ML021280346

Technical Specifications, Changes to Technical Specification Bases Pages

ML021280346
Person / Time
Site:	Millstone
Issue date:	05/01/2002
From:	Office of Nuclear Reactor Regulation
To:
Ennis R, NRR/DLPM, 415-1420
Shared Package
ML021280480	List: ML021090571 ML021280346
References
TAC MB4827
Download: ML021280346 (39)

Text

2.1 SAFETY LIMITS TSCR 2-6-02 March 8, 2002 BASES 2.1.1 REACTOR CORE The restrictions of this safety limit prevent overheating of the fuel cladding and possible cladding perforation which would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate at o' 16H thAh W fU81 centerline melt linear heat rate limit. Centerline fuel melting will not occur for this peak linear heat rate. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.

Operation above the upper boundary of the nucleate boiling regime could result in excessive cladding temperatures because of the onset of departure from nucleate boiling (DNB) and the resultant sharp reduction in heat transfer coefficient. DNB is not a directly measurable parameter during operation and therefore THERMAL POWER and Reactor Coolant Temperature and Pressure have been related to DNB through the HTP correlation. The HTP DNB correlation has been developed to predict the DNB flux and the location of DNB for axially uniform and non-uniform heat flux distributions. The local DNB heat flux ratio, DNBR, defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB.

The value of the DNBR during steady state operation, normal operational transients, and anticipated transients is limited to be no less than the DNB correlation limit. The correlation limit corresponds to a 95 percent probability at a 95 percent confidence level (i.e., 95/95 limit) that DNB will not occur and is chosen as an appropriate margin to DNB for all operating conditions.

The curves of Figure 2.1-1 show the loci of points of THERMAL POWER, Reactor Coolant System pressure and maximum cold leg temperature with four Reactor Coolant Pumps operating for which the minimum DNBR is no less than the 95/95 limit for the DNB correlation. The limits in Figure 2.1-1 were calculated for reactor coolant inlet temperatures less than or equal to 580°F.

The dashed line at 580°F coolant inlet temperatures is not a safety limit; however, operation above 580°F is not possible because of the actuation of the main steam line safety valves which limit the maximum value of reactor inlet temperature. Reactor operation at THERMAL POWER levels higher than 111.6% of RATED THERMAL POWER is prohibited by the high power level trip setpoint specified in Table 2.2-1. The area of safe operation is below and to the left of these lines.

MILLSTONE - UNIT 2 B 2-1 Amendment No. 7, 97, $J,179, 779, 0803 loge RE,ýby leterdated ýty 1, MUY.

SAFETY LIMIT TSCR 2-6-02 March 8, 2002 BASES The conditions for the Thermal Margin Safety Limit curves in figure 2.1-1 to be valid are shown on the figure.

The reactor protective system in combination with the Limiting Conditions for Operation, is designed to prevent any anticipated combination of transient conditions for reactor coolant system temperature, pressure, and thermal power level that would result in a DNBR below the 95/95 limit for the DNB correlation and preclude the existence of flow instabilities.

2.1.2 REACTOR COOLANT SYSTEM PRESSURE The restriction of this Safety Limit protects the integrity of the Reactor Coolant System from overpressurization and thereby prevents the release of radionuclides contained in the reactor coolant from reaching the containment atmosphere.

The reactor pressure vessel and pressurizer are designed to Section III of the ASME Code for Nuclear Power Plant Components which permits a maximum transient pressure of 110% (2750 psia) of design pressure. The Reactor Coolant System piping, valves and fittings, are designed to ANSI B31.7, Class I which permits a maximum transient pressure of 110% (2750 psia) of component design pressure. The Safety Limit of 2750 psia is therefore consistent with the design criteria and associated code requirements.

The entire Reactor Coolant System is hydrotested at 3125 psia to demon strate integrity prior to initial operation.

MILLSTONE - UNIT 2 B 2-3 Amendment No. 7 JI 0804 Pevise by WJ letter datE k gll2i Xhy1,2?If

LIMITING SAFETY SYSTEM SETTINGS TSCR 2-6-02 March 8, 2002 BASES Reactor Coolant Flow-Low (Continued)

The low-flow trip setpoint and Allowable Value have been derived in consideration of instrument errors and response times of equipment involved to maintain the DNBR above the 95/95 limit for the DNB correlation under normal operation and I expected transients.

Pressurizer Pressure-Hiqh The pressurizer Pressure-High trip, backed up by the pressurizer code safety valves and main steam line safety valves, provides reactor coolant system protection against overpressurization in the event of loss of load without reactor trip. This trip's setpoint is approximately 100 psi below the nominal lift setting (2500 psia) of the pressurizer code safety valves and its concurrent operation with the power-operated relief valves avoids the undesirable operation of the pressurizer code safety valves.

Containment Pressure-High The Containment Pressure-High trip provides assurance that a reactor trip is initiated concurrently with a safety injection. The setpont for this trip is identical to the safety injection setpoint.

Steam Generator Pressure-Low The Steam Generator Pressure-Low trip provides protection against an excessive rate of heat extraction from the steam generators and subsequent cooldown of the reactor coolant. The trip setting is sufficiently below the full-load operating point so as not to interfere with normal operation, but still high enough to provide the required protection in the event of excessively high steam flow.

MILLSTONE - UNIT 2 B 2-5 Amendment No. 0, P1, 17, J?,

0805 Revisd by MC letter dated Ihy 1, 2002.

LIMITING SAFETY SYSTEM SETTINGS TSCR 2-6-02 March 8, 2002 RASFS Steam Generator Water Level - Low The Steam Generator Water Level-Low Trip provides core protection by preventing operation with the steam generator water level below the minimum volume required for adequate heat removal capacity and assures that the design pressure of the reactor coolant system will not be exceeded.

Local Power Density-High The Local Power Density-High trip, functioning from AXIAL SHAPE INDEX monitoring, is provided to ensure that the peak local power density in the fuel which corresponds to fuel centerline melting will not occur as a conse quence of axial power maldistributions. A reactor trip is initiated whenever the AXIAL SHAPE INDEX exceeds the allowable limits of Figure 2.2-2. The AXIAL SHAPE INDEX is calculated from the upper and lower ex-core neutron detector channels. The calculated setpoints are generated as a function of THERMAL POWER level. The trip is automatically bypassed below 15 percent power.

The maximum AZIMUTHAL POWER TILT and maximum CEA misalignment permitted for continuous operation are assumed in generation of the setpoints. In addition, CEA group sequencing in accordance with the Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally, the maximum insertion of CEA banks which can occur during any anticipated operational occurrence prior to a Power Level-High trip is assumed.

Thermal Marqin/Low Pressure The Thermal Margin/Low Pressure trip is provided to prevent operation when the DNBR is below the 95/95 limit for the DNB correlation.

MILLSTONE - UNIT 2 B 2-6 Amendment No. 7, 01, 01, P1, 17g, 0805 Pevised by MC letter dated lTy 1, 200F2.

LIMITING SAFETY SYSTEM SETTINGS TSCR 2-6-02 March 8, 2002 Underspeed - Reactor Coolant Pumps The Underspeed - Reactor Coolant Pumps trip provides core protection to prevent DNB in the event of a sudden significant decrease in reactor coolant pump speed (with resulting decrease in flow) on all four reactor coolant pumps.

The trip setpoint ensures that a reactor trip will be generated, considering instrument errors and response times, in sufficient time to allow the DNBR to be maintained above the 95/95 limit for the DNB correlation following a 4 pump loss of flow event.

MILLSTONE 0806

- UNIT 2 B 2-8 Amendment No. fl, f7, XJP, R--iseby ME letter datedMtyl1, 2002.

3/4.1 REACTIVITY CONTROL SYSTEMS February 7, 2002 TSCR 2-2-02 BASES 3/4.1.1 BORATION CONTROL 3/4.1.1.1 and 3/4.1.1.2 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that 1) the reactor can be made subcritical from all operating conditions, 2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limits, and 3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.

SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS Tav9. The most restrictive condition occurs at EOL, with Tavg at no load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, the minimum SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT is initially required to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN required by Specification 3.1.1.1 is based upon this limiting condition and is consistent with FSAR accident analysis assumptions. For earlier periods during the fuel cycle, this value is conservative. With Tavg

• 200 0 F, the reactivity transients resulting from any postulated accident are minimal and the reduced SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT provides adequate protection.

3/4.1.1.3 BORON DILUTION A minimum flow rate of at least 1000 GPM provides adequate mixing, prevents stratification and ensures that reactivity changes will be gradual during reductions in Reactor Coolant System boron concentration. The 1000 GPM limit is the minimum required shutdown cooling flow to satisfy the boron dilution accident analysis. This 1000 GPM flow is an analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommoaate flow measurement uncertainties. While the plant is operating in reduced inventory operations, plant operating procedures also specify an upper flow limit to prevent vortexing in the shutdown cooling system. A flow rate of at least 1000 GPM will circulate the full Reactor Coolant System volume in approximately 90 minutes. With the RCS in mid-loop operation, the Reactor Coolant System volume will circulate in approximately 25 minutes. The reactivity change rate associated with reductions in Reactor Coolant System boron concentration will be within the capability for operator recognition and control.

3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)

The limitations on MTC are provided to ensure that the assumptions used in the accident and transient analyses remain valid through each fuel cycle. The surveillance requirements for measurement of the MTC during each fuel cycle are adequate to confirm the MTC value since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup. The confirmation that the measured MTC value is within its limit provides assurance that the coefficient will be maintained within acceptable values throughout each fuel cycle.

MILLSTONE - UNIT 2 B 3/4 1-1 Amendment No. Jlo, Jf, Jp 0794 Reviedby MC letter dateld hy 1, M.

December 20, 2001 BASES PTSCR 2-20-01 3/4.1.2 BORATION SYSTEMS (Continued)

The provision in Specification 3.1.2.4 that Specifications 3.0.4 and 4.0.4 are not applicable for entry into MODE 4 is provided to allow for closing the motor circuit breaker and subsequent testing of the inoperable charging pump.

Specification 3.4.9.3, which is applicable to MODES 5 and 6, requires that one charging pump be capable of injecting into the RCS at or below 190'F.

Specification 3.1.2.4 requires that at least two charging pumps be OPERABLE in MODES 1, 2, 3, and 4. The exception from Specification 3.0.4 and 4.0.4 will allow Millstone Unit No. 2 to enter into MODE 4 and test the inoperable charging pump and declare it OPERABLE.

Surveillance Requirement (SR) 4.1.2.2.a requires all testable power operated valves in each required flow path to be exercised through one complete cycle at least once per 7 days. This surveillance requirement does not apply to 2-CS-13.1B. This motor operated valve is in the RWST supply to the charging pumps and the RWST supply to the Facility 2 emergency core cooling pumps (HPSI, LPSI, and CS). It is key-locked in the open position during normal plant operation. This valve is not in the boration flow path when it is in the normal locked open position, and it is a non-testable valve in Modes 1 through 4 for boration flow path verification due to the increase in plant risk with no offsetting improvement in plant safety. Therefore, it is not necessary to stroke this valve at least once per 7 days for the boration flow path verification required by SR 4.1.2.2.a. However, for additional assurance, 2-CS-13.1B should be verified locked open when performing SR 4.1.2.2.a.

3/4.1.3 MOVEABLE CONTROL ASSEMBLIES The specifications of this section ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of a CEA ejection accident are limited to acceptable levels.

The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original criteria are met.

The ACTION statements applicable to an immovable or untrippable CEA and to a large misalignment (Ž 20 steps) of two or more CEAs, require a prompt shutdown of the reactor since either MILLSTONE - UNIT 2 B 3/4 1-3a Amendment No. f7, 11f, jp, lo, 0766 719, Pevised byW1letter dated yt 1, 2M1Y2.

3/4.4 REACTOR COOLANT SYSTEM TSCR 2-6-02 March 8, 2002 BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION The plant is designed to operate with both Reactor Coolant System (RCS) loops and associated reactor coolant pumps (RCPs) in operation, and maintain the DNBR above the 95/95 limit for the DNB correlation during all normal operations and anticipated transients. In MODES 1 and 2, both RCS loops and associated RCPs are required to be OPERABLE and in operation.

In MODE 3, a single RCS loop with one RCP and adequate steam generator secondary water inventory provides sufficient heat removal capability.

However, both RCS loops with at least one RCP per loop are required to be OPERABLE to provide redundant paths for decay heat removal. In addition, as a minimum, one RCS loop must be in operation. Any exceptions to these requirements are contained in the LCO Notes.

In MODE 4, one RCS loop with one RCP and adequate steam generator secondary water inventory, or one shutdown cooling (SDC) train provides sufficient heat removal capability. However, two loops or trains, consisting of any combination of RCS loops or SDC trains, are required to be OPERABLE to provide redundant paths for decay heat removal. In addition, as a minimum, one RCS loop or SDC train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.

In MODES 3 and 4, an OPERABLE RCS loop consists of the RCS loop, associated steam generator, and at least one RCP. The steam generator must have sufficient secondary water inventory for heat removal.

In MODE 5, with the RCS loops filled, the SDC trains are the primary means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for decay heat removal either two SDC trains are required to be OPERABLE, or one SDC train is required to be OPERABLE and both steam generators are required to have adequate steam generator secondary water inventory. In addition, as a minimum, one SDC train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.

By maintaining adequate secondary water inventory and makeup capability, the steam generators will be able to support natural circulation in the RCS loops. In addition, the ability to pressurize and control RCS pressure is necessary to support RCS natural circulation. If the pressurizer steam bubble has been collapsed and the RCS has been depressurized or drained sufficiently that voiding of the steam generator U-tubes may have occurred, the RCS loops should be considered not filled unless an evaluation is performed to verify the ability of the RCS to support natural circulation. If the RCS loops are considered not filled, the RCS must be refilled, pressurized, and the RCPs bumped (unless a vacuum fill of the RCS was performed) before the RCS loops can be considered filled.

In MODE 5, with the RCS loops not filled, the SDC trains are the only means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for decay heat removal, two SDC trains are required to be OPERABLE. In addition, as a minimum, one SDC MILLSTONE - UNIT 2 B 3/4 4-1 Amendment No. go, f, y, X7ý, 7F, 0807 Pevised1j M3C letter dated y 1, 2XO2.

3/4.4 REACTOR COOLANT SYSTEM PTSCR 2-17-01 November 28, 2001 BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.

An OPERABLE SDC train, for plant operation in MODES 4 and 5, includes a pump, heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine RCS temperature. In addition, sufficient portions of the Reactor Building Closed Cooling Water (RBCCW) and Service Water (SW) Systems shall be OPERABLE as required to provide cooling to the SDC heat exchanger. The flow path starts at the RCS hot leg and is returned to the RCS cold legs.

In MODE 4, an OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);

2. The associated SDC heat exchanger from the same facility as the SDC pump;

3. The associated reactor building closed cooling water loop from the same facility as the SDC pump;

4. The associated service water loop from the same facility as the SDC pump; and

5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.

In MODE 4, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers and 2 SW headers are required to support the SOC heat exchangers, consistent with the requirements of Technical Specifications 3.7.3.1 and 3.7.4.1.

In MODE 5, an OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);

2. The associated SDC heat exchanger from the same facility as the SDC pump;

3. An RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heat exchanger capable of cooling the associated SDC heat exchanger;

4. A SW pump, powered from the same facility as the SDC pump, capable of supplying cooling water to the associated RBCCW heat exchanger; and

5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.

MILLSTONE - UNIT 2 B 3/4 4-1a Amendment No. go, P, g, X;O, 71p, 0763 70t81 0763y 1, M.

3/4.4 REACTOR COOLANT SYSTEM November 28, 2001 PTSCR 2-17-01 BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)

In MODE 5, two OPERABLE SDC tra4 ns require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers are required to provide cooling to the SDC heat exchangers, but only I SW header is required to support the SDC trains. The equipment specified is sufficient to address a single active failure of the SDC System and associated support systems.

The operation of one Reactor Coolant Pump or one shutdown cooling pump provides adequate flow to ensure mixing, prevent stratification and produce gradual reactivity changes during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reductions will, therefore, be within the capability of operator recognition and control.

The restrictions on starting a Reactor Coolant Pump in MODE 4 with one or more RCS cold legs < 275°F and in MODE 5 are provided to prevent RCS pressure transients, caused by energy additions from the secondary system, which could exceed the limits of Appendix G to 10 CFR Part 50. The RCS will be protected against overpressure transients and will not exceed the limits of Appendix G by:

1. Restricting pressurizer water volume to ensure sufficient steam volume is available to accommodate the insurge;

2. Restricting pressurizer pressure to establish an initial pressure that will ensure system pressure does not exceed the limit; and

3. Restricting primary to secondary system delta-T to reduce the energy addition from the secondary system.

If these restrictions are met, the steam bubble in the pressurizer is sufficient to ensure the Appendix G limits will not be exceeded. No credit has been taken for PORV actuation to limit RCS pressure in the analysis of the energy addition transient.

The limitations on pressurizer water level, pressurizer pressure, and primary to secondary delta-T are necessary to ensure the validity of the analysis of the energy addition due to starting an RCP. The values for pressurizer water level and pressure can be obtained from control room indications. The primary to secondary system delta-T can be obtained from Shutdown Cooling (SDC) System outlet temperature and the saturation temperature for indicated steam generator pressure. If there is no indicated steam generator pressure, the steam generator shell temperature indicators can be used. If these indications are not available, other appropriate instrumentation can be used.

The RCP starting criteria values for pressurizer water level, pressurizer pressure, and primary to secondary delta-T contained in Technical Specification 3.4.1.3 have not been adjusted for instrument uncertainty. The values for these parameters contained in the procedures that will be used to start an RCP have been adjusted to compensate for instrument uncertainty.

MILLSTONE - UNIT 2 B 3/4 4-lb Amendment No. 0, p, f, 17g, 7*,

0763 ~Pevi: by ME Thtte2r datW y fXY2

'I

3/4.4 REACTOR COOLANT SYSTEM TSCR 2-19-01 and PTSCR 2-17-01 December 13, 2001 November 28, 2001 BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)

The value of RCS cold leg temperature (* 275 OF) used to determine if the RCP start criteria applies, will be obtained from SDC return temperature if SDC is in service. If SDC is not in service, or natural circulation is occurring, RCS cold leg temperature will be used.

Average Coolant Temperature (Tavg) values are derived under the following 3 plant conditions, using the designated formula as appropriate for use in Unit 2 operating procedures.

"* RCP Operation: (TCoIdl + TCold2 + Thotl +Thot 2 ) / 4 = Tavg

"* Natural circulation only flow: (TCoIdl + TcoJd2 + +hoti

+ Thot 2 ) / 4 = Tavg

• SDC flow greater than 1000 gpm: (SDCoutiet + SDCiniet) / 2 = Tavg (exception: Tavu is not expected to be calculated by this definition during the initial portion of the initiation phase of SDC. The transition point from loop temperature average to SDC system average during cooldowns is when T351Y decreases below Loop T~ood)

During operation with one or more Reactor Coolant Pumps (RCPs) providing forced flow and during natural circulation conditions, the loop Resistance Temperature Detectors (RTDs) represent the inlet and outlet temperatures of the reactor and hence the average temperature of the water that the reactor is exposed to. This holds during concurrent RCP/SDC operation also.

During Shutdown Cooling (SDC) only operation, there is no significant flow past the loop RTDs. Core inlet and outlet temperatures are accurately measured during those conditions by using T351Y, SDC return to RCS temperature indication, and T351X, RCS to SDC temperature indication. The average of these two indicators provides a temperature that is equivalent to the average RCS temperature in the core.

During the transition from Steam Generator (SG) and SDC heat removal to SDC only heat removal, actual core average temperature results from a mixture of both SDC flow and loop flow from natural circulation. This condition occurs from the time SDC cooling is initiated until SG steaming process stops removing heat. The temperature of this mixture cannot be measured or calculated. However, the average of the SDC temperatures is still appropriate for use. This provides a straightforward process for determining Tavg.

During some transient conditions, such as heatups on SDC, the value calculated by this average definition will be slightly higher than the actual core average. During other transients, such as cooldowns where SG heat removal is still taking place causing some natural circulation flow, the value calculated by the average definition will be slightly lower than actual core average conditions. For the purpose of determining mode changes and technical specification applicability, these transient condition results are conservative.

3/4.4.2 SAFETY VALVES The pressurizer code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 296,000 lbs per hour of saturated steam at the valve setpoint. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown. If any pressurizer code safety valve is inoperable, and cannot be restored to OPERABLE status, the action statement requires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 will become applicable and require the Low Temperature Overpressure Protection System to be placed in service to provide overpressure protection.

MILLSTONE - UNIT 2 B 3/4 4-1c Amendment No. 0, g, g, 170, f*,

0785 M 7 Pvised by MC lettercdated ity 1, 2002.

REACTOR COOLANT SYSTEM TSCR 2-19-01 December 13, 2001 BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS The RCS leakage detection systems required by this specification are rovided to monitor and detect leakage from the Reactor Coolant Pressure oundary. These detection systems are consistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems."

3/4.4.6.2 REACTOR COOLANT SYSTEM LEAKAGE Industry experience has shown that while a limited amount of leakage is expected from the RCS, the unidentified portion of this leakage can be reduced to a threshold value of less than 1 GPM. This threshold value is sufficiently low to ensure early detection of additional leakage.

The 10 GPM IDENTIFIED LEAKAGE limitation provides allowance for a limited amount of leakage from known sources whose presence will not interfere with the detection of UNIDENTIFIED LEAKAGE by the leakage detection systems.

The steam generator tube leakage limit of 0.035 GPM per steam generator ensures that the dosage contribution from the tube leakage will be less than the limits of General Design Criteria 19 of 10CFR50 Appendix A in the event of either a steam generator tube rupture or steam line break. The 0.035 GPM limit is consistent with the assumptions used in the analysis of these accidents.

PRESSURE BOUNDARY LEAKAGE of any magnitude is unacceptable since it may be indicative of an impending gross failure of the pressure boundary.

Therefore, the presence of any PRESSURE BOUNDARY LEAKAGE requires the unit to be promptly placed in COLD SHUTDOWN.

The IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE limits listed in LCO 3.4.6.2 only apply to the reactor coolant system pressure boundary within the containment.

In accordance with 10 CFR 50.2 "Definitions" the RCS Pressure Boundary means all those pressure-containing components such as pressure vessels, piping pumps and valves which are (1) Part of the Reactor Coolant System, or (2)

Connected to the Reactor Coolant System, up to and including any and all of the following: (i) The outermost containment isolation valve in system piping which penetrates primary reactor containment, (ii) The second of two valves normally closed in system piping which does not penetrate primary reactor containment, or (iii) The reactor coolant safety and relief valves.

The definitions for IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE are provided in the Technical Specifications definitions section, definitions 1.14 and 1.15 respectively.

Leakage outside of the second isolation valve for containment which is included in the RCS Leak Rate Calculation is not considered RCS leakage and can be subtracted from RCS Unidentified Leakage.

The safety significance of RCS leakage varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS leakage into the containment area is necessary. Quickly separating IDENTIFIED LEAKAGE from the UNIDENTIFIED LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur.

LCO 3.4.6.2 deals with protection of the reactor coolant pressure boundary from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded.

MILLSTONE - UNIT 2 B 3/4 4-3 Amendment Nos. 171, J7, JF, 0786 1bvi1sd by NC letter dated y 1,2002.

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) TSCR 2-19-01 December 13, 2001 BASES 3/4.5.1 SAFETY INJECTION TANKS (continued) within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and pressurizer pressure reduced to < 1750 psia within 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />. The allowed completion times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.

If more than one SIT is inoperable, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

LCO 3.5.1.a requires that each reactor coolant system safety injection tank shall be OPERABLE with the isolation valve open and the power to the valve operator removed.

This is to ensure that the valve is open and cannot be inadvertently closed.

To meet LCO 3.5.1.a requirements, the valve operator is considered to be the valve motor and not the motor control circuit. Removing the closing coil while maintaining the breaker closed meets the intent of the Technical Specification by ensuring that the valve cannot be inadvertently closed.

Removing the closing coil and verifying that the closing coil is removed (Per SR 4.5.1.e) meets the Technical Specification because it prevents energizing the valve operator to position the valve in the close direction.

Opening the breaker, in lieu of removing the closing coil, to remove power to the valve operator is not a viable option since:

1. Millstone Unit 2 Safety Evaluation Report (SER) Docket No. 50-336, dated May 10, 1974, requires two independent means of position indication.

2. Surveillance Requirement 4.5.1.a requires the control/indication circuit to be energized, to verify that the valve is open.

3. Technical Specification 3/4.3.2, Engineered Safety Feature Actuation System Instrumentation, requires these valves to open on a SIAS signal.

Opening the breaker would eliminate the ability to satisfy the above three items.

3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two separate and independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the safety injection tanks is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward.

Limiting Condition for Operation (LCO) 3.5.2.d, which requires a separate and independent OPERABLE flow path from an OPERABLE Boric Acid Storage Tank to one OPERABLE charging pump, is satisfied when the requirements of Technical Specification 3.1.2.8.a are met.

MILLSTONE - UNIT 2 B 3/4 5-2 Amendment No. 91, 77, J9, 0787 g17, 770, 779, evisdby1MC1etterdate1d hl1, 2002.

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) TSCR 2-19-01 December 13, 2001 BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)

Technical Specification 3.1.2.8.a provides the requirements for an OPERABLE Boric Acid Storage Tank (BAST) and flow paths to the charging pump suction header. Combustion Engineering Calculation No. N-PEC-39, "Charging Pump NPSH Check-Millstone #2," dated September 20, 1973, shows that there is adequate suction head for the charging pumps for the four (4) different cases in which all three charging pumps can take suction. These cases are as follows:

"* Suction from VCT (assumed 5% level in VCT)

"* Suction from BASTs (gravity feed, assumed 0% level in one BAST)

• Suction from BASTs (boric acid pumps, assumed 0% level in one BAST) 0 Suction from the Refueling Water Storage Tank (RWST) (assumed 10% level in the RWST)

The BASTs are passive components which supply concentrated boric acid to the Reactor Coolant System (RCS) via the charging system. Passive components are not subject to single active failures. Two redundant flow paths are provided to the charging system from the BASTs. These include the following:

1. A gravity feed flow path from either BAST through motor-operated valves (either 2-CH-508 or 2-CH-509) to the common suction header to the charging pumps.

Both of these parallel valves obtain their electrical power from Facility Z-1. To ensure that the Volume Control Tank (VCT) will not prevent the gravity feed flow path from delivering boric acid to the charging pump suction, the VCT isolation valve (2-CH-501) receives a close signal upon SIAS. Valve 2-CH-501 is also electrically powered from a Facility Z-1 source.

2. Separate parallel suction line flow path from the BASTs through the boric acid pumps.

Flow from the discharge of the pumps is directed to the suction header for the charging pumps via a single special line through motor-operated valve 2-CH-514. This valve, plus the valves to isolate the boric acid pump recirculation (air operated valves 2-CH-510 and 2-CH-511), receive open and close signals upon SIAS, respectively. All of this equipment in the second redundant flow path obtains its electrical power from Facility Z-2.

Protection against a single active failure (i.e., failure of a pump or valve) is provided by the requirement to have a minimum of two (2) separate and redundant boron injection flow paths to the charging pumps (per Bases 3/4.1.2).

The ECCS leak rate surveillance requirements assure that the leakage rates assumed for the system outside containment during the recirculation phase will not be exceeded.

The Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the accident analyses are MILLSTONE - UNIT 2 B 3/4 5-2a Amendment No. 91, 77, J9, 0787 sl7, 202,.

Reviý by NU~ letter dated ýW 1, MW.

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) TSCR 2-19-01 December 13, 2001 BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) met and that subsystem OPERABILITY is maintained. The purpose of the HPSI and LPSI pumps differential pressure test on recirculation ensures that the pump(s) have not degraded to a point where the accident analysis would be adversely impacted.

The acceptance criteria for the HPSI pumps Technical Specification Surveillance Requirement (SR 4.5.2.a.1.b), a minimum pump recirculation flow test, was developed assuming a 5% degraded pump using the manufacturer curves. The associated accident analyses assume a HPSI flow that represents 5% degradation. Early delivery of HPSI pump flow, at high head conditions similar to those established when the pump is on recirculation flow, is an important assumption in the accident analyses. Flow measurement instrument inaccuracy has been accounted for in the design basis hydraulic analysis.

Pressure measurement instrument inaccuracy will be accounted for in the acceptance criteria contained in the surveillance procedure for SR 4.5.2.a.1.b. Pressure measurement instrument inaccuracy is not reflected in the Technical Specification acceptance criteria.

The acceptance criteria for the LPSI pumps Technical Specification Surveillance Requirement (SR 4.5.2.a.2.b) was developed assuming a 10%

degraded pump from the actual pump curves. The associated accident analyses assume a LPSI flow that represents 10% degradation. For the limiting large break loss of coolant accident (LBLOCA) analysis case, the analysis does not credit LPSI flow following the safety injection actuation signal until after a time delay which simulates the time for the emergency diesel generators to start and load. After this delay, the Reactor Coolant System (RCS) has depressurized well below the shutoff head of the LPSI pumps. At this low RCS pressure, the operating point of the pumps is significantly greater than minimum recirculation flow. For boron precipitation control following a loss of coolant accident, the LPSI pump is credited with providing hot leg injection flow. The operating point for the LPSI pumps during hot leg injection is also greater than minimum recirculation flow. Flow measurement instrument inaccuracy has been accounted for in the design basis hydraulic analysis. Pressure measurement instrument inaccuracy will be applied and controlled by the surveillance procedures when verifying pump performance in the flow ranges credited in the accident analyses. No correction for pressure measurement instrument inaccuracy will be applied to minimum recirculation flow type test data since this portion of the curve is not credited in the accident analyses. Pressure measurement instrumentation inaccuracy is not reflected in either Technical Specification SR 4.5.2.a.2.b, or in the associated surveillance procedure.

The purpose of the ECCS throttle valve surveillance requirements is to provide assurance that proper ECCS flows will be maintained in the event of a LOCA.

Maintenance of proper flow resistance and pressure drop in the piping system to each injection point is necessary to: (1) prevent total pump flow from exceeding runout conditions when the system is in its minimum resistance configuration, (2) provide the proper flow split between injection points in accordance with the assumptions used in the ECCS-LOCA analyses, and (3) provide an acceptable level of total ECCS flow to all injection points equal to or above that assumed in the ECCS-LOCA analyses.

MILLSTONE - UNIT 2 B 3/4 5-2b Amendment No. 9, 97, 77, J9, 0787 J0, 779, 719, 717, 770, 777, 236, Rvialby NC letter dateld 1,2002.

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) TSCR 2-19-01 December 13, 2001 BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)

Verification of the correct position for the mechanical and/or electrical valve stops can be performed by either of the following methods:

1. Visually verify the valve opens to the designated throttled position; or

2. Manually position the valve to the designated throttled position and verify that the valve does not move when the applicable valve control switch is placed to "OPEN."

In MODE 4 the automatic safety injection signal generated by low pressurizer pressure and high containment pressure and the automatic sump recirculation actuation signal generation by low refueling water storage tank level are not required to be OPERABLE. Automatic actuation in MODE 4 is not required because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating engineered safety features components. Since the manual actuation (trip pushbuttons) portion of the safety injection and sump recirculation actuation signal generation is required to be OPERABLE in MODE 4, the plant operators can use the manual trip pushbuttons to rapidly position all components to the required accident position. Therefore, the safety injection and sump recirculation actuation trip pushbuttons satisfy the requirement for generation of safety injection and sump recirculation actuation signals in MODE 4.

In MODE 4, the OPERABLE HPSI pump is not required to start automatically on a SIAS. Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lock position without affecting the OPERABILITY of the pump.

This will prevent the pump from starting automatically, which could result in overpressurization of the Shutdown Cooling System. Only one HPSI pump may be OPERABLE in MODE 4 with RCS temperatures less than or equal to 275°F due to the restricted relief capacity with Low-Temperature Overpressure Protection System. To reduce shutdown risk by having additional pumping capacity readily available, a HPSI pump may be made inoperable but available at short notice by shutting its discharge valve with the key lock on the control panel.

The provision in Specification 3.5.3 that Specifications 3.0.4 and 4.0.4 are not applicable for entry into MODE 4 is provided to allow for connecting the HPSI pump breaker to the respective power supply or to remove the tag and open the discharge valve, and perform the subsequent testing necessary to declare the inoperable HPSI pump OPERABLE. Specification 3.4.9.3 requires all HPSI pumps to be not capable of injecting into the RCS when RCS temperature is at or below 190°F. Once RCS temperature is above 190°F one HPSI pump can be capable of injecting into the RCS. However, sufficient time may not be available to ensure one HPSI pump is OPERABLE prior to entering MODE 4 as required by Specification 3.5.3. Since Specifications 3.0.4 and 4.0.4 prohibit a MODE change in this situation, this exemption will allow Millstone Unit No. 2 to enter MODE 4, take the steps necessary to make the HPSI pump capable of injecting into the RCS, and then declare the pump OPERABLE. If it is necessary to use this exemption during plant heatup, the appropriate action statement of Specification 3.5.3 should be entered as soon as MODE 4 is reached.

MILLSTONE - UNIT 2 B 3/4 5-2c Amendment No. 9, J*, J*,

0787 719, , f7, 236, evised by Mc letter dated1 Yy 1, 202.

314.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) TSCR 2-19-01 December 13, 2001 BASES 3/4.5.4 REFUELING WATER STORAGE TANK (RWST)

The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ensure that

1) sufficient water is available within containment to permit recirculation cooling flow to the core, and 2) after a LOCA the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes. Small break LOCAs assume that all control rods are inserted, except for the control element assembly (CEA) of highest worth, which remains withdrawn from the core. Large break LOCAs assume that all CEAs remain withdrawn from the core.

MILLSTONE - UNIT 2 B 3/4 5-2d Amendment No. fp, Jg, IP, 0787 719, 719, 719, 779, 777, 236, Revise by Iiqletter dated Iny i, 20n2.

CONTAINMENT SYSTEMS October 1, 2001 TSCR 2-8-01 BASES 3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS The OPERABILITY of the containment spray system ensures that contain ment depressurization and cooling capability will be available in the event of a LOCA. The pressure reduction and resultant lower containment leakage rate are consistent with the assumptions used in the accident analyses. The leak rate surveillance requirements assure that the leakage assumed for the system outside containment during the recircula tion phase will not be exceeded.

The OPERABILITY of the containment cooling system ensures that

1) the containment air temperature will be maintained within limits during normal operation, and 2) adequate heat removal capacity is available when operated in conjunction with the containment spray system during post LOCA conditions.

To be OPERABLE, the two trains of the containment spray system shall be capable of taking a suction from the refueling water storage tank on a containment spray actuation signal and automatically transferring suction to the containment sump on a sump recirculation actuation signal. Each containment spray train flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.

The containment cooling system consists of two containment cooling trains. Each containment cooling train has two containment air recirculation and cooling units. For the purpose of applying the appropriate action statement, the loss of a single containment air recirculation and cooling unit will make the respective containment cooling train inoperable.

Either the containment spray system or the containment cooling system is sufficient to mitigate a loss of coolant accident. The containment spray system is more effective than the containment cooling system in reducing the temperature of superheated steam inside containment following a main steam line break. Because of this, the containment spray system is required to mitigate a main steam line break accident inside containment. In addition, the containment spray system provides a mechanism for removing iodine from the containment atmosphere. Therefore, at least one train of containment spray is required to be OPERABLE when pressurizer pressure is > 1750 psia, and the allowed outage time for one train of containment spray reflects the dual function of containment spray for heat removal and iodine removal.

The Technical Specification Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the accident analysis are met and the subsystem OPERABILITY is maintained.

The purpose of the containment spray pumps differential pressure test on recirculation, Surveillance Requirement 4.6.1.1.a.2, ensures that the pumps have not degraded to a point where the accident analysis would be adversely impacted. The surveillance requirement acceptance criteria for the containment spray pumps was developed assuming a 5% degraded pump from the actual pump curves. Flow and pressure measurement instrument inaccuracies have been accounted for in the design basis hydraulic analysis. It is not necessary to account for either flow or pressure measure instrument inaccuracy in the acceptance criteria contained in the surveillance procedure. Flow and MILLSTONE - UNIT 2 B 3/4 6-3 Amendment No. ?X, P1, 719, 110, 0762 7 77, Pevis by Ur letter dated mav 1. M202.

CONTAINMENT SYSTEMS PTSCR 2-9-01 July 12, 2001 BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

The administrative controls for valves 2-SI-651 and 2-SI-709 apply only during preparations for initiation of SDC, and during SDC operations. They are acceptable because RCS pressure and temperature are significantly below normal operating pressure and temperature when 2-SI-651 and 2-SI-709 are opened, and these valves are not opened until shortly before SDC flow is initiated. The penetration flowpath can be isolated from the control room by closing either 2-SI-652 or 2-SI-651, and the manipulation of these valves, during this evolution, is controlled by plant procedures.

The pressurizer auxiliary spray valve, 2-CH-517, can be used as an alternate method to decrease pressurizer pressure, or for boron precipitation control following a loss of coolant accident. When this valve is opened from the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.

The exception for 2-CH-517 is acceptable because the fluid that passes through this valve will be collected in the Pressurizer (reverse flow from the Pressurizer to the charging system is prevented by check valve 2-CH-431), and the penetration associated with 2-CH-517 is open during accident conditions to allow flow from the charging pumps. Also, this valve is normally operated from the control room, under the supervision of the licensed control room operators, in accordance with plant procedures.

A dedicated operator is not required when opening remotely operated valves associated with Type N fluid penetrations (Criterion 57 of IOCFR50, Appendix A). Operating these valves from the control room is sufficient. The main steam isolation valves (2-MS-64A and 64B), atmospheric steam dump valves (2-MS-190A and 190B), and the containment air recirculation cooler RBCCW discharge valves (2-RB-28.2A-D) are examples of remotely operated containment isolation valves associated with Type N fluid penetrations.

MSIV bypass valves 2-MS-65A and 65B are remotely operated MOVs, but while in MODE 1, they are closed with power to the valve motors removed via lockable disconnect switches located at their respective MCC to satisfy Appendix "R" requirements.

Local operation of the atmospheric steam dump valves (2-MS-190A and 190B), or other remotely operated valves associated with Type N fluid penetrations, will require a dedicated operator in constant communication with the control room, except when operating in accordance with AOPs or EOPs.

Even though these valves can not be classified as locked or sealed closed, the use of a dedicated operator will satisfy administrative control requirements.

Local operation of these valves with a dedicated operator is equivalent to the operation of other manual (locked or sealed closed) containment isolation valves with a dedicated operator.

The main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and 2-MS-202) are remotely operated valves associated with Type N fluid penetrations. These valves are maintained open during power operation.

2-MS-201 is maintained energized, so it can be closed from the control room, if necessary, for containment isolation. However, 2-MS-202 is deenergized MILLSTONE - UNIT 2 B 3/4 6-3c Amendment No. 7;9, 11g, 770 0784 -evisedbly C letter dateld 1, 21X02.

CONTAINMENT SYSTEMS PTSCR 2-9-01 July 12, 2001 BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued) open by removing power to the valve's motor via a lockable disconnect switch to satisfy Appendix R requirements. Therefore, 2-MS-202 cannot be closed immediately from the control room, if necessary, for containment isolation.

The disconect switch key to power for 2-MS-202 is stored in the Unit 2 control room, and can be used to re-power the valve at the MCC; this will allow the valve to be closed from the control room. It is not necessary to maintain a dedicated operator at 2-MS-202 because this valve is already in the required accident position. Also, the steam that passes through this valve should not contain any radioactivity. The steam generators provide the barrier between the containment and the atmosphere. Therefore, it would take an additional structural failure for radioactivity to be released to the environment through this valve.

Steam generator chemical addition valves, 2-FW-15A and 2-FW-15B, are opened to add chemicals to the steam generators using the Auxiliary Feedwater System (AFW). When either 2-FW-15A or 2-FW-15B is opened, a dedicated operator, in continuous communication with the control room, is required.

Operation of these valves is expected during plant startup and shutdown.

The bypasses around the main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and 2-MS-202), 2-MS-458 and 2-MS-459, are opened to drain water from the steam supply lines. When either 2-MS-458 or 2-MS-459 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of these valves is expected during plant startup.

The containment station air header isolation, 2-SA-19, is opened to supply station air to containment. When 2-SA-19 is opened, a dedicated operator, in continuous communication with the control room, is required.

Operation of this valve is only expected for maintenance activities inside containment.

The backup air supply master stop, 2-IA-566, is opened to supply backup air to 2-CH-517, 2-CH-518, 2-CH-519, 2-EB-88, and 2-EB-89. When 2-IA-566 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected in response to a loss of the normal air supply to the valves listed.

The nitrogen header drain valve, 2-SI-045, is opened to depressurize the containment side of the nitrogen supply header stop valve, 2-SI-312. When 2-SI-045 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected after using the high pressure nitrogen system to raise SIT nitrogen pressure.

The containment waste gas header test connection isolation valve, 2-GR-63, is opened to sample the primary drain tank for oxygen and nitrogen.

When 2-GR-63 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is expected during plant startup and shutdown.

MILLSTONE - UNIT 2 B 3/4 6-3d Amendment No. 710, 17A, 0784 Pevis dby NC letter datedl y 1, 2002.

CONTAINMENT SYSTEMS TSCR 2-19-01 December 13, 2001 BASES 3/4.6.5 SECONDARY CONTAINMENT 3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM The OPERABILITY of the Enclosure Building Filtration System ensures that containment leakage occurring during LOCA conditions into the annulus will be filtered through the HEPA filters and charcoal adsorber trains prior to discharge to the atmosphere. This requirement is necessary to meet the assumptions used in the accident analyses and limit the site boundary radia tion doses to within the limits of 10 CFR 100 during LOCA conditions.

The laboratory testing requirement for the charcoal sample to have a removal efficiency of > 95% is more conservative than the elemental and organic iodine removal efficiencies of 90% and 70%, respectively, assumed in the DBA analyses for the EBFS charcoal adsorbers in the Millstone Unit 2 Final Safety Analysis Report. A removal efficiency acceptance criteria of > 95%

will ensure the charcoal has the capability to perform its intended safety function throughout the length of an operating cycle.

Surveillance Requirement 4.6.5.1.b.1 dictates the test frequency, method and acceptance criteria for the EBFS trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below:

Section C.5.a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of ANSI N510-1975:

0 in-place air flow distribution test 0 DOP test 0 activated carbon adsorber section leak test Section C.5.c requires the in-place Dioctyl phthalate (DOP) test for HEPA filters to conform to section 10 of ANSI N510-1975. The HEPA filters should be tested in place (1) initially, (2) at least once per 18 months thereafter, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than 0.05%* at rated flow. A filtration system satisfying this criteria can be considered to warrant a 99% removal efficiency for particulates.

Section C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenated hydrocarbon refrigerant, in accordance with section 12 of ANSI N510-1975 to ensure that bypass leakage through the adsorber section is less than 0.05%.** Adsorber leak testing should be conducted (1) initially, (2) at least once per 18 months thereafter, (3) following removal of an adsorber sample for laboratory testing if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.

• Means that the HEPA filter will allow passage of less than 0.05% of the test concentration injected at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than 0.05% of the injected test concentration around the charcoal adsorber sections.

MILLSTONE - UNIT 2 B 3/4 6-5 Amendment No. 79 0788 Pevis1 by NC letter dated1 Iy 1, 2002.

CONTAINMENT SYSTEMS TSCR 2-19-01 December 13, 2001 BASES 3/4.6.5.2 ENCLOSURE BUILDING The OPERABILITY of the Enclosure Building ensures that the releases of radioactive materials from the primary containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the accident analyses. This restriction, in conjunction with operation of the Enclosure Building Filtration System, will limit the site boundary radiation doses to within the limits of 10 CFR 100 during accident conditions.

One Enclosure Building Filtration System train is required to establish a negative pressure of 0.25 inches W.G. in the Enclosure Building Filtration Region within one minute after an Enclosure Building Filtration Actuation Signal is generated. The one minute time requirement does not include the time necessary for the associated emergency diesel generator to start and power Enclosure Building Filtration System equipment.

To enable the Enclosure Building Filtration System to establish the required negative pressure in the Enclosure Building, it is necessary to ensure that all Enclosure Building access openings are closed. For double door access openingc, both doors are required to be closed and latched, except for normal passage. For single door access openings, that door is required to be closed and latched, except for normal passage.

A door is OPERABLE when it is capable of automatically closing and latching. If the required door is not capable of automatically closing and latching, the door must be maintained closed and latched or personnel may be stationed at the door to ensure that the door is closed and latched after each transit through the door. Otherwise, the access opening (door) should be declared inoperable and the appropriate technical specification action statement entered.

MILLSTONE - UNIT 2 B 3/4 6-5a Amendment No. 208 0788 visRl by NRCletter datedl*y 1, 2002.

PLANT SYSTEMS TSCR 2-22-01 December 27, 2001 BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS The OPERABILITY of the auxiliary feedwater pumps ensures that the Reactor Coolant System can be cooled down to less than 300'F from normal operating conditions in the event of a total loss of off-site power.

Any single motor driven or steam driven pump has the required capacity to provide sufficient feedwater flow to remove reactor decay heat and reduce the RCS temperature to 300'F where the shutdown cooling system may be placed into operation for continued cooldown.

The Technical Specification Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the accident analysis are met and that subsystem OPERABILITY is maintained. The purpose of the auxiliary feedwater pumps differential pressure tests on recirculation, Surveillance Requirements 4.7.1.2.a.2.a and 4.7.1.2.a.2.b, is to ensure that the pumps have not degraded to a point where the accident analysis would be adversely impacted.

The surveillance requirement acceptance criteria for the motor driven auxiliary feedwater pumps was developed assuming a 5% degraded pump from the actual pump curves. The surveillance requirement acceptance criteria for the turbine driven auxiliary feedwater pump was developed from high flow test data extrapolated to minimum recirculation flow, and can be adjusted to account for the affect on pump performance of variations in pump speed.

Flow and pressure measurement instrument inaccuracies have not been accounted for in the design basis hydraulic analysis for the motor driven auxiliary feedwater pumps. Flow, pressure, and speed measurement instrument inaccuracies have not been accounted for in the design basis hydraulic analysis for the turbine driven auxiliary feedwater pump. Corrections for flow, pressure, and speed (turbine driven pump only) measurement instrument inaccuracies will be applied to test data taken when verifying pump performance in the flow ranges credited in the accident analyses. No corrections for flow, pressure, and speed (turbine driven pump only) measurement instrument inaccuracies will be applied to minimum recirculation flow type test data since this portion of the curve is not credited in the accident analyses. Corrections for flow, pressure, and speed (turbine driven pump only) measurement instrument inaccuracies are not reflected in the Technical Specification acceptance criteria.

The Auxiliary Feed Water (AFW) system is OPERABLE when the AFW pumps and flow paths required to provide AFW to the steam generators are OPERABLE.

Technical Specification 3.7.1.2 requires three AFW pumps to be OPERABLE and provides ACTIONS to address inoperable AFW pumps. The AFW flow path requirements are separated into AFW pump suction flow path requirements, AFW pump discharge flow path to the common discharge header requirements, and common discharge header to the steam generators flow path requirements.

There are two AFW pump suction flow paths from the Condensate Storage Tank to the AFW pumps. One flow path to the turbine driven AFW pump, and one flow path to both motor driven AFW pumps. There are three AFW pump discharge flow paths to the common discharge header, one flow path from each of the three AFW pumps. There are two AFW discharge flow paths from the common discharge header to the steam generators, one flow path to each steam MILLSTONE - UNIT 2 B 3/4 7-2 Amendment No. *, $7, $, *77, 0789 W, 7,0 Pvised by MC letter dated Ml 1, 2002.

PLANT SYSTEMS TSCR 2-22-01 December 27, 2001 BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS (Continued) generator. With 2-FW-44 open (normal position), the discharge from any AFW pump will be supplied to both steam generators through the associated AFW regulating valves.

A flow path may be considered inoperable as the result of closing a manual valve, failure of an automatic valve to respond correctly to an actuation signal, or failure of the piping. In the case of an inoperable automatic AFW regulating valve (2-FW-43A or B), flow path OPERABILITY can be restored by use of a dedicated operator stationed at the associated bypass valve (2-FW-56A or B) as directed by OP 2322. Failure of the common discharge header piping will cause both discharge flow paths to the steam generators to be inoperable.

An inoperable suction flow path to the turbine driven AFW pump will result in one inoperable AFW pump. An inoperable suction flow path to the motor driven AFW pumps will result in two inoperable AFW pumps. The ACTION requirements of Technical Specification 3.7.1.2 are applicable based on the number of inoperable AFW pumps.

An inoperable pump discharge flow path from an AFW pump to the common discharge header will cause the associated AFW pump to be inoperable. The ACTION requirements of Technical Specification 3.7.1.2 for one AFW pump are applicable for each affected pump discharge flow path.

AFW must be capable of being delivered to both steam generators for design basis accident mitigation. Certain design basis events, such as a main steam line break or steam generator tube rupture, require that the affected steam generator be isolated, and the RCS decay heat removal safety function be satisfied by feeding and steaming the unaffected steam generator. If a failure in an AFW discharge flow path from the common discharge header to a steam generator prevents delivery of AFW to a steam generator, then the design basis events may not be effectively mitigated.

In this situation, the ACTION requirements of Technical Specification 3.0.3 are applicable and an immediate plant shutdown is appropriate.

Two inoperable AFW System discharge flow paths from the common discharge header to both steam generators will result in a complete loss of the ability to supply AFW flow to the steam generators. In this situation, all three AFW pumps are inoperable and the ACTION requirements of Technical Specification 3.7.1.2 are applicable. Immediate corrective action is required. However, a plant shutdown is not appropriate until a discharge flow path from the common discharge header to one steam generator is restored.

During quarterly surveillance testing of the turbine driven AFW pump, valve 2-CN-27A is closed and valve 2-CN-28 is opened to prevent overheating the water being circulated. In this configuration, the suction of the turbine driven AFW pump is aligned to the Condensate Storage Tank via the motor driven AFW pump suction flow path, and the pump minimum flow is directed to the Condensate Storage Tank by the turbine driven AFW pump suction path upstream of 2-CN-27A in the reverse direction. During this surveillance, the suction path to the motor driven AFW pump suction path MILLSTONE - UNIT 2 B 3/4 7-2a Amendment No.

0789 Pised bylHC letter dated My 1, 2002.

PLANT SYSTEMS TSCR 2-22-01 December 27, 2001 BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS (Continued) remains OPERABLE, and the turbine driven AFW suction path is inoperable. In this situation, the ACTION requirements of Technical Specification 3.7.1.2 for one AFW pump are applicable.

3/4.7.1.3 CONDENSATE STORAGE TANK The OPERABILITY of the condensate storage tank with the minimum water volume ensures that sufficient water is available for cooldown of the Reactor Coolant System to less than 300°F in the event of a total loss of off-site power. The minimum water volume is sufficient to maintain the RCS at HOT STANDBY conditions for 10 hours0.417 days <br />0.0595 weeks <br />0.0137 months <br /> with steam discharge to atmosphere. The contained water volume limit includes an allowance for water not usable due to discharge nozzle pipe elevation above tank bottom, plus an allowance for vortex formation.

3/4.7.1.4 ACTIVITY The limitations on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small fraction MILLSTONE - UNIT 2 B 3/4 7-2b Amendment No. 0, *J, $,

0789 ?X1, 236, Revised byl letter datedlhy 1, 2002.

PLANT SYSTEMS January 10, 2002 PTSCR 2-18-01 BASES a feedwater isolation signal since the steam line break accident analysis credits them in prevention of feed line volume flashing in some cases.

Feedwater pumps are assumed to trip immediately with an MSI signal.

3/4.7.1.7 ATMOSPHERIC DUMP VALVES The atmospheric dump valve (ADV) lines provide a method to maintain the unit in HOT STANDBY, and to replace or supplement the condenser steam dump valves to cool the unit to Shutdown Cooling (SDC) entry conditions. Each ADV line contains an air operated ADV, and an upstream manual isolation valve.

The manual isolation valves are normally open, and the ADVs closed. The ADVs, which are normally operated from the main control room, can be operated locally using a manual handwheel.

An ADV line is OPERABLE if local manual operation of the associated valves can be used to perform a controlled release of steam to the atmosphere.

This is consistent with the LOCA analysis which credits local manual operation of the ADV lines for accident mitigation.

3/4.7.1.8 STEAM GENERATOR BLOWDOWN ISOLATION VALVES The steam generator blowdown isolation valves will isolate steam generator blowdown on low steam generator water level. An auxiliary feedwater actuation signal will also be generated at this steam generator water level. Isolation of steam generator blowdown will conserve steam generator water inventory following a loss of main feedwater. The steam generator blowdown isolation valves will also close automatically upon receipt of a containment isolation signal or a high radiation signal (steam generator blowdown or condenser air ejector discharge).

3/4.7.2 STEAM GENERATOR PRESSURE/TEMPERATURE LIMITATION The limitation on steam generator pressure and temperature ensures that the pressure induced stresses in the steam generators do not exceed the maximum allowable fracture toughness stress limits. The limitations of 70 0 F and 200 psig are based on a steam generator RTNDT of 50'F and are sufficient to prevent brittle fracture.

3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM The OPERABILITY of the Reactor Building Closed Cooling Water (RBCCW) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident analyses.

The RBCCW loops are redundant of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a design basis accident, one RBCCW loop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two RBCCW loops must be OPERABLE, and independent to the extent necessary to ensure that a single failure will not result in the unavailability MILLSTONE - UNIT 2 B 3/4 7-3a Amendment No. 71g, 77, 17, Reý by NC letter dated *T 1, 2002.

PLANT SYSTEMS January 10, 2002 PTSCR 2-18-01 BASES 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued) of both RBCCW loops. At least one RBCCW loop will operate assuming the worst single active failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs during post-loss of coolant accident long term cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate the passive failure.

The RBCCW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system loops are no longer independent. The loss of independence will result in one large RBCCW loop. This may adversely impact the ability of the RBCCW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening the manual cross connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis events coincident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated. (Several system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance applies. If only the manual cross-connect valves have been opened, and the RBCCW System is in a normal configuration otherwise, with all system equipment OPERABLE, one RBCCW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.3.1 applied. If the RBCCW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both RBCCW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.

The loss of loop independence is equivalent to the situation where one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less than the Technical Specification specified allowed outage time. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a design basis event concurrent with a single failure during this limited time period. The allowed outage time for one inoperable RBCCW loop provides an appropriate limit for continued operation with only one OPERABLE RBCCW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop determined to be inoperable should be the loop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Restoration of loop independence within the time constraints of the allowed outage time is required, or a plant shutdown is necessary.

MILLSTONE - UNIT 2 B 3/4 7-3b Amendment No.

Revised byW letter datedl y 1, 2o02.

PLANT SYSTEMS January 10, 2002 PTSCR 2-18-01 BASES 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued)

It is acceptable to operate with the RBCCW pump minimum flow valves (2-RB 107A, 2-RB-107B, 2-RB-107C), RBCCW pump sample valves (2-RB-56A, 2-RB-56B, and 2-RB-56C), and the RBCCW pump radiation monitor stop valves (2-RB-39, 2-RB-41, and 2-RB-43) open. An active single failure will not adversely impact both RBCCW loops with these valves open. In addition, protection against a passive single failure after the initiation of post - loss of coolant accident long term cooling is achieved by manually closing these accessible valves, as directed by the emergency operating procedures. In addition, operation with RBCCW chemical addition valves (2-RB-50A and 2-RB-5OB) open during chemical addition evolutions is acceptable since these normally closed valves are opened to add chemicals to the RBCCW and then closed as directed by normal operating procedures. Therefore, operation with these valves open does not affect OPERABILITY of the RBCCW loops.

The Technical Specification Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the accident analysis are met and that subsystem OPERABILITY is maintained. The purpose of the reactor building closed cooling water pumps differential pressure test, Surveillance Requirement 4.7.3.1.a.2, a substantial flow test, is to ensure that the pumps have not degraded to a point where the accident analysis would be adversely impacted. The surveillance requirement acceptance criteria for the reactor building closed cooling water pumps was developed assuming a 7%

degraded pump from the actual pump curves. Flow measurement instrument inaccuracy for the reactor building closed cooling water pumps have been accounted for in the design basis hydraulic analysis. Pressure measurement instrument inaccuracy for the reactor building closed cooling water pumps is accounted for in the acceptance criteria contained in the surveillance procedure.

3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water (SW) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident con ditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident analyses.

The SW loops are redundant of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a design basis accident, one SW loop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two SW loops must be OPERABLE, and independent to the extent necessary to ensure that a single failure will not result in the unavailability of both SW loops. At least one SW loop will operate assuming the worst single active failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs post - loss of coolant accident long term cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate the passive failure.

MILLSTONE - UNIT 2 B 3/4 7-3c Amendment No. 71p, 77, jXp, Revisd.by NWC letter dated Y y I, 1 0y

PLANT SYSTEMS January 10, 2002 PTSCR 2-18-01 BASES 3/4.7.4 SERVICE WATER SYSTEM (Continued)

The SW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system loops are no longer independent. The loss of independence will result in one large SW loop. This may adversely impact the ability of the SW System to mitigate the design basis events if a single failure, active or passive, occurs.

Opening the manual cross-connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis event coincident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated. (Several system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance applies. If only the manual cross-connect valves have been opened, and the SW System is in a normal configuration otherwise, with all system equipment OPERABLE, one SW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.4.1 applied. If the SW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both SW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.

The loss of loop independence is equivalent to the situation where one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less then the Technical Specification specified allowed outage time. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a design basis event concurrent with a single failure during this limited time period. The allowed outage time for one inoperable SW loop provides an appropriate limit for continued operation with only one OPERABLE SW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop determined to be inoperable should be the loop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Restoration of loop independence within the time constraints of the allowed outage time is required, or a plant shutdown is necessary.

It is acceptable to operate with the SW header supply valves to sodium hypochlorite (2-SW-84A and 2-SW-84B) and the SW header supply valves to the north and south filters (2-SW-298 and 2-SW-299) open. Protection against a single failure (active or passive after the initiation of post - loss of coolant accident long term cooling) with these valves open is provided by the flow restricting orifices contained in these lines. Therefore, operation with these valves open does not affect OPERABILITY of the SW loops.

MILLSTONE - UNIT 2 B 3/4 7-4 Amendment No.

sed byM* letter datedDly 1, 2002.

PLANT SYSTEMS January 10, 2002 PTSCR 2-18-01 BASES 3/4.7.4 SERVICE WATER SYSTEM (Continued)

The Technical Specification Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the accident analysis are met and that subsystem OPERABILITY is maintained. The purpose of the service water pumps differential pressure test, Surveillance Requirement 4.7.4.1.a.2, a substantial flow test, is to ensure that the pumps have not degraded to a point where the accident analysis would be adversely impacted. The surveillance requirement acceptance criteria for the service water pumps was developed assuming a 7% degraded pump from the actual pump curves. Flow and pressure measurement instrument inaccuracies for the service water pumps have been accounted for in the design basis hydraulic analysis. It is not necessary to account for flow and pressure measurement instrument inaccuracies in the acceptance criteria contained in the surveillance procedure.

3/4.7.5 FLOOD LEVEL The service water pump motors are normally protected against water damage to an elevation of 22 feet. If the water level is exceeding plant grade level or if a severe storm is approaching the plant site, one service water pump motor will be protected against flooding to a minimum elevation of 28 feet to ensure that this pump will continue to be capable of removing decay heat from the reactor. In order to ensure operator accessibility to the intake structure action to provide pump motor protection will be initiated when the water level reaches plant grade level.

3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM The OPERABILITY of the Control Room Emergency Ventilation System ensures that 1) the ambient air temperature does not exceed the allowable temperature for continuous duty rating for the equipment and instrumentation cooled by this system and 2) the control room will remain habitable for operations personnel during and following all credible accident conditions.

The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room to 5 rem or less whole body, or its equivalent.

This limitation is consistent with the requirements of General Design Criteria 19 of Appendix "A", 10 CFR 50.

The LCO is modified by a footnote allowing the control room boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in constant communication with the control room. This individual will have a method to rapidly close the opening when a need for control room isolation is indicated.

The control room radiological dose calculations use the conservative minimum acceptable flow of 2250 cfm based on the flowrate surveillance requirement of 2500 cfm + 10%.

MILLSTONE - UNIT 2 B 3/4 7-4a Amendment No. , ,

vised by NU letter datedl y 1, 2002.

PLANT SYSTEMS TSCR 2-19-01 and PTSCR 2-18-01 December 13, 2001 January 10, 2002 BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

Currently there are some situations where the CREV System may not automatically start on an accident signal, without operator action. Under most situations, the emergency filtration fans will start and the CREV System will be in the accident lineup. However, a failure of a supply fan (F21A or B) or an exhaust fan (F31A or B), operator action will be required to return to a full train lineup. Also, if a single emergency bus does not power up for one train of the CREV System, the opposite train filter fan will automatically start, but the required supply and exhaust fans will not automatically start.

Therefore, operator action is required to establish the whole train lineup.

This action is specified in the Emergency Operating Procedures. The radiological dose calculations do not take credit for CREV System cleanup action until 10 minutes into the accident to allow for operator action.

When the CREV System is checked to shift to the recirculation mode of operation, this will be performed from the normal mode of operation, and from the smoke purge mode of operation.

With both control room emergency ventilation trains inoperable due to an inoperable control room boundary, the movement of fuel assemblies within the spent fuel pool and the movement of shielded casks over the spent fuel pool cask laydown area must be immediately suspended. The control room boundary must be restored to OPERABLE status within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

If the control room boundary is inoperable in MODES 1, 2, 3, and 4, the control room emergency ventilation trains cannot perform their intended functions. Actions must be taken to restore an OPERABLE control room boundary within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect control room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplanned measures should be available to address these concerns for intentional and unintentional entry into this condition. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is a typically reasonable time to diagnose, plan, and possibly repair, and test most problems with the control room boundary.

Surveillance Requirement 4.7.6.1.c.1 dictates the test frequency, methods and acceptance criteria for the Control Room Emergency Ventilation System trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below.

Section C.5.a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of ANSI N510-1975:

"* in-place air flow distribution test

"* DOP test

• activated carbon adsorber section leak test MILLSTONE - UNIT 2 B 3/4 7-4b Amendment No. 7, 7, 7, lbi by MU letter dated ft 1, #1 1 7

PLANT SYSTEMS TSCR 2-19-0i and PTSCR 2-18-01 December 13, 2001 January 10, 2002 BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

Section C.5.c requires the in-place Dioctyl phthalate (DOP) test for HEPA filters to conform to section 10 of ANSI N510-1975. The HEPA filters should be tested in place (1) initially, (2) at least once per 18 months thereafter, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than 0.05%* at rated flow. A filtration system satisfying this criteria can be considered to warrant a 99% removal efficiency for particulates.

Section C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenated hydrocarbon refrigerant, in accordance with section 12 of ANSI N510-1975 to ensure that bypass leakage through the adsorber section is less than 0.05%.** Adsorber leak testing should be conducted (1) initially, (2) at least once per 18 months thereafter, (3) following removal of an adsorber sample for laboratory testing if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.

The ACTION requirements to immediately suspend various activities (CORE ALTERATIONS, fuel movement, shielded cask movement, etc.) do not preclude completion of the movement of a component to a safe position.

• Means that the HEPA filter will allow passage of less than 0.05% of the test concentration injected at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than 0.05% of the injected test concentration around the charcoal adsorber sections.

MILLSTONE - UNIT 2 B 3/4 7-4c Amendment No. IFl, 7;, XIg, Pe isebly NU letter dated 1y 1, 2002.

3/4.8 ELECTRICAL POWER SYSTEMS PTSCR 2-1-01 September 6, 2001 BASES The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for 1) the safe shutdown of the facility and 2) the mitigation and control of accident conditions within the facility. The minimum specified indepen dent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50.

The required circuits between the offsite transmission network and the onsite Class IE distribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification 3.8.1.1.a (MODES 1, 2, 3, and 4) consist of the following circuits from the switchyard to the onsite electrical distribution system:

a. Station safeguards busses 24C and 24D via the Unit 2 Reserve Station Service Transformer and bus 24G; and

b. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer (energized with breaker 13T and associated disconnect switches open) and bus 34A or 34B.

If the plant configuration will not allow Unit 3 to supply power to Unit 2 from the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer within 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br />, Unit 2 must consider the second offsite source inoperable and enter the appropriate action statement of Technical Specification 3.8.1.1 for an inoperable offsite circuit.

This is consistent with the GDC 17 requirement for two offsite sources. Each offsite circuit is required to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The first source is required to be available within a few seconds to supply power to safety related equipment following a loss of coolant accident. The second source is not required to be available immediately and no accident is assumed to occur concurrently with the need to use the second source. However, the second source is required to be available in sufficient time to assure the reactor remains in a safe condition. The 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time period is based on the Millstone Unit No. 2 Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safe condition (i.e.,

the pressurizer will not empty) if charging is restored within 3 hours0.125 days <br />0.0179 weeks <br />0.00411 months <br />.

In MODES 1 through 4 (Technical Specification 3.8.1.1), the Unit 2 Normal Station Service Transformer can be used as the second offsite source after the main generator disconnect links have been removed and the backfeed lineup established.

The required circuit between the offsite transmission network and the onsite Class IE distribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification 3.8.1.2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsite electrical distribution system:

a. Station safeguards bus 24C or 24D via the Unit 2 Reserve Station Service Transformer and bus 24G; or

b. Station safeguards bus 24C or 24D via the Unit 2 Normal Station Service Transformer and bus 24A or 24B after the main generator disconnect links have been removed and the backfeed lineup established; or

c. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer (energized with breaker 13T and associated disconnect switches open) and bus 34A or 34B.

MILLSTONE - UNIT 2 B 3/4 8-1 Amendment No. J*, Jýf, XJ, 0771 avise by l letter ated*ý 1, 21002.

REFUELING OPERATIONS TSCR 2-3-02 February 28, 2002 BASES 3/4.9.6 DELETED 3/4.9.7 DELETED 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION In MODE 6, the shutdown cooling (SDC) trains are the primary means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for decay heat removal either two SDC trains are required to be OPERABLE and one SDC train must be in operation, or one SDC train is required to be OPERABLE and in operation with the refueling cavity water level > 23 feet above the reactor vessel flange. This volume of water in the refueling cavity will provide a large heat sink in the event of a failure of the operating SDC train. Any exceptions to these requirements are contained in the LCO Notes.

An OPERABLE SDC train, for plant operation in MODE 6, includes a pump, heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine RCS temperature. In addition, sufficient portions of the Reactor Building Closed Cooling Water (RBCCW) and Service Water (SW) Systems shall be OPERABLE as required to provide cooling to the SDC heat exchanger. The flow path starts at the RCS hot leg and is returned to the RCS cold legs. An OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);

2. The associated SDC heat exchanger from the same facility as the SDC pump;

3. An RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heat exchanger capable of cooling the associated SDC heat exchanger;

4. A SW pump, powered from the same facility as the SDC pump, capable of supplying cooling water to the associated RBCCW heat exchanger; and

5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.

In MODE 6, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers are required to provide cooling to the SDC heat exchangers, but only 1 SW header is required to support the SDC trains. The equipment specified is sufficient to address a single active failure of the SDC System and associated support systems.

Either SDC pump may be aligned to the refueling water storage tank (RWST) to support filling the refueling cavity or for performance of required testing. A SDC pump may also be used to transfer water from the refueling cavity to the RWST. In addition, either SDC pump may be aligned to draw a suction on the spent fuel pool (SFP) through 2-RW-11 and 2-SI-442 instead of the normal SDC suction flow path, provided the SFP transfer canal gate valve 2-RW-280 is open under administrative control (e.g., caution tagged). When using this alternate SDC flow path, it will be necessary to secure the SFP cooling pumps, and limit SDC flow as specified in the appropriate procedure, to prevent vortexing in the suction piping. The evaluation of this alternate SDC flow path assumed that this flow path will not be used during a refueling outage until after the completion of the fuel shuffle such that approximately one third of the reactor core will contain new fuel. By waiting until MILLSTONE - UNIT 2 B 3/4 9-2 Amendment No. AP, 77, XX7, 70, 0800 7 01 Pse by1 MU letter catedI f 1, 20(02.

REFUELING OPERATIONS TSCR 2-3-02 February 28, 2002 BASES 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) the completion of the fuel shuffle, sufficient time (at least 14 days from reactor shutdown) will have elapsed to ensure the limited SDC flow rate specified for this alternate lineup will be adequate for decay heat removal from the reactor core and the spent fuel pool. In addition, CORE ALTERATIONS shall be suspended when using this alternate flow path, and this flow path should only be used for short time periods, approximately 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />. If the alternate flow path is expected to be used for greater than 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, or the decay heat load will not be bounded as previously discussed, further evaluation is required to ensure that this alternate flow path is acceptable.

These alternate lineups do not affect the OPERABILITY of the SDC train. In addition, these alternate lineups will satisfy the requirement for a SDC train to be in operation if the minimum required SDC flow through the reactor core is maintained.

In MODE 6, with the refueling cavity filled to > 23 feet above the reactor vessel flange, both SDC trains may not be in operation for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in each 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period, provided no operations are permitted that would cause a reduction in RCS boron concentration. Boron concentration reduction is prohibited because uniform concentration distribution cannot be ensured without forced circulation.

This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, and RCS to SDC isolation valve testing. During this 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> period, decay heat is removed by natural convection to the large mass of water in the refueling pool.

In MODE 6, with the refueling cavity filled to > 23 feet above the reactor vessel flange, both SDC trains may also not be in operation for local leak rate testing of the SDC cooling suction line (containment penetration number 10) or to permit maintenance on valves located in the common SDC suction line. This will allow the performance of required maintenance and testing that otherwise may require a full core offload. In addition to the requirement prohibiting operations that would cause a reduction in RCS boron concentration, CORE ALTERATIONS are suspended and all containment penetrations providing direct access from the containment atmosphere to outside atmosphere must be closed or capable of being closed by an OPERABLE Containment Purge Valve Isolation System. No time limit is specified to operate in this configuration. However, factors such as scope of the work, decay heat load/heatup rate, and RCS temperature should be considered to determine if it is feasible to perform the work. Prior to using this provision, a review and approval of the evolution by the SORC is required. This review will evaluate current plant conditions and the proposed work to determine if this provision should be used, and to establish the termination criteria and appropriate contingency plans. During this period, decay heat is removed by natural convection to the large mass of water in the refueling pool.

The requirement that at least one shutdown cooling loop be in operation at

> 1000 gpm ensures that (1) sufficient cooling capacity is available to remove decay heat and maintain the water in the reactor pressure vessel below 140°F as required during the REFUELING MODE, (2) sufficient coolant circulation is maintained through the reactor core to minimize the effects of a boron dilution incident and prevent boron stratification, and (3) is consistent with boron dilution analysis assumptions. The 1000 gpm shutdown cooling flow limit is the minimum analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommodate flow measurement uncertainties.

MILLSTONE - UNIT 2 B 3/4 9-2a Amendment No. 9, 77, 177, 109, 0800 1 7 7 Revis by MC letter datedlMay 1, 2002.

REFUELING OPERATIONS TSCR 2-3-02 February 28, 2002 BASES 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued)

Average Coolant Temperature ( Tavg) values are derived under shutdown cooling conditions, using the designated formula for use in Unit 2 operating procedures.

0 SDC flow greater than 1000 gpm: (SDCoutiet + SDCiniet) / 2 = Tavg During SDC only operation, there is no significant flow past the loop RTDs.

Core inlet and outlet temperatures are accurately measured during those conditions by using T351Y, SDC return to RCS temperature indication, and T351X, RCS to SDC temperature indication. The average of these two indicators provides a temperature that is equivalent to the average RCS temperature in the core.

T351X will not be available when using the alternate SDC suction flow path from the SFP. Substitute temperature monitoring capability shall be established to provide indication of reactor core outlet temperature. A portable temperature device can be used to indicate reactor core outlet temperature. Indication of reactor core outlet temperature from this temporary device shall be readily available to the control room personnel. A remote television camera or an assigned individual are acceptable alternative methods to provide this indication to control room personnel.

3/4.9.9 and 3/4.9.10 DELETED 3/4.9.11 and 3/4.9.12 WATER LEVEL-REACTOR VESSEL AND STORAGE POOL WATER LEVEL The restrictions on minimum water level ensure that sufficient water depth is available to remove 99% of the assumed 10% iodine gap activity released from the rupture of an irradiated fuel assembly. The minimum water depth is consistent with the assumptions of the accident analysis.

MILLSTONE - UNIT 2 B 3/4 9-2b Amendment No. 0, 77, 177, 199, 0800 1#9 W, 7, Pevissd by HC letter dated 1hy 1, 2002.

REFUELING OPERATIONS TSCR 2-5-02 Februrary 21, 2002 BASES 3/4.9.13 DELETED 3/4.9.14 DELETED 3/4.9.15 STORAGE POOL AREA VENTILATION SYSTEM The limitations of this specification on the operation of the Storage Pool Area Ventilation System ensure that the radioactive material that could be released from irradiated fuel assemblies as a result of a fuel handling or shielded cask drop accident will be filtered through the HEPA filters and charcoal adsorber prior to discharge to the atmosphere. No credit is taken for automatic operation of this system, as a result of high spent fuel pool area radiation, to mitigate the consequences of these accidents. Therefore, the system must be in operation and exhausting through the HEPA filters and charcoal adsorber prior to fuel movement within the spent fuel pool when irradiated fuel assemblies that have decayed less than 60 days are located within the spent fuel pool, or during the movement of a shielded cask over the spent fuel pool cask laydown area.

An OPERABLE Enclosure Building Filtration Train operating in the auxiliary exhaust mode and exhausting through the HEPA filters and charcoal adsorber removes radioiodine from the Spent Fuel Pool area atmosphere following a fuel handling accident. After 60 days of decay, there is negligible radioiodine. Therefore, filtration is not necessary.

An OPERABLE Enclosure Building Filtration Train operating in the auxiliary exhaust mode and exhausting through the HEPA filters and charcoal adsorber removes radioactivity from the Spent Fuel Pool area atmosphere following a shielded cask drop accident. A shielded cask is a shielded container used for the transfer of irradiated (spent fuel, irradiated hardware, etc.) or radioactive (contaminated) materials. Filtration is required whenever a shielded cask is being moved over the spent fuel pool cask laydown area.

The ACTION requirements for this specification ensure that fuel movement within the spent fuel pool or shielded cask movement over the spent fuel pool cask laydown area will not occur unless an Enclosure Building Filtration Train is operating in the auxiliary exhaust mode. The ACTION requirement to suspend fuel movement within the storage pool and shielded cask movement over the cask laydown area does not preclude completion of the movement of a component to a safe position.

The requirements for spent fuel pool area integrity ensure that an Enclosure Building Filtration Train operating in the auxiliary exhaust mode collects and filters radioiodine following a fuel handling or shielded cask drop accident. Normal entry and egress through spent fuel pool area access doors is permitted and does not violate spent fuel pool area integrity. The acceptable access doors for normal entry and egress are designed to automatically close and latch after use. If a required door that is designed to automatically close and latch is not capable of automatically closing and latching, the door shall be maintained closed and latched, or personnel shall be stationed at the door to ensure that the door is closed and latched after each transit through the door. Otherwise, the access opening (door) should be declared inoperable and spent fuel pool area integrity will be violated. In addition, use of doors that are not designed for automatic closure (e.g., a roll-up door) will violate spent fuel pool area integrity.

MILLSTONE - UNIT 2 B 3/4 9-3 Amendment No. *, J9, 117, 0799 7,197, X71, , M Pý lby lC letter datedlW 1, 2M02.

REFUELING OPERATIONS TSCR 2-19-01 December 13, 2001 BASES (Continued)

The spent fuel pool area access doors and other openings, required to be closed, are listed in the Technical Requirements Manual.

The Millstone Unit No. 2 Auxiliary Building elevator shaft smoke/heat hole has been evaluated and determined to be an acceptable minor leakage pathway. Therefore, spent fuel pool area integrity is maintained, and the required Enclosure Building Filtration Train is OPERABLE, when the elevator shaft smoke/heat hole is open. 2-HV-171, Spent Fuel Pool Area Exhaust Damper, is not an acceptable bypass leakage path and must remain closed when necessary to maintain spent fuel pool area integrity.

The laboratory testing requirement for the charcoal sample to have a removal efficiency of > 95% is more conservative than the elemental and organic iodine removal efficiencies of 90% and 70%, respectively, assumed in the DBA analyses for the EBFS charcoal adsorbers in the Millstone Unit 2 Final Safety Analysis Report. A removal efficiency acceptance criteria of > 95%

will ensure the charcoal has the capability to perform its intended safety function throughout the length of an operating cycle.

Surveillance Requirement 4.9.15.1.b.1 dictates the test frequency, method and acceptance criteria for the Storage Pool Area Ventilation System trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below:

Section C.5.a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of ANSI N510-1975:

• in-place air flow distribution test

"* DOP test

"* activated carbon adsorber section leak test Section C.5.c requires the in-place Dioctyl phthalate (DOP) test for HEPA filters to conform to section 10 of ANSI N510-1975. The HEPA filters should be tested in place (1) initially, (2) at least once per 18 months thereafter, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than 0.05%* at rated flow. A filtration system satisfying this criteria can be considered to warrant a 99% removal efficiency for particulates.

Section C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenated hydrocarbon refrigerant, in accordance with section 12 of ANSI N510-1975 to ensure that bypass leakage through the adsorber section is less than 0.05%.** Adsorber leak testing should be conducted (1) initially, (2) at least once per 18 months thereafter, (3) following removal of an

• Means that the HEPA filter will allow passage of less than 0.05% of the test concentration injected at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than 0.05% of the injected test concentration around the charcoal adsorber sections.

MILLSTONE - UNIT 2 B 3/4 9-3a Amendment No. 9, J0, 117, 0792 79, 197, 177, , 7 Pevised by Mr letter dateday 1, 2M02.

REFUELING OPERATIONS TSCR 2-19-01 December 13, 2001 BASES (Continued) adsorber sample for laboratory testing if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.

3/4.9.16 SHIELDED CASK The limitations of this specification and 3/4.9.15 ensure that in the event of a shielded cask drop accident 1) the doses from ruptured fuel assemblies will be within the assumptions of the safety analyses, 2) Keff will remain < .95.

3/4.9.17 MOVEMENT OF FUEL IN SPENT FUEL POOL The limitations of this specification ensure that in the event of a fuel handling accident involving a dropped, misplaced, or misloaded fuel assembly (or consolidated fuel storage box), the Keff of the spent fuel pool racks and fuel transfer carriage will remain less than or equal to 0.95.

3/4.9.18 SPENT FUEL POOL - REACTIVITY CONDITION The limitations described by Figures 3.9-1a, 3.9-Ib, and 3.9-3 ensure that the reactivity of fuel assemblies and consolidated fuel storage boxes, introduced into the Region C spent fuel racks, are conservatively within the assumptions of the safety analysis.

The limitations described by Figure 3.9-4 ensure that the reactivity of the fuel assemblies, introduced into the Region A spent fuel racks, are conservatively within the assumptions of the safety analysis.

MILLSTONE - UNIT 2 B 3/4 9-3b Amendment No. 7, J9, 177, Ly MC letter Pe7, d~atedl nl197 1,17, 2M00.

0,2.

0792 R-