated the DE response spectra. Since the DE PGA indications are available and displayed on the1 EFM within minutes, these are the indications used for timely emergency classification. The seismic monitoring system also stores the seismic event data and generates reports later used during the post-earthquake evaluation (ref.4) To avoid inappropriate emergency classification resulting from spurious actuation of the seismic instrumentation or felt motion not attributable to seismic activity, an offsite agency (USGS, National Earthquake Information Center) can confirm that an earthquake has occurred in the area of the plant. Such confirmation should not, however, preclude a timely emergency declaration based on receipt of the EFM alert alarm. The NEIC can be contacted by calling (303) 273-8500. Select option #1 and inform the analyst you wish to confirm recent seismic* activity in the vicinity of DCPP. Alternatively, near real-time seismic activity can be accessed via the NEIC website: http://earthquake.usgs.gov/eqcenterl This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for a Design Earthquake (DE). An earthquake greater than a DE but less than a Double Design Earthquake (DOE) should have no significant impact on safety-related

'systems, structures and components; however, some time may be required for the plant staff to ascertain the actual post-event condition of the plant (e.g., performs walk-downs and post-event inspections). Given the time necessary to perform walk-downs and inspections, and     -..--.

fully understand any impacts, this event represents a potential degradation of the level of safety of the plant.

*NOTE: An Operating Basis Earthquake (OBE) is referred to as Design Earthquake (DE) at DCPP, and a Safe Shutdown Earthquake (SSE) is referred to as Double Design Earthquake (ODE) at DCPP (ref. 3).

DCPP Basis Reference(s):

1. DCM T-6, Seismic Analysis of Structures

2. AR PK 15-24, Seismic Instr System'

3. CP M-4, Earthquake

4. AWP E-017 Guidelines for Post-Earthquake Engineering Response

5. NEI 99-01 HL)2 I [Document No.] Rev. [X] Page 135 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.1 Unusual Event A TORNADO strike within the PLANT PROTECTED AREA. Mode Applicability: All Definition(s): PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. TORNADO - A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm. Basis: ERO Decision Making Information A TORNADO striking (touching down) within the PLANT PROTECTED AREA warrants declaration of an Unusual Event regardless of the measured wind speed at the meteorological tower. If damage is confirmed visually or by other in-plant indications, the event may be escalated to an Alert under EAL CA6.1 or SA9.1.

Background

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL HU3.1 addresses a TORNADO striking (touching down) within the PLANT PROTECTED AREA. DCPP Basis Reference(s):

1. CP M-16 Severe Weather

2. NEI 99-01 HU3 I [Document No.] Rev. [X] Page 136 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.2 Unusual Event Internal room or area FLOODING of a magnitude sufficient to require manual or automatic electrical isolation of a SAFETY SYSTEM component required for the current operating mode. (Note 5) Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted. Mode Applicability: All Definition(s): FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2)'The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information This EAL addresses FLOODING of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to water level or other wetting concerns. Classification is also required if the water level or related wetting causes an automatic isolation of a SAFETY SYSTEM component from its power source (e.g., a breaker or relay trip). To warrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode. In modes 5, 6 and defueled, the appropriate plant configuration based Outage Safety Checklist in AD8.DC55 "Outage Safety Scheduling" should be consulted to identify required equipment supporting each of the specified safety functions (ref. 1). Refer to EAL CA6.1 or SA9.1 for internal flooding affecting one or more SAFETY SYSTEM trains. I[Document No.] Rev. [X] Page 137 of 2891

ATTACHMENT 1 EAL Bases Escalation of the emergency classification level would be based on ICs in Recognition Categories R, F, S or C.

Background

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.  : DCPP Basis Reference(s):

1. AD8.DC55 Outage Safety Scheduling

2. NEI 99-01 HU3 I [Document No.] Rev. [X] Page 138 of 2891

ATIACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.3 Unusual Event Movement of personnel within the PLANT PROTECTED AREA is IMPEDED due to an event involving hazardous materials (e.g., a chemical spill or toxic gas release from an area outside the PLANT PROTECTED AREA): Mode Applicability: All Definition(s):plant IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipm,ent, such as SCBAs, that is not routinely employed). PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. Basis: ERO Decision Making Information This EAL is applicable to events in areas external tothe DCPP PLANT PROTECTED AREA. This EAL addresses a hazardous materials event originating outside the PLANT PROTECTED AREA and of sufficient magnitude to IMPEDE the movement of personnel within the PLANT PROTECTED AREA. Escalation of the emergency classification level would be based on ICs in Recognition Categories R, F, Sor C.

Background

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. CP M-9A Hazardous Material Incident - Initial Emergency Response/Mitigation Procedure

2. NEI 99-01 HU3 I [Document No.] Rev. [X] Page 139 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technology Hazard Initiating Condition: Hazardous event. EAL: HU3.4 Unusual Event A hazardous event that results in conditions sufficient to prohibit the plant staff from accessing the site via personal vehicles. (Note 7) , Note 7: This EAL does not apply to routine traffic impediments such as fog, snow, ice, or vehicle breakdowns

           . or accidents.

• Mode Applicability:

All Definition(s): FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. Basis: ERO Decision Making Information This EAL addresses a hazardous event, that causes an impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles. Examples of such an event include when both north and south access routes are unavailable due to site FLOODING caused by a hurricane, heavy rains, dam failure, tsunami, mudslide, etc., blocking the access and egress roads (refer to CP M-12). This EAL is not intended apply to routine impediments such as fog, snow, ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the flooding around the Cooper Station during the Midwest floods of 1993, or the flooding around Ft. Calhoun Station in 2011. Escalation of the emergency classification level would be based on ICs in Recognition Categories R, F, S or C.

Background

Refer to CP M-12 Stranded Plant for conditions in which viable plant access routes are lost (ref. 1). This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. CP M-12 Stranded Plant

2. NEI 99-01 HU3 I [Document No.]_ Rev. [X] Page 140 of 289 j

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant. EAL: HU4.1 Unusual Event A FIRE is not extinguished within 15 minutes of any of the following FIRE detection indications (Note 1):

• Report from the field (i.e., visual observation).
• Receipt of multiple (more than 1) fire alarms or indications.
• Field verification of a single _fire alarm. '

AND The FIRE is located within any Table H-1 area. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table H-1 Fire Areas

• Containment
• Auxiliary Building
• Fuel Handling Building
• Turbine Building
• Intake Structure Lower Levels
• Pipe Rack
• Main, Auxiliary & Startup Transformers Mode Applicability:

All Definition(s): FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. these are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: ( 1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; I [Document No.] Rev. [X] Page 141 of 2891

ATIACHMENT 1 EAL Bases (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information Multiple flow switches for the same general vicinity constitute a single alarm. This is because water flow in the sprinkler system can be seen on multiple switches for the same location. However, smoke and flame detectors are all individual alarms spaced far enough apart that each should be considered independent of each other. For EAL HU4.1 the intent of the 15-minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc. Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL HU4.1 assessment purposes, the emergency declaration clock starts at the time that multiple alarms or indications are received, the report was received, or the time that a single alarm is confirmed by subsequent verification action. Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

Table H-1 Fire Areas are based on CP M-10, Fire Protection of Safe Shutdown Equipment. Table H-1 Fire Areas include those structures containing functions and systems required for safe shutdown of the plant (SAFETY SYSTEMS) (ref. 1). This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. CP M-10, Fire Protection of Safe Shutdown Equipment

2. NEI 99-01 HU4 I [Document No.] Rev. [X] Page 142 of 2891

ATIACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant. EAL: HU4.2 Unusual Event Receipt of a single fire alarm (i.e., no other indications of a FIRE). AND The fire alarm is associated with any Table H-1 area. AND The existence of a FIRE is not verified within 30 minutes of alarm receipt. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table H-1 Fire Areas

• Containment
• Auxiliary Building
• Fuel Handling Building
• Turbine Building
• Intake Structure Lower Levels
• Pipe Rack
• Main, Auxiliary & Startup Transformers Mode Applicability:

All Definition (s): FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: - (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. j [Document No.] Rev. [X] Page 143 of 289 j

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information Multiple flow switches for the same general vicinity constitute a single alarm. This is because water flow in the sprinkler system can be seen on multiple switchE3S for the same location. However, smoke and flame detectors are all individual alarms spaced far enough apart that each should be considered independent of each other. An "Incipient Alarm" meets the intent of a "single fire alarm." A "pre-alarm" does not meet the intent of a "single fire alarm." This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL HU4.2 assessment purposes, the 30-minute clock starts at the time that the initial alarm was received, and not the time that a subsequent verification action was performed. If an actual FIRE is verified by a report from the field, then HU4.1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs. within 30-minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

Table H-1 Fire Areas are based on CP M-10, Fire Protection of Safe Shutdown Equipment. Table H-1 Fire Areas include those structures containing functions and systems required for safe shutdown of the plant (SAFETY SYSTEMS) (ref. 1). This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of time to determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress. Basis-Related Requirements from Appendix R Appendix R to 10 CFR 50, states in part: Criterion 3 of Appendix A to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions." When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance to safety because

• damage to them can lead to core damage resulting from loss of coolant through boil-off.

I[Document No.] . Rev. [X] Page 144 of 2891

ATIACHMENT 1 EAL Bases Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents. In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1-hour fire barriers for the enclosure of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). As used in HU4.2, the 30-minutes to verify a single alarm is well within this worst-case 1-hour time period. DCPP Basis Reference(s):

1. CP M-10, Fire Protection of Safe Shutdown Equipment

2. NEI 99-01 HU4 J [Document No.] Rev. [X] Page 145 of 289 J

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE *potentially degrading the level of safety of the plant. EAL: HU4.3 Unusual Event A FIRE within the ISFSI PROTECTED AREA or PLANT PROTECTED AREA not extinguished within 60 minutes of the initial report, alarm or indication. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: All Definition(s): FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large q!Jantities of smoke and heat are observed. ISFSI PROTECTED AREA - Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan. PROTECTED AREA -Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED AREA separate from the PLANT PROTECTED AREA. Basis: ERO Decision Making, Information This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. In addition to a FIRE addressed by EAL HU4.1 or HU4.2, a FIRE within the PLANT PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety. This basis extends to a FIRE occurring within the Protected Area of the ISFSI located outside the PLANT PROTECTED AREA. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 HU4 I [Document No.] Rev. [X] Page 146 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant. EAL: HU4.4 Unusual Event A FIRE within the ISFSI PROTECTED AREA or PLANT PROTECTED AREA that requires firefighting support by an offsite fire response agency to extinguish. Mode Applicability: All Defiriition(s): FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. ISFSI PROTECTED AREA - Areas within the ISFSI to which access is strictly controlled in accordance with the station's Security Plan. PLANT PROTECTED AREA - Areas to which access is strictly controlled in accordance with the station's Security Plan. Note: The DCPP Independent Spent Fuel Storage Installation (ISFSI) has its own ISFSI PROTECTED ARE.I) separate from the PLANl PROTECTED AREA. Basis: ERO Decision Making Information This IC addresses the magnitude and extent bf FIRES that may be indicative of a potential degradation of the level of safety of the plant. If a FIRE within the ISFSI or PLANT PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department, for DCPP this is normally CalFire), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts (engages in firefighting efforts or is needed to engage in firefighting efforts) because the fire is beyond the capability of the Fire Brigade (for DCPP, this is the DCPP* Fire Department) to extinguish. Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions.

                                                  .                         \

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

Background

None DCPP Basis Reference(s): I [Document No.] Rev. [X] Page 147 of 2891

ATTACHMENT 1 EAL Bases

1. NEI 99-01 HU4 Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 5 - Hazardous Gases Initiating Condition: Gaseous release IMPEDING access to equipment necessary for normal plant operations, cooldown or shutdown.

EAL: HAS.1 Alert Release of a toxic, corrosive, asphyxiant or flammable gas into any Table H-2 rooms or areas. AND Entry into the room or area is prohibited or IMPEDED. (Note 5) Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the, event occurred, then no emergency classification is warranted. Table H-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode(s) Auxiliary Building - 115' - BASTs 2, 3,4 Auxiliary Building - 100' - BA Pumps . 2, 3,4 Auxiliary Building - 85' - Aux Control Board - 2, 3,4 Auxiliary Building - 64' - BART Tank area 2,3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 Mode Applicability: 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protectiye equipment, such as SCBAs, that is not routinely employed). Basis: ERO Decision Making Information The list of plant rooms or areas with entry-related mode applicability identified specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown. Specifically, the identified rooms are those where an activity must be performed to borate to cold shutdown, isolate accumulators or cooldown using RHR. If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event. j [Document No.] Rev. [X] Page 148 of 289 j

ATTACHMENT 1 EAL Bases An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release. Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the SM/SAC/ED judgment that the gas concentration in the affected room/area is sufficient to' preclude or significantly IMPEDE procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on. personnel, advice from a subject matter expert or operating experience with the same or similar hazards. Access should be considered as IMPEDED if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). An emergency declaration is not warranted if any of the following conditions apply:

• The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release). For example, the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4. *
• The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., fire suppression system testing).
• The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).
• The access control measures are of a conservative or precautionary nature, and would not actually prevent or IMPEDE a required action.

This EAL does not apply to firefighting activities that automatically or manually activate a fire suppression system in an area. Such events are classified per IC HU4 - Fire. Escalation of the emergency classification level would be via Recognition Category R, C or F ICs.

Background

Rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations) are not included. In addition, the list specifies the plant mode(s) during which entry would be required for each room or area (ref. 1). This EAL addresses an event involving a release of a hazardous gas that precludes or IMPEDES access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant.

• An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels. Most commonly, asphyxiants work by merely displacing air in an enclosed environment.

This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness or even death. I [Document No.] Rev. [X] Page 149 of 2891

ATTACHMENT 1 EAL Bases NOTE: IC HA5 mode applicability has been limited to the applicable modes identified in Table H-2 Safe Operation & Shutdown Rooms/Areas. If due to plant operating procedure or plant configuration.changes, the applicable plant modes specifiedln Table H-2 are changed, a corresponding change to Attachment 3 'Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases' and to IC HA5 mode applicability is required. DCCP Basis Reference(s):

1. Attachment 3 Safe Operation & Shutdown Rooms/Areas Table R-2 & H-2 Bases

2. NEI 99-01 HA5 I [Document No.] Rev. [X] Page 150 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6 - Control Room Evacuation Initiating Condition: Control Room evacuation resulting in transfer of plant control to alternate locations. EAL: HA6.1 Alert An event requiring plant control to be transferred from the Control Room to the Hot Shutdown Panel area. Mode Applicability: All Definition(s): None Basis: ERO Decision Making Information For the purpose of this EAL the 15 minute classification clock starts when the last licensed operator leaves the Control Room. The Shift Manager (SM) determines if the Control Room requires evacuation and entry into OP AP-BA. Control Room inhabitability may oe caused by fire, dense smoke, noxious fumes, bomb threat in or adjacent to the Control Room, or other life threatening conditions. OP AP-BA Control Room Inaccessibility- Establishing Hot Standby and OP AP-BB Control Room. Inaccessibility- Hot Standby to Cold Shutdown provides the instructions establishing plant control from outside the Control Room (Ref. 1, 2). Inability to establish plant control from outside the Control Room escalates this event to a Site Area Emergency per EAL HS6.1. Escalation of the emergency classification level would be via IC HS6.

Background

I This IC addresses an evacuation of the Control Room that results in transfer of plant control to . alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety.

• Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations. Th,e necessity to control a plant shutdown from outside the Control Room, in addition to responding to*the event that required the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel. Activation of the ERO and emergency response facilities will assist in responding to these challenges.

DCPP Basis Reference(s):

1. OP AP-BA Control Room Inaccessibility - Establishing Hot Standby I[Document No.] Rev. [X] Page 151 of 2B9 I

ATTACHMENT 1 EAL Bases

2. OP AP-88 Control Room Inaccessibility - Hot Standby to Cold Shutdown

3. OP AP-34.5.1 Fire Response- Cable Spreading Room (FA 7-A)

4. OP AP-34.5.3 Fire Response - Control Room (CR-1)

5. NEI 99-01 HA6 J [Document No.] Rev. [X] Page 152 of 289 J

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6 - Control Room Evacuation Initiating Condition: Inability to control a key safety function from outside the Control Room. EAL: HS6.1 Site Area Emergency An event has resulted in plant control being transferred from the Control Room to the Hot Shutdown Panel area. AND Control of any of the following key safety functions is not re-established within 15 minutes (Note 1):

• Reactivity (Modes 1, 2 and 3 only)
• Core Cooling
• RCS heat removal Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown, 5 - Cold Shutdown, 6 - Refueling Definition(s): None Basis: ERO Decision Making Information / The Shift Manager (SM) determines if the Control Room requires evacuation per OP AP-SA. Control Room inhabitability may be caused by fire, dense smoke, noxious fumes, bomb threat in or adjacent to the Control Room, or other life threatening conditions. OP AP-SA Control Room Inaccessibility - Establishing Hot Standby and OP AP-SB Control Room Inaccessibility - Hot Standby to Cold Shutdown, provides the instructions establishing plant control from outside the Control Room (Ref. 1, 2). The determination of whether or not "control" is established at the remote safe shutdown location(s) is based on SM/SEC/ED judgment. The SM/SEC/ED is expected to make a reasonable, informed judgment within 15 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s). The 15 minute clock starts once plant control has been transferred to the Hot Shutdown Area (OP AP-SA Attachment 4 4SOV Bus Alignment and Appendix F Electrical System Actions). Physical control of key safety functions by manipulation of controls is not required to verify control, rather, it is sufficient that control transfer is succi3ssful (i.e. light indication of applicable equipment). I [Document No.] Rev. [X] Page 153 of 2S9 I

ATIACHMENT 1 EAL Bases Escalation of the emergency classification level would be via IC FG1 or CG1

Background

Once the Control Room is evacuated, the objective is to establish control of important plant equipment and maintain knowledge of important plant parameters in a timely manner. Primary emphasis should be placed on components and instruments that supply protection for and information about safety functions. Typically, these safety functions are reactivity control (ability to shut down the reactor and maintain it shutdown), RCS inventory (ability to cool the core), and secondary heat removal (ability to maintain a heat sink). Hot Shutdown Panel (HSDP) indications for Reactivity, Core Cooling and RCS Heat Removal:

• Reactivity o Gamma Metrics indicators (Nl-53 & Nl-54)
• Core Cooling o Pressurizer Liquid Temperature (Tl-453B) o Pressurizer Pressure (Pl-455B) o RCS WR Pressure (Pl-406 at Dedicated Shutdown Panel) o RCS Temperatures (Loop 1 at Dedicated Shutdown Panel)
• RCS heat removal o AFW Flow Indicators (Fl-165 through 168) o AFW Pump discharge pressures (Pl-51 B through 53B) o SG WR Levels (Ll-501 through 504) o SG Pressures (Pl-514, 524, 534, 544)

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time. DCPP Basis Reference(s):

1. OP AP-SA Control Room Inaccessibility - Establishing Hot Standby

2. OP AP-SB Control Room Inaccessibility- Hot Standby to Cold Shutdown

3. OP AP-34.5.1 Fire Response - Cable Spreading Room (FA 7-A)

4. OP AP-34.5.3 Fire Response - Control Room (CR-1)

5. NEI 99-01 HS6 I [Document No.] Rev. [X] . Page 154 of 2891

ATIACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions existing that in the judgment of the SM/SEC/ED warrant declaration of a UE. EAL: HU7.1 Unusual Event Other conditions exist which in the judgment of the SM/SEC/ED indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs. Mode Applicability: All Definition(s): SAFETY SYSTEM - A system required for safe plan't operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and compqnents that are relied upon to remain functional during

     .and following design basis events to assure:

(1) Th~ integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SM/SEC/ED to fall under the emergency classification level description for an Unusual Event.

Background

The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the SM/SEC/ED, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, but Plant Management is expected to manage the emergency response I [Document No.] Rev. [X] Page 155 of 2891

ATTACHMENT 1 EAL Bases as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. Refer to CP M-10 Fire Protection of Safe Shutdown Equipment for a list of SAFETY SYSTEMS. DCPP Basis Reference{s):

1. NEI 99-01 HU7 I [Document No.] Rev. [X] Page 156 of 2891

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions exist that in the judgment of the SM/SEC/ED warrant declaration of an Alert. EAL: HA7.1 Alert Other conditions exist which, in the judgment of the SM/SEC/ED, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a SECURITY EVENT that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA PROTECTIVE ACTION GUIDELINE exposure levels. Mode Applicability: All Definition(s): EPA PROTECTIVE ACTION GUIDELINES (EPA PAG) - The EPA PAGs are expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. - HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. SECURITY EVENT -Any incident representing an attempted, threatened, or actual breach of the security system or reduction of the operational effectiveness of that system. A security event can result in either a SECURITY CONDITION or HOSTILE ACTION. Basis: ERO Decision Making Information This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SM/SEC/ED to fall under the emergency classification level description for an Alert.

Background

I [Document No.] Rev. [X] Page 157 of 2891

ATTACHMENT 1 EAL Bases The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the SM/SEC/ED, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, but Plant Manag-ement is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. DCPP Basis Reference(s):

1. NEI 99-01 HA?

I I [Document No.] Rev. [X] Page 1'58 of 2891

ATIACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions existing that in the judgment of the SM/SEC/ED warrant declaration of a Site Area Emergency. EAL: HS7 .1 Site Area Emergency Other conditions exist which in the judgment of the SM/SEC/ED indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely f~ilure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA PROTECTIVE ACTION GUIDELINE exposure levels beyond the SITE BOUNDARY. Mode Applicability: All Definition(s): EPA PROTECTIVE ACTION GUIDELINES (EPA PAG) - The EPA PAGs are expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planning agencies. HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the* licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this 'may include violent acts between individuals in the OWNER CONTROLLED AREA) OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. SITE BOUNDARY - As depicted in the Final Safety Analysis Report Update (UFSAR), Figure 2.1-2, Site Plan and Gaseous/Liquid Effluent Release Points. Basis: ERO Decision Making Information This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SM/SEC/ED to fall under the emergency classification level description for a Site Area Emergency.

Background

I [Document No.] Rev. [X] Page 159 of 2891

ATTACHMENT 1 EAL Bases The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the SM/SEC/ED, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency. DCPP Basis Reference(s):

1. NEI 99-01 HS7 I [Document No.] Rev. [X] Page 160 of 2891

ATIACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SM/SEC/ED Judgment Initiating Condition: Other conditions exist which in the judgment of the SM/SEC/ED warrant declaration of a General Emergency. EAL: HG7 .1 General Emergency Other conditions exist which in the judgment of the SM/SEC/ED indicate that events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA PROTECTIVE ACTION GUIDELINE exposure levels offsite for more than the immediate site area. Mode Applicability: All Definition(s): EPA PROTECTIVE ACTION GUIDELINES (EPA PAG) - The EPA PAGs are expressed in terms of dose commitment: 1 Rem TEDE or 5 Rem COE Thyroid. Actual or projected offsite exposures in excess of the EPA PAGs requires DCPP to recommend protective actions for the general public to offsite planr:iing agencies. HOSTILE ACTION - An act toward DCPP or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on DCPP. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA). ' IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. OWNER CONTROLLED AREA (OCA) - For purpose of HOSTILE ACTION classifications, in accordance with this EAL scheme, the OCA is defined as the same area and boundary contained in the DCPP Security and Safeguards Contingency Plan. Basis: ERO Decision Making Information This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SM/SEC/ED to fair under the emergency classification level description for a General Emergency. Releases can reasonably be expected to exceed EPA PAG plume exposure levels outside the SITE BOUNDARY. I[Document No.] Rev. [X] Page 161 of 2891

ATTACHMENT 1 EAL Bases

Background

The SM/SEC/ED is the designated onsite individual having the responsibility and authority for implementing the DCPP Radiological Emergency Response Plan. The operations Shift Manager (SM) initially acts in the capacity of the SEC/ED and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the SM/SEC/ED, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the* possible wide-ranging responsibilities associated with managing a major emergency. DCPP Basis Reference(s):

1. NEI 99-01 HG7 I [Document No.] Rev. [X] Page 162 of 2891

ATTACHMENT 1 EAL Bases Category S - System Malfunction EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes. Numerous system-related equipment failure events that warrant emergency classification have been identified in this category. They may pose actual or potential threats to plant safety. The events of this category pertain to the following subcategories: 1 . Loss of Vital AC Power Loss of vital electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of onsite and offsite sources for 4.16KV AC vital buses.

2. Loss of Vital DC Power Loss of vital electrical power can compromise plant SAFETY SYSTEM operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of vital plant 125 VDC power sources.

3. Loss of Control Room Indications Certain events that degrade plant operator ability to effectively assess plant conditions within the plant warrant emergency classification. Losses of indicators are in this subcategory.

4. RCS Activity During normal operation, reactor coolant fission product activity is very low. Small concentrations of fission products in the coolant are primarily from the fission of tramp uranium in the fuel clad or minor perforations in the clad itself. Any significant increase from these base-line levels (2% - 5% clad failures) is indicative of fuel failures and is covered under the Fission Product Barrier Degradation category. However, lesser amounts of clad damage may result in coolant activity exceeding Technical Specification limits. These fission products will be circulated with the reactor coolant and can be detected by coolant sampling.

5. RCS LEAKAGE The re,actor vessel provides a volume for the coolant that covers the reactor core. The reactor pressure vessel and associated pressure piping (reactor coolant system) together provide a barrier to limit the release of radioactive material should the reactor fuel clad integrity fail. Excessive RCS LEAKAGE greater than Technical Specification limits indicates potential pipe cracks that may propagate to an extent threatening fuel clad, RCS and containment integrity.

6. RTS Failure This subcategory includes events related to failure of the Reactor Trip System (RTS) to initiate and complete reactor trips. In the plant licensing basis, postulated failures of the RTS to com lete a reactor tri rise a specific set of anal zed events referred to as

[Document No.] Rev. [X] Page .163 of 289

ATTACHMENT 1 EAL Bases Anticipated Transient Without Scram (ATWS) events. For EAL classification, however, A TWS is intended to mean any trip failure event that does not achieve reactor shutdown. If RTS actuation fails to assure reactor shutdown, positive control of reactivity is at risk and could cause a threat to fuel clad, RCS and containment integrity.

7. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.

8. Containment Failure Failure of containment isolation capability (under conditions in which the containment is not currently challenged) warrants emergency classification. Failure of containment pressure control capability also warrants emergency classification.

9. Hazardous Event Affecting Safety Systems Various natural and technological events that result in degraded plant SAFETY SYS'fEM performance or significant VISIBLE DAMAGE warrant emergency classification under this subcategory.  :

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. j [Document No.] Rev. [X] Page 164 of 289 j

ATIACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Loss of all offsite AC power capability to vital buses for 15 minutes or longer. EAL: SU1.1 Unusual Event Loss of all offsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H for ~ 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table S-1 AC Power Capability, Unit 1 Unit2

          ~

Cl)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1 of!?

          .....

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• AuxXFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator Cl)

          ~

• DG1-1-BusH
• DG 2 Bus H ..

tn c

• DG 1 Bus G
• DG 2 Bus G 0
• DG 1 Bus F
• DG 2 Bus F
• Other Unit via Startup Bus X-Tie
• Other. Unit via Startup Bus X-Tie iylode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ( ERO Decision Making Information For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant see fi ure below). [Document No.] Rev. [X] Page 165 of 289

ATIACHMENT 1 EAL Bases This EAL addresses a prolonged (greater than 15 minutes) loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency buses. This condition represents a potential reduction in the level of safety of the plant. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power. When filling out the ENF form, this event can be Unit 1, Unit 2 or Unit 1 and 2. Escalation of the emergency classification level would be via IC SA 1.

Background

Unit 1(2) 4.16KV buses F, G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV 'power is ~vailable. During normal operations, vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition, each units vital buses F, G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). I [Document No.] Rev. [X] Page 166 of 2891

ATTACHMENT 1 EAL Bases DCPP Electrical Distribution System 500kV Switch yard 230kV Switch yard 8 Midway 2'~1~T~T'°£Y~ Bus1E  :  :~$Mesa Midway3+- ~T'£"""T~ LJ?'J1.....J

                                                                                                                                                  -...,.+ Morro
             ~ '-f'L/~.                                                                               r-"--,      I--/---.---".                  6        Bay Gates 1 E  '-' *T* '-'

• U1 Main ____l_~_i__::___J 722 622 Bus1 BankXfmr ~SUXfmrs ~ *¥* , Bus2

                                         ~~ ~

AuxX~~ ~l 12~5~1N 1:::::::r::::::f ~-~XfiTlr Jllj_ ~) ~3~: ~cl j_ rFJI~ u2AMuxaXfmrin2-sran~T'soow4~~2ws'1"2u'

                                                                                                              ~                ..   *v *v
                                                                                                                                            ~l~-'fXfiTlr
                                                                                                                                            ~

(Y) (X) U1 Main 7 ,-.... j j 7 U2 Main (X) (Y)

                                                "U" Generator                   12kV SU Bus (  (  (           Generator r -       ~)-----------'~SUXfmrs£                                                                                           (      (   -(         7
     .:./ .:.J                 °"                                     M':: '"    OGLOG                            OG                =~
     ~ ITT~~ ~Tl~~) (~~rTc~ =ii:TlJ ~
             .i.;..i.

BusD I I BusH I I I I BusG

                                                        .i.;...J.;...J.

BusF

                                                                                ~

BusF I I I BusG I I I BusH

                                                                                                                                       .i...;.i.

BusD DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 SU1 I[Document No.] Rev. [X] Page 167 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Loss of all but one AC power source to vital buses for 15 minutes or longer. EAL: SA1.1 Alert AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H reduced to a single power source for~ 15 minutes. (Note 1) AND A failure of that single power source will result in loss of all AC power to SAFETY SYSTEMS. Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table 5-1 AC Power Capability Unit 1 Unit 2 d>

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

         ~

• Startup XFMR 1~2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR .. Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator d>

fl)

• DG 1 Bus H
• DG 2 Bus H 0

s:::::

• DG 1 Bus G
• DG 2 Bus G

                 ,

• DG 1 Bus F
• DG 2 Bus F
• qther Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These ar~ typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. I [Document No.] Rev. [X] Page 168 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

This EAL describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equipment.. This IC provides an escalation path from IC SU1. An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.

• A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).
• A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being back-fed from the unit main generator. /
• A loss of emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being fed from an offsite power source.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power. When filling out the ENF form, this event can be Unit 1, Unit 2 or Unit 1 and 2. Escalation of the emergency classification level would be via IC SS1.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below).Unit 1(2) 4.16KV buses F, G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations, vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition, each units vital buses F, G and H have I [Document No.] Rev. [X] Page 169 of 2891

ATTACHMENT 1 EAL Bases an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). If the capability of a second source of emergency bus power is not restored within 15 minutes, an Alert is declared under this EAL. Refer to CP M-10 Fire Protection of Safe Shutdown Equipment for a list of SAFETY SYSTEMS. DCPP Electrical Distribution System 500kV Switchyard 230kV Switchyard Midwa:;~1~T'-£YT~~ . Bus1E  : :~~Mesa Midway 3 ~ ~J'£-1~ ------. T~,.+ Morro Gates 1

                  ~T~_____/

722 622 Bus1 u1 Main ------- r---,

                                                                                               -----1..'-()-/~

1---/~ Bus2

                                                                                                                               ~6.LJ     Bay l                              BankXfmr        I N SU Xfmrs   i-11                       212 AuxXfmr 1-1 l
             ~
                 ~-~~25kV-~+--.

12W 25W 4W

                                  =-t=

500W AuxXfmr (Q"' (~ 1-2U1 Main ul *-= ~ 230W ~ r-ry"""' 12W ~ I_

                                                                ) ,....
                                                                               -I (I    I   I -=

I U2MainBarikXfmr500W/25W A U2M: Xfm 2-~X) ~~J5~w l A 2-'f Xfm r I I Generator @ ) 12kV SU Bus ( ( ( Generator I" I 1 f) )- ) )

of f.:f OG 00JG ~';;"" 'l__r := LC~

                                                          ~SU Xfmrs ~-=============(::::--(

OG

                                                                                                                                -( -:1
       ~ u=ti: ~~Tl~~) (~~rT~ ~inJ ~
                  .i.;...i.

BusD Ill~~ BusH BusG BusF Ill BusF Ill BusG Ill BusH J..,;,j,, BusD DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 SA1

                                                                                 \

I [Document No.] Rev. [X] Page 170 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Loss of all offsite power and all onsite AC power to vital buses for 15 minutes or longer. EAL: SS1 .1 Site Area Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H for;::: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Table S-1 AC Power Capability Unit 1 Unit2

         ,!

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

         .....

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator C1)

t::!

en

• DG 1-1-BusH
• DG 2 Bus H c
• DG 1 Bus G
• DG 2 Bus G O*
• DG 1 Bus F
• DG 2 Bus F
• 0th er Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie

' Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those. structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The i11tegrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information I [Document No.] Rev. [X] Page 171 of 2891

ATTACHMENT 1 EAL Bases For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

The 15-minute interval begins when both offsite and onsite AC power capability are lost. This EAL addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. In addition, fission product barrier monitoring capabilities may be degraded under these conditions. This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. When filling out the ENF form, this event can be Unit 1, Unit 2 or Unit 1 and 2. Escalation of the emergency classification level would be via ICs RG1, FG1 or SG1.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F, G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations, vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition, each units vital buses F, G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). I [Document No.] Rev. [X] Page 172 of 2891

ATIACHMENT 1 EAL Bases DCPP Electrical Distribution System SOOkV Switch yard 230kV Switch yard MidwayB2'~,~J'£-"J'-£Y~----------~ Bus1E  :  :~$Mesa Midway3.,_ ~T~T~ - - - . T~-r+ Morro

                  ~ ~____/.                                                                                       ..-"---,    1-/---.--/.        ~.LJ       Bay Gates 1         722 J 622                Bus 1 u1Main                r-:-:-=-:-:-::---.,,--,---          __L'-0--"~                      Bus 2
                                                                    ~ su ~rs 230       i-11 l

• BankXfrnr 212 5001& .v ~ U2 Main BankXfrnr 5001&/251&

         .._.._L_,~-1-2"~-5W-4-'"_T_:=L~,-A-1-ux2~~5-::~r AuxXfrn1-r1l
                       'v 'v Tl-cb-+11~

lj'_J_

                                                                    '""T")

121& ~ ( I AuxX~Tor . ~* 4iJ5~W ~-'fXfrnr U L (Y) (X) U1 Main °=" r-. °=" U2 Main (X) (Y) Generator ) 12kV SU Bus ( 1 ( 1 ( 1 Generator r - --.----------~~s~;:rs £--========::::::;-- -- -:i

    .JJ....)

Bus E J2..1 Bus D DG DG DG (X) 4 1& (X) DG (Y) DG DG (~ Bus D cw Bus E2

    ~ ITT~~ ~T=l;,4) (~~17,f; ~ i:nJ (~
                 ..i.;..i.

Bus D Ill~~ Bus H Bus G Bus F Ill Bus F Ill Bus G Ill Bus H J..,;,1. Bus D DCPP Basis Reference(s):

1. UFSAR, Section 8.2.2

2. UFSAR, Section 8.3.1.6

3. OP AP SD-1, Loss of AC Power

4. OP AP-2, Loss of Offsite Power

5. OP J-2:V, Backfeeding the Unit From the 500kV System

6. ECA-0.0, Loss of All Vital AC Power

7. NEI 99-01 SS1 I[Document No.] Rev. [X] Page 173 of 2891

ATTACHMENT 1 EAL Bases Category: S -System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Prolonged loss of all offsite and all onsite AC power to vital buses . EAL: SG1 .1 General Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to Unit 1 or Unit 2 vital 4.16KV buses F, G and H. AND EITHER:

• Restoration of at least one 4.16KV vital bus in < 4 hours is not likely. (Note 1)
• CSFST Core Cooling RED path conditions met.

Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded , or will likely be exceeded. Table 5-1 AC Power Capability Unit 1 Unit 2

          ~

(I)

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1

          ~
          .....

• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator (I)

          ~

• DG 1 Bus H
• DG 2 Bus H 0

           "'c:

• DG 1 Bus G
• DG2-1-BusG
• DG1-3-BusF
• DG 2 Bus F
• Other Un it via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup , 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50 .2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. I [Document No.] Rev. [X] Page 174 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information This EAL is indicated by the extended loss of all offsite and onsite AC power capability to 4.16KV vital buses F, G and Heither for greater then the DCPP Station Blackout (SBO) coping analysis time (4 hrs.) (ref. 1) or that has resulted in indications of an actual loss of adequate core cooling . Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED path conditions being met. (ref. 2). For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:

• By a clear procedure path ,

and

• Breakers and equipment are readily available to power up the bus within the allotted time frame.

The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG1. This will allow additional time for implementation of offsite protective actions. The estimate for restoring at least one emergency bus should be based on a realistic appraisal of the situation . Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public. The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core. When filling out the ENF form , th is event can be Unit 1, Unit 2 or Unit 1 and 2.

Background

The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below) . I [Document No.] Rev. [X] Page 175 of 2891

ATTACHMENT 1 EAL Bases Unit 1(2) 4.16KV buses F, G and H are the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2). If the 1-1 or 2-1 transformer is unavailable, the other unit's #1 transformer (2-1 or 1-1) can be used to supply the startup bus through the startup bus cross tie breaker. Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations , vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition , each units vital buses F, G and H have an onsite emergency diesel generator which can supply electrical power to its associated bus

• automatically in the event that the preferred source becomes unavailable (ref. 3-8).

Four hours is the station blackout coping time (ref 1). Indication of continuing core cooling degradation must be based on fission product barrier monitoring with particular emphasis on SM/SEC/ED judgment as it relates to IMMINENT Loss of fission product barriers and degraded ability to monitor fission product barriers. Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED Path conditions being met (ref.2). Specifically, Core Cooling RED Path conditions exist if either:

• Core exit TCs are reading greater than or equal to 1200°F, or
• Core exit TCs are reading greater than or equal to 700°F with RCS subcooling less than or equal to 20°F, and RVLIS full range indication is less than or equal 32%.

This EAL addresses a prolonged loss of all power sources to AC emergency buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers. In addition , fission product barrier monitoring capabilities may be degraded under these conditions . Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emergency bus by the end of the analyzed station blackout coping period. Beyond this time, plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges to multiple fission product barriers . DCPP Electrical Distribution System I (Document No.] Rev. (X] Page 176 of 2891

ATIACHMENT 1 EAL Bases 500kV Switch yard 230kV Switchyard Bus1E~~_Q... Mesa 1 Bus2 ~ ~ ~~ Midway2+- XJ 642 ~ ---------------

                                                                                                                                      ~-               282 Midway3+-     ~T'£°"T~                ___.                                                                                              L__          T~-r+ Morro
              ~T'-()-/_____/.              U1 Main                                                                  ..--'---, 1---/----.---J'.       ~ J Bay Ga tes 1 ,                                                    ~                                          -----1..'-()-/~                     Bus2 722   622          Bus 1 BankXfmr                      1-1 SU Xfmrs ~    2-1                  )        212 SOOk\/                               230k\/

l-- U2 Main BankXfmr 500k\//25k\/

   .                                      ?Ski/~               ' - 12k\/               ~

AuxX~~ l~ 1205~k\/ =-i= ~-~Xfmr Jll_l_ ) ( AuxXfmr 25k\/ AuxXfmr I 2

                                                                                                                            -~X) ~~kV                        ~-

1 11 U L 12 (Y) (X) U1 Main -=- ,..., -=- U2 Main k\/ Generator ) 12kV SU Bus ( ( 1 ( 1 Generator I I v 1 r -- -~------------'~SUX!mrs ~-==========:::;- ~

    ~ ,W)

Bus E Bus _D DG DG DG 4 _(X)12k\/ k\/ (X) DG (Y)

• DG DG c.w Bus D (~

Bus E2

    ~ ITTi: ~ ~Tl~4) ((~~17,f'. =ii.i=JJ ~

Bus D I I Bus H I .i.;...J.;...j. Bus G

                                                              .i.;...J.;...j.

Bus F I I Bus F I ~ Bus G I I Bus H I ~ Bus D [Document No.] - Rev. [X] Page 177 of 2891

ATTACHMENT 1 EAL Bases DCPP Basis Reference(s):

1. DCM T-42, Station Blackout

2. F-0, Critical Safety Function Status Trees Attachment 2, Core Cooling

3. UFSAR, Section 8.2.2

4. UFSAR, Section 8.3.1.6

5. OP AP SD-1, Loss of AC Power

6. OP AP-2, Loss of Offsite Power

7. OP J-2:V, Backfeeding the Unit From the 500kV System

8. ECA-0.0, Loss of All Vital AC Power

9. NEI 99-01 SG1 I [Document No.] Rev. [X] Page 178 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all vital DC power for 15 minutes or longer. EAL:* SS2.1 Site Area Emergency Loss of all 125 VDC power based on battery bus voltage indications< 105 VDC on all Unit 1 or Unit 2 vital DC buses for~ 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded,. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems. classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information Minimum battery voltage of 105 VDC is the voltage below which supplied loads may not function (ref. 1, 3, 4). This IC addresses a loss of vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Escalation of the emergency classification level would be via ICs RG1, FG1 or SG1.

Background

The vital 125 VDC system consists of three independent networks per unit. Each network contains the following components:

• Battery
• Battery charger
• Standby battery charger to allow maintenance and/or testing I [Document No.] I Rev. [X] I Page 179 of 2s9 I

ATTACHMENT 1 EAL Bases

• Distribution panels
• Ground detector The vital 125 VDC batteries and distribution panels are located in Area "H" of the 115 feet elevation of the Auxiliary Building. There are a total of three batteries per unit, 11 (21 ), 12(22),

and 13(23). The batteries are sized to provide sufficient power to operate the associated DC loads for the time necessary to safely shut down the unit, should a 480-VAC source to one or more battery chargers be unavailable (ref. 1, 2, 3). DCPP Basis Reference(s):

1. ECA-0.0, Loss of All Vital AC Power

2. UFSAR, Section 8.3.2.2.2

3. OP AP-23, Loss of Vital DC Bus

4. Notification 50804190 DC Bus Voltage Trigger for EALs

5. NEI 99-01 SS8 I [Document No.] Rev. [X] Page 180 of 2891

ATTACHMENT 1 EAL Bases Category:

• S -System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all AC and vital DC power sources for 15 minutes or longer.

EAL: SG2.1 General Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to Unit 1 or.Unit 2 vital 4.16KV buses F, G and H for~ 15 minutes. AND Loss of all 125 VDC power based on battery bus voltage indications < 105 VDC on all Unit 1 or Unit 2 vital DC buses for~ 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

• Table S-1 AC Power Capability Unit 1 Unit2 Cl)

          .:::

• Startup XFMR 1-2 via Startup XFMR 1-1
• Startup XFMR 2-2 via Startup XFMR 1-1 J!?
• Startup XFMR 1-2 via Startup XFMR 2-1
• Startup XFMR 2-2 via Startup XFMR 2-1 0
• Aux XFMR 1-2 backfed via Main XFMR
• Aux XFMR 2-2 backfed via Main XFMR
• Aux XFMR 1-2 fed from the Main
• Aux XFMR 2-2 fed from the Main Generator Generator Cl)

          .:::fl)

• DG1-1-BusH
• DG 2 Bus H '

c

• DG 1 Bus G
• DG 2 Bus G 0 I
• DG 1 Bus F
• DG 2-3-Bus F
• Other Unit via Startup Bus X-Tie
• Other Unit via Startup Bus X-Tie Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. I [Document No.] Rev. [X] Page 181 of 2891

ATTACHMENT 1 EAL Bases Basis: ERO Decision Making Information For emergency classification purposes, "capability" means that, whether or not the buses are actually powered from it, an AC power source(s) can be aligned to the vital buses within 15 minutes:*

• By a clear procedure path, and
• Breakers and equipment are readily available to power up the bus within the allotted time frame.

Minimum battery voltage of 105 VDC is the voltage below which supplied loads may not function (ref.6, 8, 9). This IC addresses* a concurrent and prolonged loss of both vital AC and Vital DC power. A loss of all vital AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both vital AC and vital DC power will lead to multiple challenges to fission product barriers. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.

Background

This EAL is indicated by the loss of all offsite and onsite vital AC power capability to 4.16KV vital buses F, G and H for greater than 15 minutes in combination with degraded vital DC power voltage. This EAL addresses operating experience from the March 2011 accident at Fukushima Daiichi. - The vital 4.16KV AC System provides the power requirements for operation and safe shutdown of the plant (see figure below). Unit 1(2) 4.16KV buses F, G and Hare the emergency (vital) buses. Each bus has three sources of power. One offsite source is from the 230KV switchyard via 12KV startup transformer 1-1 (2-1) to the 4.16KV startup transformer 1-2 (2-2) . . Another method to obtain offsite power is by back feeding the vital buses from the 500KV switchyard through the main transformer to the 4.16KV unit auxiliary transformer 1-2 (2-2). This is normally only done post-trip when 500KV power is available. During normal operations, vital bus power is supplied from onsite by the main generator via the 4.16KV unit auxiliary transformer 1-2 (2-2). In addition, each units vital buses F, G and H have. an onsite emergency diesel generator which can supply electrical power to its associated bus automatically in the event that the preferred source becomes unavailable (ref. 1-6). The vital 125 VDC system consists of three independent networks per unit. Each network contains the following components: I[Document No.] Rev. [X] Page 182 of 289 j 1

ATTACHMENT 1 EAL Bases

• Battery
• Battery charger
• Standby battery charger to allow maintenance and/or testing
• Distribution panels
• Ground detector The vital 125 VDC batteries and distribution panels are located in Area "H" of the 115 feet elevation of the Auxiliary Building. A total of three batteries per unit, 11 (21 ), 12(22), and 13(23) are supplied for Units 1 and 2. The batteries are sized to provide sufficient power to operate the associated DC loads for the time necessary to safely shut down the unit, should a 480-VAC source to one or more battery chargers be unavailable (ref. 7, 8).

DCPP Electrical Distribution System 500kV Switch yard 230kV Switchyard MidwayB2'~1~T'£°"T~~ Midway 3 +- ~T'£°"T'*g~ Bus 1E :~~$Mesa T~,.+ Morro

                   ~ ~__/.                                                                          r-"---,    I--/---.----/'.      ~61......J   Bay Gates 1       722    J 622       Bus1    u1Main BankXfmr
                                                                ~--~-- ____j_'-0--'..L.:...___J I i=1SU Xfmrs i i i                    212 Bus2 l

SOOKV ~ 23Dl<V ~ U2 Main BankXfmr 500KV/25KV

                 ----~-~251s1_1 AuxXt;'.'~ l~ 12~5KV4KV     (,=;=, ~-~Xfmr _1]_-+---.

U1 Main cbll -

                                                             '-         12KV ~
                                                                  ) , ,.....    (I    I I
                                                                                          -=

U2 Main 2-1' (X)

                                                                                                                  ~     4KV 12KV (Y)
                                                                                                                                               ~-'fXfmr
                                                                                                                                             25%

electrical load

• EGCS actuation Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): I [Document No.] Rev. [X] Page 187 of 2891

ATIACHMENT 1 EAL Bases Those structures, systems and components that are relied upon to remain functional during and. following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown. Basis: ERO Decision Making Information SAFETY SYSTEM parameters listed in Table S-2 are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems. The Plant Computer (PPC), ERFDS and SPDS serve as a redundant compensatory indicator which may be utilized in lieu of normal Control Room indicators (ref. 1). Significant transients are listed in Table S-3 and indude response _to automatic or manually initiated functions such as reactor trips, runbacks involving greater than or equal to 25% . thermal power change, electrical load rejections of greater than 25% full electrical load or ECCS (SI) injection actuations. As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room'sources for the given pa_rameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of

• indication.

Escalation of the emergency classification level would be via ICs FS1 or IC RS1

Background

This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant. An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accid,ent assessment, or protective action decision-making. I [Document No.] Rev. [X] Page 188 of 2891

ATIACHMENT 1 EAL Bases This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well. DCPP Basis Reference(s):

1. UFSAR Section 7.5 Safety-Related Display Instrumentation

2. NEI 99-01 SA2 I [Document No.] Rev. [X] Page 189 of 2891

ATIACHMENT 1 EAL Bases Category: S - System Malfunction

• Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification

                           *permissible limits.

EAL: SU4.1 Unusual Event RCS activity > Technical Specification Section 3.4.16 permissible limits. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This EAL would be met if TS 3.4.16 Required Action C.1 (place plant in Mode 3 in 6 hours) or C.2 (place plant in Mode 5 in 36 hours) were not met. Escalation of the emergency classification level would be via ICs FA 1 or the Recognition Category R ICs.

Background

The specific iodine activity is limited to 1.0 µCi/gm Dose Equivalent 1-131. However, operation with iodine specific activity levels greater than the limit is permissible, if the activity levels do not exceed 60.0 µCi/gm Dose Equivalent 1-131, for more than 48 hours. The specific Xe-133 activity is limited to::;; 600 µCi/gm Dose Equivalent XE-133(ref1). With the Dose Equivalent 1-131 greater than the LCO limit of 1 µCi/gm, samples at intervals of 4 hours must be taken-to demonstrate that the specific activity is < 60.0 µCi/gm. Dose Equivalent 1-131 must be restored to within limits within 48 hours. This is acceptable since it is expected that, if there were an iodine spike, the normal RCS iodine concentration (:5 1 µCi/gm) would be restored within this time period (ref 2). This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant. DCPP Basis Reference(s):

1. DCPP Technical Specifications section 3.4.16 RCS Specific Activity

2. DCPP Technical Specifications Basis section 3.4.16 RCS Specific Activity

3. NEI 99-01 SU3 I [Document No.] Rev. [X] Page 190 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 4 - RCS Activity* Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits. EAL: SU4.2 Unusual Event With letdown in service, procedurally directed letdown dose point radiation > 3 R/hr. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant. Escalation of the emergency dassification level would be via ICs FA 1 or the Recognition Category R ICs.

Background

• Initial indication of Fuel Clad degradation can be determined by measuring the external radiation dose rate at a distance of one foot from the center of the letdown line in the letdown heat exchanger room using the technique described in Attachment 7.1 of EP RB-14A, Initial Detection of Core Damage. An external radiation dose rate exceeding 3 R/hr indicates Fuel Clad degradation greater than Technical Specification allowable limits. This value was determined by ratioing 15 R/hr which corresponds to coolant activity at 300 µCi/gm to the Technical Specification LCO coolant activity of 60 µCi/gm which includes iodine spike (see

                                     =

EAL SU4.1), or 15 R/hr x 60/300 3 R/hr (ref 1, 2, 3). DCPP Basis Reference(s):

1. EP RB-14A, Initial Detection of Core Damage

2. DCPP Technical Specifications section 3.4.16 RCS Specific Activity

3. PG&E Calculation EP 95-02 Rev. 0, Letdown Heat Exchanger Rom Dose Rates Corresponding to EP G-1, Alert No. 2 RCS Activity

4. NEI 99-01 SU3 I [Document No.] Rev. [X] Page 191 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 5 - RCS Leakage Initiating Condition: RCS LEAKAGE for 15 minutes or longer. EAL: SU5.1 Unusual Event RCS unidentified or pressure boundary leakage > 10 gpm for;::: 15 minutes. OR RCS identified leakage > 25 gpm for ;::: 15 minutes. OR Leakage from the RCS to a location outside containment > 25 gpm for ;::: 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank; *

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage; *

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

f. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

Basis: I [Document No.] Rev. [X] Page 192 of 2891

ATIACHMENT 1 EAL Bases ERO Decision Making Information These conditions apply to leakage into the containment, a secondary-side system (e.g., steam generator tube leakage) or a location outside of containment. The first and second EAL conditions are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications) (ref. 2). The third condition address~s an RCS mass loss caused by an UNISOLABLE leak through an interfacing system (ref. 3, 4, 5). The release of mass from the RCS due to the as-designed/expected operation of a relief valve ' does not warrant an emergency classification. An emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flow cannot be isolated). The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible .. Escalation of the emergency classification level would be via ICs of Recognition Category R or F. Below is a summary of classific?tion guidance for steam generator tube leaks: Affected SG is FAULTED Outside of Containment? Primary-to-Secondary Yes No Leak Rate Less than or equal to 25 gpm No classification No classification Greater than 25 gpm Unusual Event per SU5.1 Unusual Event per SU5.1 Requires operation of a standby Site Area Emergency per charging (makeup) pump (RCS Alert per FA1 .1 FS1.1 Barrier Potential Loss) Requires an automatic or manual Site Area Emergency per ECCS (SI) actuation (RCS Barrier Alert per FA 1.1 FS1.1 Loss)

Background

Manual or computer-based methods of performing an RCS inventory balance are normally used to determine RCS LEAKAGE. STP R-1 OC, Reactor Coolant System Water Inventory Balance, is performed to determine the source and flow rate of the leakage. (ref. 1). Escalation of this EAL to the Alert level is via Category F, Fission Product Barrier Degradation, EAL FA1.1. This IC addresses RCS LEAKAGE which may be a precursor to a more significant event. In this case, RCS LEAKAGE has been detected and operators, following applicable procedures, I[Document No.] I Rev. [X] I Page 193 of 2891

ATTACHMENT 1 EAL Bases have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant. The leak rate values for each condition were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage. DCPP Basis Reference(s):

1. STP R-1 OC, Reactor Coolant System Water Inventory Balance

2. DCPP Technical Specifications Definitions section 1.1

3. UFSAR Section 5.2. 7 Reactor Coolant Pressure Boundary Leakage Detection System

4. UFSAR Section 5.2.9 Leakage Prediction From Primary Coolant Sources Outside Containment

5. OP AP-1, Excessive Reactor Coolant System Leakage

6. NEI 99-01 SU4 I [Document No.] Rev. [X] Page 194 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 6 - RTS Failure Initiating Condition: Automatic or manual trip fails to shu_t dowri the reactor. EAL: SU6.1 Unusual Event An automatic trip did not shut down the reactor as indicated by reactor power :::: 5% after any RTS setpoint is exceeded. AND A subsequent automatic trip or manual trip action taken at the control room panels (CC1, VB2 or VB5) is successful in shutting down the reactor as indicated by reactor power

 < 5%. (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. Mode Applicability: 1 - Power Operation Definition(s): None Basis: ERO Decision Making Information For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the control room panels (CC1, VB2 or VB5):

• Reactor trip switches (CC1 and VB2)
• Deenergization of 480V Buses 130 and 13E (230 and 23E) at the Control Room vertical board (VB5)

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/ATWS (such as locally opening the reactor trip beakers, local deenergization of 480V Buses 130 and 13E, emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4). , Following any automatic RTS trip signal, E-0 (ref. 2) and FR-S.1 (ref. 4) prescribe insertion of redundant manual trip signals to back up the automatic RTS trip function and ensure reactor shutdown is achieved. Even if the first su,bsequent manual trip signal inserts all control rods to the full-in position immediately after the initial failure of the automatic trip, the' lowest level of classification that must be declared is an Unusual Event (ref. 4). A reactor trip resulting from actuation of the A TWS Mitigation System Actuation Circuitry (AMSAC) logic that results in full insertion of control rods and diminishing neutron flux is considered a successful reactor trip. AMSAC automatically initiates auxiliary feedwater and a I [Document No.] Rev. [X] Page 195 of 2891

ATTACHMENT 1 EAL Bases turbine trip under conditions indicative of an Anticipated Transient Without Scram (ATWS) event (ref. 5). ,, In the event that the operator identifies a reactor trip is IMMINENT and initiates a successful manual reactor trip before the -automatic RTS trip setpoint is reached, no declaration is required. The successful manual trip of the reactor before it reaches its automatic trip setpoint or reactor trip signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. However, if subsequent manual reactor trip actions fail to reduce reactor power below 5%, the event escalates to the Alert under EAL SA6.1. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles". Should a reactor trip signal be generated as a result of plant work (e.g., RTS setpoint testing), the following classification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor trip and the RTS fails to automatically shut down the reactor, then this I~ and the EALs are applicable, and should be evaluated.
• If the signal does not cause a plant transient and the trip failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Background

The first condition of this EAL identifies the need to cease critical reactor operations by

.actuation of the automatic Reactor Trip System (RTS) trip function. A reactor trip is automatically initiated by the RTS when certain continuously monitored parameters exceed predetermined setpoints (ref. 1).

Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative startup rate. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-trip response from an automatic reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful trip has therefore occurred when there is sufficient rod insertion from *the trip of RTS to bring the reactor power below the immediate shutdown decay heat level of 5% (ref. 2, 3, 4). If by procedure, operator actions include the initiation of an immediate manual trip following receipt of an automatic trip signal and there are no clear indications that the automatic trip failed (such as a time delay following indications that a trip setpoint was exceeded), it may be difficult to determine if the reactor was shut down because of automatic trip or manual actions. If a subsequent review of the trip actuation indications reveals that the automatic trip did not cause the reactor to be shut down, then consideration should be given to evaluating the fuel for potential damage, and the reporting requirements of 50. 72 should be considered for the transient event. This IC addresses a failure of the RTS to initiate or complete an automatic or manual reactor trip that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic trip is successful in shutting down the reactor. I[Document No.] / Rev. [X] I Page 196 of 289 /

ATTACHMENT 1 EAL Bases This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant. Following the failure on an automatic reactor trip, operators will promptly initiate manual actions at the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor trip). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

• If an initial manual reactor trip is unsuccessful, operators will promptly .take manual action at another location(s) on the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor trip) using a different switch). Depending upon several factors, the initial or subsequent effort to manually trip the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor trip signal. If a subsequent manual or automatic trip is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor trip). This action does not include manually driving in control rods or implementation of boron injection strategies. The plant response to the failure of an automatic or manual reactor trip will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6. Depending upon the plant response, escalation is also possible via IC FA 1. Absent the plant conditions needed to meet either IC SA6 or FA 1, an unusual event declaration is appropriate for this event. A reactor shutdown is determined in accordance with applicable emergency operating procedure criteria.

• DCPP Basis Reference(s):

1. DCPP Technical Specifications Section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. E-0 Reactor Trip or Safety Injection

3. F-0 Critical Safety Function Status Trees - Subcriticality

4. FR-S.1 Response to Nuclear Power Generation/ATWS

5. UFSAR Section 7.6.2.3 ATWS Mitigation Actuation Circuitry (AMSAC) 6 NEI 99-01 SU5 I [Document No.] Rev. [X] Page 197 of 2891 L

                                                                                                                        -1 ATTACHMENT 1 EAL Bases Category:                     S - System Malfunction Subcategory:                  6 - RTS Failure Initiating Condition:         Automatic or manual trip fails to shut down the reactor.

EAL: SU6.2 Unusual Event A manual trip did not shut down the reactor as indicated by reactor power ~ 5% after any manual trip action was initiated. AND A subsequent automatic trip or manual trip action taken at the control room panels (CC1, VB2 or VB5) is successful in shutting down the reactor as indicated by reactor power

  < 5%. (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. Mode Applicability: 1 - Power Operation Definition(s): SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decisio,n Making Information For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the control room panels (CC1, VB2 or VB5):

• Reactor trip switches (CC1 and VB2)
• Deenergization of 480V Buses 130 and 13E (230 and 23E) at the Control Room vertical board (VB5)

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/AlWS (such as locally opening the reactor trip beakers, local deenergization of 480V Buses 130 and 13E (230 and 23E), emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4). I [Document No,] Rev. [X] Page 198 of 2891

ATTACHMENT 1 EAL Bases A reactor trip resulting from actuation of the A TWS Mitigation System Actuation Circuitry (AMSAC) logic that results in full insertion of control rods and diminishing neutron flux is considered a successful reactor trip. AMSAC automatically initiates auxiliary feedwater and a turbine trip under conditions indicative of an Anticipated Transient Without Scram (ATWS) - event (ref. 5). If both subsequent automatic and subsequent manual reactor trip actions in the Control Room fail to reduce reactor power below the power associated with the SAFETY SYSTEM design (< 5%) following a failure of an initial manual trip, the event escalates to an Alert under EAL SA6.1. . Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles". Should a reactor trip signal be generated as a result of plant work (e.g., RTS setpoint testing), the following clas~ification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor trip and the RTS fails to automatically shut down the reactor, then this IC and the EALs are

         . applicable, and should be evaluated.

• If the signal_ does not cause a plant transient and the trip failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Background

This EAL addresses a failure of a manually initiated trip in the absence of having exceeded an automatic RTS trip setpoint and a subsequent automatic or manual trip is successful in shutting down the reactor (reactor power< 5%). (ref. 1).

• Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative startup rate. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-trip response from a manual reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful trip has therefore occurred when there is sufficient rod insertion from the trip of RTS to bring the reactor power below the immediate shutdown decay heat level of 5% (ref. 2, 3, 4).

This IC addresses a failure of the RTS to initiate or complete an automatic or manual reactor . trip that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic trip is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant. Following the failure on an automatic reactor trip, operators will promptly initiate manual actions at the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor trip). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. j [Document No.] Rev. [X] Page 199 of 289 j

ATTACHMENT 1 EAL Bases If an initial manual reactor trip is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor trip) using a different switch. Depending upon several factors, the initial or subsequent effort to manually trip the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor trip signal. If a subsequent manual or automatic trip is successful in shutting down the reactor, core heat generation will quickly fall to. a level within the capabilities of the plant's decay heat removal systems. A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor trip). This action does not include manually driving in control .rods or implementation of ooron injection strategies. *

• The plant response to the failure of an automatic or manual reactor trip will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant
• conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6. Depending upon the plant response, escalation is also possible via IC FA 1. Absent the plant conditions needed to meet either IC SA6 or FA 1, an unusual event declaration is appropriate for this event.

A reactor shutdown is determined in accordance with applicable emergency operating procedure criteria. DCPP Basis Reference(s):

1. DCPP Technical Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. E-0 Reactor Trip or Safety Injection

3. F-0 Critical Safety Function Status Trees - Subcriticality

4. FR-S.1 Response to Nuclear Power Generation/ATWS

5. UFSAR Section 7.6.2.3 ATWS Mitigation Actuation Circuitry (AMSAC)

6. NEI 99-01 SU5 I [Document No.] Rev. [X] Page 200 of 2891

ATIACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - RTS Failure

• Initiating Condition: Automatic or manual trip fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor.

EAL: SA6.1 Alert An automatic or manual trip fails to shut down the reactor as indicated by reactor power

 ~5%.

AND Manual trip actions taken at the control room panels (CC1, VB2 or VB5) are not successful in shutting down the reactor as indicated by reactor power ~ 5%. (Note 8) Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. Mode Applicability: 1 - Power Operation Definition(s): SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of-accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the control room panels (CC1, VB2 or VB5):

• Reactor trip switches (CC1 and VB2)
• Deenergization of 480V Buses 13D and 13E (23D and 23E) at the Control Room vertical board (VB5)

Reactor shutdown achieved by use of other trip actions specified in FR.,.S.1 Response to Nuclear Power Generation/ATWS (such as locally opening the reactor trip beakers, local I [Document No.] Rev. [X] Page 201 of 2891

ATTACHMENT 1 EAL Bases deenergization of 480V Buses 13D and 13E (230 and 23E), emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4). A reactor trip resulting from actuation of the A TWS Mitigation System Actuation Circuitry (AMSAC) logic that results in full insertion of control rods and diminishing neutron flux is considered a successful reactor trip. AMSAC automatically initiates auxiliary feedwater and a turbine trip under conditions indicative of an Anticipated Transient Without Scram (ATWS) event (ref. 5). Escalation of this event to a Site Area Emergency would be under EAL SS6.1 or SM/SEC/ED judgment. If the failure to shut down the reactor is prolonged enough to cause a challenge tq the core cooling or RCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS6. Depending upon plant responses and symptoms, escalation is also possible via IC FS1.

Background

This EAL addresses any automatic or manual reactor trip signal that fails to shut down the reactor (reactor power< 5%) followed by a subsequent manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the SAFETY SYSTEMS were designed (ref. 1). On the power range scale 5% rated power is a minimum reading on the power range scale that indicates continued power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below 5%, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation can be used to determine if reactor power is greater than 5 % power (ref. 3, 4). This IC addresses a failure of the RTS to initiate or complete an automatic or manual reactor trip that resultS in a reactor shutdown, and subsequent operator manual actions taken at the

• reactor control consoles to shut down the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RTS.

A manual action at the reactor control console is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor trip). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control console (e.g., locally opening breakers). Actions taken at back panels or other locations within the control room, or any location outside the control room, are not considered to be "at the reactor control console". The plant response to the failure of an automatic or manual reactor trip will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. Absent the plant conditions needed to meet either IC SS6 or FS 1, an Alert declaration is appropriate for this event. I [Document No.] Rev. [X] Page 202 of 2891

ATTACHMENT 1 EAL Bases It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration. A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria. DCPP Basis Reference(s):

1. DCPP Technical*Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. E-0 Reactor Trip or Safety Injection

3. F-0 Critical Safety Function Status Trees - Subcriticality

4. FR-S.1 Response to Nuclear Power Generation/AlWS

5. UFSAR Section 7.6.2.3 AlWS Mitigation Actuation Circuitry (AMSAC)

6. NEI 99-01 SA5 I [Document No.] Rev. [X] Page 203 of 2891

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - RTS Failure Initiating Condition: Inability to shut down the reactor causing a challenge to core cooling or RCS heat removal. EAL: SS6.1 Site Area Emergency An automatic or manual trip fails to shut down the reactor as indicated by reactor power

 ~ 5% .

AND All actions to shut down the reactor are not successful as indicated by reactor power

 ~ 5%.

AND EITHER:

• CSFST Core Cooling RED path conditions met.
• CSFST Heat Sink RED path conditions met.

AND Bleed and feed criteria met. Mode Applicability: 1 - Power Operation Definition(s): SAFETY SYSTEM - A system required for safe plant operation , cooling down the plant and/or placing it in the cold shutdown condition , including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures , systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition ; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information This EAL addresses the following :

• Any automatic reactor trip signal followed by a manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the SAFETY SYSTEMS were designed (EAL SA6.1 ), and I [Document No.] Rev. [X] Page 204 of 2891

ATIACHMENT 1 EAL Bases

• Indications that either core cooling is extremely challenged or heat removal is extremely challenged.

Reactor shutdown achieved by use of other trip actions specified in FR-S.1 Response to Nuclear Power Generation/AlWS (such as local deenergization of 480V Buses 13D and 13E (23D and 23E) , emergency boration or manually driving control rods) are also credited as a successful manual trip provided reactor power can be reduced below 5% before indications of an extreme challenge to either core cooling or heat removal exist (ref. 1, 4) . Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED path conditions being met (ref. 2) . Indication of inability to adequately remove heat from the RCS is manifested by CSFST Heat Sink RED path conditions being met in combination with bleed and feed criteria being met (ref. 3). Heat Sink RED path conditions exist if:

• All SG narrow range levels less are than 15%, AND
• Less than 435 total AFW available to feed the SGs Bleed and feed criteria are met when :
• Wide range level in any three (3) SGs is less than 18% [26%] AND
• All narrow range SG levels are less than 15% [25%].

Parenthetical values are used during Adverse Containment Conditions. Escalation of the emergency classification level would be via IC RG1 or FG1.

Background

The combination of failure of both front line and backup protection systems to function in response to a plant transient, along with the continued production of heat, poses a direct threat to the Fuel Clad and RCS barriers. On the power range scale 5% rated power is a minimum reading on the power range scale that indicates continued power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below 5% , plant response will be similar to that observed during a normal shutdown . Nuclear instrumentation can be used to determine if reactor power is greater than 5 % power (ref. 1, 4). This IC addresses a failure of the RTS to initiate or complete an automatic or manual reactor trip that results in a reactor shutdown, all subsequent operator actions to manually shut down the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS . This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency. In some instances , the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs. This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shut down the reactor. The I [Document No.] I Rev. [X] I Page 205 of 2891

ATTACHMENT 1 EAL Bases inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shut down the reactor. A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 1, Subcriticality

2. F-0 Critical*Safety Funct!on Status Tress -Attachment 2, Core Cooling

3. F-0 Critical Safety Function Status Tress -Attachment 3, Heat Sink

4. FR-S.1 Response to Nuclear Power Generation/AlWS

5. NEI 99-01 SSS I [Document No.] Rev. [X]

I Page 206 of 2891 _J

ATTACHMENT 1 EAL Bases Category: *S - System Malfunction Subcategory: 7 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities. EAL: SU7.1 Unusual Event Loss of all Table S-4 onsite communication methods. OR Loss of all Table S-4 offsite communication methods. OR Loss of all Table S-4 NRC communication methods. Table S-4 Communication Methods System Onsite Offsite NRC Unit 1, Unit 2 and TSC Radio Consoles x x DCPP Telephone System (PBX) x x x Portable radio equipment (handie-talkies) c x Operations Radio System x x Security Radio Systems x CAS and SAS Consoles ' x x x Fire Radio System x - Hot Shutdown* Panel Radio Consoles x x x Public Address System x ( NRC FTS x Mobile radios x Satellite phones x x x Direct line (ATL) to the County and State OES x Mode Applicability: I [Document No.] Rev. [X] Page 207 of 2891

ATTACHMENT 1 EAL Bases 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: ERO Decision Making Information Onsite, offsite and NRC communications include one or more of the systems listed in Table S-4 (ref. 1, 2, 3). This EAL is t~e hot condition equivalent of the cold condition EAL CU5.1. This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to offsite response organizations (OROs) and the NRC. This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.). Background

• The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

The second EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are the State and county EOCs. The third EAL condition addresses a total loss of the communications methods used to notify the NRC of an emergency declaration. DCPP Basis Reference(s):

1. UFSAR, Section 9.5.2

2. Emergency Plan Section 7.2 Communications Equipment

3. AR PK15-23, Communications

4. NEI 99-01 SU6 I[Document No.] Rev. [X] Page 208 of 2891

ATIACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 8 - Containment Failure Initiating Condition: Failure to isolate containment or loss of containment pressure control. EAL: SU8.1 Unusual Event Any penetration is not isolated within 15 minutes of a VALID containment isolation signal. (Note 1) OR Containment pressure ;;:: 22 psig with < one full train of containment depressurization equipment operating per design for ;;:: 15 minutes. (Notes 1, 9) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 9: One Containment Spray pump and two CFCUs comprise one full train of depressurization equipment. Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment. Basis: ERO Decision Making Information This EAL addresses a failure of one or more containment penetrations to automatically isolate (close) when required by an actuation signal. It also addresses an event that results in high containment pressure with a concurrent failure of containment pressure control systems. Absent challenges to another fission product barrier, either condition represent~ potential degradation of the level of safety of the plant. For the first condition, the containment isolation signal must be generated as the result on an off-normal/accident condition (e.g., a safety injection or high containment pressure); a failure resulting from testing or maintenance does not warrant classification. In order for a penetration" to be considered isolated, a minimum of one valve in the flow path must be closed. The determination of containment and penetration status - isolated or not isolated - should be made in accordance with the appropriate criteria contained in the plant AOPs and EOPs. The 15-minute criterion is included to allow operators time to manually isolate the required penetrations, if possible. The second condition addresses a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of e uipment is ca able of operating per desi n. The 15- [Document No.] Rev. [X] Page 209 of 289

ATTACHMENT 1 EAL Bases minute criterion is included to allow operators time to manually start or restore equipment that may not have automatically started or actuated as required, if possible. The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g., containment sprays) are either lost or performing in a degraded manner. This event would escalate to a Site Area Emergency in accordance with IC FS 1 if there were a concurrent loss or potential loss of either the Fuel Clad or RCS fission product barriers.

Background

The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the design bases requirement. Each train includes a containment spray

, pump, spray headers, nozzles, valves, and piping. The Refueling Water Storage Tank (RWST) supplies borated water to the Containment Spray System during the injection phase of operation. In the recirculation mode of operation, Containment Spray, if needed, is transferred to the RHR Pumps and the Containment Spray Pumps are shut down(ref. 5).

The Containment Cooling System consists of two trains of Containment cooling, each of sufficient capacity to supply 100% of the design cooling requirement. Each train_, consisting of , two Containment Fan Cooling Units (CFCU), is supplied with cooling water from a separate loop of Component Cooling Water (CCW). In post accident operation following an actuation signal, the Containment Cooling System fans are designed to start automatically if not already running (ref.5). The Containment pressure setpoint (22 psig, ref. 1, 2, 3, 4) is the pressure at which the equipment should actuate and begin performing its function. The design basis accident analyses and evaluations assume the loss of one Containment Spray System train and one Containment Cooling System train (ref. 5). Consistent with the design requirement, "one full train of depressurization equipment" is therefore defined to be the availability of one train of each system. If less than this equipment is operating and Containment pressure is above the actuation setpoint, the threshold is met if the required equipment cannot be started within 15 minutes. DCPP Basis Reference(s): *

1. AR PK01-18, CONTMT SPRAY ACTUATION red

2. F-0 Critical Safety Function Status Trees - Attachment 6, Containment

3. FR-Z.1 Response to High Containment Pressure

• 4. Technical Specifications Table 3.3.2-1

5. Technical Specifications B3.6.6 Containment Spray and Cooling Systems

6. NEI 99-01 SU7 I [Document No.] Rev. [X] Page 210 of 2891

ATIACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 9 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode. EAL: SA9.1 Alert The occurrence of any Table S-5 hazardous event. AND EITHER:

• Event damage has caused indications of DEGRADED PERFORMANCE in at least one train of a SAFETY SYSTEM needed for the current operating mode.
• The eventhas caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operatin mode.

Table S-5 Hazardous Events

• Seismic event (earthquake)
• Internal or external *FLOODING event
• High winds or TORNADO strike
• FIRE
• EXPLOSION
• Tsunami
• Other events with similar hazard characteristics as determined b the SM/SEC/ED
• Mode Applicability:

1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): DEGRADED PERFORMANCE -As applied to hazardous event thresholds, event damage significant enough to cause concern regarding the operability or reliability of the affected safety system train.

• EXPLOSION -A rapid, violent.and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. I [Document No.] Rev. [X] I _ _ _ _P_a_g_e_2_1_1_o_f-28-9--.I

ATTACHMENT 1 EAL Bases FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area. SAFETY SYSTEM -As.ystem required for safe plant operation, cooling down the plant and/or 0 placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remc;:iin functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or-mitigate the consequences of accidents which could result in potential offsite exposures. TORNADO - A violently rotating column of air in contact with the ground and extending from the base of a thunderstorm. ' VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact ofthe damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not visible damage. Basis: ERO Decision Making Information This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. With respect to event damage caused by an equipment failure resulting in a FIRE or EXPLOSION, no emergency classification is required in response to a FIRE or EXPLOSION resulting from an equipment failure if the only safety system equipment affected by the event is that upon which the failure occurred. An emergency classification is required if a FIRE or EXPLOSION caused by an equipment failure damages safety system equipment that was otherwise functional or operable (i.e., equipment that was not the source/location of the failure). For example, if a FIRE or EXPLOSION resulting from the failure of a piece of safety system equipment causes damage to the other train of the affected safety system or another safety system, then an emergency declaration is required in accordance with this IC and EAL. Escalation of the emergency classification level would be via IC FS1 or RS1.

Background

This condition represents an actual or potential substantial degradation of the level of safety of the plant. Due to this actual or potential substantial degradation, this condition can significantly reduce the margin to a loss or potential loss of a fission product barrier.* The first condition addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of DEGRADED PERFORMANCE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. I [Document No.] Rev. [X] Page 212 of 2891

ATTACHMENT 1 EAL Bases The second condition addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. DCPP Basis Reference(s):

1. NEI 99-01 SA9 I [Document No.] Rev. [X] Page 213 of 2891

ATTACHMENT 1 EAL Bases Category F - Fission Product Barrier Degradation EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes. EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment. This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. The primary fission product barriers are: A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets. B. Reactor Coolant System (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves. C. Containment (GMT): The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side containment isolation valve. Containment Barrier thresholds are used as criteria for escalation of the EGL from Alert to a Site Area Emergency or a General Emergency. The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-1 (Attachment 2). "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade. The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emergency classification level: Alert: Any loss or any potential loss of either Fuel Clad or RCS Site Area Emergency: Loss or potential loss of any two barriers General Emergency: Loss of any two barriers and loss or potential loss of third barrier The logic used for emergency classification based on fission product barrier monitoring should reflect the following considerations:

• The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Containment Barrier.
• Unusual Event ICs associated with RCS and Fuel Clad Barriers are addressed under System Malfunction ICs.

I [Document No.] Rev. [X] Page 214 of 2891

ATTACHMENT 1 EAL Bases

• For accident conditions involving a radiological release, evaluation of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to ensure correct and timely escalation of the emergency classification. For example, an evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC _RG1 has been exceeded.
• The fission product barrier thresholds specified within a scheme reflect plant-specific DCPP design and operating characteristics.
• As used in this category, the term RCS LEAKAGE encompasses not just those types defined in Technical Specifications but also includes the loss of RCS mass to any location- inside the primary containment, an interfacing system, or outside of the primary containment. The release of liquid or steam mass from the RCS due to the as-designed/expected operation of a relief valve is not considered to be RCS LEAKAGE.
• At the Site Area Emergency level, EAL users should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration. For example, if the Fuel Clad and RCS fission product barriers were both lost, then there should be frequent assessmen~s of containment radioactive inventory and integrity. Alternatively, if both the Fuel Clad and RCS fission product barriers were pptentially lost, the SM/SEC/ED would have more assurance that there was no immediate need to escalate to a General Emergency.

1:_ I [Document No.] Rev. [X] Page 215 of 2891

ATIACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Any loss or any potential loss of either Fuel Clad or RCS. EAL: FA1.1 Alert Any loss or any potential loss of either Fuel Clad or RCS. (Table F-1) Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Alert classification level, Fuel Clad and RCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier, loss or potential loss of either the Fuel Clad or RCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability. Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or RCS barrier results in declaration of a Site Area Emergency under EAL FS1 .1 DCPP Basis Reference(s):

1. NEI 99-0'1 FA1 I [Document No.] Rev. [X] Page 216 of 28_9 I

ATTACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss or potential loss of any two barriers. EAL: FS1 .1 Site Area Emergency Loss or potential loss of any two barriers. (Table F-1) Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions:

• One barrier loss and a second barrier loss (i.e., loss - loss)
• One barrier loss and a second barrier potential loss (i.e., loss - potential loss)
• One barrier potential loss and a second barrier potential loss (i.e., p'otential loss -

potential loss) At the Site Area Emergency classification level, the ability to dynamically assess the proximity of present con9itions with respect to the threshold for a General Emergency is important. For example, the existence of Fuel Clad and RCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification. Alternatively, if both Fuel Clad and RCS potential loss thresholds existed, the SM/SEC/ED would have greater assurance that escalation to a General Emergency is less IMMINENT. DCPP Basis Reference(s):

1. NEI 99-01 FS1 I [Document No.] Rev. [X] Page 217 of 2891

ATIACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss of any two barriers and loss or potential loss of third barrier. EAL: FG1.1 General Emergency Loss of any two barriers AND Loss or potential loss of third barrier. (Table F-1) Mode Applicability: 1 - Power Operation, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s): None Basis: Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-1 (Attachment.

2) lists the fission product barrier thresholds, bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions:

• Loss of Fuel Clad, RCS an_d Containment barriers
• Loss of Fuel Clad and RCS1 barriers with potential loss of Containment barrier
• Loss of RCS and Containment barriers with potential loss of Fuel Clad barrier
• Loss of Fuel Clad and Containment barriers with potential loss of RCS barrier DCPP Basis Reference(s):

                                                                                                 /

1. NEI 99-01 FG1 I [DoculT]ent No.] Rev. [X] I* Page 218of289,I

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Introduction Table F-1 lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The table is structured so that each'of the three barriers occupies adjacent columns. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds. The first column of the table (to the left of the Fuel Clad Loss column) lists the categories (types) of fission product barrier thresholds. The fission product barrier categories are: A. RCS or SG Tube Leakage S. Inadequate Heat removal C. GMT Radiation I RCS Activity D. GMT Integrity or Bypass E. SM/SEC/ED Judgment Each category occupies a_ row in Table F-1 thus forming a matrix defined by the categories. The intersection of each row with each Loss/Potential Loss column forms a cell in which one or more fission product barrier thresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None" is entered in the cell. Thresholds are assigned sequential numbers within each Loss and Potential Loss column beginning with number one. In this manner, a threshold can be identified by its category title and number. For example, the first Fuel Clad barrier Loss in Category A would be assigned "FC Loss A.1," the third Containment barrier Potential Loss in Category C would be assigned "GMT P-Loss C.3," etc. If a cell in Table F-1 contains more than one numbered threshold, each of the numbered thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss. Subdivision of Table F-1 by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds. This structure promotes a . systematic approach to assessing the classification status of the fission product barriers. When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-1, locates the likely category and then reads across the fission product barrier Loss and Potential Loss thresholds in that category to determine if a threshold has been exceeded. If a threshold has not been exceeded, the EAL-user proceeds to the next likely category and continues review of the thresholds in the new category

• If the EAL-user determines that any threshold has been exceeded, by definition, the barrier is lost or potentially lost- even if multiple thresholds in the same barrier column are exceeded, only that one barrier is lost or potentially lost. The EAL-user must examine each of the three fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if containment radiation is sufficiently high, a Loss of the Fuel Clad and RCS barriers and a Potential Loss of the Containment barrier can occur. Barrier I [Document No.] Rev. [X] Page 219 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential* Loss Matrix and Bases Los.ses and Potential Losses are then applied to the algorithms given in EALs FG1 .1, FS1 .1, and FA 1.1 to determine the appropriate emergency classification. In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first, followed by the RCS barrier and finally the Containment barrier threshold bases. In each barrier, the bases are given according category Loss followed by category Potential Loss beginning with Category A, then B, ... , E. I [Document No.] Rev. [X] Page 220 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Table F-1 Fission Product Barrier Threshold Matrix Fuel Clad (FC) Barrier Reactor Coolant System (RCS) Barrier Containment (CMT) Barrier Category Loss Potential Loss Loss Potential Loss Loss Potential Loss

1. Operation of a standby

1. An automatic or manual charging pump is required by EITHER:

A ECCS (S I) actuation required by EITHER: 1. A leaking or RUPTURED SG

• UN ISOLA BLE RCS RCS or None None is FAU LTED outside of None
• UNI SOLABLE RCS LEAKAGE SG Tube Leakage LEAKAGE
• SG tube RUPTURE
• SG tube leakage

2. CSFST Integrity- RED path

                                                                                                                                             .       containment conditions met

1. CSFST Core Cooling-MAGENTA path conditions 1. CSFST Core Cooling- RED B met 1. CSFST Heat Sink-RED path path conditions met

1. CSFST Core Cooling- conditions met AND Inadequate 2. CSFST Heat Sink-RED path None None RE D path conditions met conditions met AND Restoration procedures not Heat Removal AND Bleed and feed criteria met effective within 15 minutes (Note 1)

Bleed and feed criteria met c 1. Containment radiation (RM-30 or RM-31) > 300 R/hr CMT 1. Containment radiation 1. Containment radiation Radiation None None None

2. Dose equivalent 1-131 (RM-30 or RM-31) > 40 R/hr (RM-30 or RM-31) > 5,000 R/hr

  /RCS        coolant activity > 300 Activity     µCi/gm

1. Containment isolation is required AND EITHER: 1. CSFST Containment- RED path

• Containment integrity cond itions met(~ 47 psig) has been lost based on 2. Containment hydrogen D SM/SEC/ED concentration~ 4%

CMT Integrity or Bypass None None None None

                                                                                                                                                     . determination UNISOLABLE pathway from Containment to the

3. Containment pressure ~ 22 psig with < one full train of depressurization equipment environment exists operating per design for

2. Indications of RCS ~ 15 minutes (Note 1, 9)

LEAKAGE outside of Containment E 1. Any condition in the opinion 1. Any cond ition in the opinion 1. Any condition in the opinion 1. Any cond ition in the opinion 1. Any condition in the opinion 1. Any condition in the opinion of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that of the SM/SEC/ED that SM/SEC indicates loss of the fuel indicates potential loss of indicates loss of the RCS indicates potential loss of the indicates loss of the indicates potential loss of the

    /ED clad barrier                     the fuel clad barrier             barrier                          RCS ba rrier                        containment barrier             containment barrier Judgment

[Document No.] Rev. [X] Page 221 of 289

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold: None I [Document No.] Rev. [X] Page 222 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold: None I [Document No.] Rev. [X] Page 223 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold :

1. CSFST Core Cooling-RED path conditions met.

Definition(s): None Basis: ERO Decision Making Information Core Cooling RED path conditions exist if either (ref. 1, 2):

• Core exit TCs are reading greater than or equal to 1200°F, or
• Core exit TCs are reading greater than or equal to 700°F with RCS subcooling less than or equal to 20°F and RVLIS full range indication is less than or equal 32% with no RCPs running

Background

Critical Safety Function Status Tree (CSFST) Core Cooling-RED path indicates significant core exit superheating and core uncovery. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPC, but the PPC is for information only (ref. 1, 2). This reading indicates temperatures within the core are sufficient to cause significant superheating of reactor coolant. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 2, Core Cooling

2. FR-C.1 Response to Inadequate Core Cooling

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A I [Document No.) Rev. [X] Page 224 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. CSFST Core Cooling-MAGENTA path conditions met.

Definition(s): None Basis: ERO Decision Making Information Core Cooling MAGENTA path conditions exist if core exit subcooling margin is less than 20°F and any of the following (ref. 2, 3):

• RVLIS full range less than or equal to 32% with no RCPs running and less than 700°F ,

or

• Core exit TCs reading greater than or equal to 700°F with no RCPs running with greater than 32% RVLIS full range , or
• RVLIS dynamic range level less than or equal to the specified dynamic head value with one or more RCPs running , Table F-2 Table F-2 RVLIS Values RVLIS No. RCPs Level Full Range None 32%

4 44% 3 30% Dynamic Head 2 20% 1 14%

Background

Critical Safety Function Status Tree (CSFST) Core Cooling-MAGENTA path indicates subcooling has been lost and that some fuel clad damage may potentially occur. The CSFSTs are normally monitored using the dedicated SPDS display system . Some of the data is also available on the PPG , but the PPG is for information only (ref. 1). This reading indicates a reduction in reactor vessel water level sufficient to allow the onset of heat-induced cladding damage. DCPP Basis Reference(s): I [Document No.] Rev. [X] Page 225 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

1. F-0 Critical Safety Function Status Trees - Attachment 2, Core Cooling

2. FR-C .1 Response to Inadequate Core Cooling

3. FR-C .2 Response to Degraded Core Cooling

4. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A I [Document No.] Rev. [X] Page 226 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

2. CSFST Heat Sink-RED path conditions met.

AND Bleed and feed criteria met. Definition(s): None Basis: ERO Decision Making Information Heat Sink RED path conditions exist if:

• All SG narrow range levels less are than 15%, AND
• Less than 435 gpm total AFW available to feed the SGs Bleed and feed criteria are met when:
• Wide range level in any three (3) SGs is less than 18% [26%) AND
• All narrow range SG levels are less than 15% [25%).

Parenthetical values are used during Adverse Containment Conditions. In combination with RCS Potential Loss B.1, meeting this threshold results in a Site Area Emergency.

Background

This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i .e. , loss of an effective secondary-side heat sink) . This cond ition represents a potential loss of the Fuel Clad Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators ; during these conditions , classification using threshold is not warranted. The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPC , but the PPC is for information only (ref. 1). DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 3, Heat Sink

2. FR-H .1 Response to Loss of Secondary Heat Sink

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.B I [Document No.) Rev. [X] Page 227 of 2891 J

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases I [Document No.] Rev. [X] Page 228 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. GMT Radiation I RCS Activity Degradation Threat: Loss Threshold:

1. Containment radiation (RM-30 or RM-31) > 300 R/hr.

Definition(s): None Basis: ERO Decision Making Information Containment radiation monitor readings greater than 300 R/hr (ref. 1) indicate the release of reactor coolant, with elevated activity indicative of fuel damage, into the Containment. This value is higher than that specified for RCS barrier Loss C.1. The radiation monitor reading in this threshold is higher than that specified for RCS Barrier Loss threshold C.1 since it indicates a loss of both the Fuel Clad Barrier and the RCS Barrier. Note that a combination of the two monitor readings appropriately escalates the EGL to a Site Area Emergency.

Background

Monitors used for this fission product barrier loss threshold are the Containment High Range Radiation Monitors RM-30 and RM-31. These monitors provide indfoation in the Control Room on PAM 2 with a range of 1R/hr to 1E7 R/hr (ref. 1). The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals 300 µCi/gm dose equivalent 1-131. R.eactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximately 1.8% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1602 Containment Radiation EAL Threshold Values

2. NEI 99-01 GMT .Radiation I RCS Activity Fuel Clad Loss 3.A j [Document No.] Rev. [X] Page 229 of 289 j

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. GMT Radiation I RCS Activity Degradation Threat: Loss Threshold:

2. Dose equivalent 1-131 coolant activity> 300 µCi/cc.

Definition(s): None Basis: ERO Decision Making Information This threshold indicates that RCS radioactivity concentration is greater than 300 µCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier. This condition can be identified by either:

• RCS sample analysis .
• EP RB-14A indications> 15 R/hr (ref. 1, 2)

There is no Potential Loss threshold associated with RCS Activity I Containment Radiation.

Background

None DCPP Basis Reference(s):

1. EP RB-14A Initial Detection of Fuel Cladding Damage

2. SPG-11 Obtaining the EP RB-14A Dose Rate

3. NEI 99-01 GMT Radiation I RCS Activity Fuel Clad Loss 3.B I [Document No.] Rev. [X] Page 230 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. CMT Radiation I RCS Activity Degradation Threat: Potential Loss Threshold: None

                                                     \

I [Document No.] .Rev. [X] Page 231 of 289 .1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold: I [Document No.] Rev. [X] Page 232 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold: I None I [Document No.] Rev. [X] Page 233 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: E. SM/SEC/ED Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates loss of the Fuel Clad barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and _maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from

• portable instrumentation and consideration of offsite monitoring results.
• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A lWS EALs to assure timely emergency classification declarations.

J [Document No.] Rev. [X] Page 234 of 289 J

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases This threshold addresses any other factors that are to be used by the SM/SEC/Eb in determining whether the Fuel Clad barrier is lost

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A I [Document No.] Rev. [X] Page 235 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: E. SM/SEC/ED Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates potential loss of the Fuel

    . Clad barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: * (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is potentially lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominan~ accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operabili.ty concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that are to be used by the SM/SEC/ED in determining whether the Fuel Clad barrier is potentially lost. The SM/SEC/ED should also I [Document No.] I Rev. [X] I Page 236 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A I [Document No.] Rev. [X] Page 237 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

1. An automatic or manual ECCS (SI) actuation required by EITHER:

• UNISOLABLE RCS LEAKAGE.
• SG tube RUPTURE.

Definition(s): FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

g. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

RUPTURED - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection. UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. I [Document No.] Rev. [X] Page 238 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. Basis: ERO Decision Making Information A steam generator with primary-to-secondary leakage of sufficient magnitude to require a safety injection is considered to be RUPTURED. This threshold is based on an UNISOLABLE RCS leak of sufficient size to require an automatic or manual actuation of the Emergency Core Cooling System (ECCS). This condition clearly represents a loss of the RCS Barrier. This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS LEAKAGE through an interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment. If a RUPTURED steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1.A will also be met. *.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Loss 1.A I [Document No.] Rev. [X] Page 239 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

1. Operation of a standby charging pump is required by EITHER:

• UNISOLABLE RCS LEAKAGE.
• SG tube leakage.

Definition(s): FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reactor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

h. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode)~

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. l [Document No.] Rev. [X] Page 240 of 289 l

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Basis: ERO Decision Making Information The need to start an additional charging pump due to RCS LEAKAGE is an indication that the leak is in excess of charging pump capacity. This threshold is not met when an additional charging pump is started as prudent action. Rather, the threshold is met when an additional charging pump is started per conditions outlined in procedures OP AP-1 or OP AP-3, wherein RCS LEAKAGE exceeds capacity of a single charging pump with letdown isolated (ref. 1, 2). This threshold is based on an UNISOLABLE RCS leak that results in the inability to maintain pressurizer level within specified limits by operation of a normally used charging (makeup) pump, but an ECCS (SI) actuation has not occurred. The threshold is met when an operating procedure, or operating crew supervision, directs that a standby charging (makeup) pump be placed in service to restore and maintain pressurizer level. This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS LEAKAGE through an interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment. If a leaking steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1.A will also be met.

Background

None DCPP Basis Reference(s):

1. OP AP-1 Excessive Reactor Coolant System Leakage

2. OP AP-3 Steam Generator Tube Failure

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.A j [Document No.] Rev. [X] Page 241 of 289 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

2. CSFST Integrity-RED path conditions met.

Definition(s): None Basis: ERO Decision Making Information The "Potential Loss" threshold is defined by the CSFST Reactor Coolant Integrity - RED path. CSFST RCS Integrity - Red Path plant conditions and associated PTS Limit Curve A indicates an extreme challenge to the safety function when plant parameters are to the left of the limit curve following excessive RCS cooldown under pressure (ref. 1, 2) . This condition indicates an extreme challenge to the integrity of the RCS pressure boundary due to pressurized thermal shock (PTS) . PTS results from a transient that causes rapid RCS cooldown while the RCS is in Mode 3 or higher (i.e. , hot and pressurized) .

Background

None DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 4, Integrity and 4a Limit A Curve

2. FR-P.1 Response to Imminent Pressurized Thermal Shock Condition

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.B I [Document No.] Rev. [X] Page 242 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold: I None I [Document No.) Rev. [X] Page 243 of 2891

ATIACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. CSFST Heat Sink-RED path conditions met.

AND Bleed and feed criteria met. Definition(s): None Basis: ERO Decision Making Information Heat Sink RED path conditions exist if:

• All SG narrow range levels less are than 15%, AND
• Less than 435 gpm total AFW available to feed the SGs Bleed and feed criteria are met when:
• Wide range level in any three (3) SGs is less than 18% [26%] AND
• All narrow range SG levels are less than 15% [25%].

Parenthetical values are used during Adverse Containment Conditions. In combination with RCS Potential Loss B.1 , meeting this threshold results in a Site Area Emergency.

Background

This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i .e. , loss of an effective secondary-side heat sink). This condition represents a potential loss of the RCS Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions , classification using threshold is not warranted. Meeting this threshold results in a Site Area Emergency because this threshold is identical to Fuel Clad Barrier Potential Loss threshold B.2 ; both will be met. This condition warrants a Site Area Emergency declaration because inadequate RCS heat removal may result in fuel heat-up sufficient to damage the cladding and increase RCS pressure to the point where mass will be lost from the system . The CSFSTs are normally monitored using the dedicated SPDS display system. Some of the data is also available on the PPC , but the PPC is for information only (ref. 1). DCPP Basis Reference(s): I [Document No.] I Rev. [X] Page 244 of 2891

r ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

1. F-0 Critical Safety Function Status Trees - Attachment 3, Heat Sink

2. FR-H.1 Response to Loss of Secondary Heat Sink

3. NEI 99-01 Inadequate Heat Removal RCS Loss 2.B I [Document No.] Rev. [X] Page 245 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: . Reactor Coolant System Category: C. GMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

1. Containment radiation (RM-30 or RM-31) > 40 R/hr.

Definition(s): N/A Basis: ERO Decision Making Information Containment radiation monitor readings greater than 40 R/hr (ref. 1) indicate the release of reactor coolant to the Containment. This value is lower than that specified for Fuel Clad Barrier Loss thres~old C.1 since it indicates a loss of the RCS Barrier only. There is no Potential Loss threshold associated with RCS Activity I Containment Radiation.

Background

The readings assume the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory associated with normal coolant activity, with iodine spiking, discharged into containment (ref. 1). Monitors used for this fission product barrier loss threshold are the Containment High Range Radiation Monitors RM-30 and RM-31. These monitors provide indication in the Control Room on PAM 2 with a range of 1R/hr to 1E7*R/hr (ref. 1). DCPP Basis Reference(s):

1. EP-CALC-DCPP-1602 Containment Radiation EAL Threshold Values

2. NEI 99-01 GMT Radiation I RCS Activity RCS Loss 3.A I[Document No.] Rev. [X] Page 246 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. GMT Radiation/ RCS Activity Degradation Threat: Potential Loss Threshold: None I [Document No.] Rev. [X] Page 24 7 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: D. GMT Integrity or Bypass Degradation Threat: Loss Threshold: j None J [Document No.] Rev. [X] Page 248 of 289 J

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold: I [Document No.] Rev. [X] Page 249 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: E. SM/SEC/ED Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates loss of the RCS barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant *operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1)The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the RCS barrier is lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that may be used by the SM/SEC/ED in determining whether the RCS Barrier is lost. I[Document No.] Rev. [X] Page 250 of 2891 L

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Loss 6.A I [Document No.] Rev. [X] Page 251 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: E. SM/SEC/ED Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates potential loss of the RCS barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM -A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the RCS barrier is potentially lost. Such a determinatidn should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A1WS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that may be used by the SM/SEC/ED in determining whether the RCS Barrier is potentially lost. The SM/SEC/ED should also consider j [Document No.] j Rev. [X] Page 252 of 289 j

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Potential Loss 6.A I [Document No.] Rev. [X] Page 253 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

1. A leaking or RUPTURED SG is FAULTED outside of containment.

Definition(s): FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pres,sure or the steam generator to become completely depressurized. RUPTURED - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection. , Basis: ERO Decision Making Information This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of ~ontainment. The condition of the SG, whether leaking or RUPTURED, is determined in accordance with the thresholds for RCS Barrier Potential Loss A.1 and Loss A.1, respectively. This condition represents a bypass of the containment barrier. This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldown the plant, or to drive an auxiliary (emergency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a FAULTED condition). The inability to isolate the steam flow meets the intent of a loss of containment. Steam releases associated with the expected operation of a SG power operated relief valve or safety relief valve do not meet the intent of this threshold. Such releases may occur intermittently for a short period of time following a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown. Steam releases associated with the unexpected operation of a valve (e.g., a stuck-open safety valve) do meet this threshold. Following an SG tube leak or rupture, there may be minor radiological releases through a secondary-side system component (e.g., air ejectors, gland.seal exhausters, valve packing, etc.). These types of releases do not constitute a loss or potential loss of containment but. should be evaluated using the Recognition Category R ICs. The ECLs resulting from primary-to-secondary leakage, with or without a steam release from the FAULTED SG, are summarized below., I[Document No.] Rev. [X] Page 254 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Affected SG is FAULTED Outside of .Containment? Primary-to-Secondary Yes No Leak Rate Less than or equal to 25 gpm No classification No classification Greater than 25 gpm Unusual Event per SU5.1 Unusual Event per SU5.1 Requires operation of a standby Site Area Emergency per charging (makeup) pump (RCS Alert per FA 1.1 FS1.1 Barrier Potential Loss) Requires an automatic or manual Site Area Emergency per ECCS (SI) actuation (RCS Barrier Alert per FA 1.1 FS1.1 Loss)

Background

The FAULTED criterion establishes an appropriate lower bound on the size of a ste1am release that may require an emergency classification. Steam releases of this size are readily observable with normal Control Room indications. The lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC SU4 for the fuel clad barrier (i.e., RCS activity values) and IC SU5 for the RCS barrier (i.e., RCS leak rate values). FAULTED is a defined term within the NEI 99-01 methodology; this determination is not necessarily dependent upon entry into, or diagnostic steps within, an EOP. For example, if the pressure in a steam generator is decreasing uncontrollably (part of the FAULTED definition) and the FAULTED steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher priority condition, the steam generator is still considered FAULTED for emergency classification purposes. There is no Potential Loss threshold associated with RCS or SG Tube Leakage. DCPP Basis Reference(s):

1. NEI 99-01 RCS or SG Tube Leakage Containment Loss 1.A j [Document No.] Rev. [X] Page 255 of 289 j

( ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold: I [Document No.] Rev. [X] Page 256 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold: I None I [Document No.] Rev. [X] Page 257 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. CSFST Core Cooling-RED path conditions met.

AND Restoration procedures not effective within 15 minutes. (Note 1) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded , or will likely be exceeded . Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions . Basis: ERO Decision Making Information The 15 minute clock starts upon entry into FR-C.1 Response to Inadequate Core Cooling (ref.2). The restoration procedure is considered "effective" if core exit thermocouple readings are decreasing and/or if reactor vessel level is increasing . Whether or not the procedure(s) will be effective should be apparent within 15 minutes. The SM/SEC/ED should escalate the emergency classification level as soon as it is determined that the procedure(s) will not be effective.

Background

Critical Safety Function Status Tree (CSFST) Core Cooling-RED path indicates significant core exit superheating and core uncovery. The CSFSTs are normally monitored using the dedicated SPDS display system (ref. 1). Some of the data is also available on the PPC, but the PPC is for information only The function restoration procedures are those emergency operating procedures that address the recovery of the core cooling critical safety functions. The procedure is considered effective if the temperature is decreasing or if the vessel water level is increasing (ref. 1, 2) . A direct correlation to status trees can be made if the effectiveness of the restoration procedures is also evaluated . If core exit thermocouple (CET) readings are greater than 1,200°F, the Fuel Clad barrier is also lost (see Fuel Clad Loss B.1 ). This condition represents an IMMINENT core melt sequence which, if not corrected, could lead to vessel failure and an increased potential for containment failure. For this condition to occur, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. If implementation of a procedure(s) to restore adequate core cooling is not effective (successful) I [Document No.] Rev. [X] Page 258 of 2891 __ J

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases within 15 minutes, it is assumed that the event trajectory will likely lead to core melting and a subsequent challenge of the Containment Barrier. Severe accident analyses (e.g., NUREG-1150) have concluded that function restoration procedures can arrest core degradation in a significant fraction of core damage scenarios, and that the likelihood of containment failure is very small in these events. Given this, it is appropriate to provide 15 minutes beyond the required entry point to determine if procedural actions can reverse the core melt sequence. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Attachment 2, Core Cooling

2. FR-C.1 Response to Inadequate Core Cooling

3. NEI 99-01 Inadequate Heat Removal Containment Potential Loss 2.A I [Document No.] Rev. [X] Page 259 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: C. CMT Radiation/RCS Activity Degradation Threat: Loss Threshold: None I [Document No.] Rev. [X] Page 260 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: C. CMT Radiation/RCS Activity Degradation Threat:

• Potential Loss Threshold:

1. Containment radiation (RM-30 or RM-31) > 5,000 R/hr.

Definition(s): None

 , Basis:

ERO Decision Making Information The readings are higher than that specified for Fuel Clad barrier Loss C.1 and RCS barrier Loss C.1. Containment radiation readings at or above the containment barrier Potential Loss threshold, therefore, signify a loss of two fission product barriers and Potential Loss of a third, indicating.the need to upgrade the emergency classification to a General Emergency.

Background

Containment radiation monitor readings greater than 5,000 R/hr (ref. 1) indicate significant fuel damage well in excess of that required for loss of the-RCS barrier and the Fuel Clad barrier (ref. 1). Monitors used for this fission product barrier loss threshold are the Containment High Range Radiation Monitors RM-30 and RM-31. These monitors provide indication in the Control Room on PAM 2 with a range of 1R/hr to 1E7 R/hr (ref. 1). The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the associated Fuel Clad Barrier Loss and RCS Barrier Loss thresholds. NUREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this ( condition to exist, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the ECL to a General Emergency. DCPP Basis Reference(s):

1. EP-CALC-DCPP-1602 Containment Radiation EAL Threshold Values

2. NEI 99-01 CMT Radiation I RCS Activity Containment Potential Loss 3.A' I [Document No.] Rev. [X]

• Page 261 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

1. Containment isolation is required.

AND EITHER:

• Containment integrity has been lost based on SM/SEC/ED determination.
• UNISOLABLE pathway from containment to the environment exists.

Definition(s): FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized. UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally. NOTE: If an isolation valve could not be accessed due to local conditions (i.e. high radiation, temperature, etc.) then that would also make a leak unisolable, even though the inaccessible valve could isolate the leak. Basis: ERO Decision Making Information The status of the containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold A.1. First Bullet- Containment integrity has been lost, i.e., the actual containment atmospheric leak rate likely exceeds that associated with allowable leakage (or sometimes referred to as design leakage). Recognizing the inherent difficulties in determining a containment leak rate during accident conditions, it is expected that the SM/SEC/ED will assess this threshold using judgment, and with due consideration given to current plant conditions, and available operational and radiological data (e.g., containment pressure, readings on radiation monitors outside containment, operating status of containment pressure control equipment, etc.). Second Bullet- Conditions are such that there is an UNISOLABLE pathway for the migration of radioactive material from the containment atmosphere to the environment. As used here, the term "environment" includes the atmosphere of a room or area, outside the containment, that may, in turn, communicate with the outside-the-plant atmosphere (e.g., through discharge of a ventilation system or atmospheric leakage). Depending upon a variety of factors, this condition may or may not be accompanied by a noticeable drop in containment pressure. The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or I [Document No.] Rev. [X] Page 262 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream. Leakage between two interfacing liquid systems, by itself, does not meet this threshold. Following the leakage of RCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable (design) containment leakage through various penetrations or system components. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category R ICs.

Background

These thresholds address a situation where containment isolation is required and one of two conditions exists as discussed below. Users are reminded that there may be accident and release conditions that simultaneously meet both bulleted thresholds. Following the release of RCS mass into containment, containment pressure will fluctuate based on a variety of factors; a loss of containment integrity condition may (or may not) be accompanied by a noticeable drop in containment pressure. Refer to the middle piping run of Figure 1 on the following page. Two simplified examples are provided. One is leakage from a penetration and the other is leakage from an in-service system valve. Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure. Another example would be a loss or potential loss of the RCS barrier, and the simultaneous occurrence of two FAULTED locations on a steam generator where one fault is located inside containment (e.g., on a steam or feedwater line) and the other outside of containment. In this case, the associated steam line provides a pathway for the containment atmosphere to escape to an area outside the containment. Refer to the top piping run of Figure 1 on the following page. In this simplified example, the inboard and outboard isolation valves remained open after a containment isolation was required (i.e., containment isolation was not successful). There is now an UNISOLABLE pathway from the containment to the environment. Refer to the bottom piping run of Figure 1 on the following page. In this simplified example, leakage in an RCP seal cooler is allowing radioactive material to enter the Auxiliary Building. The radioactivity would be detected by the Process Monitor. .If there is no leakage from the closed water cooling system to the Auxiliary Building, then no threshold has been met. If the pump developed a leak that allowed steam/water to enter the Auxiliary Building, then the second threshold would be met. Depending upon radiation monitor.locations and sensitivities, this leakage could be detected by any of the four monitors depicted in the figure and cause the first threshold to be met as well. Following the leakage of RCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable containment leakage through various penetrations or system components. Minor releases may also occur if a containment isolation valve(s) fails to close but the containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category R ICs. DCPP Basis Reference(s): I [Document No.] I Rev. [X] Page 263 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

1. NEI 99-01 GMT Integrity or Bypass Containment Loss 4.A I [Document No.] Rev. [X] Page 264 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Figure 1: Containment Integrity or Bypass Examples Auxiliary Building Inside CMT Damper

                                                                                  '                         I

Area '

Monitor ,

                                                                                  ':_ _ _ _ _ _ _ _ _ _ _ _ J Open valve Damper,,,
                                                       '          I

Process '

I

Monitor

                                                       ~--*---

Closed Cooling Water System RCP Seal Cooling [Document No.] Rev. [X] Page 265 of 289

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

2. Indications of RCS LEAKAGE outside of containment.

Definition(s): RCS LEAKAGE - RCS leakage shall be:

a. Identified Leakage

1. Leakage, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leak off), that is captured and conducted to collection systems or a sump or collecting tank;

2. Leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage;

3. Reaqtor Coolant System (RCS) leakage through a steam generator to the secondary system (primary to secondary leakage).

b. Unidentified Leakage All leakage (except RCP seal water injection or leak off) that is not identified leakage.

c. Pressure Boundary Leakage Leakage (except primary to secondary leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

d. RCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Component Cooling Water, or systems that directly see RCS pressure outside containment such as Chemical & Volume Control System, Nuclear Sampling System and Residual Heat Removal system (when in the shutdown cooling mode).

Basis: ERO Decision Making Information The status of the containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold A.1. To ensure proper escalation of the emergency classification, the RCS LEAKAGE outside of containment must be related to the mass loss that is causing the RCS Loss and/or Potential Loss threshold A.1 to be met. ECA-1.2 LOCA Outside Containment (ref. 1) provides instructions to identify and isolate a LOCA outside of the containment. Potential RCS leak pathways outside containment include (ref. 1, 2): --- I [Document No.] Rev. [X] Page 266 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

• Residual Heat Removal
• Safety Injection
• Chemical & Volume Control
• RCP seals
• PZR/RCS Loop sample lines Containment sump, temperature, pressure and/or radiation levels will increase if reactor coolant mass is leaking into the containment. If these parameters have not increased, then the reactor coolant mass may be leaking outside of containment (i.e., a containment bypass sequence). Increases in sump, temperature, pressure, flow and/or radiation level readings outside of the containment may indicate that the RCS mass is being lost outside of containment. \

Unexpected elevated readings and alarms on radiation monitors with detectors outside containment should be corroborated with other available indications to confirm that the source is a loss of RCS mass outside of containment. If the fuel clad barrier has not been lost, radiation monitor readings outside of containment may not increase significantly; however, other unexpected changes in sump levels, area temperatures or pressures, flow rates, etc. should be sufficient to determine if RCS mass is being lost outside of the containment.

                                                  )

I [Document No.] Rev. [X] Page 267 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases The ECLs resulting from primary leakage outside containment (without a Fuel Clad challenge) are summarized below. RCS LEAKAGE Outside Containment ECL

                   < 25 gpm                                           No EGL
    ;o; 2iJ gpm - Charging Pump capacity                               SU5.1
           ;o; Charging pump capacity                     Site Area. Emergency based on:

RCS Potential Loss A.1

                                                                         +

Containment Loss D.2

Background

Refer to the middle piping run of Figure 1 on the following page. In this simplified example, a leak has occurred at a reducer on a pipe carrying reactor coolant in the Auxiliary Building. Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure and cause threshold D.1 to be met as well. DCPP Basis Reference(s):

1. ECA-1.2 LOCA Outside Containment

2. E-1 Loss of Reactor or Secondary Coolant

3. NEI 99-01 CMT Integrity or Bypass Containm.ent Loss I [Document No.] Rev. [X] Page 268 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Figure 1: Containment Integrity or Bypass Examples

                                                             .. - - - - - - - - - - - 1 I                         I Effluent            , . *. <******.~.

• l--~~-n~!~~-.:.::

Auxiliary Building Inside GMT Damper

                                                                                                            ~------------1

Area '

Monitor , J Open valve Closed Cooling Water System RCP Seal Cooling [Document No.] Rev. [X] Page 269 of 289

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

1. CSFST Containment - RED path conditions met(~ 47 psig) .

Definition(s): None Basis: ERO Decision Making Information If containment pressure exceeds the design pressure , there exists a potential to lose the Containment Barrier. As noted in the WOG SAMG and related DCPP implementation documents, to reach this level , there must be an inadequate core cooling condition for an extended period of time; therefore, the RCS and Fuel Clad barriers would already be lost. Thus , this threshold is a discriminator between a Site Area Emergency and General Emergency since there is now a potential to lose the third barrier.

Background

Critical Safety Function-Status Tree (CSFST) Containment-RED path is entered if containment pressure is greater than or equal to 47 psig and represents an extreme challenge to safety function. The CSFSTs are normally monitored using the dedicated SPDS display system . Some of the data is also available on the PPC, but the PPC is for information only (ref. 1). Forty-seven psig is the containment design pressure (ref. 1, 2) and is the pressure used to define CSFST Containment RED path conditions. DCPP Basis Reference(s):

1. F-0 Critical Safety Function Status Trees - Containment, Attachment 5

2. FSAR Appendix 6.2D

3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.A I [Document No.] Rev. [X] Page 270 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

2. Containment hydrogen concentration~ 4%.

Definition(s): None Basis: ERO Decision Making Information The existence of an explosive mixture means, at a minimum, that the containment atmospheric . hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower flammability limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a potential loss of the Containment Barrier.

Background

After a LOCA, the containment atmosphere is a homogeneous mixture of steam, air, solid and gaseous fission products, hydrogen, and water droplets. During and following a LOCA, the hydrogen concentration in the containment results from radiolytic decomposition of water and metal-water reaction. If hydrogen conQentration exceeds the lower flammability limit (4%) in an oxygen rich environment, a potentially explosive mixture e*xists. Operation of the Containment Hydrogen Recombiner with containment hydrogen concentrations greater than 4% could result in ignition of the hydrogen. If the combustible mixture ignites inside containment, loss of the containment barrier could occur. To generate such levels of combustible gas, loss of the Fuel Clad and RCS barriers must also have occurred. Since this threshold is also indicative of loss of both Fuel Clad and RCS barriers with the Potential Loss of the containment barrier, it therefore will likely warrant declaration of a General Emergency (ref. 1, 2, 3, 4). Containment hydrogen concentration is indicated in the Control Room on ANR-82/ANR-83 PAM1, (range: 1 - 10%).

                                                    . (

DCeP Basis Reference(s):

1. UFSAR Section 6.2.5 Combustible Gas Control In Containment

2. FR-Z.4 Response to High Containment Hydrogen Concentration

3. OP-H-9 INSIDE CONT H2 RECOMB SYSTEM

4. CA-3 Hydrogen Flammability in Containment

5. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.B I[Document No.] Rev. [X] Page 271 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

3. Containment pressure ~ 22 psig.

AND Less than one full train of containment depressurization equipment operating per design for ~ 15 minutes. (Note 1, 9) Note 1: The SM/SEC/ED should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded. Note 9: One Containment Spray pump and two CFCUs comprise one full train of depressurization equipment. Definition(s): None Basis: ERO Decision Making Information This threshold describes a condition wbere containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15-minute criterion is included to allow operators time to manually start or restore equipment that may not have, automatically started or actuated as required, if possible. This threshold represents a potential loss of containment in that containment heat removal/depressurization systems (e.g., containment sprays, etc., but not including containment venting strategies) are either lost or performing in a degraded manner.

Background

The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the design bases requirement. Each train includes a containment spray pump, spray headers, nozzles, valves, and piping. The Refueling Water Storage Tank (RWST) \_ supplies borated water to the Containment Spray System during the injection phase of operation. In the recirculation mode of operation, Containment Spray, if needed, is transferred to the RHR Pumps and the Containment Spray Pumps are shut down (ref. 5). The Containment Cooling System consists of two trains of Containment cooling, each of sufficient capacity to supply 100% of the design cooling requirement. Each train, consisting of two Containment Fan Cooling Units (CFCU), is supplied with cooling water from_ a separate loop of Component Cooling Water (CCW). In post accident operation following an actuation signal, the Containment Cooling System fans are designed to start automatically if not already running (ref.5). The Containment pressure setpoint (22 psig, ref. 1, 2, 3, 4) is the pressure at which the equipment should actuate and begin performing its function. The design basis accident I [Document No.] I Rev. [X] I Page 272 of 2891

                                         . ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases analyses and evaluations assume the loss of one Containment Spray System train and one Containment Cooling System train (ref. 5). Consistent with the design requirement, "one full train of depressurization equipment" is therefore defined to be the availability of one train of each system. If less than this equipment is operating and Containment pressure is above the actuation setpoint, the threshold is met if the required equipment cannot be started within 15 minutes.                                                  '

DCPP Basis Reference(s):

1. AR PK01-18, CONTMT SPRAY ACTUATION red

2. F-0 Critical Safety Function Status Trees - Attachment 6, Contai,nment

3. FR-Z.1 Response to High Containment Pressure

4. Technical Specifications Table 3.3.2-1

5. Technical Specifications B3.6.6 Containment Spray and Cooling Systems

6. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.C I [Document No.] Rev. [X] Page 273 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: E. SM/SEC/ED Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates loss of the containment barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems arid components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable intjicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

This threshold addresses any other factors that may be used by the SM/SEC/ED in determining whether the Containment Barrier is lost. I [Document No.] Rev. [X] Page 274 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A I [Document No.] Rev. [X] Page 275 of 2891

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: E. SM/SEC/ED Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the SM/SEC/ED that indicates potential loss of the containment barrier.

Definition(s): IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2): Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures. Basis: ERO Decision Making Information The SM/SEC/ED judgment threshold addresses any other factors relevant to determining iMhe Primary Containment barrier is potentially lost. Such a determination should include IMMINENT barrier degradation, barrier monitoring capability and dominant accident sequences.

• IMMINENT barrier degradation exists if the degradation will likely occur within relatively short period of time based on a projection of current SAFETY SYSTEM performance.

The term "IMMINENT" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and cons.ideration of offsite monitoring results.

• Dominant accident sequences lead- to degradation of all fission product barriers and likely entry to the EOPs. The SM/SEC/ED should be mindful of the Loss of AC power (Station Blackout) and A TWS EALs to assure timely emergency classification declarations.

I [Doc~ment No.] Rev. [X] Page 276 of 2891

ATIACHMENT2 Fission Product Barrier Loss/Potential Loss Matrix and Bases This threshold addresses any other factors that may be used by the SM/SEC/ED in determining whether the Containment0 Barrier is lost.

Background

None DCPP Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Potential Loss 6.A I [Document No.] Rev. [X] Page 277 of 2891

ATIACHMENT3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

Background

NEI 99-01 Revision 6 ICs AA3 and HA5 prescribe declaration of an Alert based on IMPEDED access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal planfoperations, cooldown or shutdown is located. These areas are intended to be plant operating mode dependent. Specifically the Developers Notes For AA3 and HA5 states: The "site-specific list of plant rooms or areas with entry-related mode applicability identified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, coo/down and shutdown. Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry'wou/d be required for each room or area. The list should not include rooms or areas for which entry is required solely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections). Further, as specified in IC HA5: The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas. *

• Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.

Analysis OP L-4, Normal Operation at Power (rev 89/73) was reviewed to determine if any actions are

  . "necessary" to maintain power operations. Over reasonable periods of time (days vice months or years) there are no actions outside the Control Room that are required to be performed to maintain normal operations. Eventually, you would have to shut down if Technical Specification surveillance testing was not completed and you complied with the associated LCOs or based on consumable supplies being depleted. For the purpose of this table, no actions were determined to be required.                -

The following table lists the locations into which an operator may be dispatched in order perform a normal plant cool down and shutdown. The review was completed using the following procedures as the controlling documents: '\ OP L-4, Normal Operation at Power (rev 89/73) -

• Sections 6.3 (Instructions for Power Decreases from 100% to 50%)
• Section 6.4 (Instructions for Power Reduction From 50% to 20%)

OP L-5, Plant Cooldown From Minimum Load to Cold Shutdown (rev 100/83) OP L-7, Plant Stabilization Following Reactor Trip (rev 24/22) I [Document No.] I Rev. [X] I Page 278 of 2891 L

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases OP AP-25, Rapid Load Reduction or Shutdown (rev 25/12) In addition, the Residual Heat Removal System is aligned per OP B-2:V "RHR - Place In Service" (rev 37/36) which was also used to conduct this review. At DCPP, RCS Cooldown starts at OP L-5 step 6.2.3.m. Each step in the controlling procedures was evaluated to determine if the action was performed in the Control Room or in the plant. Each in-plant action listed below was evaluated and a determination made whether or not the actions, if not performed, would prevent achieving cold shutdown. The following generic assumptions were applied:

• Steps involving optional degassing of the RCS were not selected since degassing the RCS is not required to reach cold shutdown.
• Steps involving supplying Auxiliary Steam were not selected since AFW can be used to reach cold shutdown if Condenser vacuum is lost.
• Steps involving Main Feed Water Pumps were not selected since AFW can be used to reach cold shutdown if Main Feed Water is not available.
• Steps that are stated as needed when entering an outage are disregarded, as they are optional and not mandatory for placing plant in Cold Shutdown.

Travel paths to the locations where the equipment is operated are not part of the determination of affected room/area, OfllY the rooms/areas where the equipment is actually operated. Most locations can be reached via alternate travel paths if required due to a localized issue. No assumption is made about which RHR Train is aligned for operation. The minimum set of in-plant actions, associated locations, and operating modes to shut down and cool down the reactor are highlighted. The locations where those actions are performed comprise the rooms/areas to be included in EAL Tables R-2 and H-2. Specifically, the identified roonis are those where an activity must be performed to borate to cold shutdown,

• isolate accumulators or cooldown using RHR.

UFSAR Page 6.4-1 states "The DCPP control room, located at elevation 140 feet of the auxiliary building, is common to Unit 1 and Unit 2. The associated habitability systems provide for access and occupancy of the control room during normal operating conditions, radiological-emergencies, hazardous chemical emergencies, and fire emergencies." UFSAR Page 6.4-9 states "There are no offsite or onsite hazardous chemicals that would pose a credible threat to DCPP control room habitability. Therefore, engineered controls for the control room are not required to ensu~e habitability against a hazardous chemical threat and 1 no amount of assumed unfiltered in-leakage is incorporated into PG&E's hazardous chemical

• assessment."

Control room habitability relative to area radiation levels is adequately bounded by EAL RA2.3. I [Document No.] Rev. [X] Page 279 of 2891

• ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/

shut down? OP L-4, Section 6.3: Instructions for Power Decreases from 100% to 50% OP L-4, Section 6.4: Instructions for Power Reduction From 50% to 20% OP L-4 Initiate RCS degassing as directed Aux/1 OD/various 1 No 6.3.3.b.2 by chemistry PER OP B-1A:Vlll, "Reactor Coolant System Degassing During a Plant Shutdown" OR OP B 1A:X, "CVCS - VCT Degassing." OP L-4 IF either cylinder heating steam TB/104 1 No 6.3.3.I I 6.3.4.e pressure controller is i.n "MANUAL," THEN direct Turbine Building Watch to maintain cylinder heating pressure during the ramp PER OP C-3A: I, "Sealing Steam System - Place In Service." OP L-4 As power decreases, direct Nuclear TB/119 1 No 6.3.3.n Operators to adjust SGBD flows PER OP D-2:V, "Steam Generator Slowdown System - Place in Service." OP L-4 Direct operator in the field to open TB/85 1 No 6.3.3.r.6 I discharge vent to condenser valve 6.3.4.n.4 on condensate pump that was just shut down:

• CND PP 1-1: CND-1-31
• CND PP 1-2: CND-1-32
• CND PP 1-3: CND-1-33 OP L-4 WHEN less than 60% power, AND Intake 1 No 6.3.3.s I 6.3.4.i IF desired, THEN shut down one of the two running Circulating Water Pumps PER OP E-4:111, "Circulating Water System Shutdown and Clearing."

OP L-4 IF shutdown of MFW pump is TB/85 1 No 6.3.3.t.4 I required, 6.3.4.h.4 THEN complete shutdown PER OP C-8:111, "Shutdown and Clearing of a Main Feed Water Pump." OP L-4 IF condenser is to be cleared upon TB/104 1 No 6.3.4.j reaching MODE 3, THEN consider AB/100/Pen realigning TDAFWP steam traps PER appropriate steps in OP L-5, "Plant Cooldown from Minimum Load to Cold Shutdown," section for "Secondary Plant Shutdown." I[Document No.] Rev. [X] Page 280 of 2891

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? OP L-4 Direct Aux Watch to transfer aux AB/140 1 No 6.3.4.k steam supply to U2 PER OP K-5:1V "Auxiliary Steam System - Change Over to Alternate Supply of Steam." OP L-4 IF NOT already performed, THEN TB/85 1 No 6.3.4.1 swap the Hydrazine injection points to the alternate alignment (downstream of FCV-232) per OP D-2:11, "Main Feed Water Chemical Injection System - Place in Service." OP L-4 IF unit is NOT being taken off line TB/104, 85 & 70 1 No 6.3.4.m.2.a for OP L-8, "Separating From the Grid While Maintaining Reactor Power Between 17% and 30%"), THEN shut down No. 2 Heater Drip Pump PER OP C-7B:ll, "No. 2 Heater Drip Pump Shutdown and Clearing." OP L-4 On the MFW pump in service, TB/85 1 No 6.3.4.t locally place the HP and LP Stop Valves Drain control switch to the "OPEN" position to open the before-seat drains. OP L-5 Section 6.1.3: Power Decrease from 20% to MODE 3 with Normal Shutdown OP L-5 Section 6.1.4: Power Decrease from 20% to MODE 3 with Planned Reactor Trip OP L-5 IF Containment is to be entered, Pen/100 1 No 6.1.3.d.2 THEN Notify Chemistry to perform Containment air sampling. OP L-5 Place AFW chemical injection in AB/100 1 No 6.1.3.m.13/ service PER OP D-2:1, "Auxiliary 6.1.4.t Feed Water Chemical Injection System - Place In Service." OP L-5 IMPLEMENT Section 10 to open TB 1/2/3 See step by step 6.1.3.q FW-1-FCV-420 to prevent the FWH analysis of Section 1O outlet relief from lifting. OP L-5 IMPLEMENT step 11.5 for TB 1/2/3 See step by step 6.1.3.s secondary shutdown. analysis of Section 11 OP L-5 Shut down both MFW pumps PER TB 213 No 6.1.3.w.8 I 6.1.4. u OP C-8:111, "Shutdown and Clearing of a Main Feed Water Pump." OP L-5 IF desired, THEN shut down the Area H/100 3 No 6.1.3.y.5 / 6.1.4.w MG sets PER OP A-3:111, "Control Rod System - Shutdown & Clearing." I [Document No.] Rev. [X] Page 281_of2891

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shutdown? OP L-5 Initiate boration to the final AB 100/115/East 2/3 Yes- basis of location 6.1.3.aa I concentration for the mode to which End (BAST & BA is the ability to refill the 6.1.4.e.1 the plant is to be shut down PER Pumps), 85' (Aux BAST in order to have one of the following Control Board), 64' sufficient boric acid to

                      * (Preferred) OP B-1 A:XIX, "CVCS      (BART Tank area)            reach CSD
                        - Borate the RCS to Refueling                                    concentration. Cool Concentration"                                                   down below 500°F
                      * (Alternate) OP B-1A:Vll, Section                                 requires 11000 gallons 6.12, "Emergency Boration using                                  of boric acid be added CVCS-1-8104"                                                     (see step 6.2.3.d)
                      * (Alternate) OP B-1A:Vll, Section 6.3, "Routine Boration" OP L-5              IF anticipated that the RCS will be     AB/100               2/3    No 6.1.3.bb I 6.1.4.x  opened and degassing of the RCS has not been started, THEN initiate degassing of the RCS to reduce H2 concentration to 5 cc/kg or less PER OP B-1A:Vlll, "CVCS -

Reactor Coolant System Degassing During a Plant Shutdown." OP L-5 Maintenance to perform STP M- Various 1/2/3 No 6.1.3.ee I 6.1.4.z 17B2, "Functional Test of Emergency DC Lighting System in Containment." OP L-5 Ensure SGBD is maximized PER TB/119 1/2/3 No 6.1.3.gg I Chemistry direction and within the 6.1.4.bb ability to control RCS temperature. OP L-5 section 6.2: MODE 3 to Ready for RHR Operation OP L-5 Place the personnel airlock AB/140 3 No 6.2.3. automatic leak rate monitor (ALRM) in manual PER STP M-8F1, "ALRM Leak Rate Testing of Personnel Air Lock Seals," to avoid nuisance alarms in the Control Room. OP L-5 Borate the RCS to meet STP R-19 AB 100/115/East 3/4 Yes- basis of location. 6.2.3.e.2 COLD SHUTDOWN requirements. End (BAST & BA is the ability to refill the Pumps), 85' (Aux BAST in order to have Control Board), 64' sufficient boric acid to (BART Tank area) reach CSD concentration. (See Caution prior to step). TS 3.1.1 OP L-5 Close the accumulator isolation Area H/100/480V 3/4 Yes- basis is that 6.2.3.s valve breakers Buses without closing

• Sl-1-8808A: breaker 52-1F-46 Accumulator outlet
• Sl-1-8808B: breaker 52-1 G-07 valves, RCS pressure
• Sl-1-8808C: breaker 52-1 H-14 cannot go below -650 I [Document No.] Rev. [X] Page 282 of 2891

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down?

• Sl-1-88080: breaker 52-1 G-05 psig (procedure does not address alternate actions)

TS 3.5.1 OP L-5 WHEN desired, THEN secure the Area H/100/480V 3/4 No 6.2.3.y CROM fans PER OP H-6:11, "CROM Buses Fans - Shutdown and Clearing." OP L-5 Disable BOTH SI Pumps PER OP TB/119/4kV Vital 3/4 No - ECG 8.6 violation, 6.2.3.cc.1.b 0-32,"Gontrol of Refueling Tags." Bus Rooms but does not prevent getting to CSD OP L-5 Disable ONE ECCS centrifugal TB/119/4kV Vital 3/4 No - ECG 8.6 violation, 6.2.3.cc.2.b charging Bus Rooms but does not prevent pump PER OP 0-32, "Control of getting to CSD Refueling Tags." OP L-5 section 6.3: Placing RHR in Service to C,SD, Bubble in PZR OP L-5 Place RHR system in service PER 3/4 See step by step 6.3.3.b.4 OP B-2:V, "RHR-Place in Service analysis of OP B-2:V During Plant Cooldown." OP L-5 Place tags on RHR suction valves Area H/100/480V 3/4 No - This is only a tag 6.3.3.b.6 (RHR-1-8701 and RHR-1-8702) Buses hanging step. Actual breakers PER OP 0-32, "Control of breaker manipulation is Refueling Tags." in OP B-2:V steps 6.2.12 I 6.3.12 OP L-5 Perform the following actions for AB/73/CCP3 room 4 No - ECG 8.1 violation, 6.3.3.d.1 CCP 1-3: Establish fire watch but does not prevent compensatory actions per ECG 8.1. getting to CSD OP L-5 Perform the following actions for TB/119/4kV Vital 4 No - ECG 8.1 violation, 6.3.3.d.2 CCP 1-3: No more than one hour Bus Rooms but does not prevent prior to reducing any WR RCS getting to CSD TCOLD to 283°F, make CCP 1-3 incapable of injecting. OP L-5 Hang the RCS Dilution Flow Path AB/100 4 No 6.3.3.h Boundary valve tags PER OP 0-32, "Control of Refueling Tags." OP L-5 Section 1O: Condensate System Long Recirc 10.2 Ensure CLOSED FW-1-383, FCV- TB/85 3/4 No 420 Downstream Isolation. 10.3 Ensure CLOSED FW-1-384, FCV- TB/85 3/4 No 420 Downstream Isolation Bypass 10.4.1 Open FW-1-210, FW-1-211 TB/85 3/4 No Bypass. 10.4.2 Open FW-1-211 TB/85 3/4 No 10.4.3 Close FW-1-210 TB/85 3/4 No I [Document No.] Rev. [X] Page 283 of 2891

ATIACHMENT3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? 10.6 Ensure a minimum of four polisher TB/85 3/4 No vessels in service until long recirc is established. 10.8.2 IF the temperature interlock is NOT TB/85 3/4 No made up, THEN contact Maintenance to open FW-1-FCV-420 by installing an air jumper with a 50 psig air supply connected to the vent side of SV1420. 10.9 Coordinate with the Control Room TB/85 3/4 No and very slowly open FW-1-384 until the onset of FWH flashing, then throttle clos_ed until it stops 10.12 Slowly begin to open FW-1-383. If TB/85. 3/4 No FWH flashing occurs, then throttle closed until it stops. 10.14 Close FW-1-384. TB/85 3/4 No OP L-5 Section 11: Secondary System Shutdown 11.2.2.a Perform the following to prepare TB/104 3/4 No - If steam traps steam line drains for closing the cannot be re-aligned MSIVs: Align valves for steam traps declare AFW Pump 1 1, 2, 3 and 5 steam line drains. INOPERABLE. 11.2.2.b Align AFW Pump 1-1 and Main TB/104 & Pen/100 3/4 No - If steam traps Steam Traps 1, 2, 3 and 5 to the cannot be re-aligned Outfall declare AFW Pump 1 INOPERABLE. 11.2.3 Connect hoses for AFW chemical AB/100/AFW room 3/4 No injection PER OP D-2:1V, "Adding Chemicals to Chemical Day Tanks-AFW System." 11.2.5 IF desired, THEN secure and clear Intake 3/4 No a CWP PER OP E-4:111, "Circulating Water System Shutdown and Clearing." 11.2. 7 IF th~ Main Generator is to be TB/104 3/4 No depressurized and purged, THEN warm up the C02 vaporizer PER OP J-4C:lll, "Generator Hydrogen System-Remove From Service." 11.3 Just prior to separating from grid, TB/119 3/4 No drain MSR drain tanks and FW heaters PER OP C-7:111, "Condensate System - Shutdown and Layup." 11.5.2 .. IF relatching the Main Turbine is TB/140 3/4 No - If Cooldown j [Document No.] Rev. [X] Page 284 of 289 j

r - ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure 'and Building/ performed, does this Step Action *Mode Step Elevation/Room prevent cool down/ shut down? needed to control plant cool down, control is an issue then 35016 THEN perform the following:T MSIVs can be closed

a. Close AIR-1-1-2489, Air Supply to the Air/Oil Relay.

b. Isolate EH to the governor valves:

EH-1-518, for FCV-139 EH-1-519, for FCV-140 EH-1-520, for FCV-141 EH-1-521, for FCV-142 11.5.3.b Align the MSRs as necessary PER TB/119 & 104 3/4 No OP C-5:111, "Moisture Separator Reheaters - Shutdown." 11.5.5 IF desired, THEN back feed the unit Various 3/4 No from 500kV PER OP J-2:V, "Back feeding the Unit from the 500kV System." 11.5.7 Secure and drain SCCW PER OP TB/85 3/4 No J-4A:lll, "Generator Stator Cooling Water-Shutdown and Draining." 11.6.1 Depressurize and purge the Main TB/140 & 119 3/4 No Generator PER OP J-4C:lll, "Generator Hydrogen System-Remove from Service." 11.6.2 Secure SCW to exciter air coolers TB/104 3/4 No 11.7.6 Remove polishers from service TB/85 & 3/4 No PER OP C-7C:ll, "Condensate 104/Polishers Polishing System-Remove Demineralizers from Service," as directed by the Secondary Foreman. 11.7.8 Open CND-1-506 to break vacuum. TB/119 3/4 No 11.7.9 Maintenance to remove RM-15 and TB/104 3/4 No RM-15R from service. 11.7.10 Secure gland steam and cylinder TB/104 & 140 3/4 No heating steam PER OP C-3A:lll, "Sealing Steam System-Shutdown and Clearing. 11.7.11 Secure condenser air removal PER TB/104 3/4 No OP C-6:111, "Condenser and Air Removal System-Shutdown and Clearing." 11.7.12 Secure the following PER OP C- TB/119 & 140 3/4 No

   \                   6C:ll, "Condensate Air and Nitrogen ..

Injection - Remove from Service:" j [Document No.] Rev. [X] Page 285 of 2891

ATIACHMENT3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down?

                    .. N2 injection Air injection 11.7.14.b         Secure chemical injection PER OP       TB/85             3/4    No D-2:11, "Main Feed Water Chemical Injection-Place in Service."

11.7.15 Isolate condensate reject PER OP TB/85 3/4 No C-7:111, "Condensate System-Shutdown and Layup" (LCV-12). 11.11.1 Secure turning gear PER OP C- TB/140 3/4 No 3:1V, "Main Unit Turbine-Turbine Shutdown." 11.11.2 Shut down lube oil PER OP C- TB/85, 104 & 119 3/4 No 3B:lll, "Lube Oil Distribution System-Shutdown and Clearing." 11.11.4 Shut down H2 Seal Oil System TB/85 3/4 No PER OP J-4B:ll, "Hydrogen Seal Oil System-Shutdown and Drain." 11.12 WHEN the RCS is at or below TB/119 & AB/140 3/4 No 350°F, THEN remove locking devices on the following SGBD throttle valves and open them to achieve maximum blowdown OP B-2:V: RHR - Place In Service 6.1.5 Shift chemistry/radiation protection AB/100/PSSS 4 No - Basis is the system technician to sample RHR Loop 1-1 is aligned for ECCS to determine RHR Loop 1-1 boron Mode from the RWST. concentration. In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.10 Shift chemistry/radiation protection AB/100/PSSS 4 No - Basis is the system technician to sample RHR Loop 1-2 is aligned for ECCS to determine RHR Loop 1-2 boron Mode from the RWST. concentration. In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.13.b/6.2.27 I Open RHR-1-8734A, RHR System Pen/85 4 No - Basis is the system 6.2.43 1-1 Bypass to Letdown Heat is aligned for ECCS Exchanger Inlet (85' Containment Mode from the RWST. Penetration Area). In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.13.i Chemistry to sample RHR Loop 1-1 AB /100/PSSS 4 No - Basis is the system at aooroximatelv 10 mihute is aliqned for ECCS I [Document No.] Rev. [X] Page 286 of 2891

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? intervals until the boron Mode from the RWST. concentration is equal to or greater In the event of an SI, we than that in the RCS. do not verify boron concentration prior to injecting. 6.1.13.1/6.2.36.b Close RHR-1-8734A, RHR System Pen/85 4 No 1-1 Bypass to Letdown Heat Exchanger Inlet. 6.1.13.q I Open RHR-1-8734B, RHR System Pen/85 4 No - Basis is the system 6.2.36.a / 6.3.8 1-2 Bypass to Letdown Heat is aligned for ECCS Exchanger Inlet (85'Containment Mode from the RWST. Penetration Area). In the event of an SI, we do not verify boron concentration prior to injecting. 6.1.13.u Chemistry to sample the RHR loop AB /100/PSSS 4 No - Basis is the system at approximately 10 minute is aligned for ECCS intervals until the boron Mode from the RWST. concentration of RHR loop 1-2 is In the event of an SI, we equal to or greater than that in the do not verify boron RCS. concentration prior to injecting. 6.1.13.w/6.2.18 Close RHR-1-8734B, RHR System Pen/85 4 No 1-2 Bypass to Letdown Heat Exchanger Inlet. **. \ 6.2.9 / 6.3.9 Open RHR-1-8726A, RHR Heat AB/64/RHR 4 No - This keeps the Exchanger 1-1 Bypass (64' pumps hallway RHR trains split but elevation Auxiliary Building). does not prevent cool down. 6.2.10 / 6.3.10 Open RHR-1-8726B, RHR Heat AB/64/RHR 4 No - This keeps the Exchanger 1-2 Bypass (64' pumps hallway RHR trains split but elevation Auxiliary Building). does not prevent cool down. 6.2.12 / 6.3.12 Ensure CLOSED the breakers for Area H/100/480V 4 Yes - required to align the following valves: Buses RHR system

• 52-1F-31, MOV 8980
• 52-1G-25, MOV 8701
• 52-1H-19, MOV 8702 OP L-7, Plant Stabilization Following Reactor Trip 6.5.2 lE a Circulating Water pump was Intake 3 No tripped, THEN REFER TO OP E-4:111, Circulating Water System -

Shutdown and Clearing, for cleanup actions. 6.5.3 lE no Circulating Water pump can TB/various 3 No be placed in service, THEN cool I [Document No.] Rev. [X] Page 287 of 289 j

ATIACHMENT3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases If action not Procedure and Building/ performed, does this Step Action Mode Step Elevation/Room prevent cool down/ shut down? down a hot condenser in accordance with AP-7, Attachment 1 6.10.7 Align SG Slowdown via the TB/119 & Pen/100 3 No Slowdown Tank per OP D-2:V for SG chemistry and RCS temperature control. 6.11.4 Condensate Polisher Beds aligned TB/104/Polisher 3 No per Secondary Foreman direction. 6.12.2.i Open FW-1-FCV-420 TB/104 3 No 6.12.2.j Coordinate with the Control Room TB/85 3 No and ve!Y slowl~ OPEN FW-1-384 6.12:2.k Very slowly OPEN FW-1-383. TB/85 3 No 6.12.2.1 Close FW-1-384 TB/85 3 No 6.13.2.b Realign steam traps 1, 2, 3, and 5 I TB/104 3/4 No - If steam traps steam line drains cannot be re-aligned declare AFW Pump 1 INOPERABLE. 6.13.2.c & d Align AFW Pump 1-1 and Main TB/104 & Pen/100 3/4 No - If steam traps Steam Traps 1, 2, 3 and 5 to the cannot be re-aligned Outfall declare AFW Pump 1 INOPERABLE. 6.13.3 Align Auxiliary and Gland Seal TB/104 & AB/100 3/4 No steam as desired per OP C-3A:I. 6.14.2 lfdesired to control plant cool TB/140* 3/4 No - If cooldown down, relatch the Main Turbine as control is an issue then follows: MSIVs can be closed

a. Close AIR-1-1-2489, Air Supply to the Air/Oil Relay.

b. Isolate EH to the governor valves:

                    . EH-1-518,   for FCV-139
                    . EH-1-519,   for FCV-140
                    . EH-1-520, EH-1-521, for for FCV-141 FCV-142 6.15              IF desired, THEN back feed the unit   Various           3/4   No from 500kV PER OP J-2:V, "Back feeding the Unit from the 500kV System."

6.31 On the 4kV vital buses, reset TB/119/4kV Vital 3/4 No dropped flags on undervoltage Bus Rooms relays 27HFB1, 27HGB1 and 27HHB1. OP AP-25, Rapid Load Reduction or Shutdown I [Document No.] Rev. [X] Page 288 of 2891

ATIACHMENT3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases )

                                                                                  . If action not Procedure and                                                Building/             performed, does this Step Action                                Mode Step                                               Elevation/Room           prevent cool down/
                          .,                                                         shut down?

7.a RNO el WHEN plant conditions permit, TB/85 1/2/3 No 14.f.4 / 20.c.4 THEN swap Condensate Pump \ vents PER OP C-7A:I. Table R-2 & H~2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode(s) Auxiliary Building - 115' - BASTs 2, 3,4 Auxiliary Building - 100' - BA Pumps 2,3,4 Auxiliary Building - 85' - Aux Control Board 2, 3,4 Auxiliary Building -:--64' - BART Tank area 2, 3,4 Area H (below Control Room) - 100' 480V Bus area/rooms 3,4 I [Document No.] Rev. [X] Page 289 of 2891}}