ML030520447

Technical Specification Pages for Amendment 273

ML030520447
Person / Time
Site:	Millstone
Issue date:	02/13/2003
From:	Richard Ennis NRC/NRR/DLPM/LPD1
To:
References
TAC MB4273
Download: ML030520447 (9)

Text

CONTAINMENT SYSTEMS 3/4.6.3 CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3.1 Each containment isolation valve shall be OPERABLE.*

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

With one or more of the isolation valve(s) inoperable, either:

a. Restore the inoperable valve(s) to OPERABLE status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, or

b. Isolate the affected penetration(s) within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of a deactivated automatic valve(s) secured in the isolation position(s), or

c. Isolate the affected penetration(s) within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of a closed manual valve(s) or blind flange(s); or

d. Be in COLD SHUTDOWN within the next 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

SURVEILLANCE REQUIREMENTS 4.6.3.1 Each containment isolation valve shall be demonstrated OPERABLE:

a. By verifying the isolation time of each power operated automatic containment isolation valve when tested pursuant to Specification 4.0.5.

b. At least once per 18 months by verifying each automatic containment isolation valve that is not locked, sealed, or otherwise secured in position, actuates to the isolation position on an actual or simulated actuation signal.

• Locked or sealed closed valves may be opened on an intermittent basis under administrative controls.

MILLSTONE - UNIT 2 3/4 6-15 Amendment No. *, 77j, 273 0767

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 6-16 Amendment No. 7g, 710,273 0767

PLANT SYSTEMS 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.3.1 Two reactor building closed cooling water loops shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

With one reactor building closed cooling water loop inoperable, restore the inoperable loop to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in COLD SHUTDOWN within the next 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

SURVEILLANCE REQUIREMENTS 4.7.3.1 Each reactor building closed cooling water loop shall be demon strated OPERABLE:

a. At least once per 31 days by verifying each reactor building closed cooling water manual, power operated, and automatic valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

b. At least once per 18 months by verifying each reactor building closed cooling water automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

c. At least once per 18 months by verifying each reactor building closed cooling water pump starts automatically on an actual or simulated actuation signal.

MILLSTONE - UNIT 2 3/4 7-11 Amendment No. ?,273 0768

PLANT SYSTEMS 3/4.7.4 SERVICE WATER SYSTEM LIMITING CONDITION FOR OPERATION 3.7.4.1 Two service water loops shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3 and 4.

ACTION:

With one service water loop inoperable, restore the inoperable loop to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in COLD SHUTDOWN within the next 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

SURVEILLANCE REQUIREMENTS 4.7.4.1 Each service water loop shall be demonstrated OPERABLE:

a. At least once per 31 days by verifying each service water manual, power operated, and automatic valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

b. At least once per 18 months by verifying each service water automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

c. At least once per 18 months by verifying each service water pump starts automatically on an actual or simulated actuation signal.

MILLSTONE 0768

- UNIT 2 3/4 7-12 Amendment No. 777, 77, 273

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

The upstream vent valves for the steam generator atmospheric dump valves, 2-MS-369 and 2-MS-371, are opened during steam generator safety valve set point testing to allow steam header pressure instrumentation to be placed in service. When either 2-MS-369 or 2-MS-371 is opened, a dedicated operator in continuous communication with the control room is required.

The determination of the appropriate administrative controls for these containment isolation valves included an evaluation of the expected environmental conditions. This evaluation has concluded environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of containment through the respective penetration.

The containment purge supply and exhaust isolation valves are required to be sealed closed during plant operation since these valves have not been demonstrated capable of closing during a LOCA or steam line break accident.

Such a demonstration would require justification of the mechanical operability of the purge valves and consideration of the appropriateness of the electrical override circuits. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the containment purge system. The containment purge supply and exhaust isolation valves are sealed closed by removing power from the valves.

This is accomplished by pulling the control power fuses for each of the valves. The associated fuse blocks are then locked. This is consistent with the guidance contained in NUREG-0737 Item II.E.4.2 and Standard Review Plan 6.2.4, "Containment Isolation System," Item II.f.

Surveillance Requirement 4.6.3.1.a verifies the isolation time of each power operated automatic containment isolation valve is within limits to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and surveillance frequency are in accordance with the Inservice Testing Program.

Surveillance Requirement 4.6.3.1.b demonstrate that each automatic containment isolation valve actuates to the isolation position on an actual or simulated containment isolation signal [containment isolation actuation signal (CIAS) or containment high radiation actuation signal (containment purge valves only)]. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillance was performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

MILLSTONE - UNIT 2 B 3/4 6-3e Amendment No. 710, Xý, 779, 273 0769

PLANT SYSTEMS BASES 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued)

It is acceptable to operate with the RBCCW pump minimum flow valves (2-RB 107A, 2-RB-107B, 2-RB-107C), RBCCW pump sample valves (2-RB-56A, 2-RB-56B, and 2-RB-56C), and the RBCCW pump radiation monitor stop valves (2-RB-39, 2-RB-41, and 2-RB-43) open. An active single failure will not adversely impact both RBCCW loops with these valves open. In addition, protection against a passive single failure after the initiation of post - loss of coolant accident long term cooling is achieved by manually closing these accessible valves, as directed by the emergency operating procedures. In addition, operation with RBCCW chemical addition valves (2-RB-50A and 2-RB-50B) open during chemical addition evolutions is acceptable since these normally closed valves are opened to add chemicals to the RBCCW and then closed as directed by normal operating procedures. Therefore, operation with these valves open does not affect OPERABILITY of the RBCCW loops.

Surveillance Requirement 4.7.3.1.a verifies the correct alignment for manual, power operated, and automatic valves in the RBCCW System flow paths to provide assurance that the proper flow paths exist for RBCCW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

Surveillance Requirements 4.7.3.1.b and 4.7.3.1.c demonstrate that each automatic RBCCW valve actuates to the required position on an actual or simulated actuation signal and that each RBCCW pump starts on receipt of an actual or simulated actuation signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillances were performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water (SW) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident con ditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident analyses.

MILLSTONE - UNIT 2 B 3/4 7-3c Amendment No. 71g, 777, 77y, 0793 7, 7, 273

PLANT SYSTEMS BASES 3/4.7.4 SERVICE WATER SYSTEM (Continued)

The SW loops are redundant of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a design basis accident, one SW loop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two SW loops must be OPERABLE, and independent to the extent necessary to ensure that a single failure will not result in the unavailability of both SW loops. At least one SW loop will operate assuming the worst single active Failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs post - loss of coolant accident long term cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate the passive failure.

The SW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system loops are no longer independent. The loss of independence will result in one large SW loop. This may adversely impact the ability of the SW System to mitigate the design basis events if a single failure, active or passive, occurs.

Opening the manual cross-connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis event coincident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated. (Several system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance applies. If only the manual cross-connect valves have been opened, and the SW System is in a normal configuration otherwise, with all system equipment OPERABLE, one SW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.4.1 applied. If the SW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both SW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.

The loss of loop independence is equivalent to the situation where one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less then the Technical Specification specified allowed outage time. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a design basis event concurrent with a single failure during this limited time period. The allowed outage time for one inoperable SW loop provides an appropriate limit for continued operation with only one OPERABLE SW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop MILLSTONE - UNIT 2 B 3/4 7-3d Amendment No.273 0793

PLANT SYSTEMS BASES 3/4.7.4 SERVICE WATER SYSTEM (Continued) determined to be inoperable should be the loop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Pestoration of loop independence within the time constraints of the allowed outage time is required, or a plant shutdown is necessary.

It is acceptable to operate with the SW header supply valves to sodium hypochlorite (2-SW-84A and 2-SW-84B) and the SW header supply valves to the north and south filters (2-SW-298 and 2-SW-299) open. Protection against a single Failure (active or passive after the initiation of post - loss of coolant accident long term cooling) with these valves open is provided by the flow restricting orifices contained in these lines. Therefore, operation with these valves open does not affect OPERABILITY of the SW loops.

Surveillance Requirement 4.7.4.1.a verifies the correct alignment for manual, power operated, and automatic valves in the Service Water (SW) System Flow paths to provide assurance that the proper flow paths exist for SW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A v*lve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

Surveillance Requirements 4.7.4.1.b and 4.7.4.1.c demonstrate that each automatic SW valve actuates to the required position on an actual or simulated actuation signal and that each SW pump starts on receipt of an actual or simulated actuation signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillances were performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

3/4.7.5 DELETED 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM The OPERABILITY of the Control Room Emergency Ventilation System ensures that 1) the ambient air temperature does not exceed the allowable temperature for continuous duty rating for the equipment and instrumentation cooled by this system and 2) the control room will remain habitable for operations personnel during and following all credible accident conditions.

MILLSTONE - UNIT 2 B 3/4 7-4 Amendment No. 77, 7 7, 273 0793

PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room to 5 rem or less whole body, or its equivalent.

This limitation is consistent with the requirements of General Design Criteria 19 of Appendix "A", 10 CFR 50.

The LCO is modified by a footnote allowing the control room boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in constant communication with the control room. This individual will have a method to rapidly close the opening when a need for control room isolation is indicated.

The control room radiological dose calculations use the conservative minimum acceptable flow of 2250 cfm based on the flowrate surveillance requirement of 2500 cfm + 10%.

MILLSTONE 0793

- UNIT 2 B 3/4 7-4a Amendment No. Z77, 7f, 777, 273