LIC-09-0004, License Amendment Request (LAR) 09-01, Steam Generator Blowdown Isolation Operability and Testing Requirements

License Amendment Request (LAR) 09-01, Steam Generator Blowdown Isolation Operability and Testing Requirements

ML090340536
Person / Time
Site:	Fort Calhoun
Issue date:	01/30/2009
From:	Clemens R Omaha Public Power District
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LIC-09-0004
Download: ML090340536 (32)

Text

Bupp

"*m m Omaha Public Power District 444 South 16th Street Mall Omaha NE 68102-2247 LIC-09-0004 January 30, 2009 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001

References:

1. Docket No. 50-285

2. Letter from NRC (A. B. Wang) to OPPD (R. T. Ridenoure), "Fort Calhoun Station, Unit No. 1 - Issuance of Amendment Re: Loss of Main Feedwater Event Analyses as Documented in the Updated Safety Analysis Report, Section 14.10 (TAC No. MC7524)," dated September 11, 2006 (NRC 0126) (ML062280476)

SUBJECT:

Fort Calhoun Station (FCS) Unit No. 1, License Amendment Request.

(LAR) 09-01, Steam Generator Blowdown Isolation Operability and Testing Requirements Pursuant to 10 CFR 50.90, the Omaha Public Power District (OPPD) hereby requests changes to the Fort Calhoun Station (FCS), Unit No. 1, Renewed Operating License No.

DPR-40, adding operability and surveillance testing requirements to the FCS Technical Specifications (TS) for the steam generator (SG) blowdown isolation on a reactor trip. This will allow FCS to credit an automatic SG blowdown isolation interlock being installed during the 2009 Refueling Outage (RFO).

During the 2009 RFO, OPPD plans to install a modification to the SG blowdown isolation valves to automatically close the valves during a loss of main feedwater (LMFW) event.

This modification adds automatic blowdown isolation following an LMFW. An interlock, which isolates SG blowdown following a reactor trip, will be added to the control circuits for SG blowdown isolation valves HCV-1387A, HCV-1388A, HCV-1387B, and HCV-1388B.

The current Updated Safety Analysis Report (USAR), Chapter 14, accident analysis for the LMFW event credits manual action for isolation within 15 minutes of an LMFW event.

(This 15-minute manual action was requested by OPPD and subsequently approved by the Nuclear Regulatory Commission in Reference 2.) Automatic isolation will ensure that the 15-minute requirement is met without the risk that an unanticipated distraction could prevent manual action from occurring at the proper time. The installation of this automatic feature eliminates the need for manual isolation of blowdown and thus will eliminate the associated operator challenge. The manual isolation capability is being maintained and the operator's ability to manually isolate blowdown remains unchanged by this activity.

Employment with Equal Opportunity

U. S. Nuclear Regulatory Commission LIC-09-0004 Page 2 The proposed changes will revise TS Limiting Conditions for Operation (LCO) 2.15, Instrumentation and Control Systems, Table 2-4, Instrument Operating Conditions for Isolation Functions, to include operability requirements for SG blowdown isolation on a reactor trip and to add applicable footnotes. In addition, TS 3.1, Instrumentation and Control, Table 3-2, Minimum Frequencies for Checks, Calibrations and Testing of Engineered Safety Features, Instrumentation and Controls, is being revised to include the surveillance test requirements for SG blowdown isolation on a reactor trip.

An administrative change is also being made to TS LCO 2.15(1), to delete the words "key operated" as the "key" associated with the bypass switches is not a critical element in controlling the use of bypass switches. The actual physical positions of bypass switches are administratively controlled through procedural guidance. The physical key operation of the bypass switches does not impact the actual TS action for the LCO which remains the same with this proposed change.

The associated TS Basis for TS 2.15 is also being revised to reflect the operation of the SG blowdown isolation function. This TS Basis Change (TSBC) is included for information only and will be processed in accordance with TS 5.20.

OPPD requests approval of the proposed amendment by September 30, 2009. Once approved,,the amendment shall be implemented prior to startup from the 2009 RFO, which is scheduled to commence on November 1, 2009.

There are no regulatory commitments associated with this proposed change.

In accordance with 10 CFR 50.91, a copy of this application, with attachments, is being provided to the designated State of Nebraska official.

If you should have any questions regarding this submittal or require additional information, please contact Mr. Bill R. Hansher at 402-533-6894.

I declare under penalty of perjury that the foregoing is true and correct. Executed on January 30, 200 ic rd P. Clemens Division Manager Nuclear Engineering

Enclosure:

OPPD's Evaluation of the Proposed Change(s) c: E. E. Collins, NRC Regional Administrator, Region IV A. B. Wang, NRC Project Manager J. D. Hanna, NRC Senior Resident Inspector Director of Consumer Health Services, Department of Regulation and Licensure, Nebraska Health and Human Services, State of Nebraska

LIC-09-0004 Enclosure Page 1 Omaha Public Power District's Evaluation of the Proposed Change(s)

Subject:

Steam Generator Blowdown Isolation Operability and Testing Requirements 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedent 4.3 Significant Hazards Consideration 4.4 Conclusions

6.0 REFERENCES

ATTACHMENTS:

1. Technical Specification Pages Markups

2. Technical Specification Basis Page Markups,- For Information Only

3. Retyped ("Clean") Technical Specifications

4. Retyped ("Clean") Basis Page - For Information Only

LIC-09-0004 Enclosure Page 2 1.0

SUMMARY

DESCRIPTION This letter is a request to amend Renewed Operating License No. DPR-40 for Fort Calhoun Station (FCS), Unit No. 1.

The Omaha Public Power District (OPPD) proposes to revise Technical Specification (TS) Limiting Conditions for Operation (LCO) 2.15, Instrumentation and Control Systems, and surveillance requirement TS 3.1, Instrumentation and Control, to provide operability and surveillance testing requirements for the steam generator (SG) blowdown isolation on a reactor trip in the event of a loss of main feedwater (LMFW). Specifically, TS 2.15, Table 2-4, Instrument Operating Conditions for Isolation Functions, is being revised to include operability requirements for SG blowdown isolation on a reactor trip. TS 3.1, Table 3-2, Minimum Frequencies for Checks, Calibrations and Testing of Engineered Safety Features,Instrumentation and Controls, is being revised to include the surveillance requirements for SG blowdown isolation on a reactor trip.

In addition, OPPD proposes an administrative change to TS LCO 2.15(1), deleting the words "key operated" as the "key" associated with the bypass switches is not a critical element in controlling the use of bypass switches. The position of bypass switches is controlled through procedural guidance and the key is only necessary to position the switch. The key operation of the bypass switches does not impact the actual TS action for this LCO which remains the same with this proposed change.

In preparation for the installation of replacement SGs in 2006, an analysis was prepared for the LMFW scenario which concluded that it is necessary to isolate SG blowdown within 15 minutes of a reactor trip in order to meet required success criteria. This 15-minute blowdown isolation function is met through operator action in accordance with Emergency Operating Procedures (EOPs) since there currently is no automatic isolation in the event of an LMFW. This manual action was previously approved by the Nuclear Regulatory Commission (NRC) in License Amendment No. 242 (Reference 6.6).

The current Updated Safety Analysis Report (USAR), Chapter 14 Accident Analysis for the LMFW credits manual action for isolation within 15 minutes of an LMFW event. Automatic isolation will ensure that the 15-minute requirement is met without the risk that an unanticipated distraction could prevent manual action from occurring at the proper time. The installation of this automatic feature will eliminate the need for manual isolation of blowdown and thus will eliminate the associated operator challenge. The manual isolation capability is being maintained and the operator's ability to manually isolate SG blowdown remains unchanged by this activity.

During the 2009 refueling outage (RFO), OPPD plans to install an interlock to the SG blowdown isolation valves to automatically close the valves during the LMFW event. Engineering change (EC) 37112 (Reference 6.7) will add the interlock, which actuates SG blowdown following a reactor trip, to the control circuits for SG

LIC-09-0004 Enclosure Page 3 blowdown isolation valves HCV-1387A, HCV-1388A, HCV-1387B, and HCV-1388B.

Approval of this proposed license amendment request (LAR) will allow OPPD to credit (in accordance with these TS changes) this automatic SG blowdown isolation interlock being installed during the 2009 RFO via EC 37112 (Reference 6.7).

2.0 DETAILED DESCRIPTION During the 2009 RFO, OPPD plans to install a modification to the SG blowdown isolation valves to automatically close the valves during an LMFW event.

Modification (EC 37112, Reference 6.7) will add automatic SG blowdown isolation following an LMFW by adding an interlock, which isolates SG blowdown following a reactor trip, to the control circuits for SG blowdown isolation valves HCV-1387A, HCV-1388A, HCV-1387B, and HCV-1388B. Because this is a new automatic feature, the TS currently contain no provision for testing of the interlock nor do the TS contain operability requirements for the interlock.

The proposed TS changes are as follows:

" TS 2.15(1) is being administratively changed to remove the words "key operated." This is an administrative change as the "key" associated with bypass switches is not a critical element in controlling the use of bypass switches. The position of bypass switches is controlled through procedural guidance and the key is only necessary to position the switch. The key operation of the bypass switches does not impact the actual TS action for this LCO which remains the same with this proposed change.

" TS 2.15, Table 2 Items 4A and 4B are being added to include the operability requirements for SG blowdown isolation on a reactor trip.

" TS 2.15, Table 2 Footnote (h) is added to document that the minimum operable channels for steam generator blowdown isolation refers to the minimum number of trains (logic subsystems) which are installed to provide automatic SG blowdown isolation. This is being done to provide clarification since TS 2.15, for the most part, refers to initiation channels, whereas SG blowdown isolation refers to actuation logic trains.

" TS 2.15, Table 2 Footnote (i) is added to document that with both trains A and B inoperable, power operation may continue provided at least one SG blowdown isolation valve for each SG is closed OR be in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 3 in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. TS LCOs 2.15(3), 2.15(4), and 2.0.1 are not applicable. (This proposed change is aligned with the current TS LCO 2.5(1)C.

for AFW operability.)

LIC-09-0004 Enclosure Page 4 e TS 2.15, Table 2 Footnote (j) is added to document that if one train becomes inoperable, that train may be placed in the bypassed condition. If the train is not returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery of loss of operability, power operation may continue as long as one SG blowdown isolation valve to each SG is closed. If the train is not returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery, with blowdown not isolated to both SGs, be in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 3 in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. TS 2.15(1) and 2.0.1 are not applicable. (This proposed change is aligned with the current TS LCO 2.5(1)C. for AFW operability.)

• TS 3.1, Table 3 Items 25 and 26 are added to include surveillance testing requirements for SG blowdown isolation on a reactor trip. Testing (CHANNEL FUNCTIONAL TEST) to ensure operability of the interlock will be performed on a refueling outage frequency, consistent with the current testing frequency for other interlocks that perform similar type functions.

• TS Basis for TS 2.15 is being revised to provide verbiage addressing the automatic SG blowdown isolation on a reactor trip. This TS Basis Change (TSBC) is attached for information only and will be processed in accordance with TS 5.20.

In preparation for.the installation of replacement SGs in 2006, an analysis was prepared for an LMFW scenario which concluded that it is necessary to isolate SG blowdown within 15 minutes of a reactor trip in order to meet required success criteria. This 15-minute blowdown isolation function is met through operator action in accordance with Emergency Operating Procedures (EOPs) since there currently is no automatic isolation in the event of an LMFW. This manual action was previously requested by OPPD in References 6.1 through 6.5 and subsequently approved by the Nuclear Regulatory Commission (NRC) in License Amendment No.

242 (Reference 6.6).

The current Updated Safety Analysis Report (USAR), Chapter 14, accident analysis for the LMFW credits manual action for isolation within 15 minutes of an LMFW event. Automatic isolation will ensure that the 15-minute requirement is met without the risk that an unanticipated distraction could prevent manual action from occurring at the proper time. The installation of this automatic feature eliminates the need for manual isolation of SG blowdown and thus will eliminate the associated operator challenge. The manual isolation capability is being maintained and the operator's ability to manually isolate SG blowdown remains unchanged by this activity.

3.0 TECHNICAL EVALUATION

The proposed changes will allow FCS to credit automatic SG blowdown isolation.

Currently, manual operator action is credited for this isolation feature. A new interlock feature being added during the 2009 RFO will provide automatic SG blowdown following a reactor trip. This will eliminate the need for manual operator action to isolate SG blowdown.

LIC-09-0004 Enclosure Page 5 Modification EC 37112 (Reference 6.7) adds an automatic SG blowdown isolation feature to the existing SG blowdown isolation valves. The isolation feature will automatically close the valves to isolate blowdown in the event of an LMFW. The interlock, which isolates SG blowdown following a reactor trip, will be added to the control circuits for SG blowdown isolation valves HCV-1387A, HCV-1388A, HCV-1387B, and HCV-1388B.

Currently, SG blowdown isolation is addressed in the USAR, Chapter 14.10, Safety Analysis, Malfunctions of the Feedwater System, accident analysis for the LMFW event. Although the valves are credited as containment isolation valves, the specific containment isolation feature is not addressed. The USAR accident analysis currently "assumes no operator action other than closing the SG blowdown isolation valves within 15 minutes of reactor trip" for an LMFW event. As part of implementation of the modification to the SG blowdown circuits, the Chapter 14.10 analysis is being revised to address the automatic SG blowdown isolation feature and delete the reference to operator action. These changes will also remove reference to Amendment No. 242 and add reference to the NRC approved amendment for this LAR. The following revised text is proposed for USAR 14.10:

This analysis assumes the steam generator blowdown isolation valves close within 15 minutes of a reactortrip. (Reference 14.10-17)

• In addition, the following proposed discussion will be added to USAR Section 9.4.5, Auxiliary Systems, Auxiliary Feedwater, Design Evaluation, to address the new interlock:

Steam generatorblowdown isolation ensures that the auxiliary feedwater system performs its design function of maintaining adequate SG water level for decay heat removal once the auxiliary feedwater actuation signal (AFAS) is actuated.

Steam generatorblowdown is automaticallyisolated when a reactortrip occurs.

The following discussion provides details of the design for automatic SG blowdown isolation. The new interlock is designed in accordance with the standards and guidance currently used for safety related circuits at FCS. This includes provisions to address signal selection, single failure criteria, redundancy and independence.

The interlock uses existing instrumentation from sensor to actuation relay. Spare contacts from existing relays will be used to supply the interlock for the SG blowdown isolation valve circuits. Details are as follows:

Signal Selection Because there is no direct signal for an LMFW event, it is necessary to consider the appropriateness of available signals. A number of signals were considered for this isolation feature. The signals considered must provide indication of an LMFW event in a timely manner, and be directly related to parameters that are indicative of a challenge to reactor safety. One signal considered, SG level, is

LIC-09-0004 Enclosure Page 6 directly related to the status of feedwater flow and provides an input to the Auxiliary Feedwater Actuation Signal (AFAS). Therefore, the actuation signal selected is "Low Steam Generator Water Level."

The FCS protection systems have two different signals associated with low SG water level. One signal is used to generate a reactor trip and the other is used to actuate auxiliary feedwater. The TS setpoints associated with each are:

Low SG Water Level Reactor Trip 31.2% narrow range (NR) (TS 2.13)

Low SG Water Level AFAS 28.2% wide range (WR) (TS 2.14)

For this feature, it is desirable to isolate blowdown as soon as possible following an LMFW event, as isolating blowdown earlier in the event provides greater margin in terms of maximizing SG inventories. More margin allows operators more time to address operator demands that occur during transient events.

AFAS occurs at approximately 9 to 10 minutes after an LMFW event. A reactor trip occurs much earlier due to the higher setpoint. Using an AFAS instead of the reactor trip signal greatly reduces the margin between when the event occurs and when blowdown isolation is initiated. A reactor trip signal has been chosen as the actuation signal for blowdown isolation because it is initiated by the SG low level signal. Note that by using the reactor trip signal, blowdown isolation Will occur following all reactor trips (i.e., low SG level is one of many signals that will generate a reactor trip and the reactor trip signal will be used to isolate blowdown).

The reactor trip signal will be provided by the Reactor Protection System (RPS) clutch power supply relays, K1, K2, K3, and K4. These relays are used to monitor the status of the clutch power supplies and provide reactor trip signals to various plant components when the clutch power supplies de-energize on a reactor trip. These relays provide a signal that can be used in the SG blowdown isolation circuits.

Isolation override capability will be included to permit operation of blowdown after a reactor trip (e.g., during a controlled plant shutdown). Override switches will be installed at the ESF control room panels, AI-30A and AI-30B, for this purpose.

Valve Reposition at Reset The SG blowdown isolation valves will remain closed even after a reset of the reactor trip. The valve control circuits are designed such that manual action is required to open the valves following reset of the isolation signal.

LIC-09-0004 Enclosure Page 7 Existing Valve Isolation Signals There are currently two signals that generate a SG blowdown isolation signal.

The first is a SG Blowdown Hi Radiation level (indicative of a SG tube rupture event). The second is a Containment Isolation Actuation Signal (CIAS). It is important to note that the signal being added (Reactor Trip) is being added only to meet the requirement to isolate SG blowdown on an LMFW event. The other two isolation features of the valves will remain unchanged by this modification.

Override Feature The SG blowdown actuation circuit will be equipped with an override switch that will allow operators to re-establish blowdown following a reactor trip. One override switch will be provided for each train of "K" relays (AI-31B and AI-31C).

The override switches will be installed at panel AI-30A (HC-1387A/1388A) and panel AI-30B (HC-1387B/1388B). Annunciation will be provided on either Al-30A (RX TRIP STEAM GEN BLOWDOWN ISOLATION TRAIN A OVERRIDE) or AI-30B (RX TRIP STEAM GEN BLOWDOWN ISOLATION TRAIN B OVERRIDE) to alert operators when a switch is placed in Override. Note that one switch will override two isolation valves (either Train A inboard or Train B outboard). Therefore, with only one switch in Override, the LMFW isolation feature is still satisfied by the opposite train of isolation. Also, when in Override, only the LMFW isolation feature is overridden. The remaining two isolation features of the valves (Hi Radiation and CIAS) remain operable.

Failure Mode Evaluation A discussion of the various failure modes associated with the revised circuit design is as follows. From USAR Appendix G, "Response to 70 Criteria,"

Criterion 19, Protection Systems Reliability is addressed.

CRITERION 19- PROTECTION SYSTEMS RELIABILITY states:

Protection systems shall be designed for high functional reliability and in-service testability commensurate with the safety functions to be performed.

This criterion is met. Design of protection systems includes specification of high quality components, ample design capacity, component redundancy, and in-service testability. The following principaldesign criteriahave been applied:

a) No single component failure shall prevent the protection systems from fulfilling theirprotective function when action is required.

b) No single component failure shall initiate unnecessary protection system action provided implementation does not conflict with the criterionabove.

LIC-09-0004 Enclosure Page 8 Therefore, two failure modes will be addressed: (1) failure to isolate and (2) spurious isolation (de-energization).

(1) Failure to isolate - A review of the "K" relay circuitry shows that there are no single failures within the reactor protection circuitry that could result in the failure of these relays to de-energize on a reactor trip. The relays operate based on the status of the clutch power supplies and share the same redundancy as the reactor protection system. Because of the redundancy associated with the actuation of the relays, it is only necessary to discuss the failure of a "K" relay to de-energize. The failure of a relay to de-energize is taken to be the single failure for the system. Because of the redundancy of the SG blowdown isolation system, isolation would be achieved through the redundant blowdown isolation valves. Therefore, this signal failure will not prevent the system from performing its safety related function.

(2) Spurious isolation (de-enerqization of a "K" relay) - A spurious de-energization of a relay will result in blowdown isolation. While this is undesirable, the consequences of a spurious blowdown isolation are minimal. Additionally, the blowdown flow control circuitry is non-critical quality element (non-CQE) and susceptible to the same type of single failure.

Therefore, this modification adds no new failure modes to the system.

Because it is desirable to have operators aware of this type of failure in a timely manner, the computer alarm circuit associated with the "K" relays will be revised to alarm on the actuation (de-energization) of a single "K" relay.

Currently, these contacts are wired in a way that it is necessary to actuate (de-energize) two relays to generate an alarm. As part of implementation of the modification, the annunciator response procedures (ARPs) will be revised to have the operators verify SG blowdown status after this alarm is received.

Proposed TS Change - Mode Applicability While the new SG blowdown isolation interlock is being added to enhance the performance of the Auxiliary Feedwater (AFW) system, the proposed TS for the interlock will have the same mode dependencies as the automatic initiation for AFAS.

As a result, the proposed TS change allows both trains of SG blowdown isolation to be inoperable and placed in the bypassed condition in Operating Modes 3, 4, and 5.

In Modes 1 or 2, power operation may continue with both trains inoperable if at least one SG blowdown isolation valve for each SG is closed, or the unit must be placed in Mode 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in Mode 3 in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. For this proposed TS change, provisions of TS LCOs 2.15(3), 2.15(4), and 2.0.1 are not applicable to two trains of SG blowdown isolation being inoperable.

LIC-09-0004 Enclosure Page 9 If one train of SG blowdown isolation becomes inoperable, that train may be placed in the bypassed condition. If the train is not returned to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery of loss of operability, operation may continue provided one SG blowdown isolation valve to each SG is closed. If the train is not returned to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of time of discovery, with blowdown not isolated to both SGs, be in Mode 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and be in Mode 3 in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. TS 2.15(1) and 2.0.1 are not applicable to one train of SG blowdown isolation being inoperable.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.1.1 Regulations Fort Calhoun Station (FCS), Unit No. 1, was licensed for construction prior to May 21, 1971, and atthat time committed to the draft General Design Criteria (GDC). The draft GDC are contained in Appendix G of the FCS Updated Safety Analysis Report (USAR) and are similar to 10 CFR 50 Appendix A, General Design Criteria for Nuclear Power Plants.

The USAR Appendix G, draft GDC that govern ESF and reactor protection are Criteria 14, 15, 19, 20, 21,22, 23, 25, 26, and 53.

CRITERION 14 - CORE PROTECTION SYSTEMS states:

Core protection systems, together with associated equipment, shall be designed to act automaticallyto prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits.

This criterion is unchanged. The new interlock uses existing channels and relays to supply the interlock. Spare contacts are used to provide the interlock to the SG blowdown isolation valve circuits. The functionality of the core protection system remains unchanged.

CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION SYSTEM states:

Protection systems shall be provided for sensing accident situations and initiatingthe operation of necessary engineeredsafety features.

This criterion is met. The actuation signal and component initiation has been selected to address the specific function of SG blowdown isolation following a reactor trip to provide SG blowdown isolation for an LMFW event.

LIC-09-0004 Enclosure Page 10 CRITERION 19 - PROTECTION SYSTEMS RELIABILITY states:

Protection systems shall be designed for high functional reliability and in-service testability commensurate with the safety functions to be performed.

This criterion is met. The circuit design satisfies the single failure criteria and testability criteria consistent with that used in other safety grade interlocks used at FCS.

CRITERION 20 - PROTECTION SYSTEMS REDUNDANCY AND INDEPENDENCE states:

Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function. The redundancy provided shall include as a minimum, two channels of protection for each protection function to be served. Different principles shall be used where necessary to achieve true independence of redundantinstrumentationcomponents.

This criterion is met. The circuit design meets the redundancy and independence criteria consistent with that used in other safety grade interlocks used at FCS.

CRITERION 21 - SINGLE FAILURE DEFINITION states:

Multiple failures resulting from a single event shall be treated as single failure.

This criterion is met. The circuit design meets the single failure criteria consistent with that used in other safety grade interlocks used at FCS.

Single failures that impact multiple components (such as loss of DC power) have been considered in the design.

CRITERION 22 - SEPARATION OF PROTECTION AND CONTROL INSTRUMENTATION SYSTEMS states:

Protectionsystems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation and protection circuitry leaves intact a system satisfying all requirements for the protection channels.

This criterion is met. The interlock is separated from control instrumentation systems so that failure or removal from service of any control instrumentation system component or channel does not inhibit the function of the interlock.

LIC-09-0004 Enclosure Page 11 CRITERION 23 - PROTECTION AGAINST MULTIPLE DISABILITY FOR PROTECTION SYSTEMS states:

The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of protection function.

This criterion is met. The interlock relies on signals and components used in existing protection systems. The use of spare contacts to provide these interlocks ensures that this criterion is satisfied.

CRITERION 25 - DEMONSTRATION OF FUNCTION OF FUNCTIONAL OPERABILITY OF PROTECTION SYSTEM states:

Means shall be included for testing protection systems while the reactor is in operation to demonstrate that no failure or loss of redundancyhas occurred.

This criterion is met. Existing components are being used therefore, the testing associated with those components will be used to demonstrate operability of the interlock. Testing for the new interlock is consistent with that of other interlocks that provide similar isolation functions.

CRITERION 26 - PROTECTION SYSTEMS FAIL-SAFE DESIGN states:

The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.

This criterion is met. The interlock is designed to fail in a safe condition. On failure of power to the actuating relays, SG blowdown isolation will occur.

CRITERION 53 - CONTAINMENT ISOLATION VALVES states:

Penetrations that require closure for the containment function shall be protected by redundant valving and associatedapparatus.

This criterion is met. The interlock being added to the SG blowdown isolation valves has no impact on the containment isolation feature of these valves.

The valves will continue to satisfy their containment isolation function.

4.1.2 Design Basis (USAR)

The USAR Chapter 14.10 accident analysis for a Loss of Main Feedwater (LMFW) event currently credits manual isolation of SG blowdown. Upon implementation of the modification, SG blowdown isolation will occur automatically following a reactor trip. The time requirement associated with

LIC-09-0004 Enclosure Page 12 SG blowdown isolation, as delineated in the USAR Chapter 14.10 accident analysis, remains at 15 minutes. The proposed changes to the USAR, which remove reference to the operator action and reflect the automatic SG blowdown isolation feature, will be made during implementation of the modification and approved license amendment.

4.1.3 Approved Methodologies There are no new specific approved methodologies associated with this proposed TS change.

4.1.4 Analysis No new analyses were needed in support of this proposed license amendment request.

4.2 Precedent As a matter of precedence, it was identified that Amendment No. 226 was issued for Millstone Nuclear Power Station, Unit No. 2 (Reference 6.8), in part, to add a new TS associated with the automatic isolation of steam generator blowdown..

However, there are some basic differences between the Millstone Unit No. 2 and FCS applications. For instance, the requirements for the Millstone SG blowdown isolation actuation were the same as the low SG level - automatic auxiliary feedwater actuation versus using the SG low water level - reactor trip as proposed by.OPPD. Millstone also added specific TS requirements for the SG blowdown isolation valves, whereas, OPPD, applies the TS definition of containment integrity, item (4), to the SG blowdown isolation valves. As such, there are no individual TS proposed for the SG blowdown isolation valves since, per TS, in part, "all automatic containment isolation valves are operable, locked closed, or deactivated and secured in their closed position..." as one of the criteria for containment integrity to be met.

In addition, OPPD proposes a channel functional test for both the manual and automatic SG blowdown isolation functions on an RFO frequency, whereas Millstone performs a shiftly channel check, a monthly channel functional test, and a channel calibration on an RFO frequency of the SG blowdown - SG level low functional unit.

Although Millstone Unit No. 2 was issued a license amendment to add automatic SG blowdown isolation (Reference 6.8), there was no industry precedent identified specifically related to license amendments for TS changes for the addition of surveillance and operability requirements for SG blowdown isolation following a reactor trip. Manual isolation of SG blowdown within 15 minutes of a reactor trip was previously approved for FCS by the NRC and documented via License Amendment No. 242 in Reference 6.6.

LIC-09-0004 Enclosure Page 13 4.3 Significant Hazards Consideration The Omaha Public Power District (OPPD) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change provides Technical Specification (TS) operability and surveillance testing requirements for automatic steam generator (SG) blowdown isolation on a reactor trip in the event of a loss of main feedwater (LMFW). Automatic isolation will ensure that the existing 15-minute requirement in the Updated Safety Analysis Report (USAR) Chapter 14.10 safety analysis is met without the risk that an unanticipated distraction could prevent manual action from occurring at the proper time. The installation of this feature will eliminate the need'for manual isolation of blowdown and thus will eliminate the associated operator challenge.

Automatic isolation of blowdown will reduce the consequences of the LMFW event by providing automatic isolation prior to manual isolation being initiated by the operators. Automatic isolation at the time of reactor trip will reduce the severity of the LMFW event by isolating the SGs earlier in the event, thereby conserving SG inventory.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?'

Response: No.

No new malfunctions are being introduced by this activity, and based on the current redundancy in the design, there are no malfunctions of the SG blowdown isolation valves that challenge nuclear safety.

The SG blowdown isolation valves will continue to function as currently credited for the LMFW event; thus, this proposed change does not alter their ability to function as containment isolation valves to maintain containment integrity. The manual isolation capability remains unchanged.

LIC-09-0004 Enclosure Page 14 A failure analysis has been prepared which shows that the addition of the automatic isolation feature does not introduce a new failure mode or malfunction to the valve circuits. An isolation of SG blowdown, either through the designed circuit following a reactor trip, or during normal operations, does not present a nuclear safety challenge. The capability exists for operators to bypass the isolation signal and restore blowdown as plant conditions warrant.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The addition of an automatic isolation interlock to the SG blowdown isolation valve circuits that close the valves on a reactor trip actually increases the margin of safety by isolating the SG early in the event to maintain SG inventories.

A reactor trip signal is generated in the first seconds of an LMFW due to reduced SG inventories. Because it is desirable to isolate blowdown as soon as possible following the LMFW event, for maximum margin, a reactor trip signal will be used for the SG blowdown isolation interlock. Isolating blowdown earlier in an event provides greater operating margin in terms of maximizing SG inventories. More margin allows operators more time to address operator demands that occur during transient events.

Therefore, the proposed change does not involve a.significant reduction in a margin of safety.

Based on the above, OPPD concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c),

and, accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

LIC-09-0004 Enclosure Page 15

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b),

no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

6.1 Letter from OPPD (S. K. Gambhir) to NRC (Document Control Desk), "Fort Calhoun Station Unit No. 1 License Amendment Request, Updated Safety Analysis Report Clarificationof OperatorAction during Loss of Main Feedwater Event," dated July 1,2005 (LIC-05-0001) (ML051950401).

6.2 Letter from OPPD (R. T. Ridenoure) to NRC, "Response to Request forf Additional Information and Revision of Fort Calhoun Station Unit No. 1 License Amendment Request, Updated Safety Analysis, Report Clarification of OperatorAction during Loss of Main Feedwater Event," dated September 16, 2005 (LIC-05-0109) (ML052630443).

6.3 Letter from OPPD (R. T. Ridenoure) to NRC (Document Control Desk),

"Response to Request for Additional Information and Revision of Fort Calhoun Station Unit No. 1 License Amendment Request, Updated Safety Analysis Report Clarificationof OperatorAction during Loss of Main Feedwater Event,"

dated December 14, 2005 (LIC-05-0141) (ML053540318 Non-Public).

6.4 Letter from OPPD (R. T. Ridenoure) to NRC, "Response to Request for Additional Information and Revision of Fort Calhoun Station Unit No. 1 License Amendment Request, Updated Safety Analysis Report Clarification of OperatorAction during Loss of Main Feedwater Event," dated February 16, 2006 (LIC-06-0016) (ML060470591).

6.5 Letter from OPPD (J. A. Reinhart) to NRC, "Response to Fort Calhoun, Unit 1

- Request for Additional Information to License Amendment Request for Updated Safety Analysis Report Clarification of Operator Action during Loss of Main Feedwater Event (TAC No. MC7524)," dated July 6, 2006 (LIC-06-0038)

(ML061880425).

LIC-09-0004 Enclosure Page 16 6.6 Letter from NRC (A. B. Wang) to OPPD (R. T. Ridenoure), "Fort Calhoun Station, Unit No. 1 - Issuance of Amendment Re: Loss of Main Feedwater Event Analyses as Documented in the Updated Safety Analysis Report, Section 14.10 (TAC No. MC7524)," dated September 11, 2006 (NRC-06-0126)

(ML062280476).

6.7 Fort Calhoun Station, Unit No. 1, Modification EC 37112, "Automatic Blowdown Isolation."

6.8 Letter from NRC (S. Dembek) to Northeast Nuclear Energy Company (M. L.

Bowling, Jr.), "Issuance of Amendment - Millstone Nuclear Power Station, Unit No. 2 (TAC No. MA2340)," dated February 8, 1999.

LIC-09-0004 Enclosure, Attachment 1 Page 1 Technical Specification Pages Markups TS 2.15 (1)

TS 2.15, Table 2-4 TS 3.1, Table 3-2

TECHNICAL SPECIFICATIONS 2.0 LIMITING CONDITIONS FOR OPERATION 2.15 Instrumentation and Control Systems Applicability Applies to plant instrumentation systems.

Oboective To delineate the conditions of the plant instrumentation and control systems necessary to assure reactor safety.

Specifications The operability, permissible bypass, and Test Maintenance and Inoperable bypass specifications of the plant instrument and control systems shall be in accordance with Tables 2-2 through 2-5.

(1) In the event the number of channels of a particular system in service falls one below the total number of installed channels, the inoperable channel shall be placed in either the bypassed or tripped condition within one hour if the channel is equipped with a k e bypass switch, and eight hours if jumpers or blocks must be installed in the control circuitry. The inoperable channel may be bypassed for up to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> from time of discovering loss of operability; however,

'if the inoperability is determined to be the result-of malfunctioning RTDs or nuclear detectors supplying signals to the high power level, thermal margin/low;,:*

pressurizer pressure, and axial power distribution channels, these channels may be bypassed for up to 7 days from time of discovering loss of operability. If the ......

inoperable channel is not restored to OPERABLE status after the allowable time for bypass, it shall be placed in the tripped position or, in the case of malfunctioning RTDs or linear power nuclear detectors, the reactor shall be placed in hot shutdown within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. If active maintenance and/or surveillance testing is being performed to return a channel to active service or to establish operability, the channel may be bypassed during the period of active maintenance and/or surveillance testing. This specification applies to the high rate trip-wide range log channel when the plant is at or above 10 4% power and is operating below 15% of rated power.

(2) In the event the number of channels of a particular system in service falls to the limits given in the column entitled "Minimum Operable Channels," one of the inoperable channels must be placed in the tripped position or low level actuation permissive position for the auxiliary feedwater system within one hour, if the channel is equipped with a bypass switch, and within eight hours if jumpers or blocks are required; however, if minimum operable channel conditions for SIRW tank low signal are reached, both inoperable channels must be placed in the bypassed condition within eight hours from time of discovery of loss of operability.

If at least one inoperable channel has not been restored to OPERABLE status after 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> from time of discovering loss of operability, the reactor shall be placed in a hot shutdown condition within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; however, operation can continue without containment ventilation isolation signals available if the containment ventilation isolation valves are closed.

2.15- Page 1 Amendment No. 8,20,54,65,88,108,194, 208, 249

TECHNICAL SPECIFICATIONS TABLE 2-4 Instrument Operating Conditions for Isolation Functions Test, Minimum .Minimum Permissible Maintenance Functional Operable Degree of Bypass and Inoperable No. Unit Channels Redundancy Condition Bypass 1 Containment Isolation A Manual 1 None None N/A B Containment High Pressure Logic Subsystem A 2 (a)(e)(g) 1 During Leak (f)

Logic Subsystem B 1 2 (a)(e)(g) Test C :Pressurizer. Low/Low Pressure Logic Subsystem A 2 (a)(e)(g) 1 Reactor Coolant (f)

Logic Subsystem B 2 (a)(e)(g) 1 Pressure Less Than 1700 psia(b) 2 Steam Generator Isolation A Manual 1 None None N/A B Steam Generator Isolation 1 None None N/A (i)'Steam Generator LowPressure, Logic Subsystem A 2/Steam 1/Steam Steam Generator (f)

Gen(a)(e)(9) Gen Pressure Less Than 600 psia(c)

Logic Subsystem B 2/Steam 1/Steam Gen(a)(e)(9) Gen (ii) Containment High Pressure Logic Subsystem A 2 (a)(e)(g) 1 During Leak (f)

ILogic Subsystem B 2 (a)(e)(g) 1 Test 3 Ventilation Isolation A Manual 1 None None N/A B Containment High Radiation 1(d)(9) (f);

Logic Subsystem A None If Containment

'Lgi' Subsystem B 1 . None Relief and Purge Valves are Closed

• 4 Ste GeeroatIr slowdowr1 1so AManual & ~1 None Qperat, Modes N/

3.4.&M Reactor Trli7 (h) f i I Trains A anid B None Operating MoqpgsjjJ

~3, 4,& 5 OR if at least one v-for each stearJ1i aererraor s closod 2.15 - Page 12 Amendment No.. 88,93,108,152,153,17-3,184,194,249,

TECHNICAL SPECIFICATIONS TABLE 2-4 (Continued) a Circuits on ESF Logic Subsystems A and B each have 4 channels.

b Auto removal of bypass prior to exceeding 1700 psia.

c Auto removal of bypass prior to exceeding 600 psia.

d A and B trains are both actuated by either the Containment or Auxiliary Building Exhaust Stack initiating channels. The number of installed channels for Containment Radiation High Signal is two for purposes of Specification 2.15(1).

e If minimum operable channel conditions are reached, one inoperable channel must be placed in the tripped condition within eight hours from the time of discovery of loss of operability. Specification 2.15(2) is applicable.

f If one channel becomes inoperable, that channel must be placed in the tripped or bypassed condition within eight hours from the time of discovery of loss of operability. Specification 2.15(1) is applicable.

g Specification 2.15(3) is applicable. If ESF Logic Subsystems A and B are inoperable, enter Specification 2.0.1.

"MirtimurnOperable Channels" for steam generator blowdown isolaton refers to the minimum number o trains Ooqic subsystems) which are installe-to pro'vide automatic SGblowddown Isolation!

Ifboth trains becom inoperable, power operation mhay continueproi&odedeat least one SO dow6 ýiso

~r1 vlve for each steam ggnerator is closed OR be inMODE 2 within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and'in MODE 3in the next.q,,

hours. S ecificatlons 2.15(3) and (4) are notapplicable: TS LCO 2.0.1 is not appIlcable!

I If one train becomes inoperable, that train may be placed in the bypassed condition. Ifthe trainis.no ,

etued 'to'OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery of loss of operabiity, loperation rma continue as iong as **e SG blowdown isolation valve toeach steam generator is closed. Ifthe traiin Is *o*

returned to OPE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery, with blowdown not isolated to bo sibe; inMODE 2 ltn6hours,tand:lnin OE 3in the nex hurs. efat2. isnn appic~able; TS LCO 2..1 is not applicableJ 2.15 - Page 13 Amendment No. 88,108,152,173,194, 219

TECHNICAL SPECIFICATIONS TABLE 3-2 (continued)

.:MINIMUM FREQUENCIES FOR CHECKS, CALIBRATIONS AND TESTING OF

" ENGINEERED SAFETY FEATURES, INSTRUMENTATION AND CONTROLS Channel Description . Surveillance Function-: *-. Frequency Surveillance Method

23. Auxiliary Feedwater a. Check: S a.

1) Steam Generator 1) CHANNELCHECK Water Level Low (Wide Range)

2) Steam Generator 2) CHANNEL CHECK Pressure Low

b. Test: b.

1) Actuation Logic 1) CHANNEL FUNCTIONAL TEST

c. Calibrate: R C.

1) Steam Generator 1) CHANNEL CALIBRATION Water Level Low (Wide Range)

2) Steam Generator 2) CHANNEL CALIBRATION Pressure Low

3) Steam Generator 3) CHANNEL CALIBRATION Differential Pressure High

24. Manual Auxiliary Feedwater a. Test R a. CHANNEL FUNCTIONAL TEST Actuation

~ aual Steam Ge-nerato * -.

I~~y I *- -

_q

~5**-- -~,S- IS ~ 1 ~I ~

I

• 'I St t tt SI Blowdown Isolationrc

6. Automatic Steam Generator a -"

,.. L I esL ",11

---ý R L..7 a

flI IA L.A1IANINL ft Ik11 11 St. IflI~k LAS rui'ik. I iIJIN/AL I t~I 1'a1 Blowdown lsoiationr NOTES: (1) Not required unless pressurizer pressure is above 1700 psia.

(2) CRHS monitors are the containment atmosphere gaseous radiation monitor and the Auxiliary Building Exhaust Stack gaseous radiation monitor.

(3) Not-required unless steam generator pressure is above 600 psia.

(4) QP-Quarterly during designated modes and prior to-taking the reactor critical ff.not completed within the-previous 92 days (not applicable to a fast trip recovery).

(5) Not required-to be-done ofi:a;SIT with inoperable level and/or pressure instrumentation. o (6) Not-required when outside ambient air temperature is greater than 50*F and less than 105*F.

(7) Tests backup channels such as derived circuits and equipment that cannot be tested when the plant is at power.

SGLS is required for containment spray pump actuation~only. SGLS lockout relays are not actuated for this test.

., 3:1- Page,13. Amendment No. 41,54,65,122,163,171,172,182,-255

LIC-09-0004 Enclosure, Attachment 2 Page 1 Technical Specification Bases Page Markups TS 2.15 Basis Page (FOR INFORMATION ONLY)

TECHNICAL SPECIFICATIONS 2.0 LIMITING CONDITIONS FOR OPERATION 2.15 Instrumentation and Control Systems (Continued)

Basis (Continued)

The High Rate of Change of Power trip acts to limit power excursions from low power levels and bypassing of this trip at a high power level is conservative. This trip is not credited in the USAR Chapter 14 Safety Analyses for Mode 1 operation. Any variance between AT-Power and NI-Power has no effect on the safety analysis.

Steam generator blowdown iisolation ensures that the auxiliary feedwater system performr its design function of maintaining adequate steam generator (SG) water level for deca_

heat removal once the auxiliar feedwater acation signal (AFAS) is actuated. The steam gneratortbiowdown isolation function consist of two trains (logic subsystem) Each trairj loses one SG"blowdown isolation valve to each SG. Each SGhas redundant (Train, Aan rain B) blowdown isolation valves. Four clutch power relays initiate closure *of the SG blowdown isolatioK valves with each clutch power relay closing one valve when the reacto trips. Failure bf one clutch power relay'ýto initiate SG blowdown isolation orf of one train will not prevent single valve isolation of SGblowdown fiow.

References (1) USAR, Section 7.2.7.1 2.15- Page 6a Amendment No. 208, 249 TSBC-08-008-0

LIC-09-0004 Enclosure, Attachment 3 Page 1 Retyped "Clean" Technical Specification Pages TS 2.15 (1)

TS 2.15, Table 2-4 TS 3.1, Table 3-2

TECHNICAL SPECIFICATIONS 2.0 LIMITING CONDITIONS FOR OPERATION 2.15 Instrumentation and Control Systems Applicability Applies to plant instrumentation systems.

Objective To delineate the conditions of the plant instrumentation and control systems necessary to assure reactor safety.

Specifications The operability, permissible bypass, and Test Maintenance and Inoperable bypass specifications of the plant instrument and control systems shall be in accordance with Tables 2-2 through 2-5.

(1) In the event the number of channels of a particular system in service falls one below the total number of installed channels, the inoperable channel shall be placed in either the bypassed or tripped condition within one hour if the channel is equipped with a bypass switch, and eight hours if jumpers or blocks must be installed in the control circuitry. The inoperable channel may be bypassed for up to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> from time of discovering loss of operability; however, if the inoperability is determined .

to be the result of malfunctioning RTDs or nuclear detectors supplying signals to the high power level, thermal margin/low pressurizer pressure, and axial power distribution channels, these channels may be bypassed for up to 7 days from time of discovering loss of operability. If the inoperable channel is not restored to OPERABLE status after the allowable time for bypass, it shall be placed in the tripped position or, in the case of malfunctioning RTDs or linear power nuclear detectors, the reactor shall be placed in hot shutdown within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. If active maintenance and/or surveillance testing is being performed to return a channel to active service or to establish operability, the channel may be bypassed during the period of active maintenance and/or surveillance testing. This specification applies to the high rate trip-wide range log channel when the plant is at or above 104% power and is operating below 15% of rated power.

(2) In the event the number of channels of a particular system in service falls to the limits given in the column entitled "Minimum Operable Channels," one of the inoperable channels must be placed in the tripped position or low level actuation permissive position for the auxiliary feedwater system within one hour, if the channel is equipped with a bypass switch, and within eight hours if jumpers or blocks are required; however, if minimum operable channel conditions for SIRW tank low signal are reached, both inoperable channels must be placed in the bypassed condition within eight hours from time of discovery of loss of operability.

If at least one inoperable channel has not been restored to OPERABLE status after 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> from time of discovering loss of operability, the reactor shall be placed in a hot shutdown condition within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; however, operation can continue without containment ventilation isolation signals available if the containment ventilation isolation valves are closed.

2.15- Page 1 Amendment No. 8,20,54,65,88,108,194, 208,2 29

TECHNICAL SPECIFICATIONS TABLE 2-4 Instrument Operating Conditions for Isolation Functions Test, Minimum Minimum Permissible Maintenance Functional Operable Degree of Bypass and Inoperable No. Unit Channels Redundancy Condition Bypass 1 Containment Isolation A Manual 1 None None N/A B Containment High Pressure Logic Subsystem A 2 (a)(e)(g) 1 During Leak (f)

Logic Subsystem B 1 Test 2 (a)e)(g)

C Pressurizer Low/Low Pressure Logic Subsystem A 2(a)(e)(g) 1 Reactor Coolant (f)

Logic Subsystem B 2(a)(e)(g) 1 Pressure Less Than 1700 psia(b) 2 Steam Generator Isolation A Manual 1 None None N/A B Steam Generator Isolation 1 None None N/A (i) Steam Generator Low Pressure Logic Subsystem A 2/Steam 1/Steam Steam Generator (jr)

Gen(a)(e)(g) Gen Pressure .Less Than Logic Subsystem B 2/Steam 1/Steam 600 psia(c)

Gen (a)(e)(g)

Gen (ii) Containment High Pressure Logic Subsystem A 2 (a)(e)(g) 1 During Leak (f)

Logic Subsystem B 2 (a)(e)(g) 1 Test 3 Ventilation Isolation A Manual 1 None None N/A B Containment High Radiation Logic Subsystem A 1 (d)(g) None If Containment (f)

Logic Subsystem B 1(d)(g) None Relief and Purge Valves are Closed 4 Steam Generator Blowdown Isolation A Manual 1 None Operating Modes N/A 3,4 & 5 B Reactor Trip Trains A and B None Operating Modes (J) 3, 4, & 5 OR if at least one valve for each steam generator is closed 2.15- Page 12 Amendment No. 88,93,10n8,152,153,173,184,191,249, 2,55

TECHNICAL SPECIFICATIONS TABLE 2-4 (Continued) a Circuits on ESF Logic Subsystems A and B each have 4 channels.

b Auto removal of bypass prior to exceeding 1700 psia.

c Auto removal of bypass prior to exceeding 600 psia.

d A and B trains are both actuated by either the Containment or Auxiliary Building Exhaust Stack initiating channels. The number of installed channels for Containment Radiation High Signal is two for purposes of Specification 2.15(1).

e If minimum operable channel conditions are reached, one inoperable channel must be placed in the tripped condition within eight hours from the time of discovery of loss of operability. Specification 2.15(2) is applicable.

f If one channel becomes inoperable, that channel must be placed in the tripped or bypassed condition within eight hours from the time of discovery of loss of operability. Specification 2.15(1) is applicable.

g Specification 2.15(3) is applicable. If ESF Logic Subsystems A and B are inoperable, enter Specification 2.0.1.

h "Minimum Operable Channels" for steam generator blowdown isolation refers to the minimum number of trains (logic subsystems) which are installed to provide automatic SG blowdown isolation.

If both trains become inoperable, power operation may continue provided at least one SG blowdown isolation valve for each steam generator is closed OR be in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 3 in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Specifications 2.15(3) and (4) are not applicable; TS LCO 2.0.1 is not applicable.

If one train becomes inoperable, that train may be placed in the bypassed condition. Ifthe train is not returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery of loss of operability, operation may continue as long as one SG blowdown isolation valve to each steam generator is closed. If the train is not returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from time of discovery, with blowdown not isolated to both SGs, be in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 3 in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Specification 2.15(1) is not applicable; TS LCO 2.0.1 is not applicable.

2.15 - Page 13 Amendment No. 88,108,152,173,194, 249

TECHNICAL SPECIFICATIONS TABLE 3-2 (continued)

MINIMUM FREQUENCIES FOR CHECKS, CALIBRATIONS AND TESTING OF ENGINEERED SAFETY FEATURES. INSTRUMENTATION AND CONTROLS Channel Description Surveillance Function Frequency Surveillance Method

23. Auxiliary Feedwater a. Check: S a.

1) Steam Generator 1) CHANNELCHECK Water Level Low (Wide Range)

2) Steam Generator 2) CHANNEL CHECK Pressure Low

b. Test: b.

1) Actuation Logic 1 CHANNEL FUNCTIONAL TEST

c. Calibrate: R C.

1) Steam Generator 1 CHANNEL CALIBRATION Water Level Low (Wide Range)

2) Steam Generator 2) CHANNEL CALIBRATION Pressure Low

3) Steam Generator 3) CHANNEL CALIBRATION Differential Pressure High

24. Manual Auxiliary Feedwater a. Test R a. CHANNEL FUNCTIONAL TEST Actuation

25. Manual Steam Generator a. Test R a. CHANNEL FUNCTIONAL TEST Blowdown Isolation

26. Automatic Steam Generator a. Test R a. CHANNEL FUNCTIONAL TEST Blowdown Isolation NOTES: (1) Not required unless pressurizer pressure is above 1700 psia.

(2) CRHS monitors are the containment atmosphere gaseous radiation monitor and the Auxiliary Building Exhaust Stack gaseous radiation monitor.

(3) Not required unless steam generator pressure is above 600 psia.

(4)ý QP - Quarterly during designated modes and prior to taking the reactor critical if not completed within the previous 92 days (not applicable to a fast trip recovery).

(5) Not required to be done on a SIT with inoperable level and/or pressure instrumentation.

(6) Not required when outside ambient air temperature is greater than 50'F and less than 105'F.

(7) Tests backup channels such as derived circuits and equipment that cannot be tested when the plant is at power.

(8) SGLS is required for containment spray pump actuation only. SGLS lockout relays are not actuated for this test.

3.1 - Page 13 Amendment No. 41,54,65,122,1 63,171,172,182, 255

LIC-09-0004 Enclosure, Attachment 4 Page 1 Retyped "Clean" Technical Specification Basis Page TS 2.15 Basis Page (FOR INFORMATION ONLY)

TECHNICAL SPECIFICATIONS 2.0 LIMITING CONDITIONS FOR OPERATION 2.15 Instrumentation and Control Systems (Continued)

Basis (Continued)

The High Rate of Change of Power trip acts to limit power excursions from low power levels and bypassing of this trip at a high power level is conservative. This trip is not credited in the USAR Chapter 14 Safety Analyses for Mode 1 operation. Any variance between AT-Power and NI-Power has no effect on the safety analysis.

Steam generator blowdown isolation ensures that the auxiliary feedwater system performs its design function of maintaining adequate steam generator (SG) water level for decay heat removal once the auxiliary feedwater actuation signal (AFAS) is actuated. The steam generator blowdown isolation function consists of two trains (logic subsystems). Each train closes one SG blowdown isolation valve to each SG. Each SG has redundant (Train A and Train B) blowdown isolation valves. Four clutch power relays initiate closure of the SG blowdown isolation valves with each clutch power relay closing one valve when the reactor trips. Failure of one clutch power relay to initiate SG blowdown isolation or failure of one train will not prevent single valve isolation of SG blowdown flow.

References (1) USAR, Section 7.2.7.1 2.15- Page 6a Amendment No. 2-08, 249 TSBC-08-008-0