Text

Technical Specification Bases Update Status
	ML021230495
Person / Time
Site:	Beaver Valley
Issue date:	04/19/2002
From:	; FirstEnergy Nuclear Operating Co
To:	; Office of Nuclear Reactor Regulation
References
	Download: ML021230495 (158)
	v • d • e

TECHNICAL SPECIFICATION BASES UPDATE STATUS UNIT: 1 Change Pages Implementation No. Issued Date 1-003 B 3/4 7-1 02/20/02 B 3/4 7-1a B 3/4 7-1b B 3/4 7-1c B 3/4 7-1d B 3/4 7-1e B 3/4 7-1f 1-004 B 3/4 4-1 03/04/02 B 3/4 4-5 B 3/4 4-6 B 3/4 4-6a B 3/4 4-7 B 3/4 4-7a B 3/4 4-7b B 3/4 4-7c B 3/4 4-8 B 3/4 4-8a B 3/4 4-9 B 3/4 4-10 B 3/4 4-10a B 3/4 4-10c B 3/4 4-10d B 3/4 4-10e B 3/4 4-10f B 3/4 4-10g B 3/4 4-10h B 3/4 4-10i B 3/4 4-10j B 3/4 4-10k 1-002 B 3/4 9-2 03/26/02 B 3/4 9-3 B 3/4 9-4

BASES FOR SAFETY LIMITS

2.1 SAFETY LIMITS BASES 2.1.1 REACTOR CORE The restrictions of this safety limit prevent overheating of the fuel and possible cladding perforation which would result in the release of fission products to the reactor coolant. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.

Operation above the upper boundary of the nucleate boiling regime could result in excessive cladding temperatures because of the onset of departure from nucleate boiling (DNB) and the resultant sharp reduction in heat transfer coefficient. DNB is not a directly measurable parameter during operation and therefore THERMAL POWER and Reactor Coolant Temperature and Pressure have been related to DNB through the WRB-1 correlation. The WRB-1 DNB correlation has been developed to predict the DNB flux and the location of DNB for axially uniform and non-uniform heat flux distributions. The local DNB heat flux ratio, DNBR, defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB.

The DNB thermal design criterion is that the probability of DNB not occurring on the most limiting rod is at least 95 percent at a 95 percent confidence level for any Condition I or II event.

In meeting the DNB design criterion, uncertainties in plant operating parameters, nuclear and thermal parameters, fuel fabrication parameters and computer codes have been statistically combined with the DNB correlation uncertainties to determine the DNBR Design Limits which are 1.24 for typical and 1.23 for thimble cell. In addition, margin has been maintained in the design by meeting a safety analysis DNBR limit of 1.33 in performing safety analyses.

The figure provided in the COLR shows the loci of points of THERMAL POWER, Reactor Coolant System pressure and average temperature for which the minimum DNBR is no less than the safety analysis DNBR limit or the average enthalpy at the vessel exit is equal to the enthalpy of saturated liquid. The figure is based on enthalpy hot channel factor limits provided in the COLR.

BEAVER VALLEY - UNIT 1 B 2-1 Amendment No. 239

SAFETY LIMITS BASES The reactor core Safety Limits are established to preclude violation of the following fuel design criteria:

a. There must be at least a 95% probability at a 95%

confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and

b. There must be at least a 95% probability at a 95%

confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.

The reactor core Safety Limits are used to define the various Reactor Protection System (RPS) functions such that the above criteria are satisfied during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). To ensure that the RPS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower T reactor trip functions. That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and I that the reactor core Safety Limits will be satisfied during steady state operation, normal operational transients, and AOOs.

2.1.2 REACTOR COOLANT SYSTEM PRESSURE The restriction of this Safety Limit protects the integrity of the Reactor Coolant System from overpressurization and thereby prevents the release of radionuclides contained in the reactor coolant from reaching the containment atmosphere.

The reactor pressure vessel and pressurizer are designed to Section III of the ASME Code for Nuclear Power Plant which permits a maximum transient pressure of 110% (2735 psig) of design pressure. The Reactor Coolant System piping and fittings are designed to ANSI B31.1 and the valves are designed to ASA 16.5 which permit a maximum transient pressure of 120% (2985) psig of component design pressure.

The Safety Limit of 2735 psig is therefore consistent with the design criteria and associated code requirements.

The entire Reactor Coolant System is hydrotested at 3107 psig to demonstrate integrity prior to initial operation.

BEAVER VALLEY - UNIT 1 B 2-2 Amendment No. 239

BASES FOR SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS

3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.0 APPLICABILITY BASES Specification 3.0.1 through 3.0.5 establish the general requirements applicable to Limiting Conditions for Operation. These requirements are based on the requirements for Limiting Conditions for Operation stated in the Code of Federal Regulations, 10 FR 50.36(c)(2):

"Limiting Conditions for Operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shutdown the reactor or follow any remedial action permitted by the technical specification until the condition can be met."

Specification 3.0.1 establishes the Applicability statement within each individual specification as the requirement for when (i.e., in which OPERATIONAL MODES or other specified conditions) conformance to the Limiting Conditions for Operation is required for safe operation of the facility. The ACTION requirements establish those remedial measures that must be taken within specified time limits when the requirements of a Limiting Conditions for Operation are not met.

There are two basic types of ACTION requirements. The first specifies the remedial measures that permit continued operation of the facility which is not further restricted by the time limits of the ACTION requirements. In this case, conformance to the ACTION requirements provides an acceptable level of safety for unlimited continued operation as long as the ACTION requirements continue to be met. The second type of ACTION requirement specifies a time limit in which conformance to the conditions of the Limiting Condition for Operation must be met. This time limit is the allowable outage time to restore an inoperable system or component to OPERABLE status or for restoring parameters within specified limits. If these actions are not completed within the allowable outage time limits, a shutdown is required to place the facility in a MODE or condition in which the specification no longer applies. It is not intended that the shutdown ACTION requirements be used as an operational convenience which permits (routine) voluntary removal of a system(s) or components(s) from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

The specified time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. The time limits of the ACTION requirements are also applicable when a system or component is removed from service for surveillance testing or investigation of operational problems.

Individual specifications may include a specified time limit for the completion of a Surveillance Requirement when equipment is removed from service. In this case, the allowable outage time limits of the ACTION requirements are applicable when this limit expires if the surveillance has not been completed. When a shutdown is required to comply with ACTION requirements, the plant may have entered a MODE in which a new specification becomes applicable. In this case, the time BEAVER VALLEY - UNIT 1 B 3/4 0-1 Amendment No. 129

APPLICABILITY BASES limits of the ACTION requirements would apply from the point in time that the new specification becomes applicable if the requirements of the Limiting Condition for Operation are not met.

Specification 3.0.2 establishes that noncompliance with a specification exists when the requirements of the Limiting Condition for Operation are not met and the associated ACTION requirements have not been implemented within the specified time interval. The purpose of this specification is to clarify that (1) implementation of the ACTION requirements within the specified time interval constitutes compliance with a specification and (2) completion of the remedial measures of the ACTION requirements is not required when compliance with a Limiting Condition of Operation is restored within the time interval specified in the associated ACTION requirements.

Specification 3.0.3 establishes the shutdown ACTION requirements that must be implemented when a Limiting Condition For Operation is not met and the condition is not specifically addressed by the associated ACTION requirements. The purpose of this specification is to delineate the time limits for placing the unit in a safe shutdown MODE when plant operation cannot be maintained within the limits for safe operation defined by the Limiting Conditions for Operation and its ACTION requirements. It is not intended to be used as an operational convenience which permits (routine) voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. One hour is allowed to prepare for an orderly shutdown before initiating a change in plant operation. This time permits the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the cooldown capabilities of the facility assuming only the minimum required equipment is OPERABLE.

This reduces thermal stresses on components of the primary coolant system and the potential for a plant upset that could challenge safety systems under conditions for which this specification applies.

If remedial measures permitting limited continued operation of the facility under the provisions of the ACTION requirements are completed, the shutdown may be terminated. The time limits of the ACTION requirements are applicable from the point in time there was a failure to meet a Limiting Condition for Operation. Therefore, a shutdown may be terminated if the ACTION requirements have been met or the time limits of the ACTION requirements have not expired, thus providing an allowance for the completion of the required actions.

BEAVER VALLEY - UNIT 1 B 3/4 0-2 Amendment No. 129

APPLICABILITY BASES The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the plant to be in the COLD SHUTDOWN MODE when a shutdown is required during the POWER MODE of operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE of operation applies. However, if a lower MODE of operation is reached in less time than allowed, the total allowable time to reach COLD SHUTDOWN, or other applicable MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the time allowed to reach HOT SHUTDOWN is the next 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months because the total time to reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to POWER operation, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.

The same principle applies with regard to the allowable outage time limits of the ACTION requirements, if compliance with the ACTION requirements for one specification results in entry into a MODE or condition of operation for another specification in which the requirements of the Limiting Condition for Operation are not met. If the new specification becomes applicable in less time than specified, the difference may be added to the allowable outage time limits of the second specification. However, the allowable outage time limits of ACTION requirements for a higher MODE of operation may not be used to extend the allowable outage time that is applicable when a Limiting Condition for Operation is not met in a lower MODE of operation.

The shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because the ACTION requirements of individual specifications define the remedial measures to be taken.

Specification 3.0.4 establishes limitations on MODE changes when a Limiting Condition For Operation is not met. It precludes placing the facility in a higher MODE of operation when the requirements for a Limiting Condition For Operation are not met and continued noncompliance to these conditions would result in a shutdown to comply with the ACTION requirements if a change in MODES were permitted. The purpose of this specification is to ensure that facility operation is not initiated or that higher MODES of operation are not entered when corrective action is being taken to obtain compliance with a specification by restoring equipment to OPERABLE status or parameters to specified limits. Compliance with ACTION requirements that permit continued operation of the facility for an unlimited period of time provides an acceptable level of safety for continued operation without regard to the status of the plant before or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or other specified condition may be made in accordance with the provisions of the ACTION requirements. The provisions of this specification should not, however, be interpreted as endorsing the failure to exercise good practice in restoring systems or components to OPERABLE status before plant startup.

When a shutdown is required to comply with ACTION requirements, the provisions of Specification 3.0.4 do not apply because they would delay placing the facility in a lower MODE of operation.

BEAVER VALLEY - UNIT 1 B 3/4 0-3 Amendment No. 129

APPLICABILITY BASES Specification 3.0.5 This specification delineates what additional conditions must be satisfied to permit operation to continue, consistent with the ACTION statements for power sources, when a normal or emergency power source is not OPERABLE. It specifically prohibits operation when one division is inoperable because its normal or emergency power source is inoperable and a system, subsystem, train, component or device in another division is inoperable for another reason.

The provisions of this specification permit the ACTION statements associated with individual systems, subsystems, trains, components, or devices to be consistent with the ACTION statements of the associated electrical power source. It allows operation to be governed by the time limits of the ACTION statement associated with the Limiting Condition For Operation for the normal or emergency power source, not the individual ACTION statements for each system, subsystem, train, component or device that is determined to be inoperable solely because of the inoperability of its normal or emergency power source.

For example, Specification 3.8.1.1 requires in part that two emergency diesel generators be OPERABLE. The ACTION statement provides for a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months out-of-service time when one emergency diesel generator is not OPERABLE. If the definition of OPERABLE were applied without consideration of Specification 3.0.5, all systems subsystems, trains, components and devices supplied by the inoperable emergency power source would also be inoperable. This would dictate invoking the applicable ACTION statements for each of the applicable Limiting Conditions for Operation. However, the provisions of Specification 3.0.5 permit the time limits for continued operation to be consistent with the ACTION statement for the inoperable emergency diesel generator instead, provided the other specified conditions are satisfied. In this case, this would mean that the corresponding normal power source must be OPERABLE, and all redundant systems, subsystems, trains, components, and devices must be OPERABLE, or otherwise satisfy Specification 3.0.5 (i.e., be capable of performing their design function and have at least one normal or one emergency power source OPERABLE). If they are not satisfied, action is required in accordance with this specification.

As a further example, Specification 3.8.1.1 requires in part that two physically independent circuits between the offsite transmission network and the onsite Class 1E distribution system be OPERABLE. The ACTION statement provides a 24-hour out-of-service time when both required offsite circuits are not OPERABLE. If the definition of OPERABLE were applied without consideration of Specification 3.0.5, all systems, subsystems, trains, components and devices supplied by the inoperable normal power sources, both of the offsite circuits, would also be inoperable. This would dictate invoking the applicable ACTION statement for the inoperable normal power sources instead, provided the other specified conditions are satisfied. In this case, this would mean that for one division the emergency power source must be OPERABLE (as must be the components supplied by the emergency power source) and all redundant systems, subsystems, trains BEAVER VALLEY - UNIT 1 B 3/4 0-4 Amendment No. 129

APPLICABILITY BASES components and devices in the other division must be OPERABLE, or likewise satisfy Specification 3.0.5 (i.e., be capable of performing their design functions and have an emergency power source OPERABLE).

In other words, both emergency power sources must be OPERABLE and all redundant systems, subsystems, trains, components and devices in both divisions must also be OPERABLE. If these conditions are not satisfied, action is required in accordance with this specification.

In MODES 5 or 6 Specification 3.0.5 is not applicable, and thus the individual ACTION statements for each applicable Limiting Condition for Operation in these MODES must be adhered to.

Specification 3.0.6 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this specification is to provide an exception to Specification 3.0.1 (e.g., to not comply with the applicable ACTIONS) to allow the performance of Surveillance Requirements and post maintenance testing to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed testing. This specification does not provide time to perform any other preventive or corrective maintenance. Minor corrections such as adjustments of limit switches to correct position indication anomalies are considered within the scope of this specification.

Other more significant tasks such as valve packing replacement are not permitted by this specification.

It is expected that the testing will confirm equipment operability.

Should the testing demonstrate that the equipment is not operable, the provisions of LCO 3.0.1 will be applied.

An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with ACTIONS and must be reopened to perform the surveillance requirements.

BEAVER VALLEY - UNIT 1 B 3/4 0-5 Amendment No. 213

APPLICABILITY BASES An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of a surveillance requirement on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of a surveillance requirement on another channel in the same trip system.

Specification 4.0.1 through 4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance Requirements stated in the Code of Federal Regulations, 10 CFR 50.36(c)(3):

"Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met."

Specification 4.0.1 establishes the requirement that surveillances must be performed during the OPERATIONAL MODES or other conditions for which the requirements of the Limiting Conditions for Operation apply unless otherwise stated in an individual Surveillance Requirement. The purpose of this specification is to ensure that surveillances are performed to verify the operational status of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a MODE or other specified condition for which the associated Limiting Conditions for Operation are applicable. Surveillance Requirements do not have to be performed when the facility is in an OPERATIONAL MODE for which the requirements of the associated Limiting Condition for Operation do not apply unless otherwise specified. The Surveillance Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception to the requirements of a Specification.

Specification 4.0.2 establishes the limit for which the specified time interval for Surveillance Requirements may be extended. It permits an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified with an 18-month BEAVER VALLEY - UNIT 1 B 3/4 0-6 Amendment No. 213

APPLICABILITY BASES surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outages. The limitation of Specification 4.0.2 is based on engineering judgement and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the Surveillance Requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified surveillance interval.

Specification 4.0.3 establishes the failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, as a condition that constitutes a failure to meet the OPERABILITY requirements for a Limiting Condition for Operation. Under provisions of this specification, systems and components are assumed to be OPERABLE when Surveillance Requirements have been satisfactorily performed within the specified time interval. However, nothing in this provision is to be construed as implying that systems or components are OPERABLE when they are found or known to be inoperable although still meeting the Surveillance Requirements. This specification also clarifies that the ACTION requirements are applicable when Surveillance Requirements have not been completed within the allowed surveillance interval and that the time limits of the ACTION requirements apply from the point in time it is identified that a surveillance has not been performed and not at the time that the allowed surveillance interval was exceeded.

Completion of the Surveillance Requirement within the allowable outage time limits of the ACTION requirements restores compliance with the requirements of Specification 4.0.3. However, this does not negate the fact that the failure to have performed the surveillance within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, was a violation of the OPERABILITY requirements of a Limiting Condition for Operation that is subject to enforcement action. Further, the failure to perform a surveillance within the provisions of Specification 4.0.2 is a violation of a Technical Specification requirement and is, therefore, a reportable event under the requirements of 10 CFR 50.73(a)(2)(i)(B) because it is a condition prohibited by the plants Technical Specifications.

If the allowable outage time limits of the ACTION requirements are less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or a shutdown is required to comply with ACTION requirements, e.g., Specification 3.0.3, a 24-hour allowance is provided to permit a delay in implementing the ACTION requirements.

This provides an adequate time limit to complete Surveillance Requirements that have not been performed. The purpose of this allowance is to permit the completion of a surveillance before a shutdown is required to comply with ACTION requirements or before BEAVER VALLEY - UNIT 1 B 3/4 0-7 Amendment No. 213

APPLICABILITY BASES other remedial measures would be required that may preclude completion of a surveillance. The basis for this allowance includes consideration for plant conditions, adequate planning, availability of personnel, the time required to perform the surveillance, and the safety significance of the delay in completing the required surveillance. This provision also provides a time limit for the completion of Surveillance Requirements that become applicable as a consequence of MODE changes imposed by ACTION requirements and for completing Surveillance Requirements that are applicable when an exception to the requirements of Specification 4.0.4 is allowed. If a surveillance is not completed within the 24-hour allowance, the time limits of the ACTION requirements are applicable at that time.

When a surveillance is performed within the 24-hour allowance and the Surveillance Requirements are not met, the time limits of the ACTION requirements are applicable at the time that the surveillance is terminated.

Surveillance Requirements do not have to be performed on inoperable equipment because the ACTION requirements define the remedial measures that apply. However, the Surveillance Requirements have to be met to demonstrate that inoperable equipment has been restored to OPERABLE status.

Specification 4.0.4 establishes the requirement that all applicable surveillances must be met before entry into an OPERATIONAL MODE or other condition of operation specified in the Applicability statement. The purpose of this specification is to ensure that system and component OPERABILITY requirements or parameter limits are met before entry into a MODE or condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in OPERATIONAL MODES or other specified conditions associated with plant shutdown as well as startup.

Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the specified surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.

When a shutdown is required to comply with ACTION requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower MODE of operation.

BEAVER VALLEY - UNIT 1 B 3/4 0-8 Amendment No. 213

APPLICABILITY BASES Specification 4.0.5 establishes the requirement that inservice inspection of ASME Code Class 1, 2, and 3 components and inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of Section XI of the ASME Boiler and Pressure Vessel Code and Addenda as required by 10 CFR 50.55a. These requirements apply except when relief has been provided in writing by the Commission.

This Specification includes a clarification of the frequencies for performing the inservice inspection and testing activities required by Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove any ambiguities relative to the frequencies for performing the required inservice inspection and testing activities.

Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME Boiler and Pressure Vessel Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into an OPERATIONAL MODE or other specified condition takes precedence over the ASME Boiler and Pressure Vessel Code provision which allows pumps and valves to be tested up to one week after return to normal operation. The Technical Specification definition of OPERABLE does not allow a grace period before a component, that is not capable of performing its specified function, is declared inoperable and takes precedence over the ASME Boiler and Pressure Vessel Code provision which allows a valve to be incapable of performing its specified function for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before being declared inoperable.

BEAVER VALLEY - UNIT 1 B 3/4 0-9 Amendment No. 213

3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 BORATION CONTROL 3.4.1.1.1 and 3/4.1.1.2 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that 1) the reactor can be made subcritical from all operating conditions, 2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limits, and 3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.

SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS Tavg. The most restrictive condition occurs at EOL, with Tavg at no load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, a minimum SHUTDOWN MARGIN of 1.77% k/k is initially required to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting condition and is consistent with FSAR accident analysis assumptions. With Tavg

< 200°F, the reactivity transients resulting from a postulated steam line break cooldown are minimal and a 1% k/k shutdown margin provides adequate protection.

The purpose of borating to the cold shutdown boron concentration prior to blocking safety injection is to preclude a return to criticality should a steam line break occur during plant heatup or cooldown.

3/4.1.1.3 BORON DILUTION A minimum flow rate of at least 3000 GPM provides adequate mixing, prevents stratification and ensures that reactivity changes will be gradual during boron concentration reductions in the Reactor Coolant System. A flow rate of at least 3000 GPM will circulate an equivalent Reactor Coolant System volume of 9370 cubic feet in approximately 30 minutes. The reactivity change rate associated with boron reductions will therefore be within the capability for operator recognition and control.

3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)

The limitations on MTC are provided to ensure that the assumptions used in the accident and transient analyses remain valid through each BEAVER VALLEY - UNIT 1 B 3/4 1-1 Amendment No. 30

REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC) (Continued) fuel cycle. The surveillance requirement for measurement of the MTC at the beginning and near the end of each fuel cycle is adequate to confirm the MTC value since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup.

3/4.1.1.5 MINIMUM TEMPERATURE FOR CRITICALITY This specification ensures that the reactor will not be made critical with the Reactor Coolant System average temperature less than 541°F.

This limitation is required to ensure (1) the moderator temperature coefficient is within its analyzed temperature range, (2) the pressurizer is capable of being in an OPERABLE status with a steam bubble, (3) the reactor pressure vessel is above its minimum RTNDT temperature, and (4) the protective instrumentation is within its normal operating range.

3/4.1.2 BORATION SYSTEMS The boron injection system ensures that negative reactivity control is available during each mode of facility operation. The components required to perform this function include (1) borated water sources, (2) charging pumps, (3) separate flow paths, (4) boric acid transfer pumps, (5) associated heat tracing systems, and (6) an emergency power supply from OPERABLE diesel generators.

With the RCS average temperature above 200°F, a minimum of two separate and redundant boron injection systems are provided to ensure single functional capability in the event an assumed failure renders one of the systems inoperable. Allowable out-of-service periods ensure that minor component repair or corrective action may be completed without undue risk to overall facility safety from injection system failures during the repair period.

With the RCS average temperature less than 200°F, a low head safety injection pump may be used in lieu of the operable charging pump with a minimum RCS vent of 2.07 square inches open to the pressurizer relief tank (PRT) or containment atmosphere. This will provide latitude for maintenance and ISI examinations on the charging system for repair or corrective action and will ensure that boration and makeup are available when the charging pumps are out-of-service. The requirement for an RCS vent ensures that the RCS pressure will not exceed the shutoff head of the low head safety injection pumps.

MOV-1SI-890C is the low head safety injection pump discharge isolation valve to the RCS coldlegs, the valve must be closed prior to reducing RCS pressure below the RWST head pressure to prevent draining into the RCS. Emergency backup power is not required since this valve is outside containment and can be manually operated if required, this will allow the associated diesel generator to be taken out of service for maintenance and testing.

BEAVER VALLEY - UNIT 1 B 3/4 1-2 Revised by NRC letter dated December 5,2000

REACTIVITY CONTROL SYSTEMS BASES 3/4.1.2 BORATION SYSTEMS (Continued)

The minimum required volume of water for the Refueling Water Storage Tank (RWST) provides: 1) a source of water and Net Positive Suction Head (NPSH) for High Head Safety Injection and Low Head Safety Injection (LHSI), 2) adequate sump water for LHSI and Recirculation Spray Pump NPSH, and 3) water for containment Quench Spray.

Specifically, the limiting case for defining the minimum RWST volume is derived from the containment analysis for subatmospheric peak pressure during a Reactor Coolant Pump suction Large Break Loss of Coolant Accident. The minimum volume corresponds to 439,050 total gallons as contained in the RWST. From this total volume, the analysis value of 430,500 gallons is considered to be delivered to the respective systems.

The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ensure that 1) sufficient water is available within containment to permit recirculation cooling flow to the core, and 2) the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes with all control rods inserted except for the most reactive control assembly.

These assumptions are consistent with the LOCA analysis.

The limitations for a maximum of one centrifugal charging pump to be OPERABLE and the surveillance requirement to verify all charging pumps except the required OPERABLE pump to be inoperable less than or equal to the enable temperature set forth in Specification 3.4.9.3 provides assurance that a mass addition pressure transient can be relieved by the operation of a single PORV. Substituting a low head safety injection pump for a charging pump in MODES 5 and 6 will not increase the probability of an overpressure event since the shutoff head of the low head safety injection pumps is less than or equal to the setpoint of the overpressure protection system.

Isolation of the primary grade water flow path during MODES 4, 5 and 6 precludes an unplanned boron dilution at these conditions since the sole source of unborated water to the charging pumps is isolated.

This eliminates the design basis boron dilution event in MODES 4, 5 and 6. During planned boron dilution events, operator attention will be focused on the boron dilution process and any inappropriate blender operation would be readily identified through various indications which includes the output from the source range nuclear instrumentation.

BEAVER VALLEY - UNIT 1 B 3/4 1-2a Revised by NRC letter dated January 19, 2000

REACTIVITY CONTROL SYSTEMS BASES 3/4.1.2 BORATION SYSTEMS (Continued)

Closing either a) 1CH-90 or b) 1CH-91 and 1CH-93 will ensure that all possible flow paths are isolated from the Primary Grade Water System to the operating Reactor Coolant System flow path via the charging pumps, thus preventing any potential inadvertent boron dilution event by injection of unborated water.

The ACTION to suspend all operations involving positive reactivity changes or CORE ALTERATIONS is intended to provide assurance that no other activity will mask any potential unintentional boron dilution event. Maintaining the Primary Grade Water System isolated is necessary to ensure that the design basis boron dilution event is not credible. Thus, immediate corrective action is needed to restore positive isolation as soon as possible when not conducting planned boron dilution or makeup activities. Lack of continuous corrective action to restore the Limiting Condition for Operation (LCO) would then make a potential inadvertent boron dilution credible and require performing additional analysis to verify acceptable consequences if it should occur.

Verifying the SHUTDOWN MARGIN within one hour ensures that no unacceptable reduction of SHUTDOWN MARGIN occurred when the LCO requirements were not satisfied. The SHUTDOWN MARGIN need only be verified once since the cessation of any activities involving positive reactivity changes, CORE ALTERATIONS or use of the Primary Grade Water System with the Charging System will prevent any future potential injection of primary grade water into the Reactor Coolant System. The verification of SHUTDOWN MARGIN needs to be completed anytime that the ACTION is entered even if the LCO is subsequently satisfied before the verification is completed to ensure that no unacceptable reduction of SHUTDOWN MARGIN occurred when the LCO requirements were not satisfied.

The primary function of the surveillance is to ensure that the valve(s) used to isolate the Primary Grade Water System are locked, sealed or otherwise secured. The frequency of 31 days to ensure that the Primary Grade Water System is properly isolated is based on engineering judgment, and has proven to be acceptable. Operating experience has shown that the failure rate is so low that the 31 day frequency is justified. A time frame of 15 minutes provides a minimum reasonable time for an operator to isolate the Primary Grade Water System following a planned activity requiring its use.

BEAVER VALLEY - UNIT 1 B 3/4 1-2b Revised by NRC letter dated January 19, 2000

REACTIVITY CONTROL SYSTEMS BASES 3/4.1.2 BORATION SYSTEMS (Continued)

The boration capability of either system is sufficient to provide a SHUTDOWN MARGIN from all operating conditions of 1.0% k/k after xenon decay and cooldown to 200°F. The maximum boration capability requirements occur at BOL from full power peak xenon conditions and requires 11,336 gallons of 7000 ppm borated water from the boric acid storage tanks or 65,000 gallons of 2400 ppm borated water from the refueling water storage tank.

With the RCS temperature below 200°F, one injection system is acceptable without single failure consideration on the basis of the stable reactivity condition of the reactor and the additional restrictions prohibiting CORE ALTERATIONS and positive reactivity change in the event the single injection system becomes inoperable.

The boration capability required below 200°F is sufficient to provide a SHUTDOWN MARGIN of 1% k/k after xenon decay and cooldown from 200°F to 140°F. This condition requires either 5000 gallons of 7000 ppm borated water from the boric acid storage tanks or 175,000 gallons of 2400 ppm borated water from the refueling water storage tank.

3/4.1.3 MOVABLE CONTROL ASSEMBLIES The specifications of this section ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of rod misalignment on associated accident analyses are limited. OPERABILITY of the movable control assemblies is established by observing rod motion and determining that rods are positioned within +/- 12 steps (indicated position), of the respective group demand counter position. The OPERABILITY of the rod position indication system is established by appropriate periodic CHANNEL CHECKS, CHANNEL FUNCTIONAL TESTS and CHANNEL CALIBRATIONS. OPERABILITY of the control rod position indicators is required to determine control rod position and thereby ensure compliance with the control rod alignment and insertion limits. The OPERABLE condition for the analog rod position indicators is defined as being capable of indicating rod position within +/- 12 steps of the associated group demand indicator. For power levels below 50 percent, the specifications of this section permit a one hour stabilization period to permit stabilization of known thermal drift in the analog rod position indicator channels.

During this stabilization period, greater reliance is placed upon the group demand position indicators to determine rod position. Above 50 percent power, rod motion is not expected to induce thermal transients of sufficient magnitude to exceed the rod position indicator instrument accuracy of +/- 12 steps. Limited use of rod position indication primary detector voltages is allowed as a backup method of determining control rod positions. Comparison of the group demand indicator to the calibration curve is sufficient to allow determination that a control rod is indeed misaligned from its bank when primary voltage measurements are used. Comparison of the group demand counters to the bank insertion limits with verification of rod position with the analog rod BEAVER VALLEY - UNIT 1 B 3/4 1-3 Amendment No. 242

REACTIVITY CONTROL SYSTEMS BASES position indicators (after thermal soak after rod motion) is sufficient verification that the control rods are above the insertion limits below 50 percent power. Above 50 percent power, reliance is placed on the analog rod position indicator channels to assure that control rods are above the insertion limits.

The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original design criteria are met. Misalignment of a rod requires measurement of peaking factors and a restriction in THERMAL POWER. These restrictions provide assurance of fuel rod integrity during continued operation. In addition, those safety analyses affected by a misaligned rod are reevaluated to confirm that the results remain valid during future operation.

For Specification 3.1.3.1 ACTION c. and d., it is incumbent upon the plant to verify the trippability of the inoperable control rod(s).

Trippability is defined in Attachment C to a letter dated December 21, 1984, from E. P. Rahe (Westinghouse) to C. O. Thomas (NRC). This may be by verification of a control system failure, usually electrical in nature, or that the failure is associated with the control rod stepping mechanism. In the event the plant is unable to verify the rod(s) trippability, it must be assumed to be untrippable and thus falls under the requirements of ACTION a.

BEAVER VALLEY - UNIT 1 B 3/4 1-4 Amendment No. 225

3/4.2 POWER DISTRIBUTION LIMITS BASES The specifications of this section provide assurance of fuel integrity during Condition I (Normal Operation) and II (Incidents of Moderate Frequency) events by: (a) maintaining the minimum DNBR in the core the design DNBR limit during normal operation and in short term transients, and (b) limiting the fission gas release, fuel pellet temperature and cladding mechanical properties to within assumed design criteria. In addition, limiting the peak linear power density during Condition I events provides assurance that the initial conditions assumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 2200°F is not exceeded.

The definitions of hot channel factors as used in these specifications are as follows:

FQ(Z) Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on the surface of a fuel rod at core elevation Z divided by the average fuel rod heat flux, allowing for manufacturing tolerances on fuel pellets and rods.

FN H Nuclear Enthalpy Rise Hot Channel Factor, is defined as the ratio of the integral of linear power along the rod with the highest integrated power to the average rod power.

3/4.2.1 AXIAL FLUX DIFFERENCE (AFD)

The limits on AXIAL FLUX DIFFERENCE assure that the FQ(Z) upper bound envelope times the normalized axial peaking factor is not exceeded during either normal operation or in the event of xenon redistribution following power changes.

Target flux difference is determined at equilibrium xenon conditions.

The full length rods may be positioned within the core in accordance with their respective insertion limits and should be inserted near their normal position for steady state operation at high power levels. The value of the target flux difference obtained under these conditions divided by the fraction of RATED THERMAL POWER is the target flux difference at RATED THERMAL POWER for the associated core burnup conditions. Target flux differences for other THERMAL POWER levels are BEAVER VALLEY - UNIT 1 B 3/4 2-1 Amendment No. 154

POWER DISTRIBUTION LIMITS BASES 3/4.2.1 AXIAL FLUX DIFFERENCE (AFD) (Continued) obtained by multiplying the RATED THERMAL POWER value by the appropriate fractional THERMAL POWER level. The periodic updating of the target flux difference value is necessary to reflect core burnup considerations.

Although it is intended that the plant will be operated with the AXIAL FLUX DIFFERENCE within the target band about the target flux difference, during rapid plant THERMAL POWER reductions, control rod motion will cause the AFD to deviate outside of the target band at reduced THERMAL POWER Levels. This deviation will not affect the xenon redistribution sufficiently to change the envelope of peaking factors which may be reached on a subsequent return to RATED THERMAL POWER (with the AFD within the target band) provided the time duration of the deviation is limited. Accordingly, a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months penalty deviation limit cumulative during the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is provided for operation outside of the target band but within the limits specified in the CORE OPERATING LIMITS REPORT for THERMAL POWER levels between 50% and 90% of RATED THERMAL POWER. For THERMAL POWER levels between 15% and 50% of RATED THERMAL POWER, deviations of the AFD outside of the target band are less significant. The penalty of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months actual time reflects this reduced significance.

Provisions for monitoring the AFD on an automatic basis are derived from the plant process computer through the AFD Monitor Alarm. The computer determines the one minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3 OPERABLE excore channels are outside the target band and the THERMAL POWER is greater than 90% of RATED THERMAL POWER. During operation at THERMAL POWER levels between 50% and 90% and between 15% and 50% RATED THERMAL POWER, the computer outputs an alarm message when the penalty deviation accumulates beyond the limits of l hour and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , respectively.

Figure B 3/4 2-1 shows a typical monthly target band near the beginning of core life.

BEAVER VALLEY - UNIT 1 B 3/4 2-2 Amendment No. 154

FIGURE B 3/4 2-1 TYPICAL INDICATED AXIAL FLUX DIFFERENCE VERSUS THERMAL POWER AT BOL BEAVER VALLEY - UNIT 1 B 3/4 2-3 Reissued March 92

POWER DISTRIBUTION LIMITS BASES 3/4.2.2 AND 3/4.2.3 HEAT FLUX AND NUCLEAR ENTHALPY HOT CHANNEL FACTORS-FQ(Z) and FNH The limits on heat flux and nuclear enthalpy hot channel factors ensure that 1) the design limits on peak local power density and minimum DNBR are not exceeded and 2) in the event of a LOCA the peak fuel clad temperature will not exceed the ECCS acceptance criteria limit of 2200°F.

Each of these hot channel factors are measurable but will normally only be determined periodically as specified in Specifications 4.2.2 and Specification 4.2.3. This periodic surveillance is sufficient to insure that the hot channel factor limits are maintained provided:

a. Control rods in a single group move together with no individual rod insertion differing by more than +/-12 steps from the group demand position.

b. Control rod groups are sequenced with overlapping groups as described in Specification 3.1.3.5.

c. The control rod insertion limits of Specifications 3.1.3.4 and 3.1.3.5 are maintained.

d. The axial power distribution, expressed in terms of AXIAL FLUX DIFFERENCE is maintained within the limits.

The relaxation in FN H as a function of THERMAL POWER allows changes in the radial power shape for all permissible rod insertion limits.

FN H will be maintained within its limits provided conditions a through d above, are maintained.

When a FQ measurement is taken, both experimental error and manufacturing tolerance must be allowed for. 5% is the appropriate experimental error allowance for a full core map taken with the incore detector flux mapping system and 3% is the appropriate allowance for manufacturing tolerance.

The specified limit of FN H contains an 8% allowance for uncertainties which means that normal, full power, three loop operation will result in FN H the design limit specified in the CORE OPERATING LIMITS REPORT.

BEAVER VALLEY - UNIT 1 B 3/4 2-4 Amendment No. 154

POWER DISTRIBUTION LIMITS BASES 3/4.2.2 AND 3/4.2.3 HEAT FLUX AND NUCLEAR ENTHALPY HOT CHANNEL N

FACTORS-FQ(Z) and FH (Continued)

Fuel rod bowing reduces the value of the DNB ratio. Margin has been maintained between the DNBR value used in the safety analyses (1.33) and the design limit (1.21) to offset the rod bow penalty and other penalties which may apply.

The radial peaking factor Fxy(Z) is measured periodically to provide assurance that the hot channel factor, FQ(Z), remains within its limits. The Fxy limit for RATED THERMAL POWER FxyRTP provided in the CORE OPERATING LIMITS REPORT was determined from expected power control maneuvers over the full range of burnup conditions in the core.

3/4.2.4 QUADRANT POWER TILT RATIO (QPTR)

BACKGROUND The Quadrant Power Tilt Ratio limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses. Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation. The QPTR is routinely determined using the power range channel input which is part of the power range nuclear instrumentation (NI). The power range channel provides a protection function and has operability requirements in LCO 3.3.1. While part of the NI channel, the power range channel input to QPTR functions independently of the power range channel in monitoring radial power distribution. For this reason, if the power range channel output is inoperable, the power range channel input to QPTR may be unaffected and capable of monitoring for the QPTR.

The power density at any point in the core must be limited so that the fuel design criteria are maintained. Together, LCO 3.2.1, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, and LCO 3.1.3.6, "Control Rod Insertion Limits," provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the design criteria and that the power distribution remains within the bounds used in the safety analyses.

BEAVER VALLEY - UNIT 1 B 3/4 2-5 Amendment No. 192

POWER DISTRIBUTION LIMITS BASES 3/4.2.4 QUADRANT POWER TILT RATIO (QPTR) (Continued)

APPLICABLE SAFETY ANALYSES This LCO precludes core power distributions that violate the following fuel design criteria:

a. During a large break loss of coolant accident, the peak cladding temperature must not exceed 2200°F in accordance with 10 CFR 50.46;

b. During a loss of forced reactor coolant flow accident, there must be at least 95 percent probability at the 95 percent confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition;

c. During an ejected rod accident, the fission energy input to the fuel must not exceed 280 cal/gm in accordance with the indicated failure threshold from the TREAT results (UFSAR 14.2.6), and

d. The control rods must be capable of shutting down the reactor with a minimum required Shutdown Margin (SDM) with the highest worth control rod stuck fully withdrawn in accordance with 10 CFR 50, Appendix A, GDC 26.

The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor (FQ(Z)), the Nuclear Enthalpy Rise Hot Channel Factor (FN H), and control bank insertion are established to preclude core power distributions that exceed the safety analyses limits.

The QPTR limits ensure that FN H and FQ(Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.

In MODE 1, the FNH and FQ(Z) limits must be maintained to preclude core power distributions from exceeding design limits assumed in the safety analysis.

BEAVER VALLEY - UNIT 1 B 3/4 2-6 Amendment No. 192

POWER DISTRIBUTION LIMITS BASES 3/4.2.4 QUADRANT POWER TILT RATIO (QPTR) (Continued)

LCO The QPTR limit of 1.02, at which corrective action is required, provides a margin of protection for both the DNB ratio and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts. A limiting QPTR of 1.02 Ncan be tolerated before the margin for uncertainty in FQ(Z) and (F H) is possibly challenged.

APPLICABILITY The QPTR limit must be maintained in MODE 1 with THERMAL POWER greater than 50 percent RATED THERMAL POWER (RTP) to prevent core power distributions from exceeding the design limits.

Applicability in MODE 1 less than or equal to 50 percent RTP and in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important. Note that the FNH and FQ(Z) LCOs still apply, but allow progressively higher peaking factors at 50 percent RTP or lower.

ACTION

a. With the QPTR exceeding its limit, a power level reduction of 3 percent RTP for each 1 percent by which the QPTR exceeds 1.00 is a conservative tradeoff of total core power with peak linear power. The completion time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows sufficient time to identify the cause and correct the tilt. Note that the power reduction itself may cause a change in the tilted condition.

b. After completion of ACTION a, any additional changes in the QPTR are detected by requiring a check of the QPTR once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. If the QPTR continues to increase, THERMAL POWER has to be reduced accordingly. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months completion time is sufficient because any additional change in QPTR would be relatively slow.

BEAVER VALLEY - UNIT 1 B 3/4 2-7 Amendment No. 225

POWER DISTRIBUTION LIMITS BASES 3/4.2.4 QUADRANT POWER TILT RATIO (QPTR) (Continued)

ACTION (Continued)

c. The peaking factors FNH and FQ(Z) are of primary importance in ensuring that the power distribution remains consistent with the initial conditions used in the safety analyses.

Performing surveillances on FN H and FQ(Z) within the completion time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that these primary indicators of power distribution are within their respective limits. A completion time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months takes into consideration the rate at which peaking factors are likely to change, and the time required to stabilize the plant and perform a flux map. If these peaking factors are not within their limits, the actions provide an appropriate response for the abnormal condition. If the QPTR remains above its specified limit, the peaking factor surveillances are required each 7 days thereafter to evaluate FN H and FQ(Z) with changes in power distribution. Relatively small changes are expected due to either burnup and xenon redistribution or correction of the cause for exceeding the QPTR limit.

d. Although FNH and FQ(Z) are of primary importance as initial conditions in the safety analyses, other changes in the power distribution may occur as the QPTR limit is exceeded and may have an impact on the validity of the safety analysis. A change in the power distribution can affect such reactor parameters as bank worths and peaking factors for rod malfunction accidents. When the QPTR exceeds its limit, it does not necessarily mean a safety concern exists. It does mean that there is an indication of a change in the gross radial power distribution that requires an investigation and evaluation that is accomplished by examining the incore power distribution. Specifically, the core peaking factors and the quadrant tilt must be evaluated because they are the factors that best characterize the core power distribution. This re-evaluation is required to ensure that, before increasing THERMAL POWER to above the limit of ACTION a or b, the reactor core conditions are consistent with the assumptions in the safety analyses.

e. If the QPTR has exceeded the 1.02 limit and a re-evaluation of the safety analysis is completed and shows that safety requirements are met, the excore detectors are normalized to BEAVER VALLEY - UNIT 1 B 3/4 2-8 Amendment No. 192

POWER DISTRIBUTION LIMITS BASES 3/4.2.4 QUADRANT POWER TILT RATIO (QPTR) (Continued)

ACTION (Continued) show a QPTR less than or equal to 1.02 prior to increasing THERMAL POWER to above the limit of ACTION a or b. This is done to detect any subsequent significant changes in QPTR.

This action assures that the indicated QPT is not normalized until after the re-evaluation of the safety analysis has determined that core conditions at RTP are within the safety analysis assumptions (i.e., ACTION d).

This is intended to prevent any ambiguity about the required sequence of actions.

f. Once the flux tilt is normalized (i.e., ACTION e is performed), it is acceptable to return to full power operation. However, as an added check that the core power distribution at RTP is consistent with the safety analysis assumptions, ACTION f requires verification that FQ(Z) and FN H are within their specified limits within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of reaching RTP. As an added precaution, if the core power does not reach RTP within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , but is increased slowly, then the peaking factor surveillances must be performed within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months of the time when the ascent to power was begun. These completion times are intended to allow adequate time to increase THERMAL POWER to above the limit of ACTION a or b, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.

This action assures that the peaking factor surveillances may only be done after the excore detectors have been normalized to show a tilt less than or equal to 1.02 (i.e.,

ACTION e). The intent of this is to have the peaking factor surveillances performed at operating power levels, which can only be accomplished after the excore detectors are normalized to show a tilt less than or equal to 1.02 and the core returned to power.

g. If ACTIONS a through f are not completed within their associated completion times, the unit must be brought to a MODE or condition in which the requirements do not apply.

To achieve this status, THERMAL POWER must be reduced to less than 50 percent RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed completion time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable, based on operating experience regarding the amount of time required to reach the reduced power level without challenging plant systems.

BEAVER VALLEY - UNIT 1 B 3/4 2-9 Amendment No. 192

POWER DISTRIBUTION LIMITS BASES 3/4.2.4 QUADRANT POWER TILT RATIO (QPTR) (Continued)

SURVEILLANCE REQUIREMENTS (SR)

SR 4.2.4.a SR 4.2.4.a is modified by a Note that allows QPTR to be calculated with three power range high neutron flux channels that input to QPTR if THERMAL POWER is less than 75 percent RTP and one power range high neutron flux channel is inoperable.

This surveillance verifies that the QPTR, as indicated by the Nuclear Instrumentation System (NIS) channels, excore channels, is within its limits. The frequency of 7 days takes into account other information and alarms available to the operator in the control room.

For those causes of QPT that occur quickly (e.g., a dropped rod),

there typically are other indications of abnormality that prompt a verification of core power tilt.

SR 4.2.4.b This surveillance is modified by a Note, which states that it is required only when less than four power range high neutron flux channels input to QPTR are operable and the THERMAL POWER is greater than or equal to 75 percent RTP.

With an excore detector inoperable, tilt monitoring for a portion of the reactor core becomes degraded. Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased. Performing SR 4.2.4.b at a frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months provides an accurate alternative means for ensuring that any tilt remains within its limits.

For purposes of monitoring the QPTR when one excore detector is inoperable, the movable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the indicated QPTR and any previous data indicating a tilt. The incore detector monitoring is performed with a full incore flux map or a partial core flux map with quarter core symmetry detailed in accordance with controlled procedures.

BEAVER VALLEY - UNIT 1 B 3/4 2-10 Amendment No. 225

POWER DISTRIBUTION LIMITS BASES 3/4.2.4 QUADRANT POWER TILT RATIO (QPTR) (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

The symmetric thimble flux map can be used to generate symmetric thimble "tilt." This can be compared to a reference symmetric thimble tilt, from the most recent full core flux map, to generate an incore QPTR. Therefore, the symmetric thimble flux map can be used to confirm that QPTR is within limits.

With one excore detector inoperable, the indicated tilt may be changed from the value indicated with all four channels OPERABLE. To confirm that no change in tilt has actually occurred, which might cause the QPTR limit to be exceeded, the incore results may be compared against previous flux maps either using the symmetric thimbles as described above or a complete flux map. Nominally, quadrant tilt from the surveillance should be within 2 percent of the tilt shown by the most recent flux map data.

3/4.2.5 DNB PARAMETERS The limits on the DNB related parameters assure that each of the parameters are maintained within the normal steady state envelope of operation assumed in the transient and accident analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, based on maximum analyzed steam generator tube plugging, is retained in the LCO. The limits are consistent with the initial FSAR assumptions and have been analytically demonstrated adequate to maintain a minimum DNBR greater than or equal to the design DNBR limit throughout each analyzed transient.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months periodic surveillance of these parameters through instrument readout is sufficient to ensure that the parameters are restored within their limits following load changes and other expected transient operation. The 18 month periodic measurement of the RCS total flow rate is adequate to detect flow degradation and ensure correlation of the flow indication channels with measured flow such that the indicated percent flow will provide sufficient verification of flow rate on a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months basis.

BEAVER VALLEY - UNIT 1 B 3/4 2-11 Amendment No. 239

3/4.3 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION The OPERABILITY of the Reactor Trip System and the Engineered Safety Features Actuation System instrumentation and interlocks ensures that: (1) the associated action and/or Reactor trip will be initiated when the parameter monitored by each channel or combination thereof reaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and (4) sufficient system functional capability is available from diverse parameters.

The OPERABILITY of these systems is required to provide the overall reliability, redundancy, and diversity assumed available in the facility design for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the safety analyses. The Surveillance Requirements specified for these systems ensure that the overall system functional capability is maintained comparable to the original design standards. The periodic surveillance tests performed at the minimum frequencies are sufficient to demonstrate this capability.

The Allowable Values specified in Table 3.3-1 and Table 3.3-3 are the values for consideration of channel operability. A channel is OPERABLE with a nominal trip setpoint value outside its calibration tolerance band provided the trip setpoint "as found" value does not exceed its associated Allowable Value.

Additional administratively controlled limits for operability of a device are determined by device drift being less than the value required for the surveillance interval. In the event the device exceeds the administratively controlled limit, operability of the device may be evaluated by other device performance characteristics, e.g., comparison to historical device drift data, calibration characteristics, response characteristics and short term drift characteristics. A device (relay, transmitter, process rack module, etc.), whose "as found" value is in excess of the calibration tolerance, but within the additional operability criteria (administratively controlled limit), is considered operable but must be recalibrated such that the "as left" value is within the two sided

(+/-) calibration tolerance. Plant procedures set administrative limits ("as left" and "as found" criteria) to control the determination of operability by setting minimum standards based on the setpoint methodology and the uncertainty values included in the determination of the Nominal Trip Setpoint, and allow the use of other device characteristics to evaluate operability.

BEAVER VALLEY - UNIT 1 B 3/4 3-1 Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

The Engineered Safety Features Actuation System and Reactor Trip System Nominal Trip Setpoints specified in the Licensing Requirements Manual (LRM) are the nominal values* at which the instrumentation is set for each functional unit. A Setpoint is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (+/-) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint).

Additionally, a trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions provided that the +/- calibration tolerance band remains the same and the allowable value is also adjusted accordingly in the conservative direction to meet the assumptions of the setpoint methodology. The conservative direction is established by the direction of the inequality applied to the Allowable Value.

The setpoint methodology, used to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties in the channels.

Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes.

Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics.

Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation.

REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS Technical specifications are required by 10 CFR 50.36 to contain Limiting Safety System Settings (LSSS) defined by the regulation as

"...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated,

With the exception of the Reactor Trip System Functional Unit number 17.B for the Turbine Stop Valve Position trip. The trip setpoint specified in the LRM for Functional Unit number 17.B is not a nominal value. The trip setpoint for this Functional Unit is adjusted to be consistent with the trip setpoint value specified in the LRM in lieu of adjusting the setpoint within an established calibration tolerance band.

BEAVER VALLEY - UNIT 1 B 3/4 3-1a Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded.

The Allowable Values (Nominal Trip Setpoints +/- the calibration tolerance) specified in Table 3.3.1 are the LSSS as identified in 10 CFR 50.36 and have been selected to ensure that the core and Reactor Coolant System are prevented from exceeding their safety limits during normal operation and design basis anticipated operational occurrences and to assist the Engineered Safety Features Actuation System in mitigating the consequences of accidents.

The various reactor trip circuits automatically open the reactor trip breakers whenever a condition monitored by the Reactor Trip System reaches a preset or calculated level. In addition to redundant channels and trains, the design approach provides Reactor Trip System functional diversity. The functional capability at the specified trip setting is required for those anticipatory or diverse reactor trips for which no direct credit was assumed in the safety analysis to enhance the overall reliability of the Reactor Trip System.

The Reactor Trip System initiates a turbine trip signal whenever reactor trip is initiated. This prevents the reactivity insertion that would otherwise result from excessive Reactor Coolant System cooldown and thus avoids unnecessary actuation of the Engineered Safety Features Actuation System.

The difference between T' (Overtemperature T) or T" (Overpower T) and the loop specific, indicated, full power Tavg shall be less than or equal to the Tavg allowances for such differences in the uncertainty calculations for these functions. In addition, T' and T" shall be less than or equal to the full power Tavg modeled in the safety analyses as an initial condition assumption; i.e., the numerical value specified in the COLR. In the event that the difference between a T' or T" set to the numerical value specified in the COLR and a loop specific, indicated, full power Tavg is greater than the Tavg allowances for such differences in the uncertainty calculations, T' or T" shall be reduced until the difference allowances in the uncertainty calculations are satisfied; i.e., T' or T" are set to a loop specific, full power value less than the numerical value specified in the COLR. These reductions in the values of T' and T" are consistent with the recommendations of Westinghouse Technical Bulletin ESBU-TB-96-07-RO, "Temperature Related Functions," 11/5/96.

BEAVER VALLEY - UNIT 1 B 3/4 3-1b Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

Manual Reactor Trip The Manual Reactor Trip is a redundant channel to the automatic protective instrumentation channels and provides manual reactor trip capability.

Power Range, Neutron Flux The Power Range, Neutron Flux channel high setpoint provides reactor core protection against reactivity excursions which are too rapid to be protected by temperature and pressure protective circuitry. The low set point provides redundant protection in the power range for a power excursion beginning from low power. The trip associated with the low setpoint may be manually bypassed when P-10 is active (two of the four power range channels indicate a power level of above the P-10 setpoint and is automatically reinstated when P-10 becomes inactive (three of the four channels indicate a power level below the P-10 setpoint).

Power Range, Neutron Flux, High Rates The Power Range Positive Rate trip provides protection against rapid flux increases which are characteristic of rod ejection events from any power level. Specifically, this trip complements the Power Range Neutron Flux High and Low trips to ensure that the criteria are met for rod ejection from partial power.

The Power Range Negative Rate trip provides protection to ensure that the minimum DNBR is maintained above the design DNBR limit for control rod drop accidents. At high power a single or multiple rod drop accident could cause flux peaking which, when in conjunction with nuclear power being maintained equivalent to turbine power by action of the automatic rod control system, could cause an unconservative local DNBR to exist. The Power Range Negative Rate trip will prevent this from occurring by tripping the reactor. For those transients on which reactor trip on power range negative rate trip is not postulated, it is shown that the minimum DNBR is greater than the design DNBR limit.

Intermediate and Source Range, Nuclear Flux The Intermediate and Source Range, Nuclear Flux trips provide reactor core protection during reactor start-up. These trips provide redundant protection to the low setpoint trip of the Power Range, Neutron Flux channels. The Source Range Channels will initiate a reactor trip at the trip setpoint unless manually blocked when P-6 BEAVER VALLEY - UNIT 1 B 3/4 3-1c Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) becomes active. The Intermediate Range Channels will initiate a reactor trip at a current level proportional to the trip setpoint unless manually blocked when P-10 becomes active. No credit was taken for operation of the trips associated with either the Intermediate or Source Range Channels in the accident analyses; however, their functional capability at the specified trip settings is required by this specification to enhance the overall reliability of the Reactor Protection System.

Overtemperature T The Overtemperature T trip provides core protection to prevent DNB for all combinations of pressure, power, coolant temperature, and axial power distribution, provided that the transient is slow with respect to piping transit delays from the core to the temperature detectors (about 4 seconds), and pressure is within the range between the High and Low Pressure reactor trips. This setpoint includes corrections for changes in density and heat capacity of water with temperature and dynamic compensation for piping delays from the core to the loop temperature detectors. With normal axial power distribution, this reactor trip limit is always below the core safety limit as shown in the COLR. If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the reactor trip is automatically reduced according to the notations in Table 3.3-1.

Overpower T The Overpower T reactor trip provides assurance of fuel integrity, e.g., no melting, under all possible overpower conditions, limits the required range for Overtemperature T protection, and provides a backup to the High Neutron Flux trip. The setpoint includes corrections for changes in density and heat capacity of water with temperature, and dynamic compensation for piping delays from the core to the loop temperature detectors. No credit was taken for operation of this trip in the accident analyses; however, its functional capability at the specified trip setting is required by this specification to enhance the overall reliability of the Reactor Protection System.

Pressurizer Pressure The Pressurizer High and Low Pressure trips are provided to limit the pressure range in which reactor operation is permitted. The High Pressure trip is backed up by the pressurizer code safety valves for BEAVER VALLEY - UNIT 1 B 3/4 3-1d Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

RCS overpressure protection, and is therefore set lower than the set pressure for these valves (2485 psig). The Low Pressure trip provides protection by tripping the reactor in the event of a loss of reactor coolant pressure.

Pressurizer Water Level The Pressurizer High Water Level trip ensures protection against Reactor Coolant System overpressurization by limiting the water level to a volume sufficient to retain a steam bubble and prevent water relief through the pressurizer safety valves. No credit was taken for operation of this trip in the accident analyses; however, its functional capability at the specified trip setting is required by this specification to enhance the overall reliability of the Reactor Protection System.

Loss of Flow The Loss of Flow trips provide core protection to prevent DNB in the event of a loss of one or more reactor coolant pumps.

Above P-7, an automatic reactor trip will occur if the flow in any two loops drop below the trip setpoint. Above P-8, an automatic reactor trip will occur if the flow in any single loop drops below the trip setpoint.

Steam Generator Water Level The Steam Generator Water Level Low-Low trip provides core protection by preventing operation with the steam generator water level below the minimum volume required for adequate heat removal capacity. The specified setpoint provides allowance that there will be sufficient water inventory in the steam generators at the time of trip to allow for starting delays of the auxiliary feedwater system.

BEAVER VALLEY - UNIT 1 B 3/4 3-1e Amendment No. 240

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

Undervoltage and Underfrequency - Reactor Coolant Pump Busses The Undervoltage and Underfrequency Reactor Coolant Pump bus trips provide reactor core protection against DNB as a result of loss of voltage or underfrequency to more than one reactor coolant pump. The trip setpoints assure a reactor trip signal is generated before the low flow trip set point is reached. Time delays are incorporated in the underfrequency and undervoltage trips to prevent spurious reactor trips from momentary electrical power transients. For undervoltage, the delay is set so that the time required for a signal to reach the reactor trip breakers following the simultaneous trip of two or more reactor coolant pump bus circuit breakers shall not exceed 0.9 seconds. For underfrequency, the delay is set so that the time required for a signal to reach the reactor trip breakers after the underfrequency trip set point is reached shall not exceed 0.3 seconds.

Turbine Trip A Turbine Trip causes a direct reactor trip when operating above P-9.

Each of the turbine trips provides turbine protection and reduces the severity of the ensuing transient. No credit was taken in the accident analyses for operation of these trips. Their functional capability at the specified trip settings is required to enhance the overall reliability of the Reactor Protection System.

Safety Injection Input from ESF If a reactor trip has not already been generated by the reactor protective instrumentation, the ESF automatic actuation logic channels will initiate a reactor trip upon any signal which initiates a safety injection. This trip is provided to protect the core in the event of a LOCA. The ESF instrumentation channels which initiate a safety injection signal are shown in Table 3.3-3.

BEAVER VALLEY - UNIT 1 B 3/4 3-1f Amendment No. 240

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

Reactor Coolant Pump Breaker Position Trip The Reactor Coolant Pump Breaker Position Trips are anticipatory trips which provide reactor core protection against DNB resulting from the opening of two or more pump breakers above P-7. These trips are blocked below P-7. The open/close position trips assure a reactor trip signal is generated before the low flow trip set point is reached. No credit was taken in the accident analyses for operation of these trips. Their functional capability at the open/close position settings is required to enhance the overall reliability of the Reactor Protection System.

Reactor Trip System Interlocks The Reactor Trip System Interlocks perform the following functions:

P-6 Above the setpoint P-6 allows the manual block of the Source Range reactor trip and de-energizing of the high voltage to the detectors. Below the setpoint Source Range level trips are automatically reactivated and high voltage restored.

P-7 Above the setpoint P-7 automatically enables reactor trips on low flow or coolant pump breaker open in more than one primary coolant loop, reactor coolant pump bus undervoltage and underfrequency, pressurizer low pressure and pressurizer high level. Below the setpoint the above listed trips are automatically blocked.

P-8 Above the setpoint P-8 automatically enables reactor trip on low flow in one or more primary coolant loops. Below the setpoint P-8 automatically blocks the above listed trip.

P-9 Above the setpoint P-9 automatically enables a reactor trip on turbine trip. Below the setpoint P-9 automatically blocks a reactor trip on turbine trip.

P-10 Above the setpoint P-10 allows the manual block of the Intermediate Range reactor trip and the low setpoint Power Range reactor trip; and automatically blocks the Source Range reactor trip and de-energizes the Source Range high voltage power. Below the setpoint the Intermediate Range reactor trip and the low setpoint Power Range reactor trip are automatically reactivated. Provides input to P-7.

P-13 Provides input to P-7.

BEAVER VALLEY - UNIT 1 B 3/4 3-1g Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

OPERABILITY of the following trips in Table 3.3-1 provides additional diverse or anticipatory protection features and is not credited in the accident analyses:

Undervoltage - Reactor Coolant Pumps (Above P-7); Underfrequency Reactor Coolant Pumps (Above P-7); Turbine Trip (Above P-9); Reactor Coolant Pump Breaker Position Trip (Above P-7); Turbine Impulse Chamber Pressure, P-13.

Specified surveillance intervals and surveillance and maintenance outage times have been determined in accordance with WCAP-10271, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System," and supplements to that report as approved by the NRC and documented in the SER (letter to J. J. Sheppard from Cecil O. Thomas dated February 21, 1985).

Jumpers and lifted leads are not an acceptable method for placing equipment in bypass as documented in the NRC safety evaluation report for this WCAP.

The surveillance requirements for the Manual Trip Function, Reactor Trip Breakers and Reactor Trip Bypass Breakers are provided to reduce the possibility of an Anticipated Transient Without Scram (ATWS) event by ensuring OPERABILITY of the diverse trip features

(

Reference:

Generic Letter 85-09).

The measurement of response time at the specified frequencies provides assurance that the protective and ESF action function associated with each channel is completed within the time limit assumed in the accident analyses. No credit was taken in the analyses for those channels with response times indicated as not applicable.

ESF response times which include sequential operation of the RWST and VCT valves are based on values assumed in the Non-LOCA safety analyses and are provided in Section 3 of the Licensing Requirements Manual. These analyses take credit for injection of borated water.

Initial borated water is supplied by the BIT, however, injection of borated water from the RWST is assumed not to occur until the VCT charging pump suction valves are closed following opening of the RWST charging pump suction valves. When sequential operation of the RWST and VCT valves is not included in the response times, the values specified are based on the LOCA analyses. The LOCA analyses take BEAVER VALLEY - UNIT 1 B 3/4 3-1h Amendment No. 240

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) credit for injection flow regardless of the source. Verification of the response times will assure that the assumptions used for the LOCA and Non-LOCA analyses with respect to operation of the VCT and RWST valves are valid.

Response time may be demonstrated by any series of sequential, overlapping or total channel test measurements provided that such tests demonstrate the total channel response time as defined. Sensor response time verification may be demonstrated by either 1) in place, onsite or offsite test measurements or 2) utilizing replacement sensors with certified response times.

The Engineered Safety Feature Actuation System interlocks perform the following functions:

P-4 Reactor tripped - Actuates turbine trip, closes main feedwater valves on Tavg below setpoint, prevents the opening of the main feedwater valves which were closed by a safety injection or high steam generator water level signal, allows safety injection block so that components can be reset or tripped. Reactor not tripped - prevents manual block of safety injection.

P-11 Above the setpoint P-11 automatically reinstates safety injection actuation on low pressurizer pressure, automatically blocks steamline isolation on high steam pressure rate, enables safety injection and steamline isolation on low steamline pressure (with Loop Stop Valves Open), and enables auto actuation of the pressurizer PORVs.

Below the setpoint P-11 allows the manual block of safety injection actuation on low pressurizer pressure, allows manual block of safety injection and steamline isolation on low steamline pressure (with Loop Stop Valves Open) and enabling steamline isolation on high steam pressure rate, automatically disables auto actuation of the pressurizer PORVs unless the Reactor Vessel Over Pressure Protection System is in service.

P-12 Above the setpoint P-12 automatically reinstates an arming signal to the steam dump system. Below the setpoint P-12 blocks steam dump and allows manual bypass of the steam dump block to cooldown condenser dump valves.

BEAVER VALLEY - UNIT 1 B 3/4 3-1i Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

Table 3.3-1 Action 2 has been modified by two notes. Note (4) allows placing the inoperable channel in the bypass condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing: a) routine surveillance testing of other channels, and b) setpoint adjustments of other channels when required to reduce the setpoint in accordance with other technical specifications. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in accordance with WCAP-10271-P-A, Supplement 2, Revision 1, June 1990. Note (5) only requires SR 4.2.4 to be performed if a Power Range High Neutron Flux channel input to QPTR becomes inoperable. Failure of a component in the Power Range High Neutron Flux channel which renders the High Neutron Flux trip function inoperable may not affect the capability to monitor QPTR. As such, determining QPTR using the movable incore detectors once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months may not be necessary.

The following discussion pertains to Table 3.3-3, Functional Units 6.b and 6.c and the associated ACTION 34. The degraded voltage protection instrumentation system will automatically initiate the separation of the offsite power sources from the emergency buses.

This action results in an automatic diesel generator start signal being generated as a direct result of the supply breakers opening between the normal and emergency buses. The failure of the degraded voltage protection system results in a loss of one of the automatic start signals for the diesel generator. Therefore, the ACTION statement requires the affected diesel generator to be declared inoperable if the required actions cannot be met within the specified time period.

The instrumentation functions that receive input from neutron detectors are modified by a note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the power range neutron detectors consists of a normalization of the detectors based on a power calorimetric and flux map performed above 15% RATED THERMAL POWER. The power range neutron detector CHANNEL CALIBRATION is performed every 18 months but is not required for entry into MODE 2 or 1 on unit startup because the unit must be in at least MODE 1 to perform the test. The neutron detector CHANNEL CALIBRATION for the source range and intermediate range detectors consists of obtaining detector characteristics and performing an engineering evaluation of those characteristics. The intermediate range neutron detector CHANNEL CALIBRATION is performed every 18 months but is not required for entry into MODE 2 on unit startup because the unit must be in at least MODE 2 to perform the test. The source range neutron detector CHANNEL CALIBRATION is performed BEAVER VALLEY - UNIT 1 B 3/4 3-1j Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) every 18 months but is not required for entry into MODE 2 or 3 on unit shutdown because the unit must be in at least MODE 3 to perform the test. The P-6 permissive neutron detector CHANNEL CALIBRATION is performed in conjunction with the intermediate range neutron detectors. The overtemperature T, P-8, P-9 and P-10 permissive neutron detector CHANNEL CALIBRATIONS are performed in conjunction with the power range neutron detectors.

Source Range Neutron Flux The limiting condition for operation (LCO) requirement for the source range neutron flux trip function ensures that protection is provided against an uncontrolled rod cluster control assembly (RCCA) bank rod withdrawal accident from a subcritical condition during startup with the reactor trip breakers (RTBs) closed. This trip function provides redundant protection to the Power Range Neutron Flux-Low Setpoint and Intermediate Range Neutron Flux trip functions (See UFSAR Section 14.1.1). In MODES 3, 4, and 5, with the RTBs closed, administrative controls also prevent the uncontrolled withdrawal of rods. The nuclear instrumentation system (NIS) source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. In Modes 3, 4, and 5, with the reactor trip breakers closed, the source range detectors provide an automatic trip function with a setpoint in the shutdown range and the intermediate range detectors provide an automatic trip function with a setpoint in the power range. Therefore, the functional capability at the specified trip setpoint is assumed to be available.

The LCO requires two channels of source range neutron flux to be OPERABLE when the RTBs are closed. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip function. The LCO also requires one channel of the source range neutron flux to be OPERABLE in MODE 3, 4, or 5 with RTBs open. In this case, the source range function is to provide control room indication and the high flux at shutdown alarm. The outputs of the function to RTS logic are not required OPERABLE when the RTBs are open.

The source range neutron flux function provides protection for control rod withdrawal from subcritical, boron dilution and control rod ejection events. The function also provides visual neutron flux indication in the control room.

BEAVER VALLEY - UNIT 1 B 3/4 3-1k Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

In MODE 2 when below the P-6 setpoint during a reactor startup, the source range neutron flux trip must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and Power Range Neutron Flux-Low Setpoint trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range detectors are de-energized and not functional.

In MODE 3, 4, or 5 with the reactor shut down and with the control rod drive (CRD) system capable of rod withdrawal, the source range neutron flux trip function must also be OPERABLE. If the CRD system is not capable of rod withdrawal, the source range detectors are not required to trip the reactor. However, their monitoring function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution.

Suitable detectors used in place of primary source range neutron flux monitors are recognized as alternate detectors. Alternate detectors may be used in place of primary source range neutron flux monitors as long as the required neutron flux indication, high flux at shutdown alarm, and source range high neutron flux trip functions are provided.

ACTION 4 Item (a) applies to one inoperable source range neutron flux trip channel when in MODE 2, below the P-6 setpoint, and performing a reactor startup. With the unit in this condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the two channels inoperable, operations involving positive reactivity additions shall be suspended immediately.

This will preclude any power escalation. With only one source range channel OPERABLE, core protection is severely reduced and any actions that add positive reactivity to the core must be suspended immediately.

Item (b) applies to one inoperable source range neutron flux trip channel when in MODE 3, 4, or 5, with the RTBs closed and the CRD system capable of rod withdrawal. With the unit in this condition, the NIS source range performs the monitoring and protection functions. With one of the source range channels inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore it to OPERABLE status. If the channel cannot be returned to an OPERABLE status, 1 additional hour BEAVER VALLEY - UNIT 1 B 3/4 3-1l Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) is allowed to open the RTBs. Once the RTBs are open, rod withdrawal is not possible and the unit enters ACTION 5. The allowance of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to restore the channel to OPERABLE status, and the additional hour to open the RTBs, are justified in WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

Item (c) applies to two inoperable source range neutron flux trip channels when in MODE 2, below the P-6 setpoint, and performing a reactor startup, or in MODE 3, 4, or 5 with the RTBs closed and the CRD system capable of rod withdrawal. With the unit in this condition, below P-6, the NIS source range performs the monitoring and protection functions. With both source range channels inoperable, the RTBs must be opened immediately. With the RTBs open, rod withdrawal is not possible and the unit enters ACTION 5.

ACTION 5 This ACTION applies when the required number of OPERABLE source range neutron flux channels is not met in MODE 3, 4, or 5 with the RTBs open. With the unit in this condition, the NIS source range performs the monitoring function. With less than the required number of source range channels OPERABLE, operations involving positive reactivity additions shall be suspended immediately. This will preclude any power escalation. However, a note applicable to this ACTION allows plant cooldown as long as the shutdown margin is adequate to account for the positive reactivity addition resulting from the temperature change. This ensures the core is controlled and the shutdown margin requirements are satisfied for all applicable events. In addition to suspension of positive reactivity additions, the valve(s) that controls the addition of unborated water to the RCS must be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The isolation of unborated water sources will preclude a boron dilution accident.

Also, the shutdown margin (SDM) must be verified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter as per SR 4.1.1.1.1 or 4.1.1.2, SDM verification. With no source range channels OPERABLE, core protection is severely reduced. Verifying the SDM within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allows sufficient time to perform the calculations and determine that the SDM requirements are met. The SDM must also be verified once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter to ensure that the core reactivity has not changed. Item (a) precludes any positive reactivity additions; therefore, core reactivity should not be increasing, and a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months frequency is adequate. This does not include xenon decay which is BEAVER VALLEY - UNIT 1 B 3/4 3-1m Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) accounted for in the shutdown margin surveillance. The completion times of within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months are based on operating experience in performing the ACTIONS and the knowledge that unit conditions will change slowly.

SOURCE RANGE NEUTRON FLUX SURVEILLANCE REQUIREMENTS (SR)

CHANNEL CHECK The alternate source range detectors are modified by a note to indicate they are not subject to the source range detector surveillance requirements until they have been connected to the applicable circuits and are required to be OPERABLE. This complies with the testing requirements for components that are required to be OPERABLE.

Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK for a single channel involves a qualitative assessment of the channel indication to verify the channel is operating in the approximate range for the expected plant conditions. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the match criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The frequency is based on operating experience that demonstrates channel failure is rare. Thus, performance of the CHANNEL CHECK ensures that undetected overt channel failure is limited to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

BEAVER VALLEY - UNIT 1 B 3/4 3-1n Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

When the control rods are fully inserted and are not capable of withdrawal, inadvertent control rod withdrawal is not a concern and one source range detector can adequately monitor the core.

CHANNEL FUNCTIONAL TEST The alternate source range detectors are modified by a note to indicate they are not subject to the source range detector surveillance requirements until they have been connected to the applicable circuits and are required to be OPERABLE. This complies with the testing requirements for components that are required to be OPERABLE.

A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function.

Setpoints must be within the Allowable Values. The frequency of 92 days is justified for certain channels in WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

This surveillance is modified by a Note that specifies testing when below P-6 and is clarified to address the transition from MODE 2 to MODE 3. A transition into MODE 3 with the reactor trip breakers closed is often made for a short period of time during plant shutdown. During a normal shutdown, the reactor trip breakers are opened shortly after entering MODE 3. The transition time in MODE 3 from when the reactor trip breakers are closed to when they are opened is less than the time required to perform the CHANNEL FUNCTIONAL TEST prior to entering MODE 3. Therefore, an allowance to enter MODE 3 without first performing the source range CHANNEL FUNCTIONAL TEST is warranted.

When performing the CHANNEL FUNCTIONAL TEST for manual initiation functions, the injection of a simulated signal into the channel as close to the primary sensor as practicable is accomplished by manually operating the function's manual switch(es).

BEAVER VALLEY - UNIT 1 B 3/4 3-1o Amendment No. 239

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

CHANNEL CALIBRATION The alternate source range detectors are modified by a note to indicate they are not subject to the source range detector surveillance requirements until they have been connected to the applicable circuits and are required to be OPERABLE. This complies with the testing requirements for components that are required to be OPERABLE.

A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. The CHANNEL CALIBRATION for the source range neutron detectors consists of obtaining the detector plateau and preamp discriminator curves, evaluating those curves, and establishing detector operating conditions as directed by the detector manufacturer. The 18 month frequency is based on the need to perform this surveillance under the conditions that apply during a plant outage since performance at power is not possible. The protection and monitoring functions are also calibrated at an 18 month frequency as is normal for reactor protection instrument channels. Operating experience has shown these components usually pass the surveillance when performed on the 18 month frequency.

BEAVER VALLEY - UNIT 1 B 3/4 3-1p Amendment No. 239

INSTRUMENTATION BASES 3/4.3.3 MONITORING INSTRUMENTATION 3/4.3.3.1 RADIATION MONITORING INSTRUMENTATION The OPERABILITY of the radiation monitoring channels ensures that:

1) the radiation levels are continually measured in the areas served by the individual channels; 2) the alarm or automatic action is initiated when the radiation level trip setpoint is exceeded; and

3) sufficient information is available on selected plant parameters to monitor and assess these variables following an accident. This capability is consistent with the recommendations of NUREG-0737, "Clarification of TMI Action Plan Requirements," October, 1980.

A "recently" irradiated fuel assembly is fuel that has occupied part of a critical reactor core within the previous 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months .

3/4.3.3.2 (This Specification number is not used.)

3/4.3.3.3 (This Specification number is not used.)

3/4.3.3.4 (This Specification number is not used.)

BEAVER VALLEY - UNIT 1 B 3/4 3-2 Amendment No. 241

INSTRUMENTATION BASES 3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the remote shutdown instrumentation ensures that sufficient capability is available to permit shutdown and maintenance of HOT STANDBY of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criteria 19 of 10 CFR 50.

3/4.3.3.7 (This Specification number is not used.)

3/4.3.3.8 ACCIDENT MONITORING INSTRUMENTATION The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables during and following an accident. This capability is consistent with the recommendations of Regulatory Guide 1.97, "Instrumentation for Light-Water-Cooled Nuclear Plants to Assess Plant Conditions During and Following an Accident," December 1975 and NUREG-0578, "TMI-2 Lessons Learned Task Force Status Report and Short-Term Recommendations."

BEAVER VALLEY - UNIT 1 B 3/4 3-3 Amendment No. 233

INSTRUMENTATION BASES 3/4.3.3.11 EXPLOSIVE GAS MONITORING INSTRUMENTATION This instrumentation includes provisions for monitoring (and controlling) the concentrations of potentially explosive gas mixtures in the waste gas holdup system. The OPERABILITY and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63 and 64 of Appendix A to 10 CFR Part 50.

BEAVER VALLEY - UNIT 1 B 3/4 3-4 Amendment No. 188

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.1, 2, 3 REACTOR COOLANT LOOPS The plant is designed to operate with all reactor coolant loops in operation and maintain DNBR above the design DNBR limit during all normal operations and anticipated transients. In Modes 1 and 2, a loss of flow in two loops will cause a reactor trip if operating above P-7 while a loss of flow in one loop will cause a reactor trip if operating above P-8.

In MODE 3, a single reactor coolant loop provides sufficient heat removal capability for removing decay heat; however, due to the initial conditions assumed in the analysis for the control rod bank withdrawal from a subcritical condition, two operating coolant loops are required to meet the DNB design basis for this Condition II event.

In MODES 4 and 5, a single reactor coolant loop or RHR subsystem provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two loops be OPERABLE. Thus, if the reactor coolant loops are not OPERABLE, this specification requires two RHR loops to be OPERABLE.

The operation of one Reactor Coolant Pump or one RHR pump provides adequate flow to ensure mixing, prevent stratification and produce gradual reactivity changes during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reduction will, therefore, be within the capability of operator recognition and control.

The restrictions on starting a Reactor Coolant Pump with one or more non-isolated RCS cold legs less than or equal to the enable temperature set forth in Specification 3.4.9.3 are provided to prevent RCS pressure transients, caused by energy additions from the secondary system, which could exceed the limits of Appendix G to 10 CFR Part 50. The RCS will be protected against overpressure transients and will not exceed the limits of Appendix G by restricting starting of the RCPs to when the secondary side water temperature of each steam generator in a non-isolated loop is less than 50°F above each of the non-isolated RCS cold leg temperatures.

The secondary side water temperature is to be verified by direct measurements of the fluid temperature, or contact temperature readings on the steam generator secondary, or blowdown piping after purging of stagnant water within the piping. This shall be determined within 10 minutes prior to starting the first reactor coolant pump.

BEAVER VALLEY - UNIT 1 B 3/4 4-1 Change No. 1-004

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.4 LOOP ISOLATION VALVES BACKGROUND The RCS may be operated with loops isolated in order to perform maintenance. While operating with a loop isolated, there is a potential for inadvertently opening the isolation valves in the isolated loop. In this event, the coolant in the isolated loop would suddenly begin to mix with the coolant in the operating loops. This situation has the potential for causing a positive reactivity addition with a corresponding reduction of SHUTDOWN MARGIN if the boron concentration in the isolated loop is less than the required SHUTDOWN MARGIN.

As discussed in the UFSAR, the startup of an isolated loop is performed in a controlled manner that virtually eliminates any inappropriate sudden positive reactivity addition from unborated water because:

a. LCO 3.4.1.5, "Isolated Loop Startup," and plant operating procedures require that the boron concentration in the isolated loop be maintained higher than the SHUTDOWN MARGIN requirement for the operating loops, thus eliminating the potential for introducing coolant from the isolated loop that could dilute the boron concentration in the operating loops below the required SHUTDOWN MARGIN; and

b. The loop isolation valves cannot be opened unless the loop has been drained and refilled with water supplied from the refueling water storage tank or from the Reactor Coolant System. This would include water from the refueling cavity. This ensures adequate boron concentration in the water to refill the isolated loop, adequate mixing of the coolant in the isolated loop, and prevents any reactivity effects due to boron concentration stratification; and

c. Removing the power from the loop isolation valve operator ensures that a loop isolation valve will not be moved unless specifically intended by a procedure.

APPLICABLE SAFETY ANALYSES Isolated loop startup is limited to MODES 5 and 6 in accordance with the NRC SER on N-1 loop operation.

During startup of an isolated loop in accordance with LCO 3.4.1.5, operating procedures prevent the opening of the loop isolation valve until the isolated loop is drained and refilled with water supplied from the refueling water storage tank or Reactor BEAVER VALLEY - UNIT 1 B 3/4 4-1a Amendment No. 195

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.4 LOOP ISOLATION VALVES (Continued)

APPLICABLE SAFETY ANALYSES (Continued)

Coolant System, and the isolated loop boron concentration is verified. Verification of the isolated loop boron concentration prior to opening the isolated loop isolation valves provides a reassurance of the adequacy of the SHUTDOWN MARGIN. This ensures that any undesirable reactivity effect from the isolated loop does not occur. The safety analyses assume a minimum SHUTDOWN MARGIN as an initial condition for Design Basis Accidents (DBAs). Violation of the LCO, combined with mixing of the isolated loop coolant into the operating loops, could result in the SHUTDOWN MARGIN being less than that assumed in the safety analyses.

LCO LCO 3.4.1.4.1 ensures that a loop isolation valve that becomes closed in MODES 1 through 4 is fully closed and the plant placed in MODE 5.

LCO 3.4.1.4.2 ensures that power is removed from isolated loop isolation valve operators when closed to perform maintenance in MODES 5 or 6 to prevent an inadvertent loop startup.

APPLICABILITY LCO 3.4.1.4.1 is applicable in MODES 1 through 4 and LCO 3.4.1.4.2 is applicable whenever an RCS loop has been isolated in MODES 5 and 6 with fuel in the reactor vessel. LCO 3.4.1.4.2 is not applicable when there is no fuel in the reactor vessel. In MODES 5 and 6, controlled startup of isolated loops is possible without significant risk of inadvertent criticality.

An RCS loop is considered isolated in MODES 5 and 6 whenever the hot and cold leg isolation valves on one RCS loop are both in a fully closed position at the same time. One isolation valve may be stroked for testing in MODES 5 and 6 and the loop will not be considered isolated when either the hot leg or cold leg loop isolation valve remains open.

BEAVER VALLEY - UNIT 1 B 3/4 4-1b Amendment No. 195

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.4 LOOP ISOLATION VALVES (Continued)

ACTION For LCO 3.4.1.4.1

a. Should a loop isolation valve be closed in MODES 1 through 4, the affected loop isolation valve(s) must be maintained closed and the plant placed in MODE 5 to preclude inadvertent startup of the loop and the subsequent potential inadvertent positive reactivity insertion or criticality. The completion time of the ACTIONs allow time for borating the operating loops to a shutdown boration level such that the plant can be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

b. If power is inadvertently restored to one or more loop isolation valve operators, the potential exists for accidental isolation of a loop with a subsequent inadvertent startup of the isolated loop. The loop isolation valves have motor operators. Therefore, these valves will maintain their last position when power is removed from the valve operator. With power applied to the valve operators, only administrative controls prevent the valve from being operated. Although operating procedures make the occurrence of this event unlikely, the prudent action is to remove power from the loop isolation valve operators. The completion time of 30 minutes to remove power from the loop isolation valve operators is sufficient considering the complexity of the task.

For LCO 3.4.1.4.2 If power is inadvertently restored to one or more loop isolation valve operators, the potential exists for accidental isolation of a loop with a subsequent inadvertent startup of the isolated loop. The loop isolation valves have motor operators. Therefore, these valves will maintain their last position when power is removed from the valve operator. With power applied to the valve operators, only administrative controls prevent the valve from being operated.

Although operating procedures make the occurrence of this event unlikely, the prudent action is to remove power from the loop isolation valve operators. The completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to remove power from the loop isolation valve operators is sufficient considering the complexity of the task.

BEAVER VALLEY - UNIT 1 B 3/4 4-1c Amendment No. 195

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.4 LOOP ISOLATION VALVES (Continued)

SURVEILLANCE REQUIREMENTS (SR)

SR 4.4.1.4.1 SR 4.4.1.4.1 is performed at least once per 31 days to ensure that the RCS loop isolation valves are open, with power removed from the loop isolation valve operators. The primary function of this surveillance is to ensure that power is removed from the valve operators, since SR 4.4.1.1 ensures that the loop isolation valves are open by verifying every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that all loops are operating and circulating reactor coolant. The frequency of 31 days ensures that the required flow can be made available, is based on engineering judgment, and has proven to be acceptable. Operating experience has shown that the failure rate is so low that the 31 day frequency is justified.

SR 4.4.1.4.2 SR 4.4.1.4.2 is performed at least once per 7 days to ensure that the RCS loop isolation valves have power removed from the loop isolation valve operators. The frequency of 7 days which ensures that the power is removed from loop isolation valve operators, is based on engineering judgment, and has proven to be acceptable. Operating experience has shown that the failure rate is so low that the 7 day frequency is justified.

3/4.4.1.5 ISOLATED LOOP STARTUP BACKGROUND The RCS may be operated with loops isolated in order to perform maintenance. While operating with a loop isolated, there is a potential for inadvertently opening the isolation valves in the isolated loop. In this event, the coolant in the isolated loop would suddenly begin to mix with the coolant in the operating loops. This situation has the potential for causing a positive reactivity addition with a corresponding reduction of SHUTDOWN MARGIN if the boron concentration in the isolated loop is less than the required SHUTDOWN MARGIN.

As discussed in the UFSAR, the startup of an isolated loop is performed in a controlled manner that virtually eliminates any inappropriate sudden positive reactivity addition from unborated water because:

a. LCO 3.4.1.5, "Isolated Loop Startup," and plant operating procedures require that the boron concentration in the isolated loop be maintained higher than the SHUTDOWN MARGIN BEAVER VALLEY - UNIT 1 B 3/4 4-1d Amendment No. 195

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.5 ISOLATED LOOP STARTUP (Continued)

BACKGROUND (Continued) requirement for the operating loops, thus eliminating the potential for introducing coolant from the isolated loop that could dilute the boron concentration in the operating loops below the required SHUTDOWN MARGIN; and

b. The loop isolation valves cannot be opened unless the loop has been drained and refilled with water supplied from the refueling water storage tank or from the Reactor Coolant System. This would include water from the refueling cavity. This ensures adequate boron concentration in the water to refill the isolated loop, adequate mixing of the coolant in the isolated loop, and prevents any reactivity effects due to boron concentration stratification; and

c. Removing the power from the loop isolation valve operator ensures that a loop isolation valve will not be moved unless specifically intended by a procedure.

APPLICABLE SAFETY ANALYSES Isolated loop startup is limited to MODES 5 and 6 in accordance with the NRC SER on N-1 loop operation.

During startup of an isolated loop in accordance with LCO 3.4.1.5, operating procedures prevent the opening of the loop isolation valve until the isolated loop is drained and refilled with water supplied from the refueling water storage tank or Reactor Coolant System, and the isolated loop boron concentration is verified. Verification of the isolated loop boron concentration prior to opening the isolated loop isolation valves provides a reassurance of the adequacy of the SHUTDOWN MARGIN. This ensures that any undesirable reactivity effect from the isolated loop does not occur. The safety analyses assume a minimum SHUTDOWN MARGIN as an initial condition for Design Basis Accidents (DBAs). Violation of the LCO, combined with mixing of the isolated loop coolant into the operating loops, could result in the SHUTDOWN MARGIN being less than that assumed in the safety analyses.

LCO Loop isolation valves are used for performing maintenance when the plant is in MODES 5 or 6. LCO 3.4.1.5 ensures that the loop isolation valves remain closed on an isolated loop until the SHUTDOWN MARGIN in the isolated loop is within acceptable limits.

BEAVER VALLEY - UNIT 1 B 3/4 4-1e Amendment No. 195

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1.5 ISOLATED LOOP STARTUP (Continued)

APPLICABILITY In MODES 5 and 6, the SHUTDOWN MARGIN of the operating loops is large enough to permit operation with isolated loops. In these MODES, controlled startup of isolated loops is possible without significant risk of inadvertent criticality.

An RCS loop is considered isolated in MODES 5 and 6 whenever the hot and cold leg isolation valves on one RCS loop are both in a fully closed position at the same time. One isolation valve may be stroked for testing in MODES 5 and 6 and the loop will not be considered isolated when either the hot leg or cold leg loop isolation valve remains open.

ACTION The ACTION for LCO 3.4.1.5 assumes that the prerequisites of the LCO are not met and a loop isolation valve has been inadvertently opened.

Therefore, the ACTION requires immediate closure of isolation valves to preclude a potential boron dilution event.

SURVEILLANCE REQUIREMENTS (SR)

SR 4.4.1.5.1 and 4.4.1.5.3 As an additional measure to ensure that the boron concentration in an isolated loop remains within acceptable limits, SR 4.4.1.5.1 requires that an isolated loop is drained and refilled with borated water supplied from the refueling water storage tank or Reactor Coolant System prior to opening the hot or cold leg isolation valve in the isolated loop. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit ensures that there is no unacceptable boron concentration stratification in an isolated loop.

These surveillance frequencies have been shown to be acceptable through operating experience.

SR 4.4.1.5.2 To ensure that the boron concentration of the isolated loop meets acceptable limits, SR 4.4.1.5.2 is performed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months prior to opening either the hot or cold leg isolation valve. This provides reasonable assurance that the boron concentration will stay within acceptable limits until the loop is unisolated.

BEAVER VALLEY - UNIT 1 B 3/4 4-1f Amendment No. 195

3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.2 and 3/4.4.3 SAFETY VALVES The pressurizer code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2735 psig. Each safety valve is designed to relieve 345,000 lbs. per hour of saturated steam at the valve set point. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown. In the event that no safety valves are OPERABLE, an operating RHR loop, connected to the RCS, provides overpressure relief capability and will prevent RCS overpressurization.

During operation, all pressurizer code safety valves must be OPERABLE to prevent the RCS from being pressurized above its safety limit of 2735 psig. The combined relief capacity of all of these valves is greater than the maximum surge rate resulting from a complete loss of load assuming no reactor trip until the first Reactor Protective System trip set point is reached (i.e., no credit is taken for a direct reactor trip on the loss of load) and also assuming no operation of the power operated relief valves or steam dump valves.

BEAVER VALLEY - UNIT 1 B 3/4 4-1g Amendment No. 195

REACTOR COOLANT SYSTEM BASES 3/4.4.2 and 3/4.4.3 SAFETY VALVES (Continued)

Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of Section XI of the ASME Boiler and Pressure Code.

3/4.4.4 PRESSURIZER The requirement that (150)kw of pressurizer heaters and their associated controls be capable of being supplied electrical power from an emergency bus provides assurance that these heaters can be energized during a loss of offsite power condition to maintain natural circulation at HOT STANDBY.

3/4.4.5 STEAM GENERATORS One OPERABLE steam generator in a non-isolated reactor coolant loop provides sufficient heat removal capability to remove decay heat after a reactor shutdown. The requirement for two OPERABLE steam generators, combined with other requirements of the Limiting Conditions for Operation ensures adequate decay heat removal capabilities for RCS temperatures greater than 350°F if one steam generator becomes inoperable due to single failure considerations.

Below 350°F, decay heat is removed by the RHR system.

The Surveillance Requirements for inspection of the steam generator tubes ensure that the structural integrity of this portion of the RCS will be maintained. The program for inservice inspection of steam generator tubes is based on a modification of Regulatory Guide 1.83, Revision 1. Inservice inspection of steam generator tubing is essential in order to maintain surveillance of the conditions of the tubes in the event that there is evidence of mechanical damage or progressive degradation due to design, manufacturing errors, or inservice conditions that lead to corrosion. Inservice inspection of steam generator tubing also provides a means of characterizing the nature and cause of any tube degradation so that corrective measures can be taken.

The plant is expected to be operated in a manner such that the secondary coolant will be maintained within those parameter limits found to result in negligible corrosion of the steam generator tubes.

If the secondary coolant chemistry is not maintained within these parameter limits, localized corrosion may likely result in stress corrosion cracking. The extent of cracking during plant BEAVER VALLEY - UNIT 1 B 3/4 4-2 Amendment No. 173

REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATORS (Continued) operation would be limited by the limitation of steam generator tube leakage between the Primary Coolant System and the Secondary Coolant System (primary-to-secondary LEAKAGE = 150 gallons per day per steam generator). Axial cracks having a primary-to-secondary LEAKAGE less than this limit during operation will have an adequate margin of safety to withstand the loads imposed during normal operation and by postulated accidents. Operating plants have demonstrated that primary-to-secondary LEAKAGE of 150 gallons per day per steam generator can readily be detected. Leakage in excess of this limit will require plant shutdown and an unscheduled inspection, during which the leaking tubes will be located and plugged or repaired by sleeving. The technical bases for sleeving are described in the approved vendor reports listed in Surveillance Requirement 4.4.5.4.a.9.

Wastage-type defects are unlikely with the all volatile treatment (AVT) of secondary coolant. However, even if a defect of similar type should develop in service, it will be found during scheduled inservice steam generator tube examinations. Plugging or repair will be required of all tubes with imperfections exceeding the plugging or repair limit. Degraded steam generator tubes may be repaired by the installation of sleeves which span the degraded tube section. A steam generator tube with a sleeve installed meets the structural requirements of tubes which are not degraded, therefore, the sleeve is considered a part of the tube. The surveillance requirements identify those sleeving methodologies approved for use. If an installed sleeve is found to have through wall penetration greater than or equal to the plugging limit, the tube must be plugged. The plugging limit for the sleeve is derived from R.G. 1.121 analysis which utilizes a 20 percent allowance for eddy current uncertainty in determining the depth of tube wall penetration and additional degradation growth. Steam generator tube inspections of operating plants have demonstrated the capability to reliably detect degradation that has penetrated 20 percent of the original tube wall thickness.

The voltage-based repair limits of these surveillance requirements (SR) implement the guidance in Generic Letter (GL) 95-05 and are applicable only to Westinghouse-designed steam generators (SGs) with outside diameter stress corrosion cracking (ODSCC) located at the tube-to-tube support plate intersections. The voltage-based repair limits are not applicable to other forms of SG tube degradation nor are they applicable to ODSCC that occurs at other locations within the SG. Additionally, the repair criteria apply only to indications where the degradation mechanism is dominantly axial ODSCC with BEAVER VALLEY - UNIT 1 B 3/4 4-2a Amendment No. 208

REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATORS (Continued) no NDE detectable cracks extending outside the thickness of the support plate. Refer to GL 95-05 for additional description of the degradation morphology.

Implementation of these SRs requires a derivation of the voltage structural limit from the burst versus voltage empirical correlation and then the subsequent derivation of the voltage repair limit from the structural limit (which is then implemented by this surveillance).

The voltage structural limit is the voltage from the burst pressure/bobbin voltage correlation, at the 95-percent prediction interval curve reduced to account for the lower 95/95-percent tolerance bound for tubing material properties at 650°F (i.e., the 95-percent LTL curve). The voltage structural limit must be adjusted downward to account for potential degradation growth during an operating interval and to account for NDE uncertainty. The upper voltage repair limit; VURL, is determined from the structural voltage limit by applying the following equation:

VURL = VSL - VGr - VNDE where VGr represents the allowance for degradation growth between inspections and VNDE represents the allowance for potential sources of error in the measurement of the bobbin coil voltage. Further discussion of the assumptions necessary to determine the voltage repair limit are discussed in GL 95-05.

Safety analyses were performed pursuant to Generic Letter 95-05 to determine the maximum MSLB-induced primary-to-secondary leak rate that could occur without offsite doses exceeding a small fraction of 10 CFR 100 (concurrent iodine spike), 10 CFR 100 (pre-accident iodine spike), and without control room doses exceeding GDC-19. The current value of this allowable leak rate and a summary of the analyses are provided in Section 14.2.5 of the UFSAR.

The mid-cycle equation in SR 4.4.5.4.a.10.d should only be used during unplanned inspections in which eddy current data is acquired for indications at the tube support plates.

SR 4.4.5.5 implements several reporting requirements recommended by GL 95-05 for situations which the NRC wants to be notified prior to returning the SGs to service. For the purposes of this reporting requirement, leakage and conditional burst probability can be calculated based on the as-found voltage distribution rather than the projected end-of-cycle (EOC) voltage distribution (refer to GL 95-05 BEAVER VALLEY - UNIT 1 B 3/4 4-2b Amendment No. 219

REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATORS (Continued) for more information) when it is not practical to complete these calculations using the projected EOC voltage distributions prior to returning the SGs to service. Note that if leakage and conditional burst probability were calculated using the measured EOC voltage distribution for the purposes of addressing the GL section 6.a.1 and 6.a.3 reporting criteria, then the results of the projected EOC voltage distribution should be provided per the GL section 6.b (c) criteria.

Whenever the results of any steam generator tubing inservice inspection fall into Category C-3, these results will be reported to the Commission pursuant to Specification 6.6 prior to resumption of plant operation. Such cases will be considered by the Commission on a case-by-case basis and may result in a requirement for analysis, laboratory examinations, tests, additional eddy-current inspection, and revision of the Technical Specifications, if necessary.

BEAVER VALLEY - UNIT 1 B 3/4 4-2c Amendment No. 208

REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION BACKGROUND GDC 30 of Appendix A to 10 CFR 50 requires means for detecting and, to the extent practical, identifying the source of RCS LEAKAGE.

Regulatory Guide 1.45 describes acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.

Industry practice has shown that water flow changes of 0.5 to 1.0 gpm can be readily detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump.

The non-ECCS portion of the containment sump used to collect unidentified LEAKAGE is instrumented to alarm due to abnormal increases in the water inventory. The sensitivity is acceptable for detecting increases in unidentified LEAKAGE.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation.

Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects.

Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE.

An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS LEAKAGE.

Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump. Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

BEAVER VALLEY - UNIT 1 B 3/4 4-3 Amendment No. 183

REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION (Continued)

BACKGROUND (Continued)

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.

APPLICABLE SAFETY ANALYSES The need to evaluate the severity of an alarm or an indication is important to the operators, and the ability to compare and verify with indications from other systems is necessary. Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.

The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public.

LCO One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

BEAVER VALLEY - UNIT 1 B 3/4 4-3a Amendment No. 183

REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION (Continued)

LCO (Continued)

The LCO is satisfied when monitors of diverse measurement means are available. Thus, the containment sump monitor, in combination with a gaseous or particulate radioactivity monitor, provides an acceptable minimum. The containment sump monitor is comprised of the instruments associated with the non-ECCS portion of the containment sump which monitor narrow range level and sump pump discharge flow.

APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.

In MODE 5 or 6, the temperature is to be less than or equal to 200°F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

ACTIONS

a. With the required containment sump monitor inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere radioactivity monitoring system will provide indications of changes in leakage. Together with the atmosphere monitor, the periodic surveillance for RCS water inventory balance, SR 4.4.6.2.b, must be performed at an increased frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to provide information that is adequate to detect leakage.

Restoration of the required sump monitor to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the frequency and adequacy of the RCS water inventory balance required by Required Action "a."

BEAVER VALLEY - UNIT 1 B 3/4 4-3b Amendment No. 183

REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION (Continued}

ACTIONS (Continued)

Required Action "a" is modified by a Note that indicates that the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when the containment sump monitor is inoperable. This allowance is provided because other instrumentation is available to monitor RCS leakage.

b.1. and b.2.

With both gaseous and particulate containment atmosphere radioactivity monitoring instrumentation channels inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR. 4.4.6.2.b, must be performed to provide alternate periodic information.

With a sample obtained and analyzed or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the reactor may be operated for up to 30 days to allow restoration of the required containment atmosphere radioactivity monitors.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect leakage. The 30 day Completion Time recognizes at least one other form of leakage detection is available.

Required Action "b" is modified by a Note that indicates that the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when the gaseous and particulate containment atmosphere radioactivity monitor channel is inoperable. This allowance is provided because other instrumentation is available to monitor for RCS LEAKAGE.

c. With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown is required. The plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.

BEAVER VALLEY - UNIT 1 B 3/4 4-3c Amendment No. 183

REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION (Continued)

SURVEILLANCE REQUIREMENTS (SR)

SR 4.4.6.1.a SR 4.4.6.1.a requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives reasonable confidence that the channel is operating properly.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

SR 4.4.6.1.a requires the performance of a CHANNEL FUNCTIONAL TEST on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency of 31 days considers instrument reliability, and operating experience has shown that it is proper for detecting degradation.

SR 4.4.6.1.a also requires the performance of a CHANNEL CALIBRATION on the required containment atmosphere radioactivity monitor. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 18 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this Frequency is acceptable.

SR 4.4.6.1.b SR 4.4.6.1.b requires the performance of a CHANNEL CALIBRATION on the required containment sump monitor. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 18 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this Frequency is acceptable.

3/4.4.6.2 OPERATIONAL LEAKAGE BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.

BEAVER VALLEY - UNIT 1 B 3/4 4-3d Amendment No. 183

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

BACKGROUND (Continued)

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.

10 CFR 50, Appendix A, GDC 30, requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 describes acceptable methods for selecting leakage detection systems.

The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary.

Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public.

A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100 percent leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.

This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).

APPLICABLE SAFETY ANALYSES Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can BEAVER VALLEY - UNIT 1 B 3/4 4-3e Amendment No. 183

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

APPLICABLE SAFETY ANALYSES (Continued) affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere conservatively assumes a 10 gpm primary-to-secondary LEAKAGE. With the exception described below for the main steamline break (MSLB) analyzed in support of voltage-based steam generator tube repair criteria.

Primary-to-secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steamline break (SLB) accident.

To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid.

The MSLB is more limiting for site radiation releases. The primary-to-secondary LEAKAGE assumed in the safety analysis for the MSLB accident is described in UFSAR Section 14.2.5. The radiological consequences of a MSLB outside of containment was reanalyzed in support of the tube support plate voltage-based repair criteria stated in SR 4.4.5.4.a.10. For this analysis, the thyroid dose was maximized at 10% of the 10 CFR Part 100 guideline of 300 rem for the co-incident iodine spike case. RCS leakage was based on projection rather than on technical specification leakage limits. The analysis indicated that offsite doses would remain within regulatory criteria with the assumed primary-to-secondary leakage (described in UFSAR Section 14.2.5) should steam generator tubes fail due to the depressurization associated with a MSLB.

A similar analysis was performed using a control room thyroid dose of 30 rem as the criterion. The control room was assumed to be manually isolated and pressurized at T=30 minutes for a period of one hour, at which time filtered emergency intake would be automatically started. The control room would be purged with fresh air at T=8 hours following release cessation. The analysis indicated that control room doses would remain within regulatory criteria with the assumed primary-to-secondary leakage (described in UFSAR Section 14.2.5) should steam generator tubes fail due to the depressurization associated with a MSLB.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is BEAVER VALLEY - UNIT 1 B 3/4 4-3f Amendment No. 219

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

LCO (Continued) unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Should pressure boundary LEAKAGE occur through a component which can be isolated from the balance of the Reactor Coolant System, plant operation may continue provided the leaking component is promptly isolated from the Reactor Coolant System since isolation removes the source of potential failure.

b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.

c. Primary-to-Secondary LEAKAGE through Any One SG Operating experience at PWR plants has shown that sudden increases in leak rate are often precursors to larger tube failures. Maintaining an operating LEAKAGE limit of 150 gpd per steam generator will minimize the potential for a large LEAKAGE event at power. This operating LEAKAGE limit is more restrictive than the operating LEAKAGE limit in standardized technical specifications.

This provides additional margin to accommodate a tube flaw which might grow at a greater than expected rate or unexpectedly extend outside the thickness of the tube support plate. This reduced LEAKAGE limit, in conjunction with a leak rate monitoring program, provides additional assurance that this precursor LEAKAGE will be detected and the plant shut down in a timely manner.

BEAVER VALLEY - UNIT 1 B 3/4 4-3g Amendment No. 219

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

d. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of identified LEAKAGE and is well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).

Violation of this LCO could result in continued degradation of a component or system.

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

LCO 3.4.6.3, "RCS Pressure Isolation Valve (PIV)," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.

ACTIONS

a. If any pressure boundary LEAKAGE exists, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.

BEAVER VALLEY - UNIT 1 B 3/4 4-3h Amendment No. 198

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

ACTIONS (Continued)

b. Unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.

If the unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.

SURVEILLANCE REQUIREMENTS (SR)

SR 4.4.6.2 Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance. Primary to secondary LEAKAGE is also measured by performance of an RCS water inventory balance in conjunction with effluent monitoring within the secondary steam and feedwater systems.

The RCS water inventory balance must be met with the reactor at steady state operating conditions and near operating pressure.

Therefore, this SR is not required to be performed in MODES 3 and 4 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of steady state operation near operating pressure have been established.

BEAVER VALLEY - UNIT 1 B 3/4 4-3i Amendment No. 184

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

SR 4.4.6.2 (Continued)

Steady state operation is required to perform a proper inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met when steady state is established.

For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the systems that monitor the containment atmosphere radioactivity and the containment sump level. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months monitoring of the leakage detection system is sufficient to provide an early warning of increased RCS LEAKAGE. These leakage detection systems are specified in LCO 3.4.6.1, "Leakage Detection Instrumentation."

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. Note (1) states that the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months surveillance is required only on leakage detection instrumentation required by LCO 3.4.6.1. This Note allows the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months monitoring to be suspended on leakage detection instrumentation which is inoperable or not required to be operable per LCO 3.4.6.1. Note (2) states that this SR is required to be performed during steady state operation.

3/4.4.6.3 PRESSURE ISOLATION VALVE LEAKAGE The leakage from any RCS pressure isolation valve is sufficiently low to ensure early detection of possible in-series valve failure. It is apparent that when pressure isolation is provided by two in-series valves and when failure of one valve in the pair can go undetected for a substantial length of time, verification of valve integrity is required. Since these valves are important in preventing overpressurization and rupture of the ECCS low pressure piping which could result in a LOCA, these valves should be tested periodically to ensure low probability of gross failure.

The Surveillance Requirements for RCS pressure isolation valves provide added assurance of valve integrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA.

Leakage from the RCS pressure isolation valve is identified LEAKAGE and will be considered as a portion of the allowed limit.

BEAVER VALLEY - UNIT 1 B 3/4 4-3j Amendment No. 184

REACTIVITY CONTROL SYSTEMS BASES 3/4.4.7 CHEMISTRY The limitations on Reactor Coolant System chemistry ensure that corrosion of the Reactor Coolant System is minimized and reduces the potential for Reactor Coolant System leakage or failure due to stress corrosion. Maintaining the chemistry within the Steady State Limits provides adequate corrosion protection to ensure the structural integrity of the Reactor Coolant System over the life of the plant.

The associated effects of exceeding the oxygen, chloride and fluoride limits are time and temperature dependent. Corrosion studies show that operation may be continued with contaminant concentration levels in excess of the Steady State Limits, up to the Transient Limits, for the specified limited time intervals without having a significant effect on the structural integrity of the Reactor Coolant System.

The time interval permitting continued operation within the restrictions of the Transient Limits provides time for taking corrective actions to restore the contaminant concentrations to within the Steady State Limits.

The surveillance requirements provide adequate assurance that concentrations in excess of the limits will be detected in sufficient time to take corrective action.

3/4.4.8 SPECIFIC ACTIVITY The primary coolant specific activity is limited in order to maintain offsite and control room operator doses associated with postulated accidents within applicable requirements. Specifically, the 0.10 µCi/gm DOSE EQUIVALENT I-131 limit ensures that the offsite dose does not exceed a small fraction of 10 CFR Part 100 guidelines and that control room operator thyroid dose does not exceed GDC-19 in the event of primary-to-secondary leakage induced by a main steam line break.

BEAVER VALLEY - UNIT 1 B 3/4 4-4 Amendment No. 244

REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (Continued)

The ACTION statement permitting POWER OPERATION to continue for limited time periods with the primary coolants specific activity

> 0.10 µCi/gram DOSE EQUIVALENT I-131, but within the allowable limit shown on Figure 3.4-1, accommodates possible iodine spiking phenomenon which may occur following changes in THERMAL POWER.

Operation with specific activity levels exceeding 0.10 µCi/gram DOSE EQUIVALENT I-131 for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months during one continuous time interval or exceeding the limits shown on Figure 3.4-1 must be restricted to ensure that assumptions made in the UFSAR accident analyses are not exceeded. [Note: The "Acceptable Operation" line is 6 µCi/gram DOSE EQUIVALENT I-131 for 80-100% power.]

Reducing Tavg to < 500°F minimizes the release of activity should a steam generator tube rupture since the saturation pressure of the primary coolant is below the lift pressure of the atmospheric steam relief valves. This action also reduces the pressure differential across the steam generator tubes reducing the probability and magnitude of main steam line break accident induced primary-to-secondary leakage. The surveillance requirements provide adequate assurance that excessive specific activity levels in the primary coolant will be detected in sufficient time to take corrective action. Information obtained on iodine spiking will be used to assess the parameters associated with spiking phenomena. A reduction in frequency of isotopic analyses following power changes may be permissible if justified by the data obtained.

3/4.4.9 PRESSURE/TEMPERATURE LIMITS All components in the Reactor Coolant System are designed to withstand the effects of cyclic loads due to system temperature and pressure changes. These cyclic loads are introduced by normal load transients, reactor trips, and startup and shutdown operations. The various categories of load cycles used for design purposes are provided in Section 4.1.4 of the UFSAR. During startup and shutdown, the rates of temperature and pressure changes are limited so that the maximum specified heatup and cooldown rates are consistent with the design assumptions and satisfy the stress limits for cyclic operation.

During heatup, the thermal gradients in the reactor vessel wall produce thermal stresses which vary from compressive at the inner wall to tensile at the outer wall. These thermal-induced compressive stresses tend to alleviate the tensile stresses induced by the internal pressure. Therefore, a pressure-temperature curve based on steady state conditions (i.e., no thermal stresses) represents a lower bound of all similar curves for finite heatup rates when the inner wall of the vessel is treated as the governing location.

BEAVER VALLEY - UNIT 1 B 3/4 4-5 Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

The heatup analysis also covers the determination of pressure-temperature limitations for the case in which the outer wall of the vessel becomes the controlling location. The thermal gradients established during heatup produce tensile stresses at the outer wall of the vessel. These stresses are additive to the pressure induced tensile stresses which are already present. The thermal induced stresses at the outer wall of the vessel are tensile and are dependent on both the rate of heatup and the time along the heatup ramp; therefore, a lower bound curve similar to that described for the heatup of the inner wall cannot be defined. Subsequently, for the cases in which the outer wall of the vessel becomes the stress controlling location, each heatup rate of interest must be analyzed on an individual basis.

The heatup limit curve, Figure 3.4-2, is a composite curve which was prepared by determining the most conservative case, with either the inside or outside wall controlling, for any heatup rate up to 100°F per hour. The cooldown limit curves, Figure 3.4-3 are composite curves which were prepared based upon the same type analysis with the exception that the controlling location is always the inside wall where the cooldown thermal gradients tend to produce tensile stresses while producing compressive stresses at the outside wall. The heatup and cooldown curves were prepared based upon the most limiting value of the predicted adjusted reference temperature at the time in life indicated on the respective curves.

The reactor vessel materials have been tested to determine their initial RTNDT; the results of these tests are shown in Table B 3/4.4-1. Reactor operation and resultant fast neutron (E > 1 MeV) irradiation will cause an increase in the RTNDT. Therefore, an adjusted reference temperature, based upon the fluence, copper content and nickel content of the material in question, can be predicted using WCAP-15570, Rev. 2 and Regulatory Guide 1.99, Revision 2. The heatup and cooldown limit curves, Figures 3.4-2 and 3.4-3 include predicted adjustments for this shift in RTNDT.

The heatup and cooldown curves have been developed in accordance with the methodology provided in Regulatory Guide 1.99, Revision 2 and no longer contain the additional margin of 10°F and 60 psig for instrument error previously incorporated in these curves.

BEAVER VALLEY - UNIT 1 B 3/4 4-6 Change No. 1-004

FIGURE B 3/4 4-1 PREDICTED DECREASE IN SHELF ENERGY AS A FUNCTION OF COPPER CONTENT AND FLUENCE BEAVER VALLEY - UNIT 1 B 3/4 4-6a Change No. 1-004

TABLE B 3/4.4-1 REACTOR VESSEL TOUGHNESS DATA (UNIRRADIATED)

Cu Ni P TNDT RTNDT Upper Shelf Energy (Ft-lb)

Component Heat No. Code No. Material Type

(%) (%) (%) (°F) (°F) MWD NMWD Closure Head C6213-1B B6610 A533B CL. 1 .15 --- .010 -40 0* 121 ---

Dome Closure Head A5518-2 B6611 A533B CL. 1 .14 --- .015 -20 -20* 131 ---

Seg.

Closure Head ZV3758 --- A508 CL. 2 .08 --- .007 60* 60* >100 ---

Flange Vessel Flange ZV3661 --- A508 CL. 2 .12 --- .010 60* 60* 166 ---

Inlet Nozzle 9-5443 --- A508 CL. 2 .10 --- .008 60* 60* 82.5 ---

Inlet Nozzle 9-5460 --- A508 CL. 2 .10 --- .010 60* 60* 94 ---

Inlet Nozzle 9-5712 --- A508 CL. 2 .08 --- .007 60* 60* 97 ---

Outlet Nozzle 9-5415 --- A508 CL. 2 --- --- .008 60* 60* 97 ---

Outlet Nozzle 9-5415 --- A508 CL. 2 --- --- .007 60* 60* 112.5 ---

Outlet Nozzle 9-5444 --- A508 CL. 2 .09 --- .007 60* 60* 103 ---

Upper Shell 123V339 --- A508 CL. 2 --- --- .010 40 40* 155 ---

Inter Shell C4381-2 B6607-2 A533B CL. 1 .14 .62 .015 -10 73 123 82.5 Inter Shell C4381-1 B6607-1 A533B CL. 1 .14 .62 .015 -10 43 128.5 90 Lower Shell C6317-1 B6903-1 A533B CL. 1 .20 .54 .010 -50 27 134 80 Lower Shell C6293-2 B7203-2 A533B CL. 1 .14 .57 .015 -20 20 129.5 83.5 Trans Ring 123V223 --- A508 CL. 2 --- --- --- 30 30* 143 ---

Bottom Hd Seg C4423-3 B6618 A533B CL. 1 .13 --- .008 -30 -29* 124 ---

Bottom Hd C4482-1 B6619 A533B CL. 1 .13 --- .015 -50 -33* 125.5 ---

Dome Inter to Lower 90136 --- --- .27 .07 --- --- -56 --- > 100 Shell Weld Inter Shell 305424 --- --- .28 .63 --- --- -56 --- > 100 Long. Weld Lower Shell 305414 --- --- .34 .61 --- --- -56 --- > 100 Long. Weld Weld HAZ --- --- --- -40 -40 --- 136.5

Estimated Per NRC Standard Review Plan Branch Technical Position MTEB 5-2 MWD - Major Working Direction NMWD - Normal to Major Working Direction Note: For evaluation of Inservice Reactor Vessel Irradiation damage assessments, the best estimate chemistry values reported in the latest response to Generic Letter 92-01 or equivalent document are applicable.

BEAVER VALLEY - UNIT 1 B 3/4 4-7 Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

Heatup and cooldown limit curves are calculated using the most limiting value of RTNDT (reference nilductility temperature). The most limiting RTNDT of the material in the core region of the reactor vessel is determined by using the preservice reactor vessel material properties and estimating the radiation-induced RTNDT. RTNDT is designated as the higher of either the drop weight nil-ductility transition temperature (TNDT) or the temperature at which the material exhibits at least 50 ft lb of impact energy and 35-mil lateral expansion (normal to the major working direction) minus 60°F.

RTNDT increases as the material is exposed to fast-neutron radiation.

Thus, to find the most limiting RTNDT at any time period in the reactor's life, RTNDT due to the radiation exposure associated with that time period must be added to the original unirradiated RTNDT.

The extent of the shift in RTNDT is enhanced by certain chemical elements (such as copper and nickel) present in reactor vessel steels. The Regulatory Guide 1.99 Revision 2 curves which show the effect of fluence and copper content on upper shelf energy (USE) for reactor vessel steels are shown in Figure B 3/4.4-1.

Given the copper and nickel contents of the most limiting material, the radiation-induced RTNDT can be predicted by the equation:

RTNDT = (CF)f(0.28-0.1 Logf) where f = fluence (n/cm2, E > 1.0 MeV) and CF = chemistry factor, a function of copper and nickel. Fast-neutron fluence (E > 1 MeV) at the 1/4 T (wall thickness) and 3/4 T (wall thickness) vessel locations can be generated as a function of full-power service life. The data for all other ferritic materials in the reactor coolant pressure boundary are examined to insure that no other component will be limiting with respect to RTNDT.

BEAVER VALLEY - UNIT 1 B 3/4 4-7a Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

The preirradiation fracture-toughness properties of the Beaver Valley Unit 1 reactor vessel materials are presented in Table B 3/4.4-1.

The fracture toughness properties of the ferritic material in the reactor coolant pressure boundary are determined in accordance with the NRC Regulatory Standard Review plan.[1] The postirradiation fracture toughness properties of the reactor vessel beltline material, determined in accordance with 1996 Addenda to ASME Section XI, Appendix G and ASME Code Case N-640, were obtained directly from the Beaver Valley Unit 1 Vessel Material Surveillance Program.

Regulatory Guide 1.99, Revision 2, is used for the calculation of Adjusted Reference Temperature (ART) values at the 1/4T and 3/4T locations, where T is the thickness of the vessel at the beltline region measured from the clad/base metal interface. Adjusted Reference Temperature (ART), defined as ART = initial RTNDT + Margins for uncertainties + RTNDT, is used to index the material to the KIC curve and, in turn, to set operating limits for the nuclear power plant which take into account the effects of irradiation on the reactor vessel materials. The most limiting ART values are used in the generation of heatup and cooldown pressure-temperature limit curves for normal operation.

The pressure-temperature limit curves are developed using ASME Code Case N-640. One of the safety margins incorporated into the curves is the lower bound fracture toughness curve. The lower bound fracture toughness curves available in Appendix G to ASME Section XI use the reference stress intensity factor KIA. The pressure-temperature limit curves based on Code Case N-640 use the reference stress intensity factor KIC. KIA is a fracture toughness curve which is a lower bound on all static, dynamic and arrest fracture toughness, and KIC is a fracture toughness curve which is a lower bound on static fracture toughness only. The only change that is made when generating the revised pressure-temperature limits curve with KIC is the lower bound fracture toughness curve selected. All other margins involved in the generation process remain unchanged.

Since the heatup and cooldown process is a very slow one, with the fastest rate allowed being 100°F per hour, the rate of change of pressure and temperature is considered constant so that the stress is essentially constant. Both heatup and cooldown correspond to

1. "Fracture Toughness Requirements," Branch Technical Position MTEB No. 5-2, Section 5.3.2-14 in Standard Review Plan, NUREG-75/087, 1975.

BEAVER VALLEY - UNIT 1 B 3/4 4-7b Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued) static loading, with regard to fracture toughness. The only time when dynamic loading can occur and where the dynamic/arrest toughness KIA should be used for the reactor pressure vessel is when a crack is running. This might happen during a pressurized thermal shock event, but not during heatup and cooldown. Therefore, the static toughness KIC lower bound toughness is used to generate the pressure-temperature limit curves.

The ASME approach for calculating the allowable limit curves for various heatup and cooldown rates specifies that the total stress intensity factor, KI, for the combined thermal and pressure stresses at any time during heatup and cooldown cannot be greater than the reference stress intensity factor, KIC, for the metal temperature at that time. KIC is obtained from the reference fracture toughness curve, defined in Appendix G (Code Case N-640) to the ASME Code.[2]

The KIC curve is given by the equation:

[0.02(T-RTNDT )]

KIC = 33.2 + 20.734

e (4-1) where KIC is the reference stress intensity factor as a function of the metal temperature T and the metal reference nilductility temperature RTNDT. Thus, the governing equation for the heatup-cooldown analysis is defined in Appendix G (Code Case N-640) to the ASME Code[2] as follows:

C KIM + KIt KIC (4-2)

2. ASME Boiler and Pressure Vessel Code,Section III, Division 1 -

Appendices, "Rules for Construction of Nuclear Vessels,"

Appendix G. "Protection Against Nonductile Failure,"

pp. 461-469, 1980 Edition, American Society of Mechanical Engineers, New York, 1980.

BEAVER VALLEY - UNIT 1 B 3/4 4-7c Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued) where:

KIM is the stress intensity factor caused by membrane (pressure) stress KIt is the stress intensity factor caused by the thermal gradients KIC is a function of temperature relative to the RTNDT of the material C = 2.0 for Level A and Level B service limits C = 1.5 for hydrostatic and leak test conditions during which the reactor core is not critical At any time during the heatup or cooldown transient, KIC is determined by the metal temperature at the tip of the postulated flaw at the 1/4T and 3/4T location, the appropriate value for RTNDT, and the reference fracture toughness curve. The thermal stresses resulting from temperature gradients through the vessel wall are calculated and then the corresponding thermal stress intensity factors, KIt, for the reference flaw are computed. From equation (4-2), the pressure stress intensity factors are obtained and, from these, the allowable pressures are calculated.

Cooldown For the calculation of the allowable pressure-versus-coolant temperature during cooldown, the Code reference flaw is assumed to exist at the inside of the vessel wall. During cooldown, the controlling location of the flaw is always at the inside of the wall because the thermal gradients produce tensile stresses at the inside, which increase with increasing cooldown rates. Allowable pressure-temperature relations are generated for both steady-state and finite cooldown rate situations. From these relations, composite limit curves are constructed for each cooldown rate of interest.

The use of the composite curve in the cooldown analysis is necessary because control of the cooldown procedure is based on measurement of reactor coolant temperature, whereas the limiting pressure is actually dependent on the material temperature at the tip of the assumed flaw. During cooldown, the 1/4T vessel location is at a higher temperature than the fluid adjacent to the vessel ID. This condition, of course, is not true for the steady-state situation.

BEAVER VALLEY - UNIT 1 B 3/4 4-8 Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

It follows that, at any given reactor coolant temperature, the T developed during cooldown results in a higher value of KIC at the 1/4T location for finite cooldown rates than for steady-state operation. Furthermore, if conditions exist such that the increase in KIC exceeds KIt, the calculated allowable pressure during cooldown will be greater than the steady-state value.

The above procedures are needed because there is no direct control on temperature at the 1/4T location and, therefore, allowable pressures may unknowingly be violated if the rate of cooling is decreased at various intervals along a cooldown ramp. The use of the composite curve eliminates this problem and insures conservative operation of the system for the entire cooldown period.

Heatup Three separate calculations are required to determine the limit curves for finite heatup rates. As is done in the cooldown analysis, allowable pressure-temperature relationships are developed for steady-state conditions as well as finite heatup rate conditions assuming the presence of a 1/4T defect at the inside of the vessel wall. The thermal gradients during heatup produce compressive stresses at the inside of the wall that alleviate the tensile stresses produced by internal pressure. The metal temperature at the crack tip lags the coolant temperature; therefore, the KIC for the 1/4T crack during heatup is lower than the KIC for the 1/4T crack during steady-state conditions at the same coolant temperature.

During heatup, especially at the end of the transient, conditions may exist such that the effects of compressive thermal stresses and lower KIC's do not offset each other, and the pressure-temperature curve based on steady-state conditions no longer represents a lower bound of all similar curves for finite heatup rates when the 1/4T flaw is considered. Therefore, both cases have to be analyzed in order to insure that at any coolant temperature the lower value of the allowable pressure calculated for steady-state and finite heatup rates is obtained.

BEAVER VALLEY - UNIT 1 B 3/4 4-8a Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

The second portion of the heatup analysis concerns the calculation of pressure-temperature limitations for the case in which a 1/4T deep outside surface flaw is assumed. Unlike the situation at the vessel inside surface, the thermal gradients established at the outside surface during heatup produce stresses which are tensile in nature and thus tend to reinforce any pressure stresses present. These thermal stresses are dependent on both the rate of heatup and the time (or coolant temperature) along the heatup ramp. Since the thermal stresses at the outside are tensile and increase with increasing heatup rates, each heatup rate must be analyzed on an individual basis.

Following the generation of pressure-temperature curves for both the steady-state and finite heatup rate situations, the final limit curves, as documented in WCAP-15570, Revision 2, are produced as follows: A composite curve is constructed based on a point-by-point comparison of the steady-state and finite heatup rate data. At any given temperature, the allowable pressure is taken to be the lesser of the three values taken from the curves under consideration. The use of the composite curve is necessary to set conservative heatup limitations because it is possible for conditions to exist wherein, over the course of the heatup ramp, the controlling condition switches from the inside to the outside and the pressure limit must at all times be based-on analysis of the most critical criterion.

The actual shift in RTNDT of the vessel material will be established periodically during operation by removing and evaluating, in accordance with 10 CFR 50 Appendix H, reactor vessel material irradiation surveillance specimens installed near the inside wall of the reactor vessel in the core area. Since the neutron spectra at the irradiation samples and vessel inside radius are essentially identical, the measured transition shift for a sample can be applied with confidence to the adjacent section of the reactor vessel. The heatup and cooldown curves must be recalculated when the RTNDT determined from the surveillance capsule is different from the calculated RTNDT for the equivalent capsule radiation exposure.

The pressure-temperature limit lines shown on Figure 3.4-2 for reactor criticality and for inservice leak and hydrostatic testing have been provided to assure compliance with the minimum temperature requirements of Appendix G to 10 CFR 50 for reactor criticality and for inservice leak and hydrostatic testing. These pressure-temperature limits lines on Figures 3.4-2 and 3.4-3 for boltup temperature are provided to ensure compliance with the minimum temperature requirements of Appendix G to ASME Section XI for vessel closure head flange boltup. It recommends that when the flange and adjacent shell region are stressed by the full intended bolt preload the minimum metal temperature in the stressed region is at least the initial RTNDT temperature for the material in the stressed regions.

BEAVER VALLEY - UNIT 1 B 3/4 4-9 Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

The number of reactor vessel irradiation surveillance specimens and the frequencies for removing and testing these specimens are provided in UFSAR Table 4.5-3 to assure compliance with the requirements of Appendix H to 10 CFR 50.

The limitations imposed on the pressurizer heatup and cooldown rates and spray water temperature differential are provided to assure that the pressurizer is operated within the design criteria assumed for the fatigue analysis performed in accordance with the ASME Code requirements.

Pressure-temperature limit curves shown in Figure B 3/4 4-2 were developed for the limiting ferritic steel component within an isolated reactor coolant loop. The limiting component is the steam generator channel head to tubesheet region. This figure provides the ASME III, Appendix G limiting curve which is used to define operational bounds, such that when operating with an isolated loop the analyzed pressure-temperature limits are known. The temperature range provided bounds the expected operating range for an isolated loop and ASME Code Case N-640.

OVERPRESSURE PROTECTION SYSTEMS BACKGROUND The overpressure protection system (OPPS) controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G. The reactor vessel is the limiting RCPB component for demonstrating such protection. The maximum setpoint for the power operated relief valves (PORVs) and the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup meet the 10 CFR 50, Appendix G (including ASME Code Case N-640) requirements during the OPPS MODES.

BEAVER VALLEY - UNIT 1 B 3/4 4-10 Change No. 1-004

FIGURE B 3/4 4-2 ISOLATED LOOP PRESSURE-TEMPERATURE LIMIT CURVE BEAVER VALLEY - UNIT 1 B 3/4 4-10a Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

BACKGROUND (Continued)

The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures. RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only during shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel.

LCO 3.4.9.l, "Pressure/Temperature Limits," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the limits.

This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity. Limiting coolant input capability requires deactivating all but one charging pump and isolating the accumulators. The pressure relief capacity requires either two redundant RCS relief valves or a depressurized RCS and an RCS vent of sufficient size.

One RCS relief valve or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.

With minimum coolant input capability, the ability to provide core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the OPPS MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve and, if needed, until the charging pump is actuated by SI.

The OPPS for pressure relief consists of two PORVs with reduced lift settings or a depressurized RCS and an RCS vent of sufficient size.

Two RCS relief valves are required for redundancy. One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant input capability.

BEAVER VALLEY - UNIT 1 B 3/4 4-10b Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

PORV REQUIREMENTS As designed for the OPPS System, each PORV is signaled to open if the RCS pressure approaches a limit determined by the OPPS actuation circuit. The OPPS actuation circuit monitors RCS pressure and determines when a condition not acceptable is approached. If the indicated pressure meets or exceeds the OPPS actuation setpoint, a PORV is signaled to open. Having the setpoints of both valves within the limits ensures that the Appendix G limits will not be exceeded in any analyzed event. When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.

The low limit on pressure during the transient is typically established based solely on an operational consideration for the Reactor Coolant Pump (RCP) No. 1 seal to maintain a nominal differential pressure across the seal faces for proper film-riding performance. The upper limit (based on the minimum of the steady-state 10 CFR 50 Appendix G requirement and the PORV piping limitations) and the RCP No. 1 seal performance criteria create a pressure range from which the setpoints for both PORVs are selected.

When there is insufficient range between the upper and lower pressure limits to select the PORV setpoints to provide protection against violating both limits, setpoint selection to provide protection against the upper limit violation takes precedence.

RCS VENT REQUIREMENTS Once the RCS is depressurized, a vent exposed to the pressurizer relief tank (PRT) or containment atmosphere will maintain the RCS pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting OPPS mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

For an RCS vent to meet the flow capacity requirement, it may be satisfied by removing a pressurizer safety valve or establishing an opening between the RCS and the PRT or containment atmosphere of the required size through any positive means available which cannot be inadvertently defeated. The vent must be above the level of reactor coolant, so as not to drain the RCS when open.

BEAVER VALLEY - UNIT 1 B 3/4 4-10c Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

APPLICABLE SAFETY ANALYSES Safety analyses demonstrate that the reactor vessel is adequately protected against exceeding the P/T limits when low RCS temperature conditions exist. At the enable temperature and below, overpressure prevention is provided by two OPERABLE RCS relief valves or a depressurized RCS and a sufficient sized RCS vent.

The actual temperature at which the pressure in the P/T limit curve falls below the OPPS setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the heatup and cooldown curves are revised, the OPPS must be re-evaluated to ensure its functional requirements can still be met.

The heatup and cooldown curves represent the Appendix G (including ASME Code Case N-640) limits that define OPPS operation. Setpoint calculations correlated to RCS temperature define acceptable OPPS setpoints for steady-state pressure-temperature limits based on Revision 2 of NRC Regulatory Guide 1.99. Any change to the RCS that may affect OPPS operation must be evaluated against the analyses to determine the impact of the change on the OPPS acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:

MASS INPUT TYPE TRANSIENTS

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

HEAT INPUT TYPE TRANSIENTS

a. Inadvertent actuation of pressurizer heaters;

b. Loss of RHR cooling; or

c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

BEAVER VALLEY - UNIT 1 B 3/4 4-10d Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

HEAT INPUT TYPE TRANSIENTS (Continued)

The following are required during the OPPS MODES to ensure that mass and heat input transients do not occur, which either of the OPPS overpressure protection means cannot handle:

a. Deactivating all but one OPERABLE charging pump, except during pump swapping operations as addressed in the LCO;

b. Deactivating the accumulator discharge isolation valves in their closed positions; and

c. Meeting the secondary side water to RCS cold leg temperature difference requirement specified in LCO 3.4.1.3, Reactor Coolant System - Shutdown.

The analyses demonstrate that either one RCS relief valve or the depressurized RCS and RCS vent can maintain the RCS pressure below the limits when only one charging pump is actuated by SI. Thus, the LCO allows only one charging pump OPERABLE during the OPPS MODES.

Since neither one RCS relief valve nor the RCS vent can handle a full SI actuation, the LCO also requires the accumulators isolated.

The isolated accumulators must have their discharge valves closed with power removed. Fracture mechanics analyses established the temperature of OPPS Applicability at the enable temperature.

PORV PERFORMANCE The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limit. The setpoint is derived by analyses that model the performance of the OPPS assuming the limiting OPPS transient of SI actuation of one charging pump. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the P/T limits will be met.

The Maximum Allowable Nominal PORV Setpoint for the OPPS is derived by analysis which models the performance of the OPPS assuming various mass input and heat input transients. Operation with a PORV setpoint less than or equal to the maximum allowable nominal setpoint ensures that 10 CFR 50 Appendix G limits will not be violated with consideration for: (1) a maximum pressure overshoot beyond the PORV setpoint which can occur as a result of time delays in signal BEAVER VALLEY - UNIT 1 B 3/4 4-10e Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

PORV PERFORMANCE (Continued) processing and valve opening; (2) a 50°F heat transport effect made possible by the geometrical relationship of the reactor vessel and the RCS wide range temperature indicator used for OPPS; (3) instrument uncertainties; (4) single failure; and (5) the pressure difference between the wide range pressure transmitter and the reactor vessel limiting beltline region.

The PORV setpoint will be updated when the revised P/T limits conflict with the OPPS analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation.

Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.9.1, "Pressure/Temperature Limits," discuss these examinations.

The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.

RCS VENT PERFORMANCE With the RCS depressurized, analyses show that a PORV or equivalent opening with a vent size of 2.07 square inches is capable of mitigating the allowed OPPS overpressure transient. The capacity of a vent this size is greater than the flow of the limiting transient for the OPPS configuration, SI actuation with one charging pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve.

The RCS vent size is based on the PORV size, therefore, the vent is bounded by the PORV analysis.

The RCS vent is passive and is not subject to active failure.

LCO This LCO requires that the OPPS is OPERABLE. The OPPS is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the limits as a result of an operational transient.

BEAVER VALLEY - UNIT 1 B 3/4 4-10f Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

LCO (Continued)

To limit the coolant input capability, the LCO requires that a maximum of one charging pump be capable of injecting into the RCS and all accumulator discharge isolation valves be closed and immobilized.

The LCO is qualified by a note that permits two pumps capable of RCS injection for less than or equal to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to allow for pump swaps.

The LCO is also qualified by a note stating that accumulator isolation with power removed from the discharge isolation valves is only required when the accumulator pressure is greater than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This note permits the accumulator discharge isolation valve surveillance to be performed only under these pressure and temperature conditions.

The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:

a. Two OPERABLE PORVs; a PORV is OPERABLE for OPPS when its block valve is open, its lift setpoint is set to the limit and testing proves its ability to open at this setpoint, and motive power is available to the two valves and their control circuits; or

b. A depressurized RCS and an RCS vent.

An RCS vent is OPERABLE when open with an area of 2.07 square inches.

Each of these methods of overpressure prevention is capable of mitigating the limiting OPPS transient.

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is less than or equal to the enable temperature, in MODE 5, and in MODE 6 when the reactor vessel head is on. When the reactor vessel head is off, overpressurization cannot occur.

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

BEAVER VALLEY - UNIT 1 B 3/4 4-10g Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

ACTION

a. With two or more charging pumps capable of injecting into the RCS, RCS overpressurization is possible.

To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.

b. An unisolated accumulator requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.

If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the ACTION provides two options, either of which must be performed in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By increasing the RCS temperature to more than the enable temperature, the accumulator pressure cannot exceed the OPPS limits if the accumulators are fully injected. Depressurizing the accumulators below the OPPS limit also gives this protection.

The completion times are based on operating experience that these activities can be accomplished in these time periods indicating that an event requiring OPPS is not likely in the allowed times.

c. In MODE 4 when any RCS cold leg temperature is less than or equal to the enable temperature, with one required RCS relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within a completion time of 7 days. Two RCS relief valves are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.

The completion time considers the facts that only one of the RCS relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low. If plant operation results in transitioning to MODE 5, the completion time to restore an inoperable PORV may not exceed 7 days as required by this ACTION.

BEAVER VALLEY - UNIT 1 B 3/4 4-10h Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

ACTION (Continued)

d. The consequences of operational events that will overpressurize the RCS are more severe at lower temperature. Thus, with one of the two RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on, the completion time to restore two valves to OPERABLE status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The completion time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE RCS relief valve to protect against overpressure events. If a PORV is inoperable when the plant enters MODE 5 from MODE 4, the completion time to restore an inoperable PORV changes to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months but the cumulative inoperable time may not exceed 7 days before taking action to depressurize and vent.

e. The RCS must be depressurized and a vent must be established within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when both required RCS relief valves are inoperable. The vent must be sized greater than or equal to 2.07 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The completion time considers the time required to place the plant in this condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

SURVEILLANCE REQUIREMENTS (SR)

SR 4.4.9.3.1 To minimize the potential for a low temperature overpressure event by limiting the mass input capability, a maximum of one charging pump is OPERABLE with the others verified deactivated with power removed and the accumulator discharge isolation valves are verified closed and locked out.

BEAVER VALLEY - UNIT 1 B 3/4 4-10i Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

The frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment.

SR 4.4.9.3.1.b allows opening the accumulator discharge isolation valves to perform accumulator discharge check valve testing.

SR 4.4.9.3.2 The PORV block valve must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve must be remotely verified open in the main control room. This surveillance is performed if the PORV satisfies the LCO.

The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months frequency is considered adequate in view of other administrative controls available to the operator in the control room, such as valve position indication, that verify that the PORV block valve remains open.

The SR is required to be performed prior to entering the condition for the OPPS to be OPERABLE. This assures low temperature overpressure protection is available when the RCS cold leg temperature is less than or equal to the enable temperature.

Performing the surveillance every 31 days on each required PORV permits verification and adjustment, if necessary, of its lift setpoint, and considers instrumentation reliability which has been shown through operating experience to be acceptable. The CHANNEL FUNCTIONAL TEST will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required.

Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 18 months to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.

BEAVER VALLEY - UNIT 1 B 3/4 4-10j Change No. 1-004

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.9 PRESSURE/TEMPERATURE LIMITS (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

SR 4.4.9.3.3 The RCS vent of greater than or equal to 2.07 square inches is proven OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for an open vent or valve that cannot be locked, except

b. Once every 31 days for a valve that is locked, or provided with remote position indication, or sealed, or secured in position. A removed pressurizer safety valve fits this category.

The passive vent arrangement must only be open to be OPERABLE. This surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO.

BEAVER VALLEY - UNIT 1 B 3/4 4-10k Change No. 1-004

REACTOR COOLANT SYSTEM BASES 3/4.4.10 STRUCTURAL INTEGRITY The inservice inspection and testing programs for ASME Code Class 1, 2, and 3 components ensure that the structural integrity and operational readiness of these components will be maintained at an acceptable level throughout the life of the plant. These programs are in accordance with Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda as required by 10 CFR Part 50.55a(g) except where specific written relief has been granted by the Commission pursuant to 10 CFR Part 50.55a(g)(6)(i).

3/4.4.11 RELIEF VALVES BACKGROUND The Pressurizer is equipped with two types of devices for pressure relief: pressurizer safety valves and PORVs. The PORVs are air operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.

Block valves, which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room.

A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.

The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permit performance of certain surveillances on the valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.

The PORVs, their block valves, and their controls are powered from emergency power sources in the event of a loss of offsite power. Two PORVs and their associated block valves are powered from two separate safety trains.

BEAVER VALLEY - UNIT 1 B 3/4 4-11 Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.11 RELIEF VALVES (Continued)

BACKGROUND (Continued)

The plant has three PORVs, each having a relief capacity of 210,000 lb/hr at 2350 psig. The functional design of the PORVs is based on maintaining pressure below the high pressure reactor trip setpoint.

In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (OPPS). See LCO 3.4.9.3, "Overpressure Protection System."

APPLICABLE SAFETY ANALYSES Plant operators employ the PORVs to depressurize the RCS in response to certain plant transients if normal pressurizer spray is not available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.

The PORVs are used in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical. Certain analyses have been performed to study the effects on primary pressure assuming PORV actuation. The results of the loss of external load and/or a turbine trip event indicate the primary pressure remains within the design limits and the DNBR is maintained within the acceptance criteria.

LCO The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.

By maintaining at least two PORVs and their associated block valves OPERABLE, redundancy has been provided. The block valves are available to isolate the flow path through either a failed open PORV or a PORV with excessive leakage. Satisfying the LCO helps minimize challenges to fission product barriers.

BEAVER VALLEY - UNIT 1 B 3/4 4-11a Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.11 RELIEF VALVES (Continued)

APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open.

Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2. The PORVs are also required to be OPERABLE in MODES 1, 2, and 3 to minimize challenges to the pressurizer safety valves.

Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the LCO is applicable in MODES 1, 2, and 3. The LCO is not applicable in MODE 4 when both pressure and core energy are decreased and the pressure surges become much less significant. The PORV setpoint is reduced for OPPS in MODES 4 (below the enable temperature), 5, and 6 with the reactor vessel head in place. LCO 3.4.9.3 addresses the PORV requirements in these MODES.

ACTION A General Note provides clarification that all pressurizer PORVs and block valves are treated as separate entities, each with separate completion times (i.e., the completion time is on a component basis).

a. With the PORVs inoperable and capable of being manually cycled, either the PORVs must be restored or the flow path isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The block valves should be closed but power must be maintained to the associated block valves, since removal of power would render the block valve inoperable. Although a PORV may be designated inoperable, it may be able to be manually opened and closed, and therefore, able to perform its function. PORV inoperability may be due to seat leakage, instrumentation problems related to PORV accident monitoring instruments identified in LCO 3.3.3.8, or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. If the position indication is inoperable, then the PORVs are inoperable. For these reasons, the block valve shall be closed but the ACTION requires power be maintained to the valve. Automatic control problems and related instrumentation problems would not render the PORVs inoperable. Accident analyses assume manual operation of BEAVER VALLEY - UNIT 1 B 3/4 4-11b Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.11 RELIEF VALVES (Continued)

ACTION (Continued) the PORVs and does not take credit for automatic actuation.

This condition is only intended to permit operation of the plant for a limited period of time not to exceed the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the seat leakage condition. Normally, the PORVs should be available for automatic mitigation of overpressure events and should be returned to OPERABLE status prior to entering startup (MODE 2).

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

b. With one or two PORV(s) inoperable and not capable of being manually cycled, the PORV(s) must be either restored or isolated by closing the associated block valve and removing the power to the associated block valve. The completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on challenges to the PORVs during this time period, and provides the operator adequate time to correct the situation. If the inoperable valve(s) cannot be restored to OPERABLE status, the PORV(s) must be isolated within the specified time. Because there is at least one PORV that remains OPERABLE, an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is provided to restore a minimum of two PORVs to OPERABLE status. If a minimum of two PORVs cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply. Two OPERABLE PORVs provide redundancy to allow continued operation until the next refueling outage to perform maintenance on the inoperable valve and return it to OPERABLE status.

c. If three PORVs are inoperable and not capable of being manually cycled, it is necessary to either restore at least one valve within the completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or isolate the flow path by closing and removing the power to the associated block valves. The completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation. If one PORV is restored, then the BEAVER VALLEY - UNIT 1 B 3/4 4-11c Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.11 RELIEF VALVES (Continued)

ACTION (Continued) plant will be in a less limiting ACTION statement with the time clock started at the original declaration of having three PORVs inoperable. If no PORVs are restored within the completion time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required. See LCO 3.4.9.3.

d. If one block valve is inoperable and open, then it is necessary to either restore the block valve to OPERABLE status within the completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the associated PORV in manual control. The prime importance for the capability to close the block valve is to isolate a stuck open PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the required action is to place the PORV in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. If the block valve in inoperable, it is necessary to restore the block valve to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or close it. If block valve instrumentation related to accident monitoring instrumentation identified in LCO 3.3.3.8 is determined to be inoperable, then the block valve shall be declared inoperable. Closing the block valve precludes the need to place the PORV in manual control since it is isolated from the system. The completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because at least one PORV remains OPERABLE, the operator is permitted a completion time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the inoperable open block valve to OPERABLE status. If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply in order to avoid continuous operation without a redundant ability to isolate this PORV flow path. If the block valve is restored within the completion time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the power will be restored and the PORV restored to OPERABLE status. With one block valve inoperable and closed, there BEAVER VALLEY - UNIT 1 B 3/4 4-11d Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.11 RELIEF VALVES (Continued)

ACTION (Continued) still remains two PORV flow paths. This redundancy will allow continued operation until the next refueling outage to perform maintenance on the inoperable valve and return it to OPERABLE status.

e. If more than one block valve is inoperable, it is necessary to either restore the block valves within the completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , or place the associated PORVs in manual control and restore at least one block valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

[and restore a minimum of two block valves within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s]. Two OPERABLE PORVs provide redundancy to allow continued operation until the next refueling outage to perform maintenance on the inoperable valve and return it to OPERABLE status. The completion times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation. If the required actions are not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required. See LCO 3.4.9.3.

SURVEILLANCE REQUIREMENTS (SR)

SR 4.4.11.1 This surveillance requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. The frequency of 18 months is based on a typical refueling cycle and industry accepted practice. Cycling the PORVs using both the normal air supply system and the backup nitrogen supply system actuates the solenoid control valves and check valves to ensure the PORV control system will actuate properly when called upon. Testing in this manner assures each component within the PORV control system necessary to support PORV operation has been determined to function satisfactorily.

BEAVER VALLEY - UNIT 1 B 3/4 4-11e Amendment No. 187

REACTOR COOLANT SYSTEM BASES (Continued) 3/4.4.11 RELIEF VALVES (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

SR 4.4.11.2 Block valve cycling verifies that the valve(s) can be closed if needed. The basis for the frequency of 92 days is the ASME Code,Section XI. If the block valve is closed to isolate a PORV that is capable of being manually cycled, the OPERABILITY of the block valve is of importance, because opening the block valve is necessary to permit the PORV to be used for manual control of reactor pressure.

If the block valves are closed to isolate otherwise inoperable PORVs, the maximum completion time to restore one PORV and open the block valve is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , which is well within the allowable limits (25%) to extend the block valve frequency of 92 days. Furthermore, these test requirements would be completed by the reopening of a recently closed block valve upon restoration of the PORV to OPERABLE status (i.e.,

completion of the required actions fulfills the SR).

This SR is not required to be met with the block valve closed, in accordance with required ACTION b or c of this LCO.

3/4.4.12 REACTOR COOLANT SYSTEM VENTS Reactor Coolant System Vents are provided to exhaust noncondensible gases and/or steam from the primary system that could inhibit natural circulation core cooling. The OPERABILITY of at least one reactor coolant system vent path from the reactor vessel head and the pressurizer steam space, ensures the capability exists to perform this function.

The valve redundancy of the reactor coolant system vent paths serves to minimize the probability of inadvertent or irreversible actuation while ensuring that a single failure of a vent valve, power supply or control system does not prevent isolation of the vent path.

The function, capabilities, and testing requirements of the reactor coolant system vent systems are consistent with the requirements of Item II.B.1 of NUREG-0737, "Clarification of TMI Action Plan Requirements," November 1980.

BEAVER VALLEY - UNIT 1 B 3/4 4-11f Amendment No. 187

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each of the RCS accumulators ensures that a sufficient volume of borated water will be immediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.

The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the accident analysis are met. The limit of one hour for operation with an inoperable accumulation minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures.

The RCS accumulators are isolated when RCS pressure is reduced to 1000 +/- 100 psig to prevent borated water from being injected into the RCS during normal plant cooldown and depressurization conditions and also to prevent inadvertent overpressurization of the RCS at reduced RCS temperature. With the accumulator pressure reduced to less than the reactor vessel low temperature overpressure protection setpoint, the accumulator pressure cannot challenge the cold overpressure protection system or exceed the 10 CFR 50 Appendix G limits.

Therefore, the accumulator discharge isolation valves may be opened to perform the accumulator discharge check valve testing specified in the IST program.

3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two separate and independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double-ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long-term core cooling capability in the recirculation mode during the accident recovery period.

The Surveillance Requirements provided to ensure OPERABILITY of each component ensure that at a minimum, the assumptions used in the accident analyses are met and that subsystem OPERABILITY is maintained.

BEAVER VALLEY - UNIT 1 B 3/4 5-1 Amendment No. 207

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (Continued)

Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section XI of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point on the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the ECCS Flow Analysis. The term required developed head refers to the pump performance at a given flow point that is assumed in the ECCS Flow Analysis. This is possible since the analysis assumes the pump delivers different flows at different times during accident mitigation. These multiple points are represented by a curve. The values at various flow points are defined by the Minimum Operating Point (MOP) curve in the Inservice Testing (IST) Program. The verification that the pumps developed head at the flow test point is greater than or equal to the required developed head is performed by using the MOP curve. Surveillance requirements are specified in the IST Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and frequencies necessary to satisfy the requirements.

The limitation for a maximum of one charging pump to be OPERABLE and the Surveillance Requirement to verify all charging pumps except the required OPERABLE pump to be inoperable < the enable temperature set forth in Specification 3.4.9.3 provides assurance that a mass addition pressure transient can be relieved by the operation of a single PORV.

BEAVER VALLEY - UNIT 1 B 3/4 5-1a Amendment No. 207

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.4 BORON INJECTION SYSTEM The OPERABILITY of the boron injection system as part of the ECCS ensures that sufficient negative reactivity is injected into the core to limit any positive increase in reactivity caused by RCS system cooldown. RCS cooldown can be caused by inadvertent depressurization, a loss-of-coolant accident or a steam line rupture.

The boron injection tank is required to be isolated when RCS temperature is the enable temperature set forth in Specification 3.4.9.3 to prevent a potential overpressurization due to an inadvertent safety injection signal.

The analysis of a main steam pipe rupture is performed to demonstrate that the following criteria are satisfied:

1. Assuming a stuck rod cluster control assembly, with or without offsite power, and assuming a single failure in the engineered safeguards, there is no consequential damage to the primary system and the core remains in place and intact.

2. Energy release to containment from the worst steam pipe break does not cause failure of the containment structure.

3. Radiation doses are not expected to exceed the guidelines of the 10 CFR 100.

The limits on injection tank minimum volume and boron concentration ensure that the assumptions used in the steam line break analysis are met.

BEAVER VALLEY - UNIT 1 B 3/4 5-2 Amendment No. 242

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.5 SEAL INJECTION FLOW BACKGROUND The function of the seal injection throttle valves during an accident is similar to the function of the Emergency Core Cooling Systems (ECCS) throttle valves in that each restricts flow from the charging pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during SI.

APPLICABLE SAFETY ANALYSES All ECCS subsystems are taken credit for in the large break loss of coolant accident (LOCA) at full power. The LOCA analysis establishes the minimum flow for the ECCS pumps. The charging pumps are also credited in the small beak LOCA analysis. This analysis establishes the flow and discharge head at the design point for the charging pumps. The steam generator tube rupture and main steam line break event analyses also credit the charging pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow of less than or equal to 28 gpm, with charging pump discharge pressure greater than or equal to 2397 psig and seal injection flow control valve full open, will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also endures that the charging pumps will deliver sufficient water for a small LOCA and sufficient boron to maintain the core subcritical. For smaller LOCAs, the charging pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.

BEAVER VALLEY - UNIT 1 B 3/4 5-3 Amendment No. 201

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.5 SEAL INJECTION FLOW (Continued)

LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that charging pump injection flow is directed to the RCS via the injection points in accordance with the requirements of 10 CFR 50.46.

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known. The flow line resistance is determined by assuming that the RCS pressure is at normal operating pressure and that the charging pump discharge pressure is greater than or equal to the value specified in this LCO.

The charging pump discharge pressure remains essentially constant through all the applicable MODES of this LCO. A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure. The valve settings established at the prescribed charging pump discharge pressure result in a conservative valve position should RCS pressure decrease. The additional modifier of this LCO, the air operated seal injection control valve being full open, is required since the valve is designed to fail open for the accident condition. With the discharge pressure and control valve position as specified by the LCO, a flow limit is established. It is this flow limit that is used in the accident analyses.

The limit on seal injection flow, combined with the charging pump discharge pressure limit and an open wide condition of the seal injection flow control valve, must be met to render the ECCS OPERABLE. If these conditions are not met, the ECCS flow will not be as assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4.

The seal injection flow limit is not applicable for MODE 4 and lower because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

BEAVER VALLEY - UNIT 1 B 3/4 5-4 Amendment No. 183

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.5 SEAL INJECTION FLOW (Continued)

ACTIONS

a. With seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced. Under this condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis. The completion time minimizes the potential exposure of the plant to a LOCA with insufficient injection flow and ensures that seal injection flow is restored to or below its limit. This time is conservative with respect to the completion times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

When the required actions cannot be completed within the required completion time, a controlled shutdown must be initiated. The plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within the following 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed completion times are reasonable, based on operating experience and normal cooldown rates, and do not challenge plant safety systems or operators.

SURVEILLANCE REQUIREMENTS (SR)

SR 3.5.5.1 Verification every 31 days that the manual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained. The Frequency of 31 days is based on engineering judgment and is consistent with other ECCS valve Surveillance Frequencies. The Frequency has proven to be acceptable through operating experience.

As noted, the Surveillance is not required to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the RCS pressure has stabilized within a + 20 psig range of normal operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly. The exception is limited to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to ensure that the Surveillance is timely.

BEAVER VALLEY - UNIT 1 B 3/4 5-5 Amendment No. 201

3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1.1 CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the accident analyses. This restriction, in conjunction with the leakage rate limitation, will limit the site boundary radiation doses to within the limits of 10 CFR 100 during accident conditions.

3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates ensure that the total containment leakage volume will not exceed the value assumed in the accident analyses at the peak accident pressure, Pa. Containment leakage is limited to < 1.0 La, except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test. At this time additional leakage limits must be met.

As left leakage prior to the first startup after performing a required leakage test is required to be < 0.60 La on a maximum pathway leakage rate (MXPLR) basis for combined Type B and C leakage following an outage or shutdown that included Type B and C testing and < 0.75 La for overall Type A leakage following an outage or shutdown that included Type A testing. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of < 1.0 La and a combined Type B and C leakage limit of < 0.60 La on a minimum pathway leakage rate (MNPLR) basis. The MXPLR for combined Type B and C leakage is the measured leakage through the worst of the two isolation valves, unless a penetration is isolated by use of a valve(s), blind flange(s), or de-activated automatic valve(s). In this case, the MXPLR of the isolated penetration is assumed to be the measured leakage through the isolation device(s).

3/4.6.1.3 CONTAINMENT AIR LOCKS BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.

Each air lock is nominally a right circular cylinder, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for BEAVER VALLEY - UNIT 1 B 3/4 6-1 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

BACKGROUND (Continued) extended periods when frequent containment entry is necessary. The emergency air lock, which is located in the equipment hatch opening, is normally removed from the containment building and stored during a refueling outage. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each of the doors contains double o-ring seals and local leakage rate testing capability to ensure pressure integrity.

DBA conditions which increase containment pressure will result in increased sealing forces on the personnel air lock inner door and both doors on the emergency air lock. The outer door on the personnel air lock is periodically tested in a manner where the containment DBA pressure is attempting to overcome the door sealing forces.

The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limits in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses.

APPLICABLE SAFETY ANALYSES The DBAs that result in a release of radioactive material within containment are a loss of coolant accident and a rod ejection accident. In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage.

The containment was designed with an allowable leakage rate of 0.1 percent of containment air weight per day. This leakage rate is defined in Specification 6.17 titled "Containment Leakage Rate Testing Program," as La = 0.1 percent of containment air weight per day, the maximum allowable containment leakage rate at the calculated peak containment internal pressure Pa = 40.0 psig following a DBA.

This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.

BEAVER VALLEY - UNIT 1 B 3/4 6-2 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

LCO Each containment air lock forms part of the containment pressure boundary. As part of containment, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events.

Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from containment.

APPLICABILITY In Modes 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.4, "Containment Building Penetrations."

ACTIONS The ACTIONS are modified by a General Note (1) that allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed to repair.

If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary may not be intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time BEAVER VALLEY - UNIT 1 B 3/4 6-3 Amendment No. 190

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

ACTIONS (Continued) in which the OPERABLE door is expected to be open. At no time should the OPERABLE door be opened if it cannot be demonstrated that the inoperable door is sufficiently closed/latched. This verification is necessary to preclude an inadvertent opening of the inoperable door while the OPERABLE door is open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit and personnel safety can be assured, entry and exit should be via an OPERABLE air lock.

General Note (2) has been added to provide clarification that, for this LCO, separate ACTION statement entry is allowed for each air lock.

In the event the air lock leakage results in exceeding the combined containment leakage rate acceptance criteria, General Note (3) directs entry into the ACTION statements of LCO 3.6.1.1 and LCO 3.6.1.2.

a. With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (ACTION statement a.1) in each affected containment air lock. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door.

This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This specified time period is consistent with the ACTION statements of LCO 3.6.1.1 and LCO 3.6.1.2, which require CONTAINMENT INTEGRITY and containment leakage rates to be restored within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the affected air lock penetration must be isolated by locking closed (ACTION statement a.2) the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed. This action places additional positive controls on the use of the air lock when one air lock door is inoperable.

ACTION statement a has been modified by a Note. Note (4) allows use of the air lock for entry and exit for 7 days under administrative controls. Containment entry may be required to perform non-routine Technical Specification (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. An example of such an activity would be the isolation of a containment penetration by at BEAVER VALLEY - UNIT 1 B 3/4 6-4 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

ACTIONS (Continued) least one operable valve, and the subsequent repair and post-maintenance technical specification surveillance testing on the inoperable valve. In addition, containment entry may be required to perform repairs on vital plant equipment which, if not repaired, could lead to a plant transient or reactor trip. This Note is not intended to preclude performing other activities (i.e., non-TS-required activities or repair of non-vital plant equipment) if the containment is entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.

ACTION statement a.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained. The completion time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned. ACTION statement a.3 is modified by a Note (5) that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, it is unlikely that a door would become misaligned once it has been verified to be in the proper position.

b. With an air lock interlock mechanism inoperable in one or more air locks, the ACTION statements and associated completion times are consistent with those specified in ACTION statement a.

The ACTION statements have been modified by two Notes.

Note (6) allows entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). Note (5) applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is BEAVER VALLEY - UNIT 1 B 3/4 6-5 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

ACTIONS (Continued) typically restricted. Therefore, it is unlikely that a door would become misaligned once it has been verified to be in the proper position.

c. With one or more air locks inoperable for reasons other than those described in ACTION statement a or b (e.g., both air lock doors inoperable and interlock mechanism inoperable or both air lock doors inoperable), ACTION statement c.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (per LCO 3.6.1.1 and LCO 3.6.1.2) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the combined containment leakage rate can still be within limits.

ACTION statement c.2 requires that one door in the affected containment air lock must be verified to be closed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time. This specified time period is consistent with the ACTION statements of LCO 3.6.1.1 and LCO 3.6.1.2, which require that CONTAINMENT INTEGRITY and containment leakage rate limits be restored within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, ACTION statement c.3 requires that the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock.

For all ACTION statements, if the inoperable containment air lock cannot be restored to OPERABLE status within the required completion time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant BEAVER VALLEY - UNIT 1 B 3/4 6-6 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

ACTIONS (Continued) conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS (SR)

Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests).

The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The frequency is required by the Containment Leakage Rate Testing Program.

Testing of the personnel air lock door seals may be accomplished with the air lock pressure equalized with containment or with atmospheric pressure. Each configuration applies Pa, as a minimum, across the sealing surfaces demonstrating the ability to function as designed. As long as the testing conducted is equivalent or more conservative than what might exist for accident conditions, the air lock doors will be able to perform their design function.

Performance of maintenance activities which affect air lock sealing capability, such as the replacement of the o-ring door seals and/or breach ring travel adjustment, will require performance of the appropriate surveillance requirements such as SR 4.6.1.3.a.1 as a minimum. The performance of SR 4.6.1.3.a.2 will depend on the air lock components which are affected by the maintenance. Replacement of o-rings and/or breech ring travel adjustment on the inner personnel air lock door, for example, normally will not require the performance of SR 4.6.1.3.a.2 as a post maintenance test. Testing per SR 4.6.1.3.a.1 is sufficient to demonstrate post accident leak tightness of the inner air lock door. The sealing force, which is applied to o-rings, is developed by the rotation of tapered wedges against the door's outer surface. This action forces the door to compress the o-rings which are located on the air lock barrel. When SR 4.6.1.3.a.1 is performed, the area between the two concentric o-rings is pressurized to at least Pa and a leak rate of the two o-rings and sealing surface is determined. This test pressure applies an opposing force to the breech ring closure force. Since the containment pressure developed during a DBA applies a closing force which is supplemental to the breech ring force, the net result would be to improve the door sealing capability of the inner personnel air lock door over that which exists during the performance of SR 4.6.1.3.a.1. For this reason, performance of SR 4.6.1.3.a.2, BEAVER VALLEY - UNIT 1 B 3/4 6-7 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued) which applies a force which opposes the breech ring force, is not necessary following certain inner air lock door maintenance.

SR 4.6.1.3.a.1 sufficiently demonstrates the ability of the inner air lock door to provide a leak tight barrier following maintenance affecting the door sealing surface.

Replacement of the o-rings on the outer personnel air lock door, which results in decreasing the breech ring closure force, will require performance of SR 4.6.1.3.a.2 in addition to SR 4.6.1.3.a.1 which is required due to the door being opened. This surveillance is required because containment DBA pressure tends to overcome the outer personnel air lock door sealing forces. Performance of SR 4.6.1.3.a.1 on the outer personnel air lock applies an opposing force to the breech ring closure force in the same manner as previously described for the inner personnel air lock door. However, for the outer personnel air lock door, the containment pressure developed during a DBA applies an opening force which is opposing the breech ring closure force. Therefore, upon completion of certain maintenance activities, continued outer door leak tightness during a DBA cannot be assured by performance of SR 4.6.1.3.a.1 alone.

Maintenance which may result in a decrease in closure force on any part of the door sealing surface (decreasing of breech ring travel for example), will require performance of SR 4.6.1.3.a.2. The performance of this surveillance is necessary to ensure that containment DBA pressure applied against the outer door will not result in the unseating of the air lock door by overcoming of the breech ring closure forces to the point where the leakage becomes excessive. Since SR 4.6.1.3.a.2 duplicates DBA forces on the outer personnel air lock door and also measures the air lock leakage rate, performance of this surveillance requirement demonstrates the continued ability of the outer personnel air lock door to provide a leak tight barrier, during a DBA, following specific maintenance activities.

The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY and personnel safety, considering the subatmospheric design, while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur.

BEAVER VALLEY - UNIT 1 B 3/4 6-8 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

The SR has been modified by two Notes. Note (7) states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note (8) has been added to this SR requiring the results to be evaluated against the acceptance criteria applicable to LCO 3.6.1.2. This ensures that air lock leakage is properly accounted for in determining the combined containment leakage rate.

3/4.6.1.4 and 3/4.6.1.5 INTERNAL PRESSURE AND AIR TEMPERATURE The limitations on containment internal pressure and average air temperature as a function of river water temperature ensure that

1) the containment structure is prevented from exceeding its design negative pressure of 8.0 psia, 2) the containment peak pressure does not exceed the design pressure of 45 psig during LOCA conditions, and

3) the containment pressure is returned to subatmospheric conditions following a LOCA.

The containment internal pressure and temperature limits shown as a function of river water temperature describe the operational envelope that will 1) limit the containment peak pressure to less than its design value of 45 psig and 2) ensure the containment internal pressure returns subatmospheric within 60 minutes following a LOCA.

The limits on the parameters of Figure 3.6-1 are consistent with the assumptions of the accident analyses.

3/4.6.1.6 CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment vessel will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to ensure that the vessel will withstand the maximum pressure of 40.0 psig in the event of a LOCA. The visual and Type A leakage tests, performed at the frequency specified in the Containment Leakage Rate Testing Program, are sufficient to demonstrate this capability.

BEAVER VALLEY - UNIT 1 B 3/4 6-9 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT QUENCH AND RECIRCULATION SPRAY SYSTEMS The OPERABILITY of the containment spray systems ensures that containment depressurization and subsequent return to subatmospheric pressure will occur in the event of a LOCA. The pressure reduction and resultant termination of containment leakage are consistent with the assumptions used in the accident analyses.

The recirculation spray system consists of four 50 percent capacity subsystems each composed of a spray pump, associated heat exchanger and flow path. Two of the recirculation spray pumps and motors are located outside containment (RS-P-2A and RS-P-2B) and two pumps and motors are located inside containment (RS-P-1A and RS-P-1B). The flow path from each pump is piped to an individual 180° recirculation spray header inside containment. Train "A" electrical power and river water is supplied to the subsystems containing recirculation spray pumps RS-P-1A and RS-P-2A. Train "B" electrical power and river water is supplied to the subsystems containing recirculation spray pumps RS-P-1B and RS-P-2B.

Verifying that each quench spray system pumps developed head at the flow test point is greater than or equal to the required developed head ensures that quench spray system pump performance has not degraded during the cycle. The term required developed head refers to the value that is assumed in the Containment Integrity Safety Analysis for the quench spray pumps developed head at a specific flow point. This value for the required developed head at a flow point is defined as the Minimum Operating Point (MOP) in the Inservice Testing (IST) Program. The verification that the pumps developed head at the flow test point is greater than or equal to the required developed head is performed by using a MOP curve. The MOP curve is contained in the IST Program and was developed using the required developed head at a specific flow point as a reference point. From the reference point, a curve was drawn which is a constant percentage below the current pump performance curve. Based on the MOP curve, a verification is performed to ensure that the pumps developed head at the flow test point is greater than or equal to the required developed head. Flow and differential head are normal test parameters of centrifugal pump performance required by Section XI of the ASME Code. Since the quench spray system pumps cannot be tested with flow through the spray headers, they are tested on bypass flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

BEAVER VALLEY - UNIT 1 B 3/4 6-10 Amendment No. 207

CONTAINMENT SYSTEMS BASES 3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT QUENCH AND RECIRCULATION SPRAY SYSTEMS (Continued)

Verifying that each recirculation spray system pumps developed head at the flow test point is greater than or equal to the required developed head ensures that recirculation spray system pump performance has not degraded during the cycle. The term "required developed head" refers to the value that is assumed in the Containment Integrity Safety Analysis for the recirculation spray pumps developed head at a specific flow point. This value for the required developed head at a flow point is defined as the MOP in the IST Program. The verification that the pumps developed head at the flow test point is greater than or equal to the required developed head is performed by using a MOP curve. The MOP curve is contained in the IST Program and was developed using the required developed head at a specific flow point as a reference point. From the reference point, a curve was drawn which is a constant percentage below the current pump performance curve. Based on the MOP curve, a verification is performed to ensure that the pumps developed head at the flow test point is greater than or equal to the required developed head. Flow and differential head are normal test parameters of centrifugal pump performance required by Section XI of the ASME Code. Since the recirculation spray system pumps cannot be tested with flow through the spray headers, they are tested on bypass flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

The ten year surveillance interval for performing an air or smoke flow test through each spray header is considered adequate for detecting obstruction of the nozzles due to the passive design of the spray header and the header's components being constructed with stainless steel.

3/4.6.2.3 CHEMICAL ADDITION SYSTEM The OPERABILITY of the chemical addition system ensures that sufficient NaOH is added to the containment spray in the event of a LOCA. The limits on NaOH minimum volume and concentration, ensure that 1) the iodine removal efficiency of the spray water is maintained because of the increase in pH value, and 2) corrosion effects on components within containment are minimized. These assumptions are consistent with the iodine removal efficiency assumed in the accident analyses.

BEAVER VALLEY - UNIT 1 B 3/4 6-11 Amendment No. 231

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment. Containment isolation within the time limits specified ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analysis for a LOCA.

The opening of locked or sealed closed containment isolation valves on an intermittent basis under administrative control includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment.

3/4.6.4 COMBUSTIBLE GAS CONTROL The OPERABILITY of the equipment and systems required for the detection and control of hydrogen gas ensures that this equipment will be available to maintain the hydrogen concentration within containment below its flammable limit during post-LOCA conditions.

Either recombiner unit is capable of controlling the expected hydrogen generation associated with 1) zirconium-water reactions,

2) radiolytic decomposition of water, and 3) corrosion of metals within containment. These hydrogen control systems are consistent with the recommendations of Regulatory Guide 1.7, "Control of Combustible Gas Concentrations in Containment Following a LOCA."

The hydrogen recombiner system is designed to maintain the hydrogen concentration in the containment structure below 4 volume percent following a LOCA. The specified system flow rate (50 scfm) is the flow at post LOCA containment conditions (13 psia and 130°F) assumed in the design analysis to assure the hydrogen concentration is maintained below 4 volume percent following a LOCA.

The equation specified below shall be used when performing Surveillance 4.6.4.2.b.3 to correct the flow measured under test conditions to the corresponding flow at design basis post accident containment conditions of 13 psia and 130°F.

BEAVER VALLEY - UNIT 1 B 3/4 6-12 Amendment No. 232

CONTAINMENT SYSTEMS BASES 3/4.6.4 COMBUSTIBLE GAS CONTROL (Continued)

TC (1 + 2682.45 PC ) (13 0.022 (1 PBlower ))

scfmPA = scfmTest (0.00154) 2 TC PBlower TC PC where:

TC = average containment temperature during testing (°R)

PBlower = blower suction pressure during testing (psia)

PC = containment pressure during testing (psia)

BEAVER VALLEY - UNIT 1 B 3/4 6-13 Amendment No. 232

3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 MAIN STEAM SAFETY VALVES (MSSVs)

BACKGROUND The primary purpose of the main steam safety valves (MSSVs) is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.

Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the UFSAR, Section 10.3.1. The specified valve lift settings and relieving capacities are in accordance with the requirements of Section III of the ASME Boiler and Pressure Code, 1971 Edition. The total relieving capacity for all valves on all of the steam lines is 12.8 x 106 lbs/hr 6 which is 108 percent of the total secondary steam flow of 11.8 x 10 lbs/hr at 100% RATED THERMAL POWER. The MSSV design includes staggered setpoints, according to Table 3.7-2 in the accompanying limiting condition for operation (LCO), so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip. The MSSVs must have sufficient capacity so that main steam pressure does not exceed 110 percent of the steam generator shell-side design pressure (the maximum pressure allowed by the ASME B&PV Code) for the worst-case loss-of-heat-sink event.

Based on this requirement, a conservative criterion was applied that the valves should be sized to relieve 100 percent of the maximum calculated steam flow at an accumulation pressure (5 percent) not exceeding 110 percent of the design pressure.

APPLICABLE SAFETY ANALYSES The design basis for the MSSVs comes from the ASME Code,Section III and its purpose is to limit the secondary system pressure to less than or equal to 110 percent of design pressure for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in UFSAR, Section 14.1. Of these, the full power turbine trip without steam dump is the limiting AOO. This event also terminates normal feedwater flow to the steam generators.

BEAVER VALLEY - UNIT 1 B 3/4 7-1 Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

APPLICABLE SAFETY ANALYSES (Continued)

The safety analysis demonstrates that the transient response for turbine trip occuring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNB design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety valves.

This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.

In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature T or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The UFSAR, Section 14.1 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.

The UFSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s), it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function.

For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in BEAVER VALLEY - UNIT 1 B 3/4 7-1a Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

APPLICABLE SAFETY ANALYSES (Continued) reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. If the Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value during an RCS heatup event (e.g., turbine trip).

Thus, for any number of inoperable MSSVs it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions, unless it is demonstrated by analysis that a specified reactor power reduction alone is sufficient to prevent overpressurization of the steam system.

The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once opened. The passive failure mode is failure to open upon demand.

LCO The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 100.6 percent RATED THERMAL POWER (RTP). The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with the ASME Code,Section III, and the DBA analysis.

The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.

This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB, or main steam system integrity.

APPLICABILITY In MODES 1, 2 and 3 five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization.

In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.

BEAVER VALLEY - UNIT 1 B 3/4 7-1b Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

ACTIONS The ACTIONS are modified by a General Note indicating that separate condition entry is allowed for each MSSV.

With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets the ASME Code,Section III requirements.

Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.

a. In the case of only a single inoperable MSSV on one or more steam generators, if the Moderator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event.

Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, ACTION a. requires an appropriate reduction in reactor power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as discussed below, with an appropriate allowance for calorimetric power uncertainty.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined by the governing heat transfer relationship from the equation q = mh, where q is the heat input from the primary side, m is the steam flow rate and h is the heat of vaporization at the steam relief pressure (assuming no subcooled feedwater). For each steam generator, at a specified pressure, the maximum allowable power level is determined as follows:

(ws hfg N)

Maximum Allowable Power Level 100/Q _______________

K BEAVER VALLEY - UNIT 1 B 3/4 7-1c Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

ACTIONS (Continued) where:

Q = Nominal NSSS power rating of the plant (including reactor coolant pump heat), Mwt.

(Btu/sec)

K = Conversion factor, 947.82 Mwt ws = Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steam generator at the highest OPERABLE MSSV opening pressure including tolerance and accumulation, as appropriate, in lb/sec. For example, if the maximum number of inoperable MSSVs on any one steam generator is one, then ws should be a summation of the capacity of the OPERABLE MSSVs at the highest OPERABLE MSSV operating pressure, excluding the highest capacity MSSV. If the maximum number of inoperable MSSVs per steam generator is three, then ws should be a summation of the capacity of the OPERABLE MSSVs at the highest OPERABLE MSSV operating pressure, excluding the three highest capacity MSSVs.

hfg = Heat of vaporization for steam at the highest MSSV opening pressure including tolerance and accumulation, as appropriate, Btu/lbm.

N = Number of loops in plant.

For use in determining the % RTP in Action a, the Maximum NSSS Power calculated above is reduced by 2% RTP to account for the calorimetric power uncertainty. This is a conservative value that bounds the uncertainties associated with both the feedwater flow venturis and the Leading Edge Flow Meter.

b. In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Furthermore, for a single inoperable MSSV on one or more steam generators if the Moderator Temperature Coefficient is positive the reactor power may increase as a BEAVER VALLEY - UNIT 1 B 3/4 7-1d Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

ACTIONS (Continued) result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time to reduce reactor power is consistent with ACTION a. An additional 32 hours3.703704e-4 days 0.00889 hours 5.291005e-5 weeks 1.2176e-5 months is allowed to reduce the Power Range Neutron Flux-High reactor trip setpoints. The total completion time of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is based on a reasonable time to correct the MSSV inoperability, the time to perform the power reduction, operating experience to reset all channels of a protection function, and on the low probability of occurrence of a transient that could result in steam generator overpressure during this period.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation discussed above, with an appropriate allowance for Nuclear Instrumentation System trip channel uncertainties.

To determine the Table 3.7-1 Maximum Allowable Power for Action b (% RTP), the calculated Maximum NSSS Power is reduced by 5.52% to account for Nuclear Instrumentation System trip channel uncertainties. An additional conservatism is employed by setting the values equal to the most conservative between the two units, this being the Unit 1 values.

ACTION b. is modified by a note, indicating that the Power Range Neutron Flux-High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the reactor protection system trips specified in LCO 3.3.1.1, "Reactor Trip System Instrumentation," provide sufficient protection.

The allowed completion times are reasonable based on operating experience to accomplish the ACTIONS in an orderly manner without challenging unit systems.

c. If the ACTIONS cannot be completed within the associated completion time, or if one or more steam generators have four or more inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

BEAVER VALLEY - UNIT 1 B 3/4 7-1e Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

ACTIONS (Continued)

d. An exception to Specification 3.0.4 is provided since the above ACTION statements require a shutdown if they are not met within a specified period of time.

SURVEILLANCE REQUIREMENTS (SR)

SR 4.7.1.1 This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program. The ASME Code,Section XI, requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987.

According to ANSI/ASME OM-1-1987, the following tests are required:

a. Visual examination;

b. Seat tightness determination;

c. Setpoint pressure determination (lift setting); and

d. Compliance with owner's seat tightness criteria.

The ANSI/ASME Standard requires that all valves be tested every 5 years. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7-2 allows a

+1 percent -3 percent setpoint tolerance for OPERABILITY; however, the valves are reset to + 1 percent during the Surveillance to allow for drift.

The lift settings according to Table 3.7-2 correspond to ambient conditions of the valve at nominal operating temperature and pressure, as identified by a note.

BEAVER VALLEY - UNIT 1 B 3/4 7-1f Change No. 1-003

PLANT SYSTEMS BASES MAIN STEAM SAFETY VALVES (MSSVs) (Continued)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.

3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW system consists of two motor driven pumps and one steam turbine driven pump. The pumps are equipped with independent recirculation lines to prevent pump operation against a closed system. Each motor driven AFW pump is powered from an independent Class 1E power supply and each pump feeds all three steam generators. The steam turbine driven AFW pump receives steam from two of the three main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100 percent of the steam requirements for the turbine driven AFW pump. The steam feed lines from each of the main steam lines combine to form one main header. The main header then splits into two parallel paths with one Train "A" operated and one Train "B" operated isolation valve on each pathway. These two parallel paths then combine into one header which supplies the turbine driven AFW pump.

The flow path from the demineralized water storage tank (WT-TK-10) to the steam generators consists of individual supply lines to each of the three AFW pumps. Each motor driven AFW pump has an individual line that connects to its train related supply header. In addition, each motor driven AFW pump has the ability to be aligned to the opposite train header. The turbine driven pump has BEAVER VALLEY - UNIT 1 B 3/4 7-2 Amendment No. 223

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

BACKGROUND (Continued) an individual line that can be aligned to either the Train "A" or "B" supply header as necessary. Both the Train "A" and "B" supply headers each contain three normally open remotely operated valves arranged in parallel. Each of these valves then provides a flow path to one of the three common feedwater injection headers. Each of the feedwater injection headers then supplies its designated steam generator via the normal feedwater header downstream of the feedwater isolation valves. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) or atmospheric dump valves (ADVs). If the main condenser is available, steam may be released via the steam dump valves.

The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions.

During a normal plant cooldown, one pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions. Thus, the requirement for diversity in motive power sources for the AFW System is met.

The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the setpoint of the MSSVs. Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the ADVs.

The AFW System actuates automatically on steam generator water level-low-low by the Engineered Safety Feature Actuation System (ESFAS). The system also actuates on loss of offsite power, safety injection, and trip of all operating main feedwater (MFW) pumps.

APPLICABLE SAFETY ANALYSES The AFW System mitigates the consequences of any event with loss of normal feedwater.

The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest steam generator safety valve set pressure plus 1%.

BEAVER VALLEY - UNIT 1 B 3/4 7-2a Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

APPLICABLE SAFETY ANALYSES (Continued)

In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to account for flow losses such as pump recirculation and line breaks.

The limiting Design Basis Accident (DBA) for the AFW System is the small break loss of coolant accident (SBLOCA).

For a SBLOCA, the analyses are performed assuming loss of offsite power coincident with reactor trip with a limiting single active failure of the loss of one train of Emergency Core Cooling System (ECCS) on a failure to start of a diesel generator. The diesel failure is presumed to render one motor driven AFW pump inoperable, which results in one motor driven and one turbine driven AFW pump being operable.

The AFW System design is such that it can perform its function following a feedwater line break (FWLB) between the MFW isolation valves and containment, combined with a loss of offsite power following turbine trip, and a single active failure of the steam turbine driven AFW pump. Sufficient flow would be delivered to the two intact steam generators following isolation of the break. The analysis assumes a ten minute delay on AFW flow to the steam generator to allow for isolation of the break.

With one feedwater injection header inoperable, an insufficient number of steam generators are available to meet the feedline break analysis. This analysis assumes AFW flow will be provided to the two remaining intact feedwater lines. Should a feedline break occur on one of the operable feedwater headers with one feedwater injection header already inoperable, the plant could no longer meet its safety analysis.

The ESFAS automatically actuates the AFW turbine driven pump and associated power operated valves and controls when required to ensure an adequate feedwater supply to the steam generators during loss of power. Power operated valves are provided for each AFW line to control the AFW flow to each steam generator.

LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of RHR capability BEAVER VALLEY - UNIT 1 B 3/4 7-2b Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

LCO (Continued) for all events accompanied by a loss of offsite power and a single failure. This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the main steam isolation valves (MSIVs).

The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.

This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to each steam generator. The turbine driven AFW pump is required to be OPERABLE with redundant steam supplies from two of the three main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to the steam generators via the designated train supply header. The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE.

The LCO is modified by two notes. Note (1) indicates that one AFW train (capable of providing flow to the steam generator(s) relied upon for heat removal), which includes a motor driven pump, is required to be OPERABLE in MODE 4. This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW may be required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump. Note (8) states that with one steam supply inoperable, follow ACTION statement a. This condition does not constitute one AFW train being inoperable. The train associated with the turbine driven AFW pump continues to be capable of performing its intended function assuming no failure of the remaining OPERABLE steam supply.

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost.

In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory lost as the unit cools to MODE 4 conditions.

In MODE 4, the AFW System may be used for heat removal via the steam generators.

In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

BEAVER VALLEY - UNIT 1 B 3/4 7-2c Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW) (Continued)

ACTIONS

a. If one of the two steam supplies to the turbine driven AFW train is inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day completion time is reasonable, based on the following reasons:

1. The redundant OPERABLE steam supply to the turbine driven AFW pump;

2. The availability of redundant OPERABLE motor driven AFW pumps; and

3. The low probability of an event occurring that requires the inoperable steam supply to the turbine driven AFW pump.

This condition does not constitute one AFW train being inoperable.

The second completion time for ACTION statement a establishes a limit on the maximum time allowed for any combination of conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day completion time provides a limitation time allowed in this specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which ACTION statements a and c are entered concurrently. The AND connector between 7 days and 10 days dictates that both completion times apply simultaneously, and the more restrictive must be met.

If the inoperable steam supply cannot be restored to OPERABLE status within the required completion time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4 with one steam supply inoperable, operation is allowed to continue because only one AFW train, which includes a motor driven pump, is required in accordance with BEAVER VALLEY - UNIT 1 B 3/4 7-2d Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

ACTIONS (Continued)

Note (1) that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.

b. With one feedwater injection header inoperable in MODES 1, 2, or 3, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4 with one feedwater injection header inoperable, operation is allowed to continue because only two steam generators are required to remove decay heat per LCO 3.4.1.3, "RCS-SHUTDOWN." Although not required, the unit may continue to cool down and initiate RHR.

c. With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than ACTION statements a or b, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months completion time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

The second completion time for ACTION statement c establishes a limit on the maximum time allowed for any combination of conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day completion time provides a limitation time allowed in this specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which ACTION statements a and c are entered concurrently. The AND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both completion times apply simultaneously, and the more restrictive must be met.

If the inoperable AFW train cannot be restored to OPERABLE status within the required completion time, the plant must be placed in a MODE in which the LCO does not apply. To BEAVER VALLEY - UNIT 1 B 3/4 7-2e Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

ACTIONS (Continued) achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4 with one AFW train inoperable, operation is allowed to continue because only one AFW train, which includes a motor driven pump, is required in accordance with Note (1) that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.

ACTION statement c is modified by a note. Note (2) states that the completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to reach HOT SHUTDOWN may be extended for an additional 90 hours0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months for the turbine driven AFW pump provided that the plant has not entered MODE 2 following a refueling outage. This extension of the required completion time to reach MODE 4 from MODE 3 to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , allows additional time to complete any necessary repairs and/or testing of the turbine driven AFW pump prior to initiating a plant cooldown to MODE 4.

d. When two AFW trains are inoperable in MODE 1, 2, or 3 for reasons which may include the feedwater injection headers, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one AFW train, which includes a motor driven pump, is required in accordance with the Note (1) that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.

e. If all three AFW trains are inoperable in MODE 1, 2, or 3 for reasons which may include the feedwater injection headers, the unit is in a seriously degraded condition with BEAVER VALLEY - UNIT 1 B 3/4 7-2f Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

ACTIONS (Continued) no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.

ACTION statement e is modified by a Note (3) indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.

f. With one required AFW train inoperable in MODE 4, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate completion time is appropriate due to the need to ensure that a safety related means of providing flow to the steam generator(s), for the purpose of core decay heat removal, is available.

SURVEILLANCE REQUIREMENTS (SR)

The Surveillance Requirements are modified by a General Note which requires that constant communications be established and maintained when any normal AFW pump discharge valve is closed during surveillance testing.

SR 4.7.1.2.1 Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions. Note (4) ensures valve position verification is reverified by a second and independent operator.

BEAVER VALLEY - UNIT 1 B 3/4 7-2g Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

SR 4.7.1.2.2 Verifying the operability of each river water auxiliary supply valve by operating the valves through one complete cycle at least once per 31 days, ensures that an alternate water source will be available if the water volume in the demineralized water storage tank is depleted during system operation as a result of a DBA.

SR 4.7.1.2.3 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. The term "required developed head" refers to the value that is assumed in the AFW safety analysis for developed head at a flow point. This value for required developed head at a flow point is defined as the Minimum Operating Point (MOP) in the Inservice Testing Program. Flow and differential head are normal test parameters of centrifugal pump performance required by Section XI of the ASME Code. Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is normally performed on recirculation flow. The recirculation flow rate is assumed to be a fixed value since the recirculation line flow resistance remains constant. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. Performance of inservice testing as required in the ASME Code,Section XI, satisfies this requirement.

This SR is modified by a Note (5) indicating that the SR should be deferred until suitable test conditions are established for testing the turbine driven AFW pump. This deferral is required because there is insufficient steam pressure to perform the test.

SR 4.7.1.2.4 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on the actual or simulated actuation signal. The 18 month Frequency is based on the need to perform this surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power. The 18 month Frequency is acceptable based on operating experience and the design reliability of the equipment.

BEAVER VALLEY - UNIT 1 B 3/4 7-2h Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

SURVEILLANCE REQUIREMENTS (SR) (Continued)

This SR is modified by a Note (6) that states the SR is not required in MODE 4 when steam generator(s) is relied upon for heat removal.

In MODE 4, the heat removal requirements would be less providing more time for operator action to manually align the flow path.

SR 4.7.1.2.5 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal. The 18 month Frequency is based on the need to perform this surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power.

This SR is modified by two notes. Note (5) indicates that the SR be deferred until suitable test conditions are established for testing the turbine driven AFW pump. This deferral is required because there is insufficient steam pressure to perform the test. Note (6) states that the SR is not required in MODE 4 when steam generator(s) is relied upon for heat removal. In MODE 4, the heat removal requirements would be less providing more time for operator action to manually start the required AFW pump.

SR 4.7.1.2.6 Cycling each power operated valve (excluding automatic) in the flow path that is not testable during plant operation, ensures that the valves will function when required. The 18 month Frequency is based on the need to perform this surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power.

SR 4.7.1.2.7 This SR verifies that the AFW is properly aligned by verifying the flow from WT-TK-10 to the steam generators prior to entering MODE 2 after more than 30 continuous days in MODE 5 or 6 per Note (7).

OPERABILITY of AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown. The Frequency is reasonable, based on engineering judgment and other administrative controls that ensure that flow paths remain OPERABLE. To further ensure AFW System alignment, flow path OPERABILITY is verified following extended BEAVER VALLEY - UNIT 1 B 3/4 7-2i Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM (AFW)

SURVEILLANCE REQUIREMENTS (SR) (Continued) outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the WT-TK-10 to the steam generators is properly aligned.

3/4.7.1.3 PRIMARY PLANT DEMINERALIZED WATER The OPERABILITY of the PPDW storage tank with the minimum water volume ensures that sufficient water is available for cooldown of the Reactor Coolant System to less than 350°F in the event of a total loss of off-site power. The minimum water volume is sufficient to maintain the RCS at HOT STANDBY conditions for 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months with steam discharge to atmosphere.

BEAVER VALLEY - UNIT 1 B 3/4 7-2j Amendment No. 206

PLANT SYSTEMS BASES 3/4.7.1.4 ACTIVITY The limitations on secondary system specific activity ensure that steam releases to the environment will not be significant contributors to radioactivity releases resulting from analyzed accidents. Many of the analyzed accidents assume that a loss of auxiliary AC power occurs, making the main condenser unavailable for plant cooldown, and making it necessary to dump steam to the environment via SG atmospheric dump valves. Maintaining secondary system specific activity within the limits ensures that these releases, in conjunction with other releases associated with the accident, will be within applicable dose criteria.

3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES The OPERABILITY of the main steam line isolation valves ensures that no more than one steam generator will blowdown in the event of a steam line rupture. This restriction is required to 1) minimize the positive reactivity effects of the Reactor Coolant System cooldown associated with the blowdown, and 2) limit the pressure rise within containment in the event the steam line rupture occurs within containment. The OPERABILITY of the main steam isolation valves within the closure times of the surveillance requirements are consistent with the assumptions used in the accident analyses.

BEAVER VALLEY - UNIT 1 B 3/4 7-3 Amendment No. 205

PLANT SYSTEMS BASES 3/4.7.2 STEAM GENERATOR PRESSURE/TEMPERATURE LIMITATION The limitation on steam generator pressure and temperature ensures that the pressure induced stresses in the steam generators do not exceed the maximum allowable fracture toughness stress limits. The limitations of 70°F and 200 psig are based on steam generator average impact values taken at 10°F and are sufficient to prevent brittle fracture.

3/4.7.3 COMPONENT COOLING WATER SYSTEM The OPERABILITY of the component cooling water system ensures that sufficient cooling capacity is available for continued operation of safety related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident analyses.

3/4.7.4 RIVER WATER SYSTEM The OPERABILITY of the river water system ensures that sufficient cooling capacity is available for continued operation of safety related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident conditions.

3/4.7.5 ULTIMATE HEAT SINK The limitations on the ultimate heat sink level and temperature ensure that sufficient cooling capacity is available to either

1) provide normal cooldown of the facility, or 2) to mitigate the effects or accident conditions within acceptable limits.

The limitations on minimum water level and maximum temperature are based on providing a 30 day cooling water supply to safety related equipment without exceeding their design basis temperature and is consistent with the recommendations of Regulatory Guide 1.27, "Ultimate Heat Sink for Nuclear Plants."

3/4.7.6 FLOOD PROTECTION The limitation on flood level ensures that facility operation will be terminated in the event of flood conditions. The limit of elevation 695 Mean Sea Level was selected on an arbitrary basis as an appropriate flood level at which to terminate further operation and initiate flood protection measures for safety related equipment.

BEAVER VALLEY - UNIT 1 B 3/4 7-4 Amendment No. 26

PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY HABITABILITY SYSTEM The OPERABILITY of the control room emergency habitability system ensures that the control room will remain habitable for operations personnel during and following all credible accident conditions. The ambient air temperature is controlled to prevent exceeding the allowable equipment qualification temperature for the equipment and instrumentation in the control room. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room to 5 rem or less whole body, or its equivalent, or 5 rem TEDE, as applicable. This limitation is consistent with the requirements of General Design Criteria 19 of Appendix "A", 10 CFR 50 or 10 CFR 50.67, as applicable.

3/4.7.8 SUPPLEMENTAL LEAK COLLECTION AND RELEASE SYSTEM (SLCRS)

The OPERABILITY of the SLCRS provides for the filtering of postulated radioactive effluents resulting from leakage of LOSS OF COOLANT ACCIDENT (LOCA) activity from systems outside of the Reactor Containment building, such as Engineered Safeguards Features (ESF) equipment, prior to their release to the environment. This system also collects potential leakage of LOCA activity from the Reactor Containment building penetrations into the contiguous areas ventilated by the SLCRS except for the Main Steam Valve Room and Emergency Air Lock. System operation was also assumed in that portion of the Design Basis Accident (DBA) LOCA analysis which addressed ESF leakage following the LOCA, however, no credit for SLCRS operation was taken in the DBA LOCA analysis for collection and filtration of Reactor Containment building leakage even though an unquantifiable amount of contiguous area penetration leakage would in fact be collected and filtered. Based on the results of the analyses, the SLCRS must be OPERABLE to ensure that ESF leakage following the postulated DBA LOCA will not exceed 10 CFR 100 limits.

3/4.7.9 SEALED SOURCE CONTAMINATION The limitations on sealed source contamination ensure that the total body or individual organ irradiation does not exceed allowable limits in the event of ingestion or inhalation of the source material. The limitations on removable contamination for sources requiring leak testing, including alpha emitters, is based on 10 CFR 70.39(c) limits for plutonium. Leakage of sources excluded from the requirements of this specification represent less than one maximum permissible body burden for total body irradiation if the source material is inhaled or ingested.

BEAVER VALLEY - UNIT 1 B 3/4 7-5 Amendment No. 241

PLANT SYSTEMS BASES SEALED SOURCE CONTAMINATION (Continued)

Sealed sources are classified into three groups according to their use, with surveillance requirements commensurate with the probability of damage to a source in that group. Those sources which are frequently handled are required to be tested more often than those which are not. Sealed sources which are continuously enclosed within a shielded mechanism (i.e., sealed sources within radiation monitoring or boron measuring devices) are considered to be stored and need not be tested unless they are removed from the shielded mechanism.

3/4.7.10 and 3/4.7.11 RESIDUAL HEAT REMOVAL SYSTEM (RHR)

Deleted 3/4.7.12 SNUBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the reactor coolant system and all other safety-related systems is maintained during and following a seismic or other similar event initiating dynamic loads. Snubbers excluded from this inspection program are those installed on nonsafety-related systems and then only if their failure or failure of the system on which they are installed, would have no adverse effect on any safety-related system.

The visual inspection frequency is based upon maintaining a constant level of snubber protection to each safety-related system during an earthquake or other similar event initiating dynamic loads.

Therefore, the required inspection interval varies based upon the number of unacceptable snubbers found during the previous inspection, the total population or category size for each type of snubber, and the previous inspection interval. This criteria follows the guidance provided in NRC Generic Letter 90-09. Inspections performed before that interval has elapsed may be used as a new reference point to determine the next inspection. However, the results of such early inspections performed before the original required time interval has elapsed (nominal time less 25%) may not be used to lengthen the required inspection interval. Any inspection whose results require a shorter inspection interval will override the previous schedule.

When the cause of the rejection of a snubber is clearly established and remedied for that snubber and for any other snubbers that may be generically susceptible, or verified operable by inservice functional testing, that snubber may be exempted from being counted as inoperable. Generically susceptible snubbers are those which are of a specific make or model and have the same design features directly BEAVER VALLEY - UNIT 1 B 3/4 7-6 Amendment No. 241

PLANT SYSTEMS BASES SNUBBERS (Continued) related to rejection of the snubber by visual inspection, or are similarly located or exposed to the same environmental conditions such as temperature, radiation and vibration.

When a snubber is found inoperable, an engineering evaluation is performed, in addition to the determination of the snubber mode of failure, in order to determine if any-safety-related component or system has been adversely affected by the inoperability of the snubber. The engineering evaluation shall determine whether or not the snubber mode of failure has imparted a significant effect or degradation on the supported component or system.

To provide assurance of snubber functional reliability, a representative sample of the installed snubbers will be functionally tested during plant shutdowns at refueling or 18 month intervals not to exceed two (2) years. Observed failures of these sample snubbers shall require functional testing of additional units.

Snubbers are classified and grouped by design and manufacturer but not by size. For example, mechanical snubbers utilizing the same design features of the 2-kip, 10-kip and 100-kip capacity manufactured by Company "A" are of the same type. The same design mechanical snubbers manufactured by Company "B" for the purposes of this Technical Specification would be of a different type, as would hydraulic snubbers from either manufacturer.

The service life of a snubber is evaluated via manufacturer input and information through consideration of the snubber service conditions and associated installation and maintenance records (newly installed snubber, seal replaced, spring replaced, in high radiation area, in high temperature area, etc...). The requirement to monitor the snubber service life is included to ensure that the snubbers periodically undergo a performance evaluation in view of their age and operating conditions. These records will provide statistical bases for future consideration of snubber service life. The requirements for the maintenance of records and the snubber service life review are not intended to affect plant operation.

BEAVER VALLEY - UNIT 1 B 3/4 7-6a Amendment No. 241

PLANT SYSTEMS BASES 3/4.7.13 AUXILIARY RIVER WATER SYSTEM (ARWS)

The operability of the ARWS ensures that sufficient cooling capacity is available to bring the reactor to a cold shutdown condition in the event that a barge explosion at the station's intake structure or any other extremely remote event would render all of the normal River Water System supply pumps inoperable. The scenario of a postulated gasoline barge impact with the intake structure and coincident explosion disabling the Reactor Plant River Water System (RPRWS) is a low probability event. Nonetheless, the ARWS provides defense in-depth in assuring shutdown cooling capability. The requirement to operate the ARWS is not coincident with a postulated Design Basis Accident, but only for the postulated gasoline barge impact event.

Although the ARWS is a manually operated non-safety system which is not required to meet single active failure criteria, the system is designed with redundant pumps and valves on a header to accommodate a single active failure on start-up. This design criteria provides a defense in-depth in order to ensure the system can adequately mitigate the consequences of the postulated event. An ARWS pump can be manually started on the emergency bus during loss of offsite power after the diesel loading sequence is complete. If there is a delay in starting the ARWS, the auxiliary feedwater system is available to remove reactor core decay heat for a short term period.

The requirements for subsystem OPERABILITY are similar to those of the RPRWS except that one subsystem is required to be OPERABLE in the MODES noted. The Limiting Condition for Operation reflects the low risk of the postulated event compared to more stringent requirements associated with safety related systems. The ACTION statement takes into account the low probability of both trains of RPRWS being disabled as a result of the postulated site scenario coincident with one of the ARWS subsystems being OPERABLE.

BEAVER VALLEY - UNIT 1 B 3/4 7-7 Revised by NRC letter dated January 24, 2000

3/4.8 ELECTRICAL POWER SYSTEMS BASES 3/4.8.1, 3/4.8.2 A.C. SOURCES, D.C. SOURCES AND ONSITE POWER DISTRIBUTION SYSTEMS The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for

1) the safe shutdown of the facility and 2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix "A" to 10 CFR 50.

The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation. The OPERABILITY of the power sources are consistent with the initial condition assumptions of the safety analyses and are based upon maintaining at least one redundant set of onsite A.C. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss of offsite power and single failure of the other onsite A.C. source.

The ACTION requirements specified in LCOs 3.8.1.2, 3.8.2.2, and 3.8.2.4 address the condition where sufficient power is unavailable to recover from postulated events (i.e. fuel handling accident).

Implementation of the ACTION requirements shall not preclude completion of actions to establish a safe conservative plant condition. Completion of the requirements will prevent the occurrence of postulated events for which mitigating actions would be required.

The OPERABILITY of the minimum specified A.C. and D.C. power sources and associated distribution systems during shutdown and refueling ensures that 1) the facility can be maintained in the shutdown or refueling condition for extended time periods, 2) sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and 3) sufficient power is available for systems (i.e. Control Room Ventilation System) necessary to recover from postulated events in these MODES, e.g. a fuel handling accident.

In Modes 1 through 4, the specified quantity of 17,500 usable gallons required in each storage tank (35,000 total gallons) ensures a sufficient volume of fuel oil that, when added to the specified 900 usable gallon volume in the day and engine-mounted tanks, provides the fuel oil necessary to support a minimum of 7 days continuous operation of one diesel generator at full load (UFSAR Sections 8.5.2 and 9.14). The total volume in each of the tanks is greater due to the tank's physical characteristics.

BEAVER VALLEY - UNIT 1 B 3/4 8-1 Amendment No. 241

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES AND ONSITE POWER DISTRIBUTION SYSTEMS (Continued)

In Modes 1 through 4, the specified fuel oil volumes of both fuel oil storage tanks are required to ensure 7 days continuous operation of a single diesel generator at full load. Should the quantity of fuel oil in either fuel oil storage tank or either day and engine-mounted tank fall below the amount required in the technical specifications, the technical specification Action Statement for the associated diesel generator is applicable and provides adequate assurance that fuel oil is restored to within the required limit(s) in a timely manner.

In Modes 5 and 6, a single diesel generator with 900 usable gallons of fuel oil in the day and engine-mounted tank and a single fuel oil storage tank with 17,500 usable gallons are required operable. These requirements ensure the capability to support the systems required during a loss of offsite power when the plant is in a cold shutdown or refueling condition.

The Surveillance Requirement for demonstrating the OPERABILITY of the station batteries are based on the recommendations of Regulatory Guide 1.129, "Maintenance Testing and Replacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, and IEEE Std 450-1980, "IEEE Recommended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations."

Verifying average electrolyte temperature above the minimum for which the battery was sized, total battery terminal voltage on float charge, connection resistance values and the performance of battery service and discharge tests ensures the effectiveness of the charging system, the ability to handle high discharge rates and compares the battery capacity at that time with the rated capacity.

Table 3.8-1 specifies the normal limits for each designated pilot cell and each connected cell for electrolyte level, float voltage and specific gravity. The limits for the designated pilot cells float voltage and specific gravity, greater than 2.13 volts and .015 below the manufacturer's full charge specific gravity or a battery charger current that had stabilized at a low value, is characteristic of a charged cell with adequate capacity. The normal limits for each connected cell for float voltage and specific gravity, greater than 2.13 volts and not more than .020 below the manufacturer's full charge specific gravity with an average specific gravity of all the connected cells not more than .010 below the manufacturer's full charge specific gravity, ensures the OPERABILITY and capability of the battery.

BEAVER VALLEY - UNIT 1 B 3/4 8-2 Amendment No. 227

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES AND ONSITE POWER DISTRIBUTION SYSTEMS (Continued)

Operation with a battery cell's parameter outside the normal limit but within the allowable value specified in Table 3.8-1 is permitted for up to 7 days. During this 7 day period: (1) the allowable values for electrolyte level ensures no physical damage to the plates with an adequate electron transfer capability; (2) the allowable value for the average specific gravity of all the cells, not more than .020 below the manufacturer's recommended full charge specific gravity, ensures that the decrease in rating will be less than the safety margin provided in sizing; (3) the allowable value for an individual cell's specific gravity, ensures that an individual cell's specific gravity will not be more than .040 below the manufacturer's full charge specific gravity and that the overall capability of the battery will be maintained within an acceptable limit; and (4) the allowable value for an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability to perform its design function.

Note (1) provides clarification of Specification 3.8.1.1 action requirements when the diesel generators are inoperable as a result of Surveillance Requirements 4.8.1.1.2.d.2 and 4.8.1.1.2.e in accordance with Regulatory Guide 1.137 Revision 1 Regulatory Position C.2.a.

For the purposes of SR 4.8.1.1.2.a.5 and SR 4.8.1.1.2.b.3.b testing, the diesel generators are started from standby conditions. Standby conditions for a diesel generator mean that the diesel engine oil is being continuously circulated and engine coolant and oil temperatures are being maintained consistent with manufacturer recommendations.

The frequency of 66.2 Hz specified in Surveillance Requirement 4.8.1.1.2.b.2 corresponds to 993 rpm.

BEAVER VALLEY - UNIT 1 B 3/4 8-3 Amendment No. 230

3/4.9 REFUELING OPERATIONS BASES 3/4.9.1 BORON CONCENTRATION The limitations on minimum boron concentration (2400 ppm) ensure that: 1) the reactor will remain subcritical during CORE ALTERATIONS, and 2) a uniform boron concentration is maintained for reactivity control in the water volume having direct access to the reactor vessel. The Limitation of Keff of no greater than 0.95 which includes a conservative allowance for uncertainties, is sufficient to prevent reactor criticality during refueling operations.

3/4.9.2 INSTRUMENTATION The OPERABILITY of the source range neutron flux monitors ensures that redundant monitoring capability is available to detect changes in the reactivity condition of the core when performing those evolutions with the potential to initiate criticality. Suitable detectors used in place of primary source range neutron flux monitors N-31 and N-32 are recognized as alternate detectors. Alternate detectors may be used in place of primary source range neutron flux monitors as long as the required indication is provided. Since installation of the upper internals does not involve movement of fuel or a significant positive reactivity addition to the core, one primary or alternate source range neutron flux monitor with continuous visual indication in the control room provides adequate neutron flux monitoring capability during this evolution.

3/4.9.3 DECAY TIME The minimum requirement for reactor subcriticality prior to movement of irradiated fuel assemblies in the reactor vessel ensures that sufficient time has elapsed to allow the radioactive decay of the short lived fission products. This decay time is consistent with the assumptions used in the accident analyses.

3/4.9.4 CONTAINMENT BUILDING PENETRATIONS The LCO is applicable during movement of recently irradiated fuel assemblies and during movement of fuel assemblies over recently irradiated fuel assemblies because there is a potential for the limiting fuel handling accident (FHA) to occur. Therefore, the requirements of this Specification may be required to limit leakage of radioactive material within the containment to the environment. A FHA which does not involve recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months ) will result in radiation exposures that are within the guideline values specified in 10 CFR 50.67 without any reliance on BEAVER VALLEY - UNIT 1 B 3/4 9-1 Amendment No. 242

REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued) the requirements of this Specification to limit leakage to the environment. The 100 hour0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months limit is based on the current radiological analysis for a FHA which assumes a decay time of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months . LCO 3.9.3 prohibits irradiated fuel movement unless 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months of decay has occurred. Therefore, this specification will not be applicable unless the decay time in Specification 3.9.3 and the time assumed in the radiological analysis for a FHA are reduced to below 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months .

An OPERABLE filtered SLCRS train is required to include only those portions of the system that are necessary to ensure that a filtered exhaust path is available from the required plant areas to HEPA and charcoal adsorbers and then to the elevated release point on top of the containment building.

The requirements on containment penetration closure and operability of the containment purge and exhaust system HEPA filters and charcoal adsorbers ensure that a release of radioactive material within containment will be restricted from leakage to the environment or filtered through the HEPA filters and charcoal adsorbers prior to discharge to the atmosphere within 10 CFR 50.67 limits. The OPERABILITY and closure restrictions are sufficient to restrict radioactive material release from the number of fuel rods assumed to be ruptured in the FHA analysis based upon the lack of containment pressurization potential while in the REFUELING MODE.

All containment penetrations, except for the containment purge and exhaust penetrations, that provide direct access from containment atmosphere to outside atmosphere must be isolated on at least one side. Penetration closure may be achieved by an isolation valve, blind flange, manual valve, or functional equivalent. Functional equivalent isolation ensures releases from the containment are prevented for credible accident scenarios. The isolation techniques must be approved by an engineering evaluation and may include use of a material that can provide a temporary, pressure tight seal capable of maintaining the integrity of the penetration to restrict the release of radioactive material from a fuel element rupture.

3/4.9.5 COMMUNICATIONS The requirements for communications capability ensures that refueling station personnel can be promptly informed of significant changes in the facility status or core reactivity conditions during CORE ALTERATIONS.

BEAVER VALLEY - UNIT 1 B 3/4 9-2 Change No. 1-002

REFUELING OPERATIONS BASES 3/4.9.6 MANIPULATOR CRANE OPERABILITY The OPERABILITY requirements for the manipulator cranes ensure that:

1) manipulator cranes will be used for movement of control rods and fuel assemblies; 2) each crane has sufficient load capacity to lift a control rod or fuel assembly; and 3) the core internals and pressure vessel are protected from excessive lifting force in the event they are inadvertently engaged during lifting operations.

3/4.9.7 (THIS SPECIFICATION NUMBER IS NOT USED.)

3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION The requirement that at least one residual heat removal (RHR) loop be in operation ensures that 1) sufficient cooling capacity is available to remove decay heat and maintain the water in the reactor pressure vessel below 140°F as required during the REFUELING MODE, and 2) sufficient coolant circulation is maintained throughout the reactor core to minimize the effect of a boron dilution incident and prevent boron stratification.

The requirement to have two RHR loops OPERABLE when there is less than 23 feet of water above the reactor pressure vessel flange ensures that a single failure of the operating RHR loop will not result in a complete loss of residual heat removal capability. With the reactor vessel head removed and 23 feet of water above the reactor pressure vessel flange, a large heat sink is available for core cooling. Thus, in the event of a failure of the operating RHR loop, adequate time is provided to initiate emergency procedures to cool the core.

3/4.9.9 CONTAINMENT PURGE AND EXHAUST ISOLATION SYSTEM The LCO is applicable during movement of recently irradiated fuel assemblies and during movement of fuel assemblies over recently irradiated fuel assemblies because there is a potential for the limiting fuel handling accident (FHA) to occur. Therefore, the requirements of this Specification may be required to limit leakage of radioactive material within the containment to the environment. A FHA which does not involve recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months ) will result in radiation exposures that are within the guideline values specified in 10 CFR 50.67 without any reliance on the requirements of this Specification to limit leakage to the environment. The 100 hour0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months limit is based on the current radiological analysis for a FHA which assumes a decay time of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months . LCO 3.9.3 prohibits irradiated fuel movement unless 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months of decay BEAVER VALLEY - UNIT 1 B 3/4 9-3 Change No. 1-002

REFUELING OPERATIONS BASES 3/4.9.9 CONTAINMENT PURGE AND EXHAUST ISOLATION SYSTEM (Continued) has occurred. Therefore, this specification will not be applicable unless the decay time in Specification 3.9.3 and the time assumed in the radiological analysis for a FHA are reduced to below 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months .

THE OPERABILITY of this system ensures that the containment vent and purge penetrations will be automatically isolated upon detection of high radiation levels within the containment. The integrity of the containment penetrations of this system may be required to restrict the release of radioactive material from the containment atmosphere to acceptable levels which are less than those listed in 10 CFR 50.67.

3/4.9.10 AND 3/4.9.11 WATER LEVEL - REACTOR VESSEL AND STORAGE POOL The restrictions on minimum water level ensure that sufficient water depth is available to remove 99.5% of the assumed iodine gap activity (8% for iodine 131 and 5% for other iodines) released from the number of fuel rods assumed to be ruptured in the fuel handling accident analysis. The minimum water depth is consistent with the assumptions of the accident analysis.

3/4.9.12 FUEL BUILDING VENTILATION SYSTEM The LCO is applicable during movement of recently irradiated fuel assemblies and during movement of fuel assemblies over recently irradiated fuel assemblies because there is a potential for the limiting fuel handling accident (FHA) to occur. Therefore, the requirements of this Specification may be required to limit leakage of radioactive material within the fuel building to the environment.

A FHA which does not involve recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months ) will result in radiation exposures that are within the guideline values specified in 10 CFR 50.67 without any reliance on the requirements of this Specification to limit leakage to the environment. The 100 hour0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months limit is based on the current radiological analysis for a FHA which assumes a decay time of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months .

LCO 3.9.3 prohibits irradiated fuel movement unless 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months of decay has occurred. Therefore, this specification will not be applicable unless the decay time in Specification 3.9.3 and the time assumed in the radiological analysis for a FHA are reduced to below 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months .

The limitations on the storage pool ventilation system ensure that all radioactive material released, as a result of a fuel handling accident (FHA) within the fuel building involving recently irradiated fuel, will be filtered through the HEPA filters and charcoal adsorber BEAVER VALLEY - UNIT 1 B 3/4 9-4 Change No. 1-002

REFUELING OPERATIONS BASES 3/4.9.12 FUEL BUILDING VENTILATION SYSTEM (Continued) prior to discharge to the atmosphere. The spent fuel pool area ventilation system is non-safety related and only recirculates air through the fuel building. The SLCRS portion of the ventilation system is safety-related and maintains a negative pressure in the fuel building. The SLCRS flow is normally exhausted to the atmosphere without filtering, however, the flow is diverted through the main filter banks by manual actuation or on a high radiation signal.

3/4.9.13 (This Specification is not used.)

3/4.9.14 FUEL STORAGE - SPENT FUEL STORAGE POOL The requirements for fuel storage in the spent fuel pool ensure that:

(1) the spent fuel pool will remain subcritical during fuel storage; and (2) a uniform boron concentration is maintained in the water volume in the spent fuel pool to provide negative reactivity for postulated accident conditions under the guidelines of ANSI 16.1-1975. The value of 0.95 or less for Keff which includes all uncertainties at the 95/95 probability/confidence level is the acceptance criteria for fuel storage in the spent fuel pool.

The Action Statement applicable to fuel storage in the spent fuel pool ensures that: (1) the spent fuel pool is protected from distortion in the fuel storage pattern that could result in a critical array during the movement of fuel; and (2) the boron concentration is maintained at 1050 ppm (this includes a 50 ppm conservative allowance for uncertainties and 600 ppm for margin) during all actions involving movement of fuel in the spent fuel pool.

The Surveillance Requirements applicable to fuel storage in the spent fuel pool ensure that: (1) the fuel assemblies satisfy the analyzed U-235 enrichment limits or an analysis has been performed and it was determined that Keff is 0.95; and (2) the boron concentration meets the 1050 ppm limit.

The reracked spent fuel pool consists of discrete Regions 1 and 2 with Region 2 further subdivided and identified as Regions 2 and 3.

Region 1 is configured to store fuel with a nominal region average enrichment of 5.0 weight percent (w/o) with individual fuel assembly tolerance of + or - 0.05 w/o U-235. The most reactive of the Westinghouse 17 X 17 STD/Vantage 5H and OFA fuel assemblies yielded a maximum Keff of 0.940 including all biases and uncertainties.

BEAVER VALLEY - UNIT 1 B 3/4 9-5 Amendment No. 241

REFUELING OPERATIONS BASES 3/4.9.14 FUEL STORAGE - SPENT FUEL STORAGE POOL (Continued)

Region 2 racks are designed to store fuel with burnup consistent with its initial enrichment. A table of enrichment and corresponding required burnup is provided in the technical specification. A conservative value of the required burnup is given by the following linear equation:

Minimum burnup for unrestricted storage in Region 2 in MWD/MTU = 12100

E% - 20500, where E is the initial enrichment in w/o.

Storage cells in Region 2, which face the pool wall, are in an area of high neutron leakage and are capable of maintaining the Keff below 0.95 with fuel that does not meet the foregoing burnup restriction.

A separate calculation to establish the admissibility of storing low burnup fuel in these cells, designated Region 3, has been performed and a table of enrichment and corresponding required burnup is provided in the technical specification. This calculation was performed using the same analytical models and computer codes which were used in the high density rack design. A conservative value of the required burnup is given by the following linear equation:

Minimum burnup for fuel storage in Region 3 in MWD/MTU = - 480 * (E%)2 + 12,900

E% - 27,400, where E is the initial enrichment in weight percent.

The maximum reactivity in Region 2 is 0.945 and in Region 3 is 0.946 if all cells are loaded with fuel with minimum allowable burnup.

This includes all biases and uncertainties and appropriate allowance for uncertainty in depletion calculations.

BEAVER VALLEY - UNIT 1 B 3/4 9-6 Amendment No. 241

3/4.10 SPECIAL TEST EXCEPTIONS BASES 3/4.10.1 SHUTDOWN MARGINS This special test exception provides that a minimum amount of control rod worth is immediately available for reactivity control when tests are performed for control rod worth measurement. This special test exception is required to permit the periodic verification of the actual versus predicted core reactivity condition occurring as a result of fuel burnup or fuel cycling operations.

3/4.10.2 GROUP HEIGHT, INSERTION AND POWER DISTRIBUTION LIMITS This special test exception permits individual control rods to be positioned outside of their normal group heights and insertion limits during the performance of such PHYSICS TESTS as those required to

1) measure control rod worth and 2) determine the reactor stability index and damping factor under xenon oscillation conditions.

3/4.10.3 PRESSURE/TEMPERATURE LIMITATIONS - REACTOR CRITICALITY This special test exception permits the reactor to be critical at less than or equal to 5% of RATED THERMAL POWER during low temperature PHYSICS TESTS required to measure such parameters as control rod worth and SHUTDOWN MARGIN.

3/4.10.4 PHYSICS TESTS This special test exception permits PHYSICS TESTS to be performed at less than or equal to 5% of RATED THERMAL POWER and is required to verify the fundamental nuclear characteristics of the reactor core and related instrumentation.

3/4.10.5 NO FLOW TESTS This special test exception permits reactor criticality under no flow conditions and is required to perform certain startup and physics tests while at low THERMAL POWER levels.

BEAVER VALLEY - UNIT 1 B 3/4 10-1 Amendment No. 2

3/4.11 RADIOACTIVE EFFLUENTS BASES 3/4.11.1 LIQUID EFFLUENTS 3/4.11.1.4 LIQUID HOLDUP TANKS Restricting the quantity of radioactive material contained in the specified tanks provides assurance that in the event of an uncontrolled release of the tanks' contents, the resulting concentrations would be less than the limits of 10 CFR Part 20, Appendix B, Table 2, Column 2, at the nearest potable water supply and the nearest surface water supply in an unrestricted area.

3/4.11.2 GASEOUS EFFLUENTS 3/4.11.2.5 GAS STORAGE TANKS Restricting the quantity of radioactivity contained in each gas storage tank provides assurance that in the event of an uncontrolled release of the tanks' contents, the resulting total body exposure to an individual located at the nearest exclusion area boundary for two hours immediately following the onset of the release will not exceed 0.5 rem. The specified limit restricting the quantity of radioactivity contained in each gas storage tank was specified to ensure that the total body exposure resulting from the postulated release remained a suitable fraction of the reference value set forth in 10 CFR 100.11(a)(1).

3/4.11.2.6 EXPLOSIVE GAS MIXTURE This specification is provided to ensure that the concentration of potentially explosive gas mixtures contained in the waste gas holdup system is maintained below the flammability limits of hydrogen and oxygen. Isolation of the affected tank for purposes of purging and/or discharge permits the flammable gas concentrations of the tank to be reduced below the lower explosive limit in a hydrogen rich system. Maintaining the concentration of hydrogen and oxygen below their flammability limits provides assurance that the releases of radioactive materials will be controlled in conformance with the requirements of General Design Criterion 60 of Appendix A to 10 CFR Part 50.

BEAVER VALLEY - UNIT 1 B 3/4 11-1 Amendment No. 188

ML021230495

Text

Reference:

Navigation menu

Search