Text

Submittal of Changes to TS Bases, Table of Contents Through Section B 3.6
	ML031250401
Person / Time
Site:	Peach Bottom
Issue date:	04/24/2003
From:	Gallagher M; Exelon Nuclear
To:	; Office of Nuclear Reactor Regulation
References
	TS 5.5.10.d
	Download: ML031250401 (177)
	v • d • e

'S.. *

- ENl PECOI ENERGY Peach Bottom Atomic Power Station IMPROVED TECHNICAL SPECIFICATIONS (UNIT #2 BASES)

I

PBAPS UNIT 2 - LICENSE NO. DPR-44 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B TABLE OF CONTENTS page(s) i ......................... Rev 25 B 2.0 SAFETY LIMITS (SLs)

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY page(s) 3.0-12 ......................... Rev 6 3.0 15 (inclusive) ......................... Rev I B 3.1 REACTIVITY CONTROL SYSTEMS page(s) 3.1-15 -18 (inclusive) ........................ Rev 2 3.1 28 (inclusive) ........................ Rev 9 3.1 33 (inclusive) ........................ Rev 2 B 3.2 POWER DISTRIBUTION LIMITS page(s) 3.2-2 . Rev 28 3.2-3 . Rev 24 3.2-8 . Rev 24 B 3.3 INSTRUMENTATION page(s) 3.3 6 (inclusive) .Rev 24 3.3-7 -12 (inclusive) .Rev 36 3.3 19 (inclusive) .Rev 43 3.3 33.Rev 36 3.3-34V.. Rev 43 3.3-35a (inclusive) .Rev 36 3.3 44 (inclusive) .Rev 24 3.345 - 46 (inclusive) .Rev 36 3.3 55 (inclusive) .Rev 36 3.3-57 .Rev 36 3.3-59 .Rev 43 3.3-67 .Rev 7 3.3 69 (inclusive) .Rev 3 3.3-70 .Rev 7 3.3 73 (inclusive) .Rev 3 3.3-91a .Rev 25 3.3-91b .Rev. 43 3.3-91c .Rev 25 3.3-91 d - 91 e (inclusive) .Rev 43 3.3-91f .Rev 25 3.3-91 g.Rev 43 3.3-91h .Rev 25 3.3-91i .Rev 43 3.3-91j .Rev 25 3.3-99. Rev 1 3.3-151 .Rev 20 3.3-155 .Rev 32 3.3-166 .Rev I PBAPS Unit 2 j Revision No. 44

PBAPS UNIT 2 - LICENSE NO. DPR-44 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.3 INSTRUMENTATION (continued) 3.3-167 ................. Rev 20 3.3-168 - 186 (inclusive) ................. Rev 1 3.3-187 ................. Rev 5 3.3-188 - 190 (inclusive) ................. Rev 30 3.3-191 -198 (inclusive ................. Rev 5 3.3-199 - 205 ................. Rev I B 3.4 REACTOR COOLANT SYSTEM (RCS) page(s) 3.4-3 .Rev 36 3.4-4 .Rev 43 3.4 6 (inclusive).Rev 36 3.4 8 (inclusive) .Rev 1 3.4 10 (inclusive) .Rev 43 3.4-18 .Rev 23 3.4-39. Rev I B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM page(s) 3.5 15 (inclusive) ......................... Rev 2 3.5-16 -17 (inclusive) ......................... Rev 23 3.5-28 ......................... Rev 42 B 3.6 CONTAINMENT SYSTEMS page(s) 3.6-1 .Rev 27 3.6-2 .Rev 19 3.6-3. Rev 6 3.6 5 (inclusive) .Rev 22 3.6-7 .Rev 19 3.6-11 -12 (inclusive) .Rev 6 3.6-13 .Rev 19 3.6-17 -18 (inclusive) .Rev 2 3.6-27 .Rev 2 3.6-28 .Rev 35 3.6-29 .Rev 22 3.6-30 .Rev 15 3.6-31 .Rev 18 3.6-33 .Rev 19 3.6-43. Rev 44 3.6-47 .Rev 44 3.6 51 (inclusive) .Rev 24 3.6-58. Rev 1 3.6 66 (inclusive) .Rev 37 3.6-69 .Rev 37 3.6 77 (inclusive) .Rev 26 3.6-90. Rev 1 B 3.7 PLANT SYSTEMS page(s) 3.7-1 .Rev 17 3.7-6 .Rev 4 3.7-7 .Rev 11 3.7 8a .Rev 33 3.7-12 .Rev 2 PBAPS Unit 2 ;j Revision No. 44

PBAPS UNIT 2 - LICENSE NO. DPR-44 TECHNICAL SPECIFICATIONS BASES PAGE REVISION LISTING B 3.7 PLANT SYSTEMS (continued) 3.7-13 ............... Rev 1 3.7-15 ............... Rev 34 3.7-21 ............... Rev 20 3.7-29 ............... Rev 31 B 3.8 ELECTRICAL POWER SYSTEMS page(s) 3.8 3 (inclusive) .Rev 33 3.8 8 (inclusive) ............................................................ .Rev 5 3.8-9 ............... Rev 38 3.8 11 (inclusive) ............... Rev 5 3.8-12 ............... Rev 1 3.8 23 (inclusive) ............... Rev 32 3.8 30 (inclusive) ............... Rev 1 3.8 37 (inclusive) ............... Rev 10 3.8-42 ............... Rev 33 3.846 - 47 (inclusive) ............... Rev 16 3.8-55 ............... Rev 37 B 3.9 REFUELING OPERATIONS page(s) 3.9-1 .Rev 29 3.9-3 .Rev 29 3.9-8 Rev 24 3.9-10 .Rev 24 3.9-14 .Rev 24 3.9-15. Rev 2 B 3.10 SPECIAL OPERATIONS page(s) 3.10-1. Rev 1 3.10-5 .Rev 24 3.10-31 .Rev 24 3.10-32 .Rev 36 3.10-35 .Rev 36 3.10-36 .Rev 2 All remaining pages are Rev 0 dated 1/18/96.

PBAPS Unit22ii Revision No. 44

Recirculation Loops Operating B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 Recirculation Loops Operating BASES BACKGROUND The Reactor Coolant Recirculation System is designed to provide a forced coolant flow through the core to remove heat from the fuel. The forced coolant flow removes more heat from the fuel than would be possible with just natural circulation. The forced flow, therefore, allows operation at significantly higher power than would otherwise be possible. The recirculation system also controls reactivity over a wide span of reactor power-by varying the recirculation flow rate to control the void content of the moderator. The Reactor Coolant Recirculation System consists of two recirculation pump loops external to the reactor vessel. These loops provide the piping path for the driving flow of water to the reactor vessel jet pumps. Each external loop contains one variable speed motor driven recirculation pump, a motor generator (MG) set to control pump speed and associated piping, jet pumps, valves, and instrumentation. The recirculation loops are part of the reactor coolant pressure boundary and are located inside the drywell structure. The jet pumps are reactor vessel internals.

The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater. This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core. The subcooled water enters the bottom of the fuel channels and contacts the fuel cladding, where heat is transferred to the coolant. As it rises, the coolant (continued)

PBAPS UNIT 2 B 3.4-1 Revision No. 0

Recirculation Loops Operating B 3.4.1 BASES BACKGROUND begins to boil, creating steam voids within the fuel channel (continued) that continue until the coolant exits the core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow and sweep some of the voids from the fuel channel, overcoming the negative reactivity void effect. Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation (i.e., 65 to 100% of RTP) without having to move control rods and disturb desirable flux patterns.

Each recirculation loop is manually started from the control room. The MG set provides regulation of individual recirculation loop drive flows. The flow in each loop is manually controlled.

APPLICABLE The operation of the Reactor Coolant Recirculation System is SAFETY ANALYSES an initial condition assumed in the design basis loss of coolant accident (LOCA) (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered.

The analyses assume that both loops are operating at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops, with the pipe break assumed to be in the loop with the higher flow. While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were operating at a lower flow rate), a small mismatch has been determined to be acceptable based on engineering judgement. The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal margins during abnormal operational transients, which are analyzed in Chapter 14 of the UFSAR.

(continued)

PBAPS UNIT 2 B 3.4-2 Revision No. 0

Operating Recirculation Loops Recirculation Loops Operating B 3.4.1 BASES APPLICABLE Plant specific LOCA and average power range monitor/rod SAFETY ANALYSES block monitor Technical Specification/maximum extended load (continued) line limit analyses have been performed assuming only one operating recirculation loop. These analyses demonstrate that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling (Refs. 2, 3, and 4).

The transient analyses of Chapter 14 of the UFSAR have also been performed for single recirculation loop operation (Ref. 5) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System (RPS) average power range monitor (APRM) instrument setpoints is also required to account for the different relationships between recirculation drive flow and reactor core flow. The MCPR limits and APLHGR limits (power-dependent APLHGR multipliers, MAPFAC , and flow-dependent APLHGR multipliers, MAPFAC,) for single loop operation are specified in the COLR. The APRM Simulated Thermal Power-High Allowable Value is in LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation."

Safety analyses performed for UFSAR Chapter 14 implicitly assume core conditions are stable. However, at the high power/low flow corner of the power/flow map, an increased probability for limit cycle oscillations exists (Ref. 6) depending on combinations of operating conditions (e.g.,

power shape, bundle power, and bundle flow). Generic evaluations indicate that when regional power oscillations become detectable on the APRMs, the safety margin may be insufficient under some operating conditions to ensure actions taken to respond to the APRMs signals would prevent violation of the MCPR Safety Limit (Ref. 7). NRC Generic Letter 86-02 (Ref. 8) addressed stability calculation methodology and stated that due to uncertainties, 10 CFR 50, Appendix A, General Design Criteria (GDC) 10 and 12 could not be met using analytic procedures on a BWR 4 design.

However, Reference 8 concluded that operating limitations which provide for the detection (by monitoring neutron flux noise levels) and suppression of flux oscillations in operating regions of potential instability consistent with (continued)

PBAPS UNIT 2 B 3.4-3 Revision No. 36

Loops Operating Recirculation Recirculation Loops Operating B 3.4.1 BASES APPLICABLE the recommendations of Reference 6 are acceptable to SAFETY ANALYSES demonstrate compliance with GDC 10 and 12. The NRC (continued) concluded that regions of potential instability could occur at calculated decay ratios of 0.8 or greater by the General Electric methodology.

Stability tests at operating BWRs were reviewed to determine a generic region of the power/flow map in which surveillance of neutron flux noise levels should be performed. A conservative decay ratio was chosen as the basis for determining the generic region for surveillance to account for the plant to plant variability of decay ratio with core and fuel designs. This decay ratio also helps ensure sufficient margin to an instability occurrence is maintained. The generic region ("Restricted" Region of Figure 3.4.1-1) has been determined to be bounded by the 78.7% rod line and the 45% core flow line. This conforms to Reference 6 recommendations. Operation is permitted in the "Restricted" Region when two recirculation loops are in operation provided neutron flux noise levels are verified to be within limits. Operation is permitted in the "Restricted" Region when only one recirculation loop is in operation provided core flow is > 39% of rated core flow and neutron flux levels are verified to be within limits.

Single recirculation loop operation in the "Restricted" Region with core flow

39% of rated core flow shall be avoided due to the increased potential for thermal hydraulic instability in this condition. The "Unrestricted" Region of Figure 3.4.1-1 is the area of the power/flow map where unrestricted operation (with respect to thermal hydraulic stability concerns) is allowed, and includes any area not shown as the "Restricted" Region of the figure. The full power/flow map is not shown in Figure 3.4.1-1 to enhance the readability of the bounds of the "Restricted" Region.

Operation outside the bounds of Figure 3.4.1-1 is governed by the plant operating procedures.

Recirculation loops operating satisfies Criterion 2 of the NRC Policy Statement.

LCO Two recirculation loops are normally required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the (continued)

PBAPS UNIT 2 B 3.4-4 Revision No. 43

Recirculation Loops Operating B 3.4.1 BASES LCO assumptions of the LOCA analysis are satisfied. In addition, the core flow expressed as a function of THERMAL POWER must be in the "Unrestricted" Region of Figure 3.4.1-1, "THERMAL POWER Versus Core Flow Stability Regions." Alternatively, with only one recirculation loop in operation, modifications to the required APLHGR limits (power- and flow-dependent APLHGR multipliers, MAPFAC and MAPFACf, respectively of LCO 3.2.1, "AVERAGE PLANAR LfNEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and APRM Simulated Thermal Power-High Allowable Value (LCO 3.3.1.1) must be applied to allow continued operation consistent with the assumptions of References 5 and 6.

The LCO is modified by a Note which allows up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months before having to put in effect the required modifications to required limits after a change in the reactor operating conditions from two recirculation loops operating to single recirculation loop operation. If the required limits are not in compliance with the applicable requirements at the end of this period, the associated equipment must be declared inoperable or the limits "not satisfied," and the ACTIONS required by nonconformance with the applicable specifications implemented. This time is provided due to the need to stabilize operation with one recirculation loop, including the procedural steps necessary to limit flow in the operating loop, limit total THERMAL POWER, monitor for excessive APRM and local power range monitor (LPRM) neutron flux noise levels; and the complexity and detail required to fully implement and confirm the required limit modifications.

APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur.

In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important.

(continued)

PBAPS UNIT 2 B 3.4-5 Revision No. 36

Loops Operating Recirculation Recirculation Loops Operating B 3.4.1 BASES ACTIONS A.1 With one or two recirculation loops in operation with core flow as a function of THERMAL POWER in the "Restricted" Region of Figure 3.4.1-1, the plant is operating in a region where the potential for thermal hydraulic instability exists. In order to assure sufficient margin is provided for operator response to detect and suppress potential limit cycle oscillations, APRM and local power range monitor (LPRM) neutron flux noise levels must be periodically monitored and verified to be s 4% and

3 times baseline noise levels. Detector levels A and C of one LPRM string per core quadrant plus detectors A and C of one LPRM string in the center of the core shall be monitored. A minimum of three APRMs shall also be monitored. The Completion Times of this verification (within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter and within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after completion of any THERMAL POWER increase 2 5% RATED THERMAL POWER) are acceptable for ensuring potential limit cycle oscillations are detected to allow operator response to suppress the oscillation. These Completion Times were developed considering the operator's inherent knowledge of reactor status and sensitivity to potential thermal hydraulic instabilities when operating in this condition.

B.1 With the Required Action and associated Completion Time of Condition A not met, sufficient margin may not be available for operator response to suppress potential limit cycle oscillations since APRM or LPRM neutron flux noise levels may be > 4% and > 3 times baseline noise levels. As a result, action must be immediately initiated to restore noise levels to within required limits. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for restoring APRM and LPRM neutron flux noise levels to within required limits is acceptable because it minimizes risk while allowing time for restoration before subjecting the plant to transients associated with shutdown.

(continued)

PBAPS UNIT 2 B 3.4-6 Revision No. 36

Loops Operating Recirculation Recirculation Loops Operating B 3.4.1 BASES ACTIONS C.1 and C.2 (continued)

With one recirculation loop in operation with core flow

< 39% of rated core flow and THERMAL POWER in the "Restricted' Region of Figure 3.4.1-1, an increased potential for thermal hydraulic instability exists. As a result, immediate action should be initiated to reduce THERMAL POWER to the "Unrestricted" Region of Figure 3.4.1-1 or increase core flow to > 39% of rated core flow. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a reasonable amount of time to complete the Required Action and is considered acceptable based on the frequent core monitoring by the operators (Required Action A.1) allowing potential limit cycle oscillations to be quickly detected.

D.1 With the requirements of the LCO not met for reasons other than Conditions A, B, C, and F, the recirculation loops must be restored to operation with matched flows within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

A recirculation loop is considered not in operation when the pump in that loop is idle or when the mismatch between total jet pump flows of the two loops is greater than required limits. The loop with the lower flow must be considered not in operation. (However, the flow rate of both loops shall be used for the purposes of determining if the THERMAL POWER and core flow combination is in the Unrestricted Region of Figure 3.4.1-1.) Should a LOCA occur with one recirculation loop not in operation, the core flow coastdown and resultant core response may not be bounded by the LOCA analyses.

Therefore, only a limited time is allowed to restore the inoperable loop to operating status.

Alternatively, if the single loop requirements of the LCO are applied to operating limits and RPS setpoints, operation with only one recirculation loop would satisfy the requirements of the LCO and the initial conditions of the accident sequence.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on frequent core monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.

(continued)

PBAPS UNIT 2 B 3.4-7 Revision No. I

Operating Recirculation Loops Recirculation Loops Operating B 3.4.1 BASES ACTIONS D.I (continued)

This Required Action does not require tripping the recirculation pump in the lowest flow loop when the mismatch between total jet pump flows of the two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing pump speeds to re-establish forward flow or by tripping the pump.

E.1 With any Required Action and associated Completion Time of Condition B, C, or D not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

F.1 With no recirculation loops in operation, the plant must be brought to a MODE in which the LCO does not apply. Action must be initiated immediately to reduce THERMAL POWER to be within the 'Unrestricted" Region of Figure 3.4.1-1 to assure thermal hydraulic stability concerns are addressed. The plant is then required to be placed in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time is reasonable to reach MODE 3 considering the potential for thermal hydraulic instability in this condition.

(continued)

PBAPS UNIT 2 B 3.4-8 Revision No. 1

Loops Operating Recirculation Recirculation Loops Operating B 3.4.1 BASES SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loops are within the allowable limits for mismatch. At low core flow (i.e.,

< 71.75 X 106 lbm/hr), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can therefore be allowed when core flow is < 71.75 X -

106 lbm/hr. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.

The mismatch is measured in terms of core flow. (Rated core flow is 102.5 X 106 lbm/hr. The first limit is based on mismatch

10% of rated 'core flow when operating at < 70% of rated core flow. The second limit is based on mismatch < 5%

of rated core flow when operating at 2 70% of rated core flow.) If the flow mismatch exceeds the specified limits, the loop with the lower flow is considered not in operation.

(However, for the purposes of performing SR 3.4.1.2, the flow rate of both loops shall be used.) The SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance must be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after both loops are in operation.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is consistent with the Surveillance Frequency for jet pump OPERABILITY verification and has been shown by operating experience to be adequate to detect off normal jet pump loop flows in a timely manner.

SR 3.4.1.2 This SR ensures the reactor THERMAL POWER and core flow are within appropriate parameter limits to prevent uncontrolled power oscillations. At low recirculation flows and high reactor power, the reactor exhibits increased susceptibility to thermal hydraulic instability. Figure 3.4.1-1 is based on guidance provided in References 6 and 9 which are used to respond to operation in these conditions. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on operating experience and the operators' inherent knowledge of reactor status, including significant changes in THERMAL POWER and core flow.

(continued)

PBAPS UNIT 2 B 3.4-9 Revision No. 43

Recirculation Loops Operating B 3.4.1 BASES REFERENCES 1. UFSAR, Section 14.6.3.

2. NEDC-32163P, "PBAPS Units 2 and 3 SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," January 1993.

3. NEDC-32162P, "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Peach Bottom Atomic Power Station Unit 2 and 3," Revision 1, February 1993.

4. NEDC-32428P, "Peach Bottom Atomic Power Station Unit 2 Cycle 11 ARTS Thermal Limits Analyses," December 1994.

5. NEDO-24229-1, "PBAPS Units 2 and 3 Single-Loop Operation," May 1980.

6. GE Service Information Letter No. 380, "BWR Core Thermal Hydraulic Stability," Revision 1, February 10, 1984.

7. NRC Bulletin 88-07, "Power Oscillations in Boiling Water Reactors (BWRs)," Supplement 1, December 30, 1988.

8. NRC Generic Letter 86-02, "Technical Resolution of Generic Issue B-19 Thermal Hydraulic Stability,"

January 22, 1986.

9. NEDC-33064P, "Safety Analysis Report For Peach Bottom Atomic Power Station Units 2 & 3 Thermal Power Optimization," May 2002.

PBAPS UNIT 2 B 3.4-10 Revision No. 43

Jet Pumps B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 Jet Pumps BASES BACKGROUND The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating,' which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (DBA) analyses.

The jet pumps are reactor vessel internals and in conjunction with the Reactor Coolant Recirculation System are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two-thirds core height, the vessel can be reflooded and coolant level maintained at two-thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation.

Each reactor coolant recirculation loop contains ten jet pumps. Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow.

The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.

APPLICABLE Jet pump OPERABILITY is an implicit assumption in the design SAFETY ANALYSES basis loss of coolant accident (LOCA) analysis evaluated in Reference 1.

(continued)

PBAPS UNIT 2 B 3.4-11 Revision No. 0

Jet Pumps B 3.4.2 BASES APPLICABLE The capability of reflooding the core to two-thirds core SAFETY ANALYSES height is dependent upon the structural integrity of the jet (continued) pumps. If the structural system, including the beam holding a jet pump in place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.

Jet pumps satisfy Criterion 2 of the NRC Policy Statement.

LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two-thirds core height during a LOCA.

OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Coolant Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1).

APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Coolant Recirculation System (LCO 3.4.1).

In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not required to be in operation, and when not in operation, sufficient flow is not available to evaluate jet pump OPERABILITY.

ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability of reflooding during a design basis LOCA. If one or more of the jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 2 B 3.4-12 Revision No. 0

Jet Pumps Jet Pumps B 3.4.2 BASES (continued)

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS This SR is designed to detect significant degradation in pump performance that precedes jet pump failure (Ref. jet This SR is required to be performed only when the loop 2).

forced recirculation flow since surveillance checks and has measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance the recirculation loop. Significant degradation is to indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships.

allowable deviations from the established patterns have The developed based on the variations experienced at plants been during normal operation and with jet pump assembly failures (Refs. 2 and 3). Each recirculation loop must satisfy of the performance criteria provided. Since refueling one activities (fuel assembly replacement or shuffle, as well any modifications to fuel support orifice size or core plate as bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle.

Similarly, initial entry into extended single loop operation may also require establishment of these relationships.

During the initial weeks of operation under such conditions, while baselining new 'established patterns," engineering judgement of the daily surveillance results is used to detect significant abnormalities which could indicate a pump failure. jet The recirculation pump speed operating characteristics flow and loop flow versus pump speed) are determined by (pump the flow resistance from the loop suction through the jet nozzles. A change in the relationship indicates a plug, pump flow restriction, loss in pump hydraulic performance, leakage, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the flow and loop flow versus pump speed relationship must pump be verified.

Individual jet pumps in a recirculation loop normally do have the same flow. The unequal flow is due to the drive not flow manifold, which does not distribute flow equally to risers. The flow (or jet pump diffuser to lower plenum all differential pressure) pattern or relationship of one jet (continued)

PBAPS UNIT 2 B 3.4-13 Revision No. 0

Pumps Jet Jet Pumps B 3.4.2 BASES SURVEILLANCE SR 3.4.2.1 (continued)

REQUIREMENTS pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2). Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency has been shown by operating experience to be timely for detecting jet pump degradation and is consistent with the Surveillance Frequency for recirculation loop OPERABILITY verification.

This SR is modified by two Notes. Note I allows this Surveillance not to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions appropriate for data collection and evaluation.

Note 2 allows this SR not to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER exceeds 25%- of RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is an acceptable time to establish conditions appropriate to perform this SR.

REFERENCES 1. UFSAR, Section 14.6.3.

2. GE Service Information Letter No. 330, "Jet Pump Beam Cracks," June 9, 1980.

3. NUREG/CR-3052, 'Closeout of IE Bulletin 80-07: BWR Jet Pump Assembly Failure," November 1984.

PBAPS UNIT 2 B 3.4-14 Revision No. 0

SRVs and SVs B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 Safety Relief Valves (SRVs) and Safety Valves (SMs)

BASES BACKGROUND The ASME Boiler and Pressure Vessel Code requires the reactor pressure vessel be protected from overpressure during upset conditions by self-actuated safety valves. As part of the nuclear pressure relief system, the size and number of SRVs and SVs are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB).

The SRVs and SVs are located on the main steam lines between the reactor vessel and the first isolation valve within the drywell. The SRVs can actuate by either of two modes: the safety mode or the depressurization mode. In the safety mode, the pilot disc opens when steam pressure at the valve inlet expands the bellows to the extent that the hydraulic seating force on the pilot disc is reduced to zero. Opening of the pilot stage allows a pressure differential to develop across the second stage disc which opens the second stage disc, thus venting the chamber over the main valve piston.

This causes a pressure differential across the main valve piston which opens the main valve. The SVs are spring loaded valves that actuate when steam pressure at the inlet overcomes the spring force holding the valve disc closed.

This satisfies the Code requirement.

Each of the 11 SRVs discharge steam through a discharge line to a point below the minimum water level in the suppression pool. The two SVs discharge steam directly to the drywell.

In the depressurization mode, the SRV is opened by a pneumatic actuator which opens the second stage disc. The main valve then opens as described above for the safety mode. The depressurization mode provides controlled depressurization of the reactor coolant pressure boundary.

All 11 of the SRVs function in the safety mode and have the capability to operate in the depressurization mode via manual actuation from the control room. Five of the SRVs are allocated to the Automatic Depressurization System (ADS). The ADS requirements are specified in LCO 3.5.1, "ECCS-Operating."

(continued)

PBAPS UNIT 2 B 3.4-15 Revision No. 0

SRMs and SMs B 3.4.3 BASES (continued)

APPLICABLE The overpressure protection system must accommodate the most SAFETY ANALYSES severe pressurization transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs), followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 1). For the purpose of the analyses, 11 SRVs and SVs are assumed to operate in the safety mode. The analysis results demonstrate that the design SRV and SV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig =

1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the Design Basis Event.

From an overpressure standpoint, the design basis events are bounded by the MSIV closure with flux scram event described above. Reference 2 discusses additional events that are expected to actuate the SRVs and SVs.

SRVs and SVs satisfy Criterion 3 of the NRC Policy Statement.

LCO The safety function of any combination of 11 SRVs and SVs are required to be OPERABLE to satisfy the assumptions of the safety analysis (Refs. 1 and 2). Regarding the SRVs, the requirements of this LCO are applicable only to their capability to mechanically open to relieve excess pressure when the lift setpoint is exceeded (safety mode).

The SRV and SV setpoints are established to ensure that the ASME Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve setpoint to be at or below vessel design pressure (1250 psig) and the highest safety valve to be set so that the total accumulated pressure does not exceed 110% of the design pressure for overpressurization conditions. The transient evaluations in the UFSAR are based on these setpoints, but also include the additional uncertainties of

+ 1% of the nominal setpoint to provide an added degree of conservatism.

Operation with fewer valves OPERABLE than specified, or with setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded.

(continued)

PBAPS UNIT 2 B 3.4-16 Revision No. 0

SVs SRVs and SRVs and SVs B 3.4.3 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, all required SRVs and SVs must be OPERABLE, since considerable energy may be in the reactor core and the limiting design basis transients are assumed to occur in these MODES. The SRVs and SVs may be required to provide pressure relief to discharge energy from the core until such time that the Residual Heat Removal (RHR) System is capable of dissipating the core heat.

In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The SRV and SV function is not needed during these conditions.

ACTIONS A.1 and A.2 With less than the minimum number of required SRVs or SVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If the safety function of one or more required SRVs or SVs is inoperable, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This Surveillance requires that the required SRVs and SVs will open at the pressures assumed in the safety analyses of References 1 and 2. The demonstration of the SRV and SV safety lift settings must be performed during shutdown, since this is a bench test, to be done in accordance with the Inservice Testing Program. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures and be verified with insulation installed simulating the in-plant condition.

The SRV and SV setpoint is +/- 1% for OPERABILITY.

(continued)

PBAPS UNIT 2 B 3.4-17 Revision No. 0

SRVs and SVs B 3.4.3 BASES SURVEILLANCE SR 3.4.3.2 REQUIREMENTS (continued) The pneumatic actuator of each SRV valve is stroked to verify that the second stage pilot disc rod is mechanically displaced when the actuator strokes. Second stage pilot rod movement is determined by the measurement of actuator rod travel. The total amount of movement of the second stage pilot rod from the valve closed position to the open position shall meet criteria established by the SRV supplier. If the valve fails to actuate due only to the failure of the solenoid, but is capable of opening on overpressure, the safety function of the SRV is considered OPERABLE.

Operating experience has shown that these components will pass the SR when performed at the 24 month Frequency, which is based on the refueling outage. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. NEDC-32183P, "Power Rerate Safety Analysis Report for Peach Bottom 2 & 3," May 1993.

2. UFSAR, Chapter 14.

PBAPS UNIT 2 B 3.4-18 Revision No. 23

RCS Operational LEAKAGE B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Operational LEAKAGE BASES BACKGROUND The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB).

The joints of the RCPB components are welded or bolted.

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration.

Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and the UFSAR (Refs. 1, 2, and 3).

The safety significance of RCS LEAKAGE from the RCPB varies widely depending on the source, rate, and duration.

Therefore, detection of LEAKAGE in the primary containment is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur that is detrimental to the safety of the facility or the public.

A limited amount of leakage inside primary containment is expected from auxiliary systems that cannot be made 100%

leaktight. Leakage from these systems should be detected and isolated from the primary containment atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.

This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident.

(continued)

PBAPS UNIT 2 B 3.4-19 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES (continued)

APPLICABLE The allowable RCS operational LEAKAGE limits are based on SAFETY ANALYSES the predicted and experimentally observed behavior of pipe cracks. The normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests that, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.

The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows that leakage rates of hundreds of gallons per minute will precede crack instability.

The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) in service sensitive type 304 and type 316 austenitic stainless steel that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.

No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell floor sump capacity.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, since it is indicative of material degradation. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

(continued)

PBAPS UNIT 2 B 3.4-20 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES LCO b. Unidentified LEAKAGE (continued)

The 5 gpm of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and drywell sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB.

c. Total LEAKAGE The total LEAKAGE limit is based on a reasonable minimum detectable amount. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE).

Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.

d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of > 2 gpm within the previous 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE I when operating pressures and temperatures are established. Violation of this LCO could result in continued degradation of the RCPB.

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies, because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized.

In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced.

(continued)

PBAPS UNIT 2 B 3.4-21 Revision No. 0

LEAKAGE RCS Operational RCS Operational LEAKAGE B 3.4.4 BASES (continued)

ACTIONS A.1 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leak. Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE; however, the total LEAKAGE limit would remain unchanged.

B.1 and B.2 An unidentified LEAKAGE increase of > 2 gpm within a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period is an indication of a potential flaw in the RCPB and must be quickly evaluated. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, certain susceptible components must be determined not to be the source of the LEAKAGE increase within the required Completion Time. For an unidentified LEAKAGE increase greater than required limits, an alternative to reducing LEAKAGE increase to within limits (i.e., reducing the leakage rate such that the current rate is less than the "2 gpm increase in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ' limit; either by isolating the source or other possible methods) is to evaluate service sensitive type 304 and type 316 austenitic stainless steel piping that is subject to high stress or that contains relatively stagnant or intermittent flow fluids and determine it is not the source of the increased LEAKAGE. This type piping is very susceptible to IGSCC.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable to properly reduce the LEAKAGE increase or verify the source before the reactor must be shut down without unduly jeopardizing plant safety.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B is not met or if pressure boundary LEAKAGE exists, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within (continued)

PBAPS UNIT 2 B 3.4-22 Revision No. 0

RCS Operational LEAKAGE B 3.4.4 BASES ACTIONS C.1 and C.2 (continued) 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant safety systems.

SURVEILLANCE SR 3.4.4.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to provide alarms when LEAKAGE is indicated and to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.5, 'RCS Leakage Detection Instrumentation." Sump level and flow rate are typically monitored to determine actual LEAKAGE rates; however, any method may be used to quantify LEAKAGE within the guidelines of Reference 6. In conjunction with alarms and other administrative controls, a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Frequency for this Surveillance is appropriate for identifying LEAKAGE and for tracking required trends (Ref. 7).

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. UFSAR, Section 4.10.4.

4. GEAP-5620, 'Failure Behavior in ASTM A106B Pipes Containing Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, 'Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactors," October 1975.

6. Regulatory Guide 1.45, May 1973.

7. Generic Letter 88-01, 'NRC Position on IGSCC in BWR Austenitic Stainless Steel Piping," January 1988.

PBAPS UNIT 2 B 3.4-23 Revision No. 0

RCS Leakage Detection Instrumentation B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Leakage Detection Instrumentation BASES BACKGROUND UFSAR Safety Design Basis (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2).

Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of leakage rates. The Bases for LCO 3.4.4, 'RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE rates.

Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action.

LEAKAGE from the RCPB inside the drywell is detected by at least one of two independently monitored variables, such as sump level changes and drywell gaseous radioactivity levels.

The primary means of quantifying LEAKAGE in-the drywell is the drywell floor drain sump monitoring system.

The drywell floor drain sump monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges or packings, floor drains, the Reactor Building Closed Cooling Water System, and drywell air cooling unit condensate drains, and any LEAKAGE not collected in the drywell equipment drain sump.

An alternate to the drywell floor drain sump monitoring system is the drywell equipment drain sump monitoring system, but only if the drywell floor drain sump is overflowing. The drywell equipment drain sump collects not only all leakage not collected in the drywell floor drain sump, but also any overflow from the drywell floor drain sump. Therefore, if the drywell floor drain sump is (continued)

PBAPS UNIT 2 B 3.4-24 Revision No. 0

RCS Leakage Detection Instrumentation B 3.4.5 BASES BACKGROUND overflowing to the drywell equipment drain sump, the drywell (continued) equipment drain sump monitoring system can be used to quantify LEAKAGE. In this condition, all LEAKAGE measured by the drywell equipment drain sump monitoring system is assumed to be unidentified LEAKAGE.

The floor drain sump level indicators have switches that start and stop the sump pumps when required. If the sump fills to the high high level setpoint, an alarm sounds in the control room, indicating a LEAKAGE rate into the sump in excess of 50 gpm.

A flow transmitter in the discharge line of the drywell floor drain sump pumps provides flow indication in the control room. The pumps can also be started from the control room.

The primary containment air monitoring system continuously monitors the primary containment atmosphere for airborne gaseous radioactivity. A sudden increase of radioactivity, which may be attributed to RCPB steam or reactor water LEAKAGE, is annunciated in the control room. The primary containment atmosphere gaseous radioactivity monitoring system is not capable of quantifying LEAKAGE rates, but is sensitive enough to indicate increased LEAKAGE rates of 1 gpm within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Larger changes in LEAKAGE rates are detected in proportionally shorter times (Ref. 3).

APPLICABLE A threat of significant compromise to the RCPB exists if the SAFETY ANALYSES barrier contains a crack that is large enough to propagate rapidly. LEAKAGE rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 4 and 5). Each of the leakage detection systems inside the drywell is designed with the capability of detecting LEAKAGE less than the established LEAKAGE rate limits. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 6). Therefore, these actions provide adequate response before a significant break in the RCPB can occur.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

(continued)

PBAPS UNIT 2 B 3.4-25 Revision No. 0

RCS Leakage Detection Instrumentation RCS Leakage Detection Instrumentation B 3.4.5 BASES (continued)

LCO The drywell sump monitoring system is required to quantify the unidentified LEAKAGE from the RCS. Thus, for the system to be considered OPERABLE, the system must be capable of measuring reactor coolant leakage. This may be accomplished by use of the associated drywell sump flow integrator, flow recorder, or the pump curves and drywell sump pump out time.

The system consists of a) the drywell floor drain sump monitoring system, or b) the drywell equipment drain sump monitoring system, but only when the drywell floor drain sump is overflowing. The other monitoring system provides early alarms to the operators so closer examination of other detection systems will be made to determine the extent of any corrective action that may be required. With the leakage detection systems inoperable, monitoring for LEAKAGE in the RCPB is degraded.

APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are required to be OPERABLE to support LCO 3.4.4. This Applicability is consistent with that for LCO 3.4.4.

ACTIONS A.1 With the drywell sump monitoring system inoperable, no other form of sampling can provide the equivalent information to quantify leakage. However, the primary containment atmospheric radioactivity monitor will provide indication of changes in leakage.

With the drywell sump monitoring system inoperable, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is acceptable, based on operating experience, considering no other method to quantify leakage is available.

B.1 and B.2 With the gaseous primary containment atmospheric monitoring channel inoperable, grab samples of the primary containment atmosphere must be taken and analyzed for gaseous radioactivity to provide periodic leakage information.

Provided a sample is obtained and analyzed once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the plant may be operated for up to 30 days to allow restoration of the required monitor.

(continued)

PBAPS UNIT 2 B 3.4-26 Revision No. 0

RCS Leakage Detection Instrumentation B 3.4.5 BASES ACTIONS B.1 and B.2 (continued)

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval provides periodic information that is adequate to detect LEAKAGE. The 30 day Completion Time for restoration recognizes that at least one other form of leakage detection is available.

The Required Actions are modified by a Note that states that the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when the gaseous primary containment atmospheric monitoring channel is inoperable.

This allowance is provided because other instrumentation is available to monitor RCS leakage.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to perform the actions in an orderly manner and without challenging plant systems.

D.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR is for the performance of a CHANNEL CHECK of the required primary containment atmospheric monitoring system.

The check gives reasonable confidence that the channel is operating properly. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

(continued)

PBAPS UNIT 2 B 3.4-27 Revision No. 0

RCS Leakage Detection Instrumentation B 3.4.5 BASES SURVEILLANCE SR 3.4.5.2 REQUIREMENTS (continued) This SR is for the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The test also verifies the alarm setpoint and relative accuracy of the instrument string.

The Frequency of 31 days considers instrument reliability, and operating experience has shown it proper for detecting degradation.

SR 3.4.5.3 This SR is for the performance of a CHANNEL CALIBRATION of required leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string.

The Frequency is 92 days and operating experience has proven this Frequency is acceptable.

REFERENCES 1. UFSAR, Section 4.10.2.

2. Regulatory Guide 1.45, May 1973.

3. UFSAR, Section 4.10.3.

4. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactors," October 1975.

6. UFSAR, Section 4.10.4.

PBAPS UNIT 2 B 3.4-28 Revision No. 0

RCS Specific Activity B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Specific Activity BASES BACKGROUND During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the reactor coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the reactor coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity. The release of coolant during a Design Basis Accident (DBA) could send radioactive materials into the environment.

Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure that in the event of a release of any radioactive material to the environment during a DBA, radiation doses are maintained within the limits of 10 CFR 100 (Ref. 1).

This LCO contains the iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT 1-131. The allowable level is intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months radiation dose to an individual at the site boundary to well within the 10 CFR 100 limit.

APPLICABLE Analytical methods and assumptions involving radioactive SAFETY ANALYSES material in the primary coolant are presented in the UFSAR (Ref. 2). The specific activity in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely.

This MSLB release forms the basis for determining offsite doses (Ref. 2). The limits on the specific activity of the primary coolant ensure that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid and whole body doses at the site boundary, resulting from an MSLB outside containment during steady state operation, will not exceed the dose guidelines of 10 CFR 100.

(continued)

PBAPS UNIT 2 B 3.4-29 Revision No. 0

RCS SpecifiicActivity B 3.4.6 BASES APPLICABLE The limits on specific activity are values from a parametric SAFETY ANALYSES evaluation of typical site locations. These limits are (continued) conservative because the evaluation considered more restrictive parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.

RCS specific activity satisfies Criterion 2 of the NRC Policy Statement.

LCO The specific iodine activity is limited to < 0.2 pCi/gm DOSE EQUIVALENT I-131. This limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is well within the 10 CFR 100 limits.

APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.

In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced.

ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT 1-131 limit, but is < 4.0 pCi/gm, samples must be analyzed for DOSE EQUIVALENT 1-131 at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In addition, the specific activity must be restored to the LCO limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes) to be cleaned up with the normal processing systems.

(continued)

PBAPS UNIT 2 B 3.4-30 Revision No. 0

RCS Specific Activity B 3.4.6 BASES ACTIONS A.1 and A.2 (continued)

A Note to the Required Actions of Condition A excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE(S) while relying on the ACTIONS even though the ACTIONS may eventually require plant shutdown. This exception is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to, power operation.

B.1. B.2.1, B.2.2.1. and B.2.2.2 If the DOSE EQUIVALENT 1-131 cannot be restored to s 0.2 XCi/gm within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or if at any time it is > 4.0 Ci/gm, it must be determined at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and all the main steam lines must be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 100 during a postulated MSLB accident.

Alternatively, the plant can be placed in MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads).

In MODE 4, the requirements of the LCO are no longer applicable.

The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the time needed to take and analyze a sample. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for placing the unit in MODES 3 and 4 are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PBAPS UNIT 2 B 3.4-31 Revision No. 0

RCS Specific Activity B 3.4.6 BASES (continued)

SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This Surveillance is performed to ensure iodine remains within limit during normal operation. The 7 day Frequency is adequate to trend changes in the iodine activity level.

This SR is modified by a Note that requires this Surveillance to be performed only in MODE I because the level of fission products generated in other MODES is much less.

REFERENCES 1. 10 CFR 100.11, 1973.

2. UFSAR, Section 14.6.5.

PBAPS UNIT 2 B 3.4-32 Revision No. 0

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to

< 212'F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Hot Shutdown condition.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. The four redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the High Pressure Service Water (HPSW)

System. Any one of the four RHR shutdown cooling subsystems can provide the required decay heat removal function.

APPLICABLE Decay heat removal by operation of the RHR System in the SAFETY ANALYSES shutdown cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. The RHR Shutdown Cooling System meets Criterion 4 of the NRC Policy Statement.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, a HPSW pump capable of providing cooling to the heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have common discharge piping. Since piping is a passive component that (continued)

PBAPS UNIT 2 B 3.4-33 Revision No. 0

RHR Shutdown Cooling System-Hot Shutdown B 3.4.7 BASES LCO is assumed not to fail, it is allowed to be common to both (continued) subsystems. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 3, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.

Note I permits both required RHR shutdown cooling subsystems and recirculation pumps to be shut down for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. Note 2 allows one required RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODE 3 with reactor steam dome pressure below the RHR shutdown cooling isolation pressure (i.e., the actual pressure at which the RHR shutdown cooling isolation pressure setpoint clears) the RHR Shutdown Cooling System must be OPERABLE and shall be operated in the shutdown cooling mode to remove decay heat to reduce or maintain coolant temperature. Otherwise, a recirculation pump is required to be in operation.

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR shutdown cooling isolation pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping.

Decay heat removal at reactor pressures greater than or equal to the RHR shutdown cooling isolation pressure is typically accomplished by condensing the steam in the main condenser.

(continued)

PBAPS UNIT 2 B 3.4-34 Revision No. 0

Shutdown RHR Shutdown Cooling System-Hot RHR Shutdown Cooling System -Hot Shutdown B 3.4.7 BASES APPLICABILITY Additionally, in MODE 2 below this pressure, the OPERABILITY (continued) requirements for the Emergency Core Cooling Systems (ECCS)

(LCO 3.5.1, FECCS-Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

The requirements for decay heat removal in MODES 4 and 5 are discussed in LCO 3.4.8, "Residual Heat Removal (RHR)

Shutdown Cooling System-Cold Shutdown"; LCO 3.9.7,

'Residual Heat Removal (RHR)-High Water Level"; and LCO 3.9.8, 'Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note to the ACTIONS excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE(S) while relying on the ACTIONS even though the ACTIONS may eventually require plant shutdown. This exception is acceptable due to the redundancy of the OPERABLE subsystems, the low pressure at which the plant is operating, the low probability of an event occurring during operation in this condition, and the availability of alternate methods of decay heat removal capability.

A second Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1. A.2. and A.3 With one required RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the inoperable subsystem must be restored to OPERABLE status without delay. In this condition, the remaining OPERABLE subsystem can provide the necessary decay heat removal. The (continued)

PBAPS UNIT 2 B 3.4-35 Revision No. 0

System-Hot Shutdown RHR Shutdown Cooling RHR Shutdown Cooling System -Hot Shutdown B 3.4.7 BASES ACTIONS A.I. A.2. and A.3 (continued) overall reliability is reduced, however, because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore, an alternate method of decay heat removal must be provided.

With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This' re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Condensate/Main Steam Systems and the Reactor Water Cleanup System.

However, due to the potentially reduced reliability of the alternate methods of decay heat removal, it is also required to reduce the reactor coolant temperature to the point where MODE 4 is entered.

B.I. B.2. and B.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or recirculation pump must be restored without delay.

Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant (continued)

PBAPS UNIT 2 B 3.4-36 Revision No. 0

System-Hot Shutdown RHR Shutdown Cooling RHR Shutdown Cooling System -Hot Shutdown B 3.4.7 BASES ACTIONS B.1. B.2. and B.3 (continued) circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This Surveillance verifies that one required RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient in view of other visual and audible indications available to the operator for monitoring the RHR subsystem in the control room.

This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after clearing the pressure setpoint that isolates the system, or for placing a recirculation pump in operation.

The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability.

REFERENCES None.

PBAPS UNIT 2 B 3.4-37 Revision No. 0 I

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 Residual Heat Removal (RHR) Shutdown Cooling System-Cold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant s 212F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Cold Shutdown condition.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR shutdown cooling subsystems per RHR System loop. Both loops have a common suction from the same recirculation loop. The four redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via the associated recirculation loop. The RHR heat exchangers transfer heat to the High Pressure Service Water (HPSW)

System. Any one of the four RHR shutdown cooling subsystems can provide the requested decay heat removal function.

APPLICABLE Decay heat removal by operation of the RHR System in the SAFETY ANALYSES shutdown cooling mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. The RHR Shutdown Cooling System meets Criterion 4 of the NRC Policy Statement.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and when no recirculation pump is in operation, one RHR shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, a HPSW pump capable of providing cooling to the heat exchanger, and the associated piping and valves. The two subsystems have a common suction source and are allowed to have common discharge piping. Since piping is a passive component that is assumed not to fail, it is allowed to be common to both (continued)

PBAPS UNIT 2 B 3.4-38 Revision No. 0

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 BASES I LCO subsystems. In MODE 4, the RHR cross tie valve (continued) (MO-2-10-020) may be opened (per LCO 3.5.2) to allow pumps in one loop to discharge through the opposite recirculation loop to make a complete subsystem. In addition, the HPSW cross-tie valve may be opened to allow an HPSW pump in one loop to provide cooling to a heat exchanger in the opposite loop to make a complete subsystem. Additionally, each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required.

However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required.

Note 1 permits both required RHR shutdown cooling subsystems to be shut down for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period.

Note 2 allows one required RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for performance of Surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODE 4, the RHR Shutdown Cooling System must be OPERABLE and shall be operated in the shutdown cooling mode to remove decay heat to maintain coolant temperature below 212 0F.

Otherwise, a recirculation pump is required to be in operation.

In MODES I and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR shutdown cooling isolation pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping.

Decay heat removal at reactor pressures above the RHR shutdown cooling isolation pressure is typically accomplished by condensing the steam in the main condenser.

(continued)

PBAPS UNIT 2 B 3.4-39 Revision No. 1

System-Cold Shutdown RHR Shutdown Cooling RHR Shutdown Cooling System -Cold Shutdown B 3.4.8 BASES APPLICABILITY Additionally, in MODE 2 below this pressure, the OPERABILITY (continued) requirements for the Emergency Core Cooling Systems (ECCS)

(LCO 3.5.1, 'ECCS-Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

The requirements for decay heat removal in MODE 3 below the RHR shutdown cooling isolation pressure and in MODE 5 are discussed in LCO 3.4.7, 'Residual Heat Removal (RHR)

Shutdown Cooling System-Hot Shutdown"; LCO 3.9.7, 'Residual Heat Removal (RHR)-High Water Level"; and LCO 3.9.8, "Residual Heat Removal (RHR)-Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1 With one of the two required RHR shutdown cooling subsystems inoperable, except as permitted by.LCO Note 2, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced.

Therefore, an alternate method of decay heat removal must be provided. With both required RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability.

This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat (continued)

PBAPS UNIT 2 B 3.4-40 Revision No. 0

System-Cold Shutdown RHR Shutdown Cooling RHR Shutdown Cooling System -Cold Shutdown B 3.4.8 BASES ACTIONS A.1 (continued) removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will provide assurance of continued heat removal capability.

The required cooling capacity of the alternate method should be ensured by verifying (by calculation or demonstration) its capability to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Condensate/Main Steam Systems (feed and bleed) and the Reactor Water Cleanup System.

B.1 and B.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as permitted by LCO Note 1, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

(continued)

PBAPS UNIT 2 B 3.4-41 Revision No. 0

RHR Shutdown Cooling System-Cold Shutdown B 3.4.8 BASES (continued)

SURVEILLANCE SR 3.4.8.1 REQU IREM ENTS This Surveillance verifies that one required RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient in view of other visual and audible indications available to the operator for monitoring the RHR subsystem in the control room.

REFERENCES None.

PBAPS UNIT 2 B 3.4-42 Revision No. 0

RCS P/T Limits B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

The Specification contains P/T limit curves for heatup, cooldown, and inservice leakage and hydrostatic testing, and also limits the maximum rate of change of reactor coolant temperature. The criticality curve provides limits for both heatup and criticality.

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure. Therefore, the LCO limits apply to the vessel.

10 CFR 50, Appendix G (Ref. 1), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, abnormal operational transients, and system hydrostatic tests. It mandates the use of the ASME Code,Section III, Appendix G (Ref. 2).

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with the UFSAR (Ref. 3) and Appendix H of 10 CFR 50 (Ref. 4). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 5.

(continued)

PBAPS UNIT 2 B 3.4-43 Revision No. 0

RCS P/T Limits B 3.4.9 BASES BACKGROUND The P/T limit curves are composite curves established by (continued) superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.

The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.

The criticality limits include the Reference 1 requirement that they be at least 40F above the heatup curve or the cooldown curve and not lower than 60OF above the adjusted reference temperature of the reactor vessel material in the region that is controlling (reactor vessel flange region).

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the reactor pressure vessel, possibly leading to a nonisolable leak or loss of coolant accident.

In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. ASME Code,Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

APPLICABLE The P/T limits are not derived from Design Basis Accident SAFETY ANALYSES (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the reactor pressure vessel, a condition that is unanalyzed.

References 7 and 8 approved the curves and limits specified in this section. Since the P/T limits are not derived from any DBA, there are no acceptance limits related to the P/T limits. Rather, the P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.

(continued)

PBAPS UNIT 2 B 3.4-44 Revision No. 0

RCS P/I Limits RCS P/T Limits B 3.4.9 BASES APPLICABLE RCS P/T limits satisfy Criterion 2 of the NRC Policy SAFETY ANALYSES Statement.

(continued)

LCO The elements of this LCO are:

a. RCS pressure and temperature are within the limits specified in Figures 3.4.9-1 and 3.4.9-2, and heatup or cooldown rates are 5 100'F during RCS heatup, cooldown, and inservice leak and hydrostatic testing;

b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is < 145*F during recirculation pump startup;

c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel is 5 50*F during recirculation pump startup;

d. RCS pressure and temperature are within the criticality limits specified in Figure 3.4.9-3, prior to achieving criticality; and

e. The reactor vessel flange and the head flange temperatures are > 70'F when tensioning the reactor vessel head bolting studs.

These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.

The rate of change of temperature limits controls the thermal gradient through the vessel wall and is used as input for calculating the heatup, cooldown, and inservice leakage and hydrostatic testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.

(continued)

PBAPS UNIT 2 B 3.4-45 Revision No. 0

RCS P/T Limits B 3.4.9 BASES LCO Violation of the limits places the reactor vessel outside of (continued) the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a P/T limit exists at all times.

For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.

ACTIONS A.I and A.2 Operation outside the P/T limits while in MODES 1, 2, and 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired.

Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.

ASME Code,Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

(continued)

PBAPS UNIT 2 B 3.4-46 Revision No. 0

Limits RCS PIT RCS P/T Limits B 3.4.9 BASES ACTIONS A.1 and A.2 (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired.

Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered.

The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits.

Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.

Pressure and temperature are reduced by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Operation outside the P/T limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.

(continued)

PBAPS UNIT 2 B 3.4-47 Revision No. 0

Limits RCS P/T RCS P/T Limits B 3.4.9 BASES ACTIONS C.1 and C.2 (continued)

Besides restoring the P/T limit parameters to within limits, an evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 212*F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components.

ASME Code,Section XI, Appendix E (Ref. 6), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS Verification that operation is within limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. Plant procedures specify the pressure and temperature monitoring points to be used during the performance of this Surveillance. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits a reasonable time for assessment and correction of minor deviations.

Surveillance for heatup, cooldown, or inservice leakage and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.

This SR has been modified with a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leakage and hydrostatic testing.

SR 3.4.9.2 A separate limit is used when the reactor is approaching criticality. Consequently, the RCS pressure and temperature must be verified within the appropriate limits before withdrawing control rods that will make the reactor critical.

(continued)

PBAPS UNIT 2 B 3.4-48 Revision No. 0

Limits RCS P/T RCS P/T Limits B 3.4.9 BASES SURVEILLANCE SR 3.4.9.2 (continued)

REQUIREMENTS Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the control rod withdrawal.

SR 3.4.9.3 and SR 3.4.9.4 Differential temperatures within the applicable limits ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. In addition, compliance with these limits ensures that the assumptions of the analysis for the startup of an idle recirculation loop (Ref. 9) are satisfied.

Performing the Surveillance within 15 minutes before starting the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.9.4 is to compare the temperatures of the operating recirculation loop and the idle loop.

SR 3.4.9.3 and SR 3.4.9.4 have been modified by a Note that requires the Surveillance to be met only in MODES 1, 2, 3, and 4. In MODE 5, the overall stress on limiting components is lower. Therefore, AT limits are not required. The Note also states the SR is only required to be met during a recirculation pump startup, since this is when the stresses occur.

SR 3.4.9.5. SR 3.4.9.6. and SR 3.4.9.7 Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.

(continued)

PBAPS UNIT 2 B 3.4-49 Revision No. 0

RCS P/T Limits RCS P/T Limits B 3.4.9 BASES SURVEILLANCE SR 3.4.9.5. SR 3.4.9.6. and SR 3.4.9.7 (continued)

REQUIREMENTS The flange temperatures must be verified to be above the limits 30 minutes before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperature s 809F, 30 minute checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature s 100F, monitoring of the flange temperature is required every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure the temperature is within the limits specified.

The 30 minute Frequency reflects the urgency of maintaining the temperatures within limits, and also limits the time that the temperature limits could be exceeded. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable based on the rate of temperature change possible at these temperatures.

SR 3.4.9.5 is modified by a Note that requires the Surveillance to be performed only when tensioning the reactor vessel head bolting studs. SR 3.4.9.6 is modified by a Note that requires the Surveillance to be initiated 30 minutes after RCS temperature s 80*F in MODE 4. SR 3.4.9.7 is modified by a Note that requires the Surveillance to be initiated 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after RCS temperature 100OF in MODE 4.

The Notes contained in these SRs are necessary to specify when the reactor vessel flange and head flange temperatures are required to be verified to be within the limits specified.

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code,Section III, Appendix G.

3. UFSAR, Section 4.2.6 and Appendix K.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

(continued)

PBAPS UNIT 2 B 3.4-50 Revision No. 0

RCS P/T Limits B 3.4.9 BASES REFERENCES 6. ASME, Boiler and Pressure Vessel Code,Section XI, (continued) Appendix E.

7. R.E. Martin (NRC) letter to G.A. Hunger (PECo),

Amendment No. 153 to Facility Operating License No.

DPR-44 for the Peach Bottom Atomic Power Station Unit No. 2, dated October 25, 1989.

8. R.J. Clark (NRC) letter to G.J. Beck (PECo), Amendment Nos. 162 and 164 to Facility Operating License Nos.

DPR-44 and DPR-56 for the Peach Bottom Atomic Power Station Units Nos. 2 and 3, dated June 27, 1991.

9. UFSAR, Section 14.5.6.2.

PBAPS UNIT 2 B 3.4-51 Revision No. 0

Reactor Steam Dome Pressure B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of design basis accidents and transients.

APPLICABLE The reactor steam dome pressure of < 1053 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 along with Reference I assumes an initial reactor steam dome pressure for the analysis of design basis accidents and transients used to determine the limits for fuel cladding integrity (see Bases for LCO 3.2.2, 'MINIMUM CRITICAL POWER RATIO (MCPR)') and 1%

cladding plastic strain (see Bases for LCO 3.2.1, 'AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").

Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of 5 1053 psig ensures the plant is operated within the assumptions of the reactor overpressure protection analysis.

Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam and the events which may challenge the overpressure limits are possible.

(continued)

PBAPS UNIT 2 B 3.4-52 Revision No. 0

Reactor Steam Dome Pressure B 3.4.10 BASES APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because (continued) the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.

ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident occurring while pressure is greater than the limit is minimized.

B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.10.1 REQUIREMENTS Verification that reactor steam dome pressure is < 1053 psig ensures that the initial conditions of the reactor overpressure protection analysis and design basis accidents are met. Operating experience has shown the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency to be sufficient for identifying trends and verifying operation within safety analyses assumptions.

REFERENCES 1. Letter G94-PEPR-002A, Peach Bottom Rerate Project Overpressure Analysis at LCO Dome Pressure, from G.V.

Kumar (GE) to T.E. Shannon (PECo), January 18, 1994.

2. UFSAR, Chapter 14.

PBAPS UNIT 2 B 3.4-53 Revision No. 0

ECCS-Operating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCS-Operating BASES BACKGROUND The ECCS are designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network consists of the High Pressure Coolant Injection (HPCI) System, the Core Spray (CS) System, the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, and the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the condensate storage tank (CST), it is capable of providing a source of water for the HPCI and CS systems.

On receipt of an initiation signal, ECCS pumps automatically start; simultaneously, the system aligns and the pumps inject water, taken either from the CST or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps.

Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCI pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the vessel to cool the core. If the break is small, the HPCI System will maintain coolant inventory as well as vessel level while the RCS is still pressurized. If HPCI fails, it is backed up by ADS in combination with LPCI and CS. In this event, the ADS timed sequence would be allowed to time out and open the selected safety/relief valves (S/RVs) depressurizing the RCS, thus allowing the LPCI and CS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure initially drops rapidly and the LPCI and CS cool the core.

Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through an RHR System heat exchanger cooled by the High Pressure Service Water System. Depending on the location and size of the break, portions of the ECCS may be (continued)

PBAPS UNIT 2 B 3.5-1 Revision No. 0

ECCS-Operating B 3.5.1 BASES BACKGROUND ineffective; however,the overall design is effective in (continued) cooling the core regardless of the size or location of the piping break.

All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS equipment.

The CS System (Ref. 1) is composed of two independent subsystems. Each subsystem consists of two 50% capacity motor driven pumps, a spray sparger above the core, and piping and valves to transfer water from the suppression pool to the sparger. The CS System is designed to provide cooling to the reactor core when reactor pressure is low.

Upon receipt of an initiation signal, the CS pumps in both subsystems are automatically started (ifoffsite power is available, A and C pumps in approximately 13 seconds, and B and D pumps in approximately 23 seconds, and if offsite power is not available, all pumps 6 seconds after AC power is available). When the RPV pressure drops sufficiently, CS System flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the CS System without spraying water in the RPV.

LPCI is an independent operating mode of the RHR System.

There are two LPCI subsystems (Ref. 2), each consisting of two motor driven pumps and piping and valves to transfer water from the suppression pool to the RPV via the corresponding recirculation loop. The two LPCI pumps and associated motor operated valves in each LPCI subsystem are powered from separate 4 kV emergency buses. Both pumps in a LPCI subsystem inject water into the reactor vessel through a common inboard injection valve and depend on the closure of the recirculation pump discharge valve following a LPCI injection signal. Therefore, each LPCI subsystems' common inboard injection valve and recirculation pump discharge valve is powered from one of the two 4 kV emergency buses associated with that subsystem (normal source) and has the capability for automatic transfer to the second 4 kV emergency bus associated with that LPCI subsystem. The ability to provide power to the inboard injection valve and the recirculation pump discharge valve from either 4 kV emergency bus associated with the LPCI subsystem ensures that the single failure of a diesel generator (DG) will not result in the failure of both LPCI pumps in one subsystem.

(continued)

PBAPS UNIT 2 B 3.5-2 Revision No. 0

ECCS -Operating B 3.5.1 BASES BACKGROUND The two LPCI subsystems can be interconnected via the LPCI (continued) cross tie valve; however, the cross tie valve is maintained closed with its power removed to prevent loss of both LPCI subsystems during a LOCA. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, all four LPCI pumps are automatically started (if offsite power is available, A and B pumps in approximately 2 seconds and C and D pumps in approximately 8 seconds, and, if offsite power is not available, all pumps immediately after AC power is available). Since one DG supplies power to an RHR pump in both units, the RHR pump breakers are interlocked between units to prevent operation of an RHR pump from both units on one DG and potentially overloading the affected DG. RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the recirculation loops.

When the RPV pressure drops sufficiently, the LPCI flow to the RPV, via the corresponding recirculation loop, begins.

The water then enters the reactor through the jet pumps.

Full flow test lines are provided for the four LPCI pumps to route water to the suppression pool, to allow testing of the LPCI pumps without injecting water into the RPV. These test lines also provide suppression pool cooling capability, as described in LCO 3.6.2.3, "RHR Suppression Pool Cooling."

The HPCI System (Ref. 3) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping for the system is provided from the CST and the suppression pool.

Pump suction for HPCI is normally aligned to the CST source to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, or if the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCI System. The steam supply to the HPCI turbine is piped from a main steam line upstream of the associated inboard main steam isolation valve.

The HPCI System is designed to provide core cooling for a wide range of reactor pressures (150 psig to 1150 psig,).

Upon receipt of an initiation signal, the HPCI turbine stop valve and turbine control valve open and the turbine accelerates to a specified speed. As the HPCI flow (continued)

PBAPS UNIT 2 B 3.5-3 Revision No. 0

ng ECCS-Operati ECCS -Operating B 3.5.1 BASES BACKGROUND increases, the turbine governor valve is automatically (continued) adjusted to maintain design flow. Exhaust steam from the HPCI turbine is discharged to the suppression pool. A full flow test line is provided to route water back to the CST to allow testing of the HPCI System during normal operation without injecting water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled with water. The LPCI and CS System discharge lines are kept full of water using a "keep fill" system. The HPCI System is normally aligned to the CST. The height of water in the CST is sufficient to maintain the piping full of water up to the first isolation valve. The relative height of the feedwater line connection for HPCI is such that the water in the feedwater lines keeps the remaining portion of the HPCI discharge line full of water. Therefore, HPCI does not require a "keep fill" system.

The Nuclear System Pressure Relief System consists of 2 safety valves (SYs) and 11 safety/relief valves (S/RVs).

The ADS (Ref. 4) consists of 5 of the 11 S/RVs. It is designed to provide depressurization of the RCS during a small break LOCA if HPCI fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (CS and LPCI), so that these subsystems can provide coolant inventory makeup. Each of the S/RVs used for automatic depressurization is equipped with one nitrogen accumulator and associated inlet check valves. The accumulator provides the pneumatic power to actuate the valves.

APPLICABLE The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in Reference 5.

The required analyses and assumptions are defined in Reference 6. The results of these analyses are described in Reference 7.

(continued)

PBAPS UNIT 2 B 3.5-4 Revision No. 0

ng ECCS-Operati ECCS -Operating B 3.5.1 BASES APPLICABLE This LCO helps to ensure that the following acceptance SAFETY ANALYSES criteria for the ECCS, established by 10 CFR 50.46 (Ref. 8),

(continued) will be met following a LOCA, assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is s 2200F;

b. Maximum cladding oxidation is s 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is s 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 7.

The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement.

LCO Each ECCS injection/spray subsystem and five ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the two CS subsystems, the two LPCI subsystems, and one HPCI System. The low pressure ECCS injection/spray subsystems are defined as the two CS subsystems and the two LPCI subsystems.

With less than the required number of ECCS subsystems OPERABLE, the potential exists that during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in Reference 8 could be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by Reference 8.

LPCI subsystems may be considered OPERABLE during alignment and operation for decay heat removal when below the actual RHR shutdown cooling isolation pressure in MODE 3, if capable of being manually realigned (remote or local) to the (continued)

PBAPS UNIT 2 B 3.5-5 Revision No. 0

ECCS-Operating B 3.5.1 BASES LCO LPCI mode and not otherwise inoperable. At these low (continued) pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.

APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3, when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, when reactor steam dome pressure isS 150 psig, HPCI is not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. In MODES 2 and 3, when reactor steam dome pressure iss 100 psig, ADS is not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "ECCS- Shutdown."

ACTIONS A.1 If any one low pressure ECCS injection/spray subsystem is inoperable, or if one LPCI pump in each subsystem is inoperable, all inoperable subsystems must be restored to OPERABLE status within 7 days (e.g., if one LPCI pump in each subsystem is inoperable, both must be restored within 7 days). In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA.

However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 9) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service.

The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

(continued)

PBAPS UNIT 2 B 3.5-6 Revision No. 0

ECCS-Operating ECCS -Operating B 3.5.1 BASES ACTIONS B.1 and B.2 (continued)

If the inoperable low pressure ECCS subsystem cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 If the HPCI System is inoperable and the RCIC System is immediately verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Immediate verification of RCIC OPERABILITY is therefore required when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be verified immediately, however, Condition E must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

D.1 and D.2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, adequate core cooling is (continued)

PBAPS UNIT 2 B 3.5-7 Revision No. 0

ECCS-Operating B 3.5.1 BASES ACTIONS D.1 and D.2 (continued) ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function.

Since both a high pressure system (HPCI) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

E.1 and E.2 If any Required Action and associated Completion Time of Condition C or D is not met, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to

< 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 The LCO requires five ADS valves to be OPERABLE in order to provide .the ADS function. Reference 7 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only four ADS valves will provide the required depressurization.

However, overall reliability of the ADS is reduced, because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

(continued)

PBAPS UNIT 2 B 3.5-8 Revision No. 0

ECCS-Operating ECCS -Operating B 3.5.1 BASES ACTIONS G.1 and G.2 (continued)

If any one low pressure ECCS injection/spray subsystem is inoperable in addition to one inoperable ADS valve, adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS injection/spray subsystem.

However, overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA could result in the minimum required ECCS equipment not being available. Since both a high pressure system (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the low pressure ECCS subsystem or the ADS valve to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 9 and has been found to be acceptable through operating experience.

H.1 and H.2 If any Required Action and associated Completion Time of Condition F or G is not met, or if two or more ADS valves are inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to s 100 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

1.1 When multiple ECCS subsystems are inoperable (for reasons other than the second Condition of Condition A), as stated in Condition I, the plant is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the HPCI System, CS System, and LPCI subsystems full of water ensures that the ECCS will perform properly, (continued)

PBAPS UNIT 2 B 3.5-9 Revision No. 0

ng ECCS-Operati ECCS -Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1 (continued)

REQUIREMENTS injecting its full capacity into the RCS upon demand. This will also prevent a water hammer following an ECCS initiation signal. One acceptable method of ensuring that the lines are full is to vent at the high points. An acceptable method of ensuring the LPCI and CS System discharge lines are full is to verify the absence of the associated 'keep fill" system accumulator alarms. For the HPCI System, an acceptable method of ensuring the discharge line is full is to verify the HPCI System is aligned to take suction from the CST and that CST level is above the Condensate Storage Tank Level-Low Allowable Value. The 31 day Frequency is based on the gradual nature of void buildup in the ECCS piping, the procedural controls governing system operation, and operating experience.

SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the HPCI System, this SR also includes the steam flow path for the turbine and the flow controller position.

The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve position would only affect a single subsystem. This Frequency has been shown to be acceptable through operating experience.

(continued)

PBAPS UNIT 2 B 3.5-10 Revision No. 0

ng ECCS-Operati ECCS -Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 (continued)

REQUIREMENTS This SR is modified by a Note that allows LPCI subsystems to be considered OPERABLE during alignment and operation for decay heat removal with reactor steam dome pressure less than the RHR shutdown cooling isolation pressure in MODE 3, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Manual realignment to the LPCI mode may also include opening the drag valve to establish the required LPCI subsystem flow rates. This allows operation in the RHR shutdown cooling mode during MODE 3, if necessary.

SR 3.5.1.3 Verification every 31 days that ADS nitrogen supply header pressure is > 85 psig ensures adequate air pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The design pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least two valve actuations can occur with the drywell at 70% of design pressure (Ref. 10). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of 2 85 psig is provided by the ADS instrument air supply. The 31 day Frequency takes into consideration administrative controls over operation of the air system and alarms for low air pressure.

SR 3.5.1.4 Verification every 31 days that the LPCI cross tie, valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem. Acceptable methods of removing power to the operator include de-energizing breaker control power or racking out or removing the breaker. If the LPCI cross tie valve is open or power has not been removed from the valve operator, both LPCI subsystems must be considered inoperable. The 31 day Frequency has been (continued)

PBAPS UNIT 2 B 3.5-11 Revision No. 0

rig ECCS-Operati ECCS -Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4 (continued)

REQUIREMENTS found acceptable, considering that these valves are under strict administrative controls that will ensure the valves continue to remain closed with either control or motive power removed.

SR 3.5.1.5 Cycling the recirculation pump discharge valves through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will close when required.

Upon initiation of an automatic LPCI subsystem injection signal, these valves are required to be closed to ensure full LPCI subsystem flow injection in the reactor via the recirculation jet pumps. De-energizing the valve in the closed position will also ensure the proper flow path for the LPCI subsystem. Acceptable methods of de-energizing the valve include de-energizing breaker control power, racking out the breaker or removing the breaker.

The specified Frequency is once during reactor startup before THERMAL POWER is > 25% RTP. However, this SR is modified by a Note that states the Surveillance is only required to be performed if the last performance was more than 31 days ago. Verification during reactor startup prior to reaching > 25% RTP is an exception to the normal Inservice Testing Program generic valve cycling Frequency of 92 days, but is considered acceptable due to the demonstrated reliability of these valves. If the valve is inoperable and in the open position, the associated LPCI subsystem must be declared inoperable.

SR 3.5.1.6 Verification every 61 days of the automatic transfer between the normal and the alternate power source (4 kV emergency bus) for each LPCI subsystem inboard injection valve and each recirculation pump discharge valve demonstrates that AC electrical power will be available to operate these valves following loss of power to one of the 4 kV emergency buses.

The ability to provide power to the inboard injection valve and the recirculation pump discharge valve from either 4 kV emergency bus associated with the LPCI subsystem ensures that the single failure of an DG will not result in the (continued)

PBAPS UNIT 2 B 3.5-12 Revision No. 0

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.6 (continued)

REQUIREMENTS failure of both LPCI pumps in one subsystem. Therefore, failure of the automatic transfer capability will result in the inoperability of the affected LPCI subsystem. The 61 day Frequency has been found acceptable based on engineering judgment and operating experience.

SR 3.5.1.7. SR 3.5.1.8. and SR 3.5.1.9 The performance requirements of the low pressure ECCS pumps are determined through application of the 10 CFR 50, Appendix K criteria (Ref. 6). This periodic Surveillance is performed to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The low pressure ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of Reference 8. The pump flow rates are verified against a system head equivalent to the RPV pressure expected during a LOCA. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during a LOCA. These values may be established by testing or analysis or during preoperational testing.

To avoid damaging CS System valves during testing, throttling is not normally performed to obtain a system head corresponding to a reactor pressure of 2 105 psig. As such, SR 3.5.1.7 is modified by a Note to allow use of pump curves to determine equivalent values for flow rate and test pressure for the CS pumps in order to meet the Surveillance Requirement. The Note allows baseline testing at a system head corresponding to a reactor pressure of 2 105 psig to be used to determine an equivalent flow value at the normal test pressure. This baseline testing is performed after any modification or repaircthat could affect system flow characteristics.

The flow tests for the HPCI System.are performed at two different pressure ranges such that system capability to provide rated flow is tested at both the higher and lower operating ranges of the system. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor (continued)

PBAPS UNIT 2 B 3.5-13 Revision No. 0

ECCS -Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7. SR 3.5.1.8. and SR 3.5.1.9 (continued)

REQUIREMENTS pressure when the HPCI System diverts steam flow. Reactor steam pressure must be < 1053 and t 940 psig to perform SR 3.5.1.8 and greater than or equal to the Electro-Hydraulic Control (EHC) System minimum pressure set with the EHC System controlling pressure (EHC System begins controlling pressure at a nominal 150 psig) and s 175 psig to perform SR 3.5.1.9. Adequate steam flow is represented by at least 2 turbine bypass valves open. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform these tests. Reactor startup is allowed prior to performing the low pressure Surveillance test because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance test is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that HPCI is inoperable.

Therefore, SR 3.5.1.8 and SR 3.5.1.9 are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

The 92 day Frequency for SR 3.5.1.7 and SR 3.5.1.8 is consistent with the Inservice Testing Program requirements.

The 24 month Frequency for SR 3.5.1.9 is based on the need to perform the Surveillance under the conditions that apply just prior to or during a startup from a plant outage.

Operating experience has shown that these components will pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.10 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCI, CS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This SR also ensures that either the HPCI System (continued)

PBAPS UNIT 2 B 3.5-14 Revision No. 2

ECCS Operating ECCS - Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.10 (continued)

REQUIREMENTS will automatically restart on an RPV low water level (Level

2) signal received subsequent to an RPV high water level (Level 8) trip or, if the initial RPV low water level (Level

2) signal was not manually reset, then the HPCI System will restart when the RPV high water level (Level 8) trip automatically clears, and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlaps this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components will pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

SR 3.5.1.11 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.12 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components will (continued)

PBAPS UNIT 2 B 3.5-15 Revision No. 2

ECCS - Operating ECCS - Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.11 (continued)

REQUIREMENTS pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.5.1.12 The pneumatic actuator of each ADS valve is stroked to verify that the second stage pilot disc rod is mechanically displaced when the actuator strokes. Second stage pilot rod movement is determined by the measurement of actuator rod travel. The total amount of movement of the second stage pilot rod from the valve closed position to the open position shall meet criteria established by the S/RV supplier. SRs 3.3.5.1.5 and 3.5.1.11 overlap this Surveillance to provide testing of the SRV depressurization mode function.

Operating experience has shown that these components will pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

PBAPS UNIT 2 B 3.5-16 Revision No. 23

ECCS -Operating B 3.5.1 BASES (continued)

REFERENCES 1. UFSAR, Section 6.4.3.

2. UFSAR, Section 6.4.4.

3. UFSAR, Section 6.4.1.

4. UFSAR, Sections 4.4.5 and 6.4.2.

5. UFSAR, Section 14.6.

6. 10 CFR 50, Appendix K.

7. NEDC-32163P, "Peach Bottom Atomic Power Station Units 2 and 3 SAFER/GESTR-LOCA Loss of Coolant Accident Analysis," January 1993.

8. 10 CFR 50.46.

9. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

10. UFSAR, Section 10.17.6.

PBAPS UNIT 2 B 3.5-17 Revision No. 23

ECCS-Shutdown B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.2 ECCS-Shutdown BASES BACKGROUND A description of the Core Spray (CS) System and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System is provided in the Bases for LCO 3.5.1, "ECCS-Operating.'

APPLICABLE The ECCS performance is evaluated for the entire spectrum SAFETY ANALYSES of break sizes for a postulated loss of coolant accident (LOCA). The long term cooling analysis following a design basis LOCA (Ref. 1) demonstrates that only one low pressure ECCS injection/spray subsystem is required, post LOCA, to maintain adequate reactor vessel water level in the event of an inadvertent vessel draindown. It is reasonable to assume, based on engineering judgement, that while in MODES 4 and 5 one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level. To provide redundancy, a minimum of two low pressure ECCS injection/

spray subsystems are required to be OPERABLE in MODES 4 and 5.

The low pressure ECCS subsystems satisfy Criterion 3 of the NRC Policy Statement.

LCO Two low pressure ECCS injection/spray subsystems are required to be OPERABLE. A low pressure ECCS injection/

spray subsystem consists of a CS subsystem or a LPCI subsystem. Each CS subsystem consists of two motor driven pumps, piping, and valves to transfer water from the suppression pool or condensate storage tank (CST) to the reactor pressure vessel (RPV). Each LPCI subsystem consists of one motor driven pump, piping, and valves to transfer water from the suppression pool to the RPV. Only a single LPCI pump is required per subsystem because of the larger injection capacity in relation to a CS subsystem. In MODES 4 and 5, the LPCI cross tie valve is not required to be closed. The necessary portions of the Emergency Service Water System are also required to provide appropriate cooling to each required ECCS subsystem.

(continued)

PBAPS UNIT 2 B 3.5-18 Revision No. 0

ECCS -Shutdown B 3.5.2 BASES LCO One LPCI subsystem may be aligned for decay heat removal and (continued) considered OPERABLE for the ECCS function, if it can be manually realigned (remote or local) to the LPCI mode and is not otherwise inoperable. Because of low pressure and low temperature conditions in MODES 4 and 5, sufficient time will be available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated fuel uncovery.

APPLICABILITY OPERABILITY of the low pressure ECCS injection/spray subsystems is required in MODES 4 and 5 to ensure adequate coolant inventory and sufficient heat removal capability for the irradiated fuel in the core in case of an inadvertent draindown of the vessel. Requirements for ECCS OPERABILITY during MODES 1, 2, and 3 are discussed in the Applicability section of the Bases for LCO 3.5.1. ECCS subsystems are not required to be OPERABLE during MODE 5 with the spent fuel storage pool gates removed, the water level maintained at

> 458 inches above reactor pressure vessel instrument zero (20 ft 11 inches above the RPV flange), and no operations with a potential for draining the reactor vessel (OPDRVs) in progress. This provides sufficient coolant inventory to allow operator action to terminate the inventory loss prior to fuel uncovery in case of an inadvertent draindown.

The Automatic Depressurization System is not required to be OPERABLE during MODES 4 and 5 because the RPV pressure is 5 100 psig, and the CS System and the LPCI subsystems can provide core cooling without any depressurization of the primary system.

The High Pressure Coolant Injection System is not required to be OPERABLE during MODES 4 and 5 since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A.1 and B.1 If any one required low pressure ECCS injection/spray subsystem is inoperable, an inoperable subsystem must be restored to OPERABLE status in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In this Condition, the remaining OPERABLE subsystem can provide sufficient vessel flooding capability to recover from an inadvertent vessel draindown. However, overall system reliability is reduced because a single failure in the remaining OPERABLE (continued)

PBAPS UNIT 2 B 3.5-19 Revision No. 0

ECCS -Shutdown ECCS -Shutdown B 3.5.2 BASES ACTIONS A.1 and B.1 (continued) subsystem concurrent with a vessel draindown could result in the ECCS not being able to perform its intended function.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time for restoring the required low pressure ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment that considered the remaining available subsystem and the low probability of a vessel draindown event.

With the inoperable subsystem not restored to OPERABLE status in the required Completion Time, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

C.I. C.2. D.1. D.2. and D.3 With both of the required ECCS injection/spray subsystems inoperable, all coolant inventory makeup capability may be unavailable. Therefore, actions must immediately be initiated to suspend OPDRVs to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended. One ECCS injection/spray subsystem must also be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

If at least one low pressure ECCS injection/spray subsystem is not restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time, additional actions are required to minimize any potential fission product release to the environment.

This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem for Unit 2 is OPERABLE; and secondary containment isolation capability (i.e., one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each associated secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases.

OPERABILITY may be verified by an administrative check, or by examining logs or other information, to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components.

(continued)

PBAPS UNIT 2 B 3.5-20 Revision No. 0

ECCS-Shutdown ECCS -Shutdown B 3.5.2 BASES ACTIONS C.1. C.2. D.1. D.2. and D.3 (continued)

If,however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time to restore at least one low pressure ECCS injection/spray subsystem to OPERABLE status ensures that prompt action will be taken to provide the required cooling capacity or to initiate actions to place the plant in a condition that minimizes any potential fission product release to the environment.

SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2 REQUIREMENTS The minimum water level of 11.0 feet required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the CS System and LPCI subsystem pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, all ECCS injection/spray subsystems are inoperable unless they are aligned to an OPERABLE CST.

When suppression pool level is < 11.0 feet, the CS System is considered OPERABLE only if it can take suction from the CST, and the CST water level is sufficient to provide the required NPSH for the CS pump. Therefore, a verification that either the suppression pool water level is 2 11.0 feet or that CS is aligned to take suction from the CST and the CST contains 2 17.3 feet of water, equivalent to

> 90,976 gallons of water, ensures that the CS System can supply at least 50,000 gallons of makeup water to the RPV.

The unavailable volume of the CST for CS is at the 40,976 gallon level. However, as noted, only one required CS subsystem may take credit for the CST option during OPDRVs.

During OPDRVs, the volume in the CST may not provide adequate makeup if the RPV were completely drained.

Therefore, only one CS subsystem is allowed to use the CST.

This ensures the other required ECCS subsystem has adequate makeup volume.

(continued)

PBAP5 UNIT 2 B 3.5-21 Revision No. 0

ECCS -Shutdown ECCS -Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 and SR 3.3.2.2 (cohtinued)

REQUIREMENTS The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency of these SRs was developed considering operating experience related to suppression pool water level and CST water level variations and instrument drift during the applicable MODES. Furthermore, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room to alert the operator to an abnormal suppression pool or CST water level condition.

SR 3.5.2.3. SR 3.5.2.5. and SR 3.5.2.6 The Bases provided for SR 3.5.1.1, SR 3.5.1.7, and SR 3.5.1.10 are applicable to SR 3.5.2.3, SR 3.5.2.5, and SR 3.5.2.6, respectively.

SR 3.5.2.4 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is appropriate because the valves are operated under procedural control and the probability of their being mispositioned during this time period is low.

In MODES 4 and 5, the RHR System may operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore, RHR valves that are required for LPCI subsystem operation may be aligned for decay heat removal.

Therefore, this SR is modified by a Note that allows one LPCI subsystem of the RHR System to be considered OPERABLE

{continued)

PBAPS UNIT 2 B 3.5-22 Revision No. 0

ECCS-Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 (continued)

REQUIREMENTS for the ECCS function if all the required valves in the LPCI flow path can be manually realigned (remote or local) to allow injection into the RPV, and the system is not otherwise inoperable. Manual realignment to allow injection into the RPV in the LPCI mode may also include opening the drag valve to establish the required LPCI subsystem flow rate. This will ensure adequate core cooling if an inadvertent RPV draindown should occur.

REFERENCES 1. NEDO-20566A, 'General Electric Company Analytical Model for Loss-of-Coolant Accident Analysis in Accordance with 10 CFR 50 Appendix K," September 1986.

PBAPS UNIT 2 B 3.5-23 Revision No. 0

RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.

The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of the RPV water level. Under these conditions, the High Pressure Coolant Injection (HPCI) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV.

However, if the CST water supply is low, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System.

The steam supply to the turbine is piped from a main steam line upstream of the associated inboard main steam line isolation valve.

The RCIC System is designed to provide core cooling for a wide range of reactor pressures 150 psig to 1150 psig. Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine governor valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water back to the CST to allow testing of the RCIC System during normal operation without injecting water into the RPV.

(continued)

PBAPS UNIT 2 B 3.5-24 Revision No. 0

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, (continued) which discharges to the suppression pool. The valve in this line automatically opens when the discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge piping is kept full of water. The RCIC System is normally aligned to the CST. The height of water in the CST is sufficient to maintain the piping full of water up to the first isolation valve. The relative height of the feedwater line connection for RCIC is such that the water in the feedwater lines keeps the remaining portion of the RCIC discharge line full of water. Therefore, RCIC does not require a 'keep fill' system.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC System is not an Engineered Safeguard System and no credit is taken in the safety analyses for RCIC System operation.

Based on its contribution to the reduction of overall plant risk, however, the system satisfies Criterion 4 of the NRC Policy Statement.

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the low pressure ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity for maintaining RPV inventory during an isolation event.

APPLICABILITY The RCIC System is required to be OPERABLE during MODE 1, and MODES 2 and 3 with reactor steam dome pressure

> 150 psig, since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure s 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the low pressure ECCS injection/spray subsystems can provide sufficient flow to the RPV.

(continued)

PBAPS UNIT 2 B 3.5-25 Revision No. 0

RCIC System B 3.5.3 BASES (continued)

ACTIONS A.1 and A.2 If the RCIC System is inoperable during MODE 1, or MODE 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCI System is immediately verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days.

In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high reactor pressure since the HPCI System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of HPCI is therefore immediately verified when the RCIC System is inoperable.

This may be performed as an administrative check, by examining logs or other information, to determine if HPCI is out of service for maintenance or other reasons. It does not mean it is necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the HPCI System. If the OPERABILITY of the HPCI System cannot be verified immediately, however, Condition B must be immediately entered. For certain transients and abnormal events with no LOCA, RCIC (as opposed to HPCI) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of the RPV water level.

Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.

The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of similar functions of HPCI and RCIC, the AOTs (i.e., Completion Times) determined for HPCI are also applied to RCIC.

B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCI System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to c 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times (continued)

PBAPS UNIT 2 B 3.5-26 Revision No. 0

RCIC System B 3.5.3 BASES ACTIONS B.1 and B.2 (continued) are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge line of the RCIC System full of water ensures that the system will perform properly, injecting its full capacity into the Reactor Coolant System upon demand. This will also prevent a water hammer following an initiation signal. One acceptable method of ensuring the line is full is to vent at the high points. Another acceptable method of ensuring the RCIC discharge line is full is to verify the RCIC System is aligned to take suction from the CST and that CST level is above the Condensate Storage Tank Level-Low Allowable Value. The 31 day Frequency is based on the gradual nature of void buildup in the RCIC piping, the procedural controls governing system operation, and operating experience.

SR 3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.

(continued)

PBAPS UNIT 2 B 3.5-27 Revision No. 0

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.2 (continued)

REQUIREMENTS The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve position would affect only the RCIC System. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.3.3 and SR 3.5.3.4 The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system.

Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Reactor steam pressure must be

1053 and 2 940 psig to perform SR 3.5.3.3 and greater than or equal to the Electro-Hydraulic Control (EHC) System minimum pressure set with the EHC System controlling pressure (the EHC System begins controlling pressure at a nominal 150 psig) and

< 175 psig to perform SR 3.5.3.4. Alternately, auxiliary steam can be used to perform SR 3.5.3.4. Adequate steam flow is represented by at least 2 turbine bypass valves open. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs.

Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance is short. Alternately, the low pressure Surveillance test may be performed prior to startup using an auxiliary steam supply. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure Surveillance has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

(continued)

PBAPS UNIT 2 B 3.5-28 Revision No. 42

RCIC System RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 (continued)

REQUIREMENTS A 92 day Frequency for SR 3.5.3.3 is consistent with the Inservice Testing Program requirements. The 24 month Frequency for SR 3.5.3.4 is based on the need to perform the Surveillance under conditions that apply just prior to or during startup from a plant outage. Operating experience has shown that these components will pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.3.5 The RCIC System is required to actuate automatically in order to verify its design function satisfactorily. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of the RCIC System will cause-the system to operate as designed, including actuation of the system throughout its emergency operating sequence; that is, automatic pump startup and actuation of all automatic valves to their required positions. This test also ensures the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool on low CST level. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2 overlaps this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components will pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

(continued)

PBAPS UNIT 2 B 3.5-29 Revision No. 0

RCIC System B 3.5.3 BASES (continued)

REFERENCES 1. UFSAR, Section 1.5.

2. UFSAR, Section 4.7.

3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

PBAPS UNIT 2 B 3.5-30 Revision No. 0

Primary Containment B 3.6.1.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.1 Primary Containment BASES BACKGROUND The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a Design Basis Accident (DBA) and to confine the postulated release of radioactive material. The primary containment consists of a steel vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment.

Portions of the steel vessel are surrounded by reinforced concrete for shielding purposes.

The isolation devices for the penetrations in the primary containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic Containment Isolation System, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";

b. The primary containment air lock is OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Lock"; and

c. All equipment hatches are closed.

This Specification ensures that the performance of the primary containment, in the event of a DBA, meets the assumptions used in the safety analyses of Reference 1.

SR 3.6.1.1.1 leakage rate requirements are in conformance with 10 CFR 50, Appendix J, Option B (Ref. 3), as modified by approved exemptions.

(continued )

PBAPS UNIT 2 B 3.6-1 Revision No. 2 7

Primary Containment B 3.6.1.1 BASES (continued)

APPLICABLE The safety design basis for the primary containment is that SAFETY ANALYSES it must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage.

Analytical methods and assumptions involving the primary containment are presented in Reference 1. The safety analyses assume a nonmechanistic fission product release following a DBA, which forms the basis for determination of offsite doses. The fission product release is, in turn, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded.

The maximum allowable leakage rate for the primary containment (L.) is 0.5% by weight of the containment air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the design basis LOCA maximum peak containment pressure (P.) of 49.1 psig. The value of P.

(49.1 psig) is conservative with respect to the current calculated peak drywell pressure of 47.2 psig 0 (Ref. 2).

This value is 47.8 psig for operation with 90 F Final Feedwater Temperature Reduction (Ref. 7).

Primary containment satisfies Criterion 3 of the NRC Policy Statement.

LCO Primary containment OPERABILITY is maintained by limiting leakage to s 1.0 L., except prior to the first startup after performing a required Primary Containment Leakage Rate Testing Program leakage test. At this time, applicable leakage limits must be met. In addition, the leakage from the drywell to the suppression chamber must be limited to ensure the pressure suppression function is accomplished and the suppression chamber pressure does not exceed design limits. Compliance with this LCO will ensure a primary containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analyses.

(continued)

PBAPS UNIT 2 B 3.6-2 Revision No. 19

Primary Containment B 3.6.1.1 BASES LCO Individual leakage rates specified for the primary (continued) containment air lock are addressed in LCO 3.6.1.2.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, primary containment is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS A.1 In the event primary containment is inoperable, primary containment must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining primary containment OPERABILITY during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring primary containment OPERABILITY) occurring during periods where primary containment is inoperable is minimal.

B.1 and B.2 If primary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without' challenging plant systems.

SURVEILLANCE SR 3.6.1.1.1 REQUIREMENTS Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. Failure to meet air lock leakage testing (SR 3.6.1.2.1), or main steam isolation (continued)

PBAPS UNIT 2 B 3.6-3 Revision No. 6

Primary Containment B 3.6.1.1 BASES SURVEILLANCE SR 3.6.1.1.1 (continued)

REQUIREMENTS valve leakage (SR 3.6.1.3.14), does not necessarily result in a failure of this SR. The impact of the failure to meet these SRs must be evaluated against the Type A, B, and C acceptance criteria of the Primary Containment Leakage Rate Testing Program. At

1.0 L.the offsite dose consequences are bounded by the assumptions of the safety analysis. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

SR 3.6.1.1.2 Maintaining the pressure suppression function of primary containment requires limiting the leakage from the drywell to the suppression chamber. Thus, if an event were to occur that pressurized the drywell, the steam would be directed through the downcomers into the suppression pool. This SR is a leak test that confirms that the bypass area between the drywell and the suppression chamber is less than or equivalent to a one-inch diameter hole (Ref. 4). This ensures that the leakage paths that would bypass the suppression pool are within allowable limits.

The leakage test is performed every 24 months. The 24 month Frequency was developed considering that component failures that might have affected this test are identified by other primary containment SRs. Two consecutive test failures, however, would indicate unexpected primary containment degradation; in this event, as the Note indicates, a test shall be performed at a Frequency of once every 12 months until two consecutive tests pass, at which time the 24 month test Frequency may be resumed.

(continued)

PBAPS UNIT 2 B 3.6-4 Revision No. 22

Primary Containment B 3.6.1.1 BASES (continued)

REFERENCES 1. UFSAR, Section 14.9.

2. Letter G94-PEPR-183, Peach Bottom Improved Technical Specification Project Increased Drywell and Suppression Chamber Pressure Analytical Limits, from G.V. Kumar (GE) to A.A. Winter (PECO), August 23, 1994.

3. 10 CFR 50, Appendix J, Option B.

4. Safety Evaluation by the Office of Nuclear Reactor Regulation Supporting Amendment Nos. 127 and 130 to Facility Operating License Nos. DPR-44 and DPR-56, dated February 18, 1988.

5. NEI 94-01, Revision 0, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J."

6. ANSI/ANS-56.8-1994, "Containment System Leakage Testing Requirements."

7. Peach Bottom Atomic Power Station Evaluation for Extended Final Feedwater Reduction, NEDC-32707P, Supplement 1, Revision 0, May, 1998.

PBAPS UNIT 2 B 3.6-5 Revision No. 22

Primary Containment Air Lock B 3.6.1.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.2 Primary Containment Air Lock BASES BACKGROUND One double door primary containment air lock has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. The air lock is designed to withstand the same loads, temperatures, and peak design internal and external pressures as the primary containment (Ref. 1). As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBAs).

Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a DBA in primary containment.

Each of the doors contains a gasket seal to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in primary containment internal pressure results in increased sealing force on each door).

Each air lock is nominally a right circular cylinder, 12 ft in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when primary containment is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent primary containment entry is necessary. Under some conditions as allowed by this LCO, the primary containment may be accessed through the air lock, when the interlock mechanism has failed, by manually performing the interlock function.

The primary containment air lock forms part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining primary containment leakage rate to within limits in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analysis.

(continued)

PBAPS UNIT 2 B 3.6-6 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES (continued)

APPLICABLE The DBA that postulates the maximum release of radioactive SAFETY ANALYSES material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (L.) of 0.5%

by weight of the containment air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the maximum peak containment pressure (P.) of 49.1 psig. The value of P.

(49.1 psig) is conservative with respect to the current calculated peak drywell pressure of 47.2 psig (Ref. 3).

This value is 47.8 psig for operation with 900 F Final Feedwater Temperature Reduction (Ref. 4). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock.

Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the secondary containment.

The primary containment air lock satisfies Criterion 3 of the NRC Policy Statement.

LCO As part of primary containment, the air lock's safety function is related to control of containment leakage rates following a DBA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

The primary containment air lock is required to be OPERABLE.

For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be opened at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry and exit from primary containment.

(continued)

PBAPS UNIT 2 B 3.6-7 Revision No. 19

Air Lock Primary Containment Primary Containment Air Lock B 3.6.1.2 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the primary containment air lock is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component.

If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit.

The ACTIONS are modified by a second Note, which ensures appropriate remedial measures are taken when necessary.

Pursuant to LCO 3.0.6, actions are not required, even if primary containment leakage is exceeding L.. Therefore, the Note is added to require ACTIONS for LCO 3.6.1.1, "Primary Containment," to be taken in this event.

A.1. A.2. and A.3 With one primary containment air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1) in the air lock. This ensures that a leak tight primary containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is considered (continued)

PBAPS UNIT 2 B 3.6-8 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1. A.2. and A.3 (continued) reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed.

Required Action A.3 ensures that the air lock with an inoperable door has been isolated by the use of a locked closed OPERABLE air lock door. This ensures that an acceptable primary containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

The Required Actions have been modified by two Notes.

Note I ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls.

Primary containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on TS-required equipment or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-related activities) if the primary containment was entered, using the inoperable air lock, to perform an allowed activity listed above. The administrative controls required consist of the stationing of a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and assuring the OPERABLE door is relocked after.

(continued)

PBAPS UNIT 2 B 3.6-9 Revision No. 0

Lock Primary Containment Air Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS A.1. A.2. and A.3 (continued) completion of the containment entry and exit. This allowance is acceptable due to the low probability of an event that could pressurize the primary containment during the short time that the OPERABLE door is expected to be open.

B.1. B.2. and B.3 With an air lock interlock mechanism inoperable, the Required Actions and associated Completion Times are consistent with those specified in Condition A.

The Required Actions have been modified by two Notes.

Note I ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the primary containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).

Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and that allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

C.1. C.2. and C.3 If the air lock is inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if the overall air lock leakage is not within (continued)

PBAPS UNIT 2 B 3.6-10 Revision No. 0

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS C.I. C.2. and C.3 (continued) limits. In many instances (e.g., only one seal per door has failed), primary-containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with the overall air lock leakage not within limits, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the primary containment air lock must be verified closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock.

D.1 and 0.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with respect to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and primary containment OPERABILITY (continued)

PBAPS UNIT 2 8 3.6-11 Revision No. 6

Air Lock Primary Containment Primary C.;ntainment Air Lock B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.1 (continued)

REQUIREMENTS testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 requires the results of air lock leakage tests to be evaluated against the acceptance criteria of the Primary Containment Leakage Rate Testing Program, 5.5.12.

This ensures that the air lock leakage is properly accounted for in determining the combined Type B and C primary containment leakage.

SR 3.6.1.2.2 The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure, closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is only challenged when primary containment is entered, this test is only required to be performed upon entering primary containment, but is not required more frequently than 184 days when primary containment is ue-inerted. The 184 day Frequency is based on engineering judgment and is considered adequate in view of other administrative controls available to operations personnel.

(continued)

'PBAPS UNIT 2 8 3.6-12 Revision No. 6

Primary Containment Air Lock B 3.6.1.2 BASES (continued)

REFERENCES 1. UFSAR, Section 5.2.3.4.5.

2. 10 CFR 50, Appendix J, Option B.

3. Letter G94-PEPR-183, Peach Bottom Improved Technical Specification Project Increased Drywell and Suppression Chamber Pressure Analytical Limits, from G.V. Kumar (GE) to A.A. Winter (PECo), August 23, 1994.

4. Peach Bottom Atomic Power Station Evaluation for Extended Final Feedwater Reduction, NEDC-32707P, Supplement 1, Revision 0, May, 1998.

PBAPS UNIT 2 B 3.6-13 Revision No. 19

PCIVs B 3.6.1.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.3 Primary Containment Isolation Valves (PCIVs)

BASES BACKGROUND The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) to within limits. Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The OPERABILITY requirements for PCIVs help ensure that an adequate primary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Therefore, the OPERABILITY requirements provide assurance that primary containment function assumed in the safety analyses will be maintained. These isolation devices are either passive or active (automatic). Closed manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves and other automatic valves designed to close without operator action following an accident, are considered active devices.

Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system.

The reactor building-to-suppression chamber vacuum breakers and the scram discharge volume vent and drain valves each serve a dual function, one of which is primary containment isolation. However, since the other safety functions of the vacuum breakers and the scram discharge volume vent and drain valves would not be available if the normal PCIV actions were taken, the PCIV OPERABILITY requirements are not applicable to the reactor building-to-suppression chamber vacuum breaker valves and the scram discharge volume vent and drain valves. Similar Surveillance Requirements in the LCO for the reactor building-to-suppression chamber vacuum breakers and the LCO for the scram discharge volume (continued)

PBAPS UNIT 2 B 3.6-14 Revision No. 0

PCIVs B 3.6.1.3 BASES BACKGROUND vent and drain valves provide assurance that the isolation (continued) capability is available without conflicting with the vacuum relief or scram discharge volume vent and drain functions.

The primary containment purge lines are 18 inches in diameter; exhaust lines are 18 inches in diameter. In addition, a 6 inch line from the Containment Atmospheric Control (CAC) System is also provided to purge primary containment. The 6 and 18 inch primary containment purge valves and the 18 inch primary containment exhaust valves are normally maintained closed in MODES 1, 2, and 3 to ensure the primary containment boundary is maintained.

However, containment purging with the 18 inch purge and exhaust valves is permitted for inerting, de-inerting, and pressure control. Included in the scope of the de-inerting is the need to purge containment to ensure personnel safety during the performance of inspections beneficial to nuclear safety; e.g., inspection of primary coolant integrity during plant startups and shutdowns. Adjustments in primary containment pressure to perform tests such as the drywell-to-suppression chamber bypass leakage test are included within the scope of pressure control purging. Purging for humidity and temperature control using the 18 inch valves is excluded. The isolation valves on the 18 inch vent lines have 2 inch bypass lines around them for use during normal reactor operation when the 18 inch valves cannot be opened.

Two additional redundant Standby Gas Treatment (SGT) isolation valves are provided on the vent line upstream of the SGT System filter trains. These isolation valves, together with the PCIVs, will prevent high pressure from reaching the SGT System filter trains in the unlikely event of a loss of coolant accident (LOCA) during venting.

The Safety Grade Instrument Gas (SGIG) System supplies pressurized nitrogen gas (from the Containment Atmospheric Dilution (CAD) System liquid nitrogen storage tank) as a safety grade pneumatic source to the CAC System purge and exhaust isolation valve inflatable seals, the reactor building-to-suppression chamber vacuum breaker air operated isolation valves and inflatable seal, and the CAC and CAD Systems vent control air operated valves. The SGIG System thus performs two distinct post-LOCA functions: (1) supports containment isolation and (2) supports CAD System vent operation. SGIG System requirements are addressed for (continued)

PBAPS UNIT 2 B 3.6-15 Revision No. 0

PCIVs B 3.6.1.3 BASES BACKGROUND each of the supported system and components in LCO 3.6.1.3, (continued) "Primary Containment Isolation Valves (PCIVs)," LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers,"

and LCO 3.6.3.1, Containment Atmospheric Dilution (CAD)

System." For the SGIG System, liquid nitrogen from the CAD System liquid nitrogen storage tank passes through the CAD System liquid nitrogen vaporizer where it is converted to a gas. The gas then flows into a Unit 2 header and a Unit 3 header separated by two manual globe valves. From each header, the gas then branches to each valve operator or valve seal supplied by the SGIG System. Each branch is separated from the header by a manual globe valve and a check valve.

To support SGIG System functions, the CAD System liquid nitrogen storage tank minimum required level is a 16 inches water column and a minimum required SGIG System header pressure of 80 psig. Minimum requirements for the CAD System liquid nitrogen storage tank to support CAD System OPERABILITY are specified -in LCO 3.6.3.1, "Containment Atmospheric Dilution (CAD) System."

APPLICABLE The PCIVs LCO was derived from the assumptions related to SAFETY ANALYSES minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during major accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment. Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO.

The DBAs that result in a release of radioactive material and are mitigated by PCIVs are a LOCA and a main steam line break (MSLB). In the analysis for each of these accidents, it is assumed that PCIVs are either closed or close within the required isolation times following event initiation.

This ensures that potential paths to the environment through PCIVs (including primary containment purge valves) are minimized. Of the events analyzed in Reference 1, the LOCA is a limiting event due to radiological consequences. The closure time of the main steam isolation valves (MSIVs) is the most significant variable from a radiological standpoint. The MSIVs are required to close within 3 to 5 seconds after signal generation. Likewise, it is assumed that the primary containment is isolated such that release of fission products to the environment is controlled.

(continued)

PBAPS UNIT 2 B 3.6-16 Revision No. 0

PCIVs B 3.6.1.3 BASES APPLICABLE The DBA analysis assumes that within 60 seconds of the SAFETY ANALYSES accident, isolation of the primary containment is complete (continued) and leakage is terminated, except for the maximum allowable leakage rate, L . The primary containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power), and PCIV stroke times.

The single failure criterion required to be imposed in the conduct of unit safety analyses was considered in the original design of the primary containment purge and exhaust valves. Two valves in series on each purge and exhaust line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred.

PCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO PCIVs form a part of the primary containment boundary. The PCIV safety function is related to minimizing the loss of the reactor coolant inventory and establishing the primary containment boundary during a DBA.

The power operated, automatic isolation valves are required to have isolation times within limits and actuate on an automatic isolation signal. In addition, for the CAC System purge and exhaust isolation valves to be considered OPERABLE, the SGIG System supplying nitrogen gas to the inflatable seals of the valves must be OPERABLE. While the reactor building-to-suppression chamber vacuum breakers and the scram discharge volume vent and drain valves isolate primary containment penetrations, they are excluded from this Specification. Controls on their isolation function are adequately addressed in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," and LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers.'

The valves covered by this LCO are listed with their associated stroke times in Reference 2. The required stroke time is the stroke time listed in Reference 2 or the Inservice Testing Program which ever is more conservative.

The normally closed PCIVs are considered OPERABLE when manual valves are closed or open in accordance with appropriate administrative controls, automatic valves are (continued)

PBAPS UNIT 2 B 3.6-17 Revision No. 2

PCIVs B 3.6.1.3 BASES LCO de-activated and secured in their closed position, blind (continued) flanges are in place, and closed systems are intact. These passive isolation valves and devices are those listed in I Reference 2 and Reference 5.

MSIVs must meet additional leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, 'Primary Containment," as Type B or C testing.

This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the primary containment boundary during accidents.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, most PCIVs are not required to be OPERABLE and the primary containment purge and exhaust valves are not required to be normally closed in MODES 4 and 5. Certain valves, however, are required to be OPERABLE to prevent inadvertent reactor vessel draindown. These valves are those whose associated instrumentation is required to be OPERABLE per LCO 3.3.6.1, "Primary Containment Isolation Instrumentation." (This does not include the valves that isolate the associated instrumentation.)

ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) except for purge or exhaust valve flow path(s) to be unisolated intermittently under administrative controls.

These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. Due to the size of the primary containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, the penetration flow path containing these valves is not allowed to be operated under administrative controls.

(continued)

PBAPS UNIT 2 B 3.6-18 Revision No. 2

Vs PCI PCIVs B 3.6.1.3 BASES ACTIONS A second Note has been added to provide clarification that, (continued) for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable PCIV.

Complying. with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS are modified by Notes 3 and 4. Note 3 ensures that appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling Systems subsystem is inoperable due to a failed open test return valve). Note 4 ensures appropriate remedial actions are taken when the primary containment leakage limits are exceeded. Pursuant to LCO 3.0.6, these actions would not be required even when the associated LCO is not met.

Therefore, Notes 3 and 4 are added to require the proper actions be taken.

A.1 and A.2 With one or more penetration flow paths with one PCIV inoperable except for NSIV leakage not within limit, the affected penetration flow paths must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available valve to the primary containment. The Required Action must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam lines). The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3.

For main steam lines, an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is allowed.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the main steam lines (continued)

PBAPS UNIT 2 B 3.6-19 Revision No. 0

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow 'path(s) must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility.

Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas, and allows them to be verified by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

(continued)

PBAPS UNIT 2 B 3.6-20 Revision No. 0

PCIVs PCIVs B 3.6.1.3

-BASES ACTIONS B.1 (continued)

With one or more penetration flow paths with two PCIVs inoperable except due to MSIV leakage not within limit, either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two PCIVs.

For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.

C.1 and C.2 With one or more penetration flow paths with one PCIV inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for lines other than excess flow check valve (EFCV) lines and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for EFCV lines. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable considering the instrument and the small pipe diameter of penetration (hence, reliability) to act as a penetration isolation boundary and the small pipe diameter of the affected penetrations.

For affected penetrations that have been isolated in accordance with Required Action C.1, the affected penetration flow path(s) must be verified to be isolated on (continued)

PBAPS UNIT 2 B 3.6-21 Revision No. 0

PCIVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued) a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment' is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low. For the valves inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the valves and other administrative controls ensuring that valve misalignment is an unlikely possibility.

Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one PCIV. For penetration flow paths with two PCIVs, Conditions A and B provide the appropriate Required Actions.

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is low.

D.1 With any MSIV leakage rate not within limit, the assumptions of the safety analysis are not met. Therefore, the leakage must be restored to within limit within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage (continued)

PBAPS UNIT 2 B 3.6-22 Revision No. 0

PCIVs PCIVs B 3.6.1.3 BASES ACTIONS D.1 (continued) rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration, the fact that MSIV closure will result in isolation of the main steam line and a potential for plant shutdown, and the relative importance of MSIV leakage to the overall containment function.

E.1 and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 and F.2 If any Required Action and associated Completion Time cannot be met for PCIV(s) required to be OPERABLE during MODE 4 or 5, the unit must be placed in a condition in which the LCO does not apply. Action must be immediately initiated to suspend operations with a potential for draining the reactor vessel (OPDRVs) to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended and valve(s) are restored to OPERABLE status. If suspending an OPDRV would result in closing the residual heat removal (RHR) shutdown cooling isolation valves, an alternative Required Action is provided to immediately initiate action to restore the valve(s) to OPERABLE status. This allows RHR to remain in service while actions are being taken to restore the valve.

(continued)

PBAPS UNIT 2 B 3.6-23 Revision No. 0

PCIVs PCIVs B 3.6.1.3 BASES (continued)

SURVEILLANCE SR 3.6.1.3.1 REQUIREMENTS Verifying that the level in the CAD liquid nitrogen tank is

> 16 inches water column will ensure at least 7 days of post-LOCA SGIG System operation. This minimum volume of liquid nitrogen allows sufficient time after an accident to replenish the nitrogen supply in order to maintain the containment isolation function. The level is verified every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to ensure that the system is capable of performing its intended isolation function when required. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on operating experience, which has shown to be an acceptable period to verify liquid nitrogen supply.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency also signifies the importance of the SGIG System for maintaining the containment isolation function of the primary containment purge and exhaust valves.

SR 3.6.1.3.2 This SR ensures that the pressure in the SGIG System header is Z 80 psig. This ensures that the post-LOCA nitrogen pressure provided to the valve operators and valve seals is adequate for the SGIG System to perform its design function.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency was developed considering the importance of the SGIG System for maintaining the containment isolation function. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is also considered to be adequate to ensure timely detection of any breach in the SGIG System which would render the system incapable of performing its isolation function.

SR 3.6.1.3.3 This SR ensures that the primary containment purge and exhaust valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable (Condition A applies). The SR is modified by a Note stating that the SR is not required to be met when the purge and exhaust valves are open for the stated reasons. The Note states that these valves may be opened for inerting, de-inerting, pressure control, ALARA or air quality considerations for personnel entry, or Surveillances that require the valves to be open.

The 6 inch and 18 inch purge valves and 18 inch exhaust (continued)

PBAPS UNIT 2 B 3.6-24 Revision No. 0

PCIVs PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 (continued)

REQUIREMENTS valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other PCIV requirements discussed in SR 3.6.1.3.4.

SR 3.6.1.3.4 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits.

This SR does not require any testing or valve manipulation.

Rather, it involves verification that those PCIVs outside primary containment, and capable of being mispositioned, are in the correct position. Since verification of valve position for PCIVs outside primary containment is relatively easy, the 31 day Frequency was chosen to provide added assurance that the PCIVs are in the correct positions.

Three Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls.

Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in the proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open. A third Note states that performance of the SR is not required for test taps with a diameter < 1 inch. It is the intent that this SR must still be met, but actual performance is not required for test taps with a diameter 5 1 inch. The Note 3 allowance is consistent with the original plant licensing basis.

(continued)

PBAPS UNIT 2 B 3.6-25 Revision No. 0

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.5 REQUIREMENTS (continued) This SR verifies that each primary containment manual isolation valve and blind flange that is located inside primary containment and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits.

For PCIVs inside primary containment, the Frequency defined as "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is appropriate since these PCIVs are operated under administrative controls and the probability of their misalignment is low.

Two Notes have been added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since the primary containment is inerted and access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these PCIVs, once they have been verified to be in their proper position, is low. A second Note has been included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.

SR 3.6.1.3.6 The traversing incore probe (TIP) shear isolation valves are actuated by explosive charges. Surveillance of explosive charge continuity provides assurance that TIP valves will actuate when required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The 31 day Frequency is based on operating experience that has demonstrated the reliability of the explosive charge continuity.

SR 3.6.1.3.7 Verifying the correct alignment for each manual valve in the SGIG System required flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked or otherwise secured in (continued)

PBAPS UNIT 2 B 3.6-26 Revision No. 0

PCI Vs PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.7 (continued)

REQUIREMENTS position, since these valves were verified to be in the correct position prior to locking or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.6.1.3.8 Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.9.

The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time is in accordance with Reference 2 or the requirements of the Inservice Testing Program which ever is more conservative. The Frequency of this SR is in accordance with the requirements of the Inservice Testing Program.

SR 3.6.1.3.9 Verifying that the isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY.

The isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the DBA analyses. This ensures that the calculated radiological consequences of these events remain within 10 CFR 100 limits. The Frequency of this SR is in accordance with the requirements of the Inservice Testing Program.

SR 3.6.1.3.10 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM (continued)

PBAPS UNIT 2 B 3.6-27 Revision No. 2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.10 (continued)

REQUIREMENTS FUNCTIONAL TEST in LCO 3.3.6.1 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed only during a unit outage since isolation of penetrations would eliminate cooling water flow and disrupt the normal operation of many critical components. Operating experience has shown that these components will usually pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.3.11 This SR requires a demonstration that a representative sample of reactor instrumentation line excess flow check valve (EFCVs) is OPERABLE by verifying that the valve actuates to the isolation position on a simulated instrument line break signal. The representative sample consists of an approximately equal number of EFCVs, such that each EFCV is tested at least once every 10 years (Nominal). In addition, the EFCVs in the sample are representative of the various plant configurations, models, sizes and operating environments. This ensures that any potentially common problem with a specific type of application of DFCV is detected at the earliest possible time. This SR provides assurance that the instrumentation line EFCVs will perform so that predicted radiological consequences will not be exceeded during a postulated instrument line break event.

The nominal 10 year interval is based on other performance-based testing programs, such as Inservice Testing (Snubbers) and Option B to 10 CFR 50, Appendix J. Furthermore, any EFCV failures will be evaluated to determine if additional testing in that test interval is warranted to ensure overall reliability is maintained. Operating experience has demonstrated that these components are highly reliable and that failures to isolate are very infrequent. Therefore, testing of a representative sample was concluded to be acceptable from a reliability standpoint. For some EFCVs, this Surveillance can be performed with the reactor at power.

SR 3.6.1.3.12 The TIP shear isolation valves are actuated by explosive charges. An in place functional test is not possible with this design. The explosive squib is removed and tested to provide assurance that the valves will actuate when required. The replacement charge for the explosive squib shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of the batch successfully fired. The Frequency of 24 months on a STAGGERED TEST BASIS is considered adequate given the administrative controls on replacement charges and the frequent checks of circuit continuity (SR 3.6.1.3.6).

(continued)

PBAPS UNIT 2 B 3.6-28 Revision No. 35

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.13 REQUIREMENTS (continued) This SR ensures that in case the non-safety grade instrument air system is unavailable, the SGIG System will perform its design function to supply nitrogen gas at the required pressure for valve operators and valve seals supported by the SGIG System. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed only during a plant outage. Operating experience has shown that these components will usually pass this Surveillance when performed at the 24 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.3.14 Leakage through each MSIV must be

11.5 scfh when tested at 2 Pt (25 psig). The analyses in Reference 1 are based on treatment of MSIV leakage as a secondary containment bypass leakage, independent of a primary to secondary containment leakage analyzed at 1.27 L.. In the Reference 1 analysis all 4 steam lines are assumed to leak at the TS Limit. This ensures that MSIV leakage is properly accounted for in determining the overall impacts of primary containment leakage. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

SR 3.6.1.3.15 Verifying the opening of each 6 inch and 18 inch primary containment purge valve and each 18 inch primary containment exhaust valve is restricted by a blocking device to less than or equal to the required maximum opening angle specified in the UFSAR (Ref. 4) is required to ensure that the valves can close under DBA conditions within the times in the analysis of Reference 1. If a LOCA occurs, the purge and exhaust valves must close to maintain primary containment leakage within the values assumed in the accident analysis. At other times pressurization concerns are not present, thus the purge and exhaust valves can be fully open. The 24 month Frequency is appropriate because the blocking devices may be removed during a refueling outage.

(continued)

PBAPS UNIT 2 B 3.6-29 Revision No. 22

PCIVS B 3.6.1.3 I

BASES SURVEILLANCE SR 3.6.1.3.16 REQUIREMENTS (continued) The inflatable seal of each 6 inch and 18 inch primary containment purge valve and each 18 inch primary containment I exhaust valve must be replaced every 96 months. This will allow the opportunity for replacement before gross leakage failure occurs.

REFERENCES 1. UFSAR, Chapter 14.

2. UFSAR, Table 7.3.1.

3. 10 CFR 50, Appendix J, Option B.

4. UFSAR, Table 7.3.1, Note 17.

5. UFSAR, Table 5.2.2.

PBAPS UNIT 2 B 3.6-30 Revision No. 15 Amendment No. 220

Drywell Air Temperature B 3.6.1.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.4 Drywell Air Temperature BASES BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell coolers remove heat and maintain a suitable environment. The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). The limitation on the drywell average air temperature was developed as reasonable, based on operating experience. The limitation on drywell air temperature is used in the Reference 1 safety analyses.

APPLICABLE Primary containment performance is evaluated for a SAFETY ANALYSES spectrum of break sizes for postulated loss of coolant accidents (LOCAs) (Ref. 1). Among the inputs to the design basis analysis is the initial drywell average air temperature (Ref. 1). Analyses assume an initial average drywell air temperature of 145 0F. This limitation ensures that the safety analysis remains valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed the maximum allowable temperature of 281 0F (Ref. 2) except for a brief period of less than 20 seconds which was determined to be acceptable in References 1 and 3. Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primary containment required to mitigate the effects of a DBA is designed to operate and be capable of operating under environmental conditions expected for the accident.

Drywell air temperature satisfies Criterion 2 of the NRC Policy Statement.

LCO In the event of a DBA, with an initial drywell average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is maintained within acceptable limits for the drywell. As a result, the ability of primary containment to perform its design function is ensured.

(continued)

PBAPS UNIT 2 B 3.6-31 Revision No. 18

Drywell Air Temperature B 3.6.1.4 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5.

ACTIONS A.]

With drywell average air temperature not within the limit of the LCO, drywell average air temperature must be restored within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable, considering the sensitivity of the analysis to variations in this parameter, and provides sufficient time to correct minor problems.

B.1 and B.2 If the drywell average air temperature cannot be restored to within the limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.4.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the primary containment analyses.

Drywell air temperature is monitored in various quadrants and at various elevations. Due to the shape of the drywell, a volumetric average is used to determine an accurate representation of the actual average temperature.

(continued)

PBAPS UNIT 2 B 3.6-32 Revision No. 0

Drywell Air Temperature B 3.6.1.4 BASES SURVEILLANCE SR 3.6.1.4.1 (continued)

REQUIREMENTS The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of the SR was developed based on operating experience related to drywell average air temperature variations and temperature dependent drift of instrumentation located in the drywell during the applicable MODES and the low probability of a DBA occurring between surveillances. Furthermore, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, to alert the operator to an abnormal drywell air temperature condition.

REFERENCES 1. Letter G94-PEPR-183, Peach Bottom Improved Technical Specification Project Increased Drywell and Suppression Chamber Pressure Analytical Limits, from G.V. Kumar (GE) to A.A. Winter (PECO), August 23, 1994.

2. UFSAR, Section 5.2.3.1.

3. Peach Bottom Atomic Power Station Evaluation for Extended Final Feedwater Reduction, NEDC-32707P, Supplement 1, Revision 0, May, 1998.

PBAPS UNIT 2 B 3.6-33 Revision No. 19

Chamber Vacuum Breakers Reactor Building-to-Suppression Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.5 Reactor Building-to-Suppression Chamber Vacuum Breakers BASES BACKGROUND The function of the reactor building-to-suppression chamber vacuum breakers is to relieve vacuum when primary containment depressurizes below reactor building pressure.

If the drywell depressurizes below reactor building pressure, the negative differential pressure is mitigated by flow through the reactor building-to-suppression chamber vacuum breakers and through the suppression-chamber-to-drywell vacuum breakers. The design of the external (reactor building-to-suppression chamber) vacuum relief provisions consists of two vacuum breakers (a check valve and an air operated butterfly valve), located in series in each of two lines from the reactor building to the suppression chamber airspace. The butterfly valve is actuated by a differential pressure signal. The check valve is self actuating and can be manually operated for testing purposes. The two vacuum breakers in series must be closed to maintain a leak tight primary containment boundary.

A negative differential pressure across the drywell wall is caused by rapid depressurization of the drywell. Events that cause this rapid depressurization are cooling cycles, primary containment spray actuation, and steam condensation in the event of a primary system rupture. Reactor building-to-suppression chamber vacuum breakers prevent an excessive negative differential pressure across the primary containment boundary. Cooling cycles result in minor pressure transients in the drywell, which occur slowly and are normally controlled by heating and ventilation equipment. Inadvertent spray actuation results in a significant negative pressure transient and is the design basis event postulated in sizing the external (reactor building-to-suppression chamber) vacuum breakers.

The external vacuum breakers are sized on the basis of the air flow from the secondary containment that is required to mitigate the depressurization transient and limit the maximum negative containment (suppression chamber) pressure to within design limits. The maximum depressurization rate is a function of the primary containment spray flow rate and temperature and the assumed initial conditions of the (continued)

PBAPS UNIT 2 B 3.6-34 Revision No. 0

Breakers Reactor Building-to-Suppression Chamber Vacuum Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES BACKGROUND suppression chamber atmosphere. Low spray temperatures and (continued) atmospheric conditions that yield the minimum amount of contained noncondensible gases are assumed for conservatism.

The Safety Grade Instrument Gas (SGIG) System supplies pressurized nitrogen gas (from the Containment Atmospheric Dilution (CAD) System liquid nitrogen storage tank) as a safety grade pneumatic source to the CAC System purge and exhaust isolation valve inflatable seals, the reactor building-to-suppression chamber vacuum breaker air operated isolation butterfly valves and inflatable seal, and the CAC and CAD Systems vent control air operated valves. The SGIG System thus performs two distinct post-LOCA functions: (1) supports containment isolation and (2) supports CAD System vent operation. SGIG System requirements are addressed for each of the supported system and components in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers,"

and LCO 3.6.3.1, 'Containment Atmospheric Dilution (CAD)

System." For the SGIG System, liquid nitrogen from the CAD System liquid nitrogen storage tank passes through the CAD System liquid nitrogen vaporizer where it is converted to a gas. The gas then flows into a Unit 2 header and a Unit 3 header separated by two manual globe valves. From each header, the gas then branches to each valve operator or valve seal supplied by the SGIG System. Each branch is separated from the header by a manual globe valve and a check valve.

To support SGIG System functions, the CAD System liquid nitrogen storage tank minimum required level is a 16 inches water column and a minimum required SGIG System header pressure of 80 psig. Minimum requirements for the CAD System liquid nitrogen storage tank to support CAD System OPERABILITY are specified in LCO 3.6.3.1, "Containment Atmospheric Dilution (CAD) System."

APPLICABLE Analytical methods and assumptions involving the reactor SAFETY ANALYSES building-to-suppression chamber vacuum breakers are used as part of the accident response of the containment systems.

Internal (suppression-chamber-to-drywell) and external (reactor building-to-suppression chamber) vacuum breakers (continued)

PBAPS UNIT 2 B 3.6-35 Revision No. 0

Chamber Vacuum Breakers Reactor Building-to-Suppression Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES APPLICABLE are provided as part of the primary containment to limit the SAFETY ANALYSES negative differential pressure across the drywell and (continued) suppression chamber walls, which form part of the primary containment boundary.

The safety analyses assume the external vacuum breakers to be closed initially and to be fully open at 0.75 psid.

Additionally, of the four reactor building-to-suppression chamber vacuum breakers (two in each of the two lines from the reactor building-to-suppression chamber airspace), one is assumed to fail in a closed position to satisfy the single active failure criterion. Design Basis Accident (DBA) analyses require the vacuum breakers to be closed initially and to remain closed and leak tight with positive primary containment pressure.

Three cases were considered in the safety analyses to determine the adequacy of the external vacuum breakers:

a. A small break loss of coolant accident followed by actuation of both drywell spray loops;

b. Inadvertent actuation of one drywell spray loop during normal operation; and

c. A postulated DBA assuming low pressure coolant injection flow out the loss of coolant accident break, which condenses the drywell steam.

The results of these three cases show that the external vacuum breakers, with an opening setpoint of 0.75 psid, are capable of maintaining the differential pressure within design limits.

The reactor building-to-suppression chamber vacuum breakers satisfy Criterion 3 of the NRC Policy Statement.

LCO All reactor building-to-suppression chamber vacuum breakers are required to be OPERABLE to satisfy the assumptions used in the safety analyses. The requirement ensures that the two vacuum breakers (check valve and air operated butterfly valve) in each of the two lines from the reactor building to (continued)

PBAPS UNIT 2 B 3.6-36 Revision No. 0

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES LCO the suppression chamber airspace are closed. Also, the (continued) requirement ensures both vacuum breakers in each line will open to relieve a negative pressure in the suppression chamber (except during testing or when performing their intended function).

In addition, for the reactor building-to-suppression chamber vacuum breakers to be considered OPERABLE and closed, the SGIG System supplying nitrogen gas to the air operated valves and inflatable seal of the vacuum breakers must be OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture, which purges the drywell of air and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. Excessive negative pressure inside primary containment could also occur due to inadvertent initiation of the Drywell Spray System.

In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining reactor building-to-suppression chamber vacuum breakers OPERABLE is not required in MODE 4 or 5.

ACTIONS A Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path.

A.I With one or more lines with one vacuum breaker not closed, the leak tight primary containment boundary may be threatened. Therefore, the inoperable vacuum breakers must be restored to OPERABLE status or the open vacuum breaker closed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is consistent with requirements for inoperable suppression chamber-to-drywell vacuum breakers in LCO 3.6.1.6, (continued)

PBAPS UNIT 2 B 3.6-37 Revision No. 0

Chamber Vacuum Breakers Reactor Building-to-Suppression Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES ACTIONS A.1 (continued)

"Suppression Chamber-to-Drywell Vacuum Breakers." The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant capability afforded by the remaining breakers, the fact that the OPERABLE breaker in each of the lines is closed, and the low probability of an event occurring that would require the vacuum breakers to be OPERABLE during this period.

B.1 With one or more lines with two vacuum breakers not closed, primary containment integrity is not maintained. Therefore, one open vacuum breaker must be closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment," which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

C.1 With one line with one or more vacuum breakers inoperable for opening, the leak tight primary containment boundary is intact. The ability to mitigate an event that causes a containment depressurization is threatened if one or more vacuum breakers in at least one vacuum breaker penetration are not OPERABLE. Therefore, the inoperable vacuum breaker must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This is consistent with the Completion Time for Condition A and the fact that the leak tight primary containment boundary is being maintained.

D.1 With two lines with one or more vacuum breakers inoperable for opening, the primary containment boundary is intact.

However, in the event of a containment depressurization, the function of the vacuum breakers is lost. Therefore, all vacuum breakers in one line must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

(continued)

PBAPS UNIT 2 B 3.6-38 Revision No. 0

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES ACTIONS E.1 and E.2 (continued)

If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.5.1 REQUIREMENTS Verifying that the level in the CAD liquid nitrogen tank is

> 16 inches water column will ensure at least 7 days of post-LOCA SGIG System operation. This minimum volume of liquid nitrogen allows sufficient time after an accident to replenish the nitrogen supply in order to maintain the design function of the reactor building-to-suppression vacuum breakers. The level is verified every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to ensure that the system is capable of performing its intended isolation function when required. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on operating experience, which has shown to be an acceptable period to verify liquid nitrogen supply. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency also signifies the importance of the SGIG System for maintaining the design function of the reactor building-to-suppression chamber vacuum breakers.

SR 3.6.1.5.2 This SR ensures that the pressure in the SGIG System header is x 80 psig. This ensures that the post-LOCA nitrogen pressure provided to the valve operators and valve seals that is adequate for the SGIG to perform its design function. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency was developed considering the importance of the SGIG System for maintaining the design function of the reactor building-to-suppression chamber vacuum breakers. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is also considered to be adequate to ensure timely detection of any breach in the SGIG System which would render the system incapable of performing its function.

(continued)

PBAPS UNIT 2 B 3.6-39 Revision No. 0

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.3 REQUIREMENTS (continued) Each vacuum breaker is verified to be closed to ensure that a potential breach in the primary containment boundary is not present. This Surveillance is performed by observing local or control room indications of vacuum breaker position or by verifying a differential pressure of 0.75 psid is maintained between the reactor building and suppression chamber. The 14 day Frequency is based on engineering judgment, is considered adequate in view of other indications of vacuum breaker status available to operations personnel, and has been shown to be acceptable through operating experience.

Two Notes are added to this SR. The first Note allows reactor building-to-suppression chamber vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers. A second Note is included to clarify that vacuum breakers open due to an actual differential pressure, are not considered as failing this SR.

SR 3.6.1.5.4 Verifying the correct alignment for each manual valve in the SGIG System required flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked or otherwise secured in position, since these valves were verified to be in the correct position prior to locking or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

(continued)

PBAPS UNIT 2 B 3.6-40 Revision No. 0

Breakers Reactor Building-to-Suppression Chamber Vacuum Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.5 REQUIREMENTS (continued) Each vacuum breaker must be cycled to ensure that it opens properly to perform its design function and returns to its fully closed position. This ensures that the safety analysis assumptions are valid. The 92 day Frequency of this SR was developed based upon Inservice Testing Program requirements to perform valve testing at least once every 92 days.

SR 3.6.1.5.6 Demonstration of air operated vacuum breaker opening setpoint is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of s 0.75 psid is valid. The 18 month Frequency is based on requirements associated with the instruments that monitor differential pressure between the reactor building and suppression chamber and that this Surveillance can be performed while the plant is operating. For this unit, the 18 month Frequency has been shown to be acceptable, based on operating experience. Operating experience has shown that these components usually pass the surveillance when performed at an 18 month frequency, and is further justified because of other surveillances performed at shorter Frequencies that convey the proper functioning status of each vacuum breaker.

SR 3.6.1.5.7 This SR ensures that in case the non-safety grade instrument air system is unavailable, the SGIG System will perform its design function to supply nitrogen gas at the required pressure for valve operators and valve seals supported by the SGIG System. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed only during a plant outage. Operating experience has shown that these components will usually pass this Surveillance when performed at the 24 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES None PBAPS UNIT 2 B 3.6-41 Revision No. 0

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.6 Suppression Chamber-to-Drywell Vacuum Breakers BASES BACKGROUND The function of the suppression chamber-to-drywell vacuum breakers is to relieve vacuum in the drywell. There are 12 internal vacuum breakers located on the vent header of the vent system between the drywell and the suppression chamber, which allow air and steam flow from the suppression chamber to the drywell when the drywell is at a negative pressure with respect to the suppression chamber.

Therefore, suppression chamber-to-drywell vacuum breakers prevent an excessive negative differential pressure across the wetwell drywell boundary. Each vacuum breaker is a self actuating valve, similar to a check valve, which can be remotely operated for testing purposes.

A negative differential pressure across the drywell wall is caused by rapid depressurization of the drywell. Events that cause this rapid depressurization are cooling cycles, drywell spray actuation, and steam condensation from sprays or subcooled water reflood of a break in the event of a primary system rupture. Cooling cycles result in minor pressure transients in the drywell that occur slowly and are normally controlled by heating and ventilation equipment.

Spray actuation or spill of subcooled water out of a break results in more significant pressure transients and becomes important in sizing the internal vacuum breakers.

In the event of a primary system rupture, steam condensation within the drywell results in the most severe pressure transient. Following a primary system rupture, air in the drywell is purged into the suppression chamber free airspace, leaving the drywell full of steam. Subsequent condensation of the steam can be caused in two possible ways, namely, Emergency Core Cooling Systems flow from a recirculation line break, or drywell spray actuation following a loss of coolant accident (LOCA). These two cases determine the maximum depressurization rate of the drywell.

In addition, the waterleg in the Mark I Vent System downcomer is controlled by the drywell-to-suppression chamber differential pressure. If the drywell pressure is less than the suppression chamber pressure, there will be an increase in the vent waterleg. This will result in an (continued)

PBAPS UNIT 2 B 3.6-42 Revision No. 0

Vacuum Breakers Suppression Chamber-to-Drywell Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES BACKGROUND increase in the water clearing inertia in the event of a (continued) postulated LOCA, resulting in an increase in the peak drywell pressure. This in turn will result in an increase in the pool swell dynamic loads. The internal vacuum breakers limit the height of the waterleg in the vent system during normal operation.

APPLICABLE Analytical methods and assumptions involving the SAFETY ANALYSES suppression chamber-to-drywell vacuum breakers are used as part of the accident response of the primary containment systems. Internal (suppression chamber-to-drywell) and external (reactor building- to-suppression chamber) vacuum breakers are provided as part of the primary containment to limit the negative differential pressure across the drywell and suppression chamber walls that form part of the primary containment boundary.

The safety analyses assume that the internal vacuum breakers are closed initially and are fully open at a differential pressure of 0.5 psid. Additionally, 1 of the 9 internal vacuum breakers required to open is assumed to fail in a closed position. The results of the analyses show that the design pressure is not exceeded even under the worst case accident scenario. The vacuum breaker opening differential pressure setpoint and the requirement that 9 of 12 vacuum breakers be OPERABLE are a result of the requirement placed on the vacuum breakers to limit the vent system waterleg height. The total cross sectional area of the main vent system between the drywell and suppression chamber needed to fulfill this requirement has been established as a minimum of 51.5 times the total break area. In turn, the vacuum relief capacity between the drywell and suppression chamber should be 1/16 of the total main vent cross sectional area, with the valves set to operate at 0.5 psid differential pressure. This was the original design basis for Peach Bottom, which required 10 18" vacuum breakers to meet the 1/16 of the total main vent cross sectional area. However, the current design basis requirement for 9 vacuum breakers required to be operable, one of which is assumed to fail to open (single active failure), is found in Reference 2.

Design Basis Accident (DBA) analyses require the vacuum breakers to be closed initially and to remain closed and leak tight, until the suppression pool is at a positive pressure relative to the drywell. All suppression chamber-to-drywell vacuum breakers are considered closed if a leak test confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole (Ref. 1).

The suppression chamber-to-drywell vacuum breakers satisfy Criterion 3 of the NRC Policy Statement.

(continued)

PBAPS UNIT 2 B 3.6-43 Revision No. 44

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES (continued)

LCO Only 9 of the 12 vacuum breakers must be OPERABLE for opening. All suppression chamber-to-drywell vacuum breakers are required to be closed (except when the vacuum breakers are performing their intended design function). All suppression chamber-to-drywell vacuum breakers are considered closed, even if position indication shows that one or more vacuum breakers is not fully seated, if a leak test confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole. The vacuum breaker OPERABILITY requirement provides assurance that the drywell-to-suppression chamber negative differential pressure remains below the design value. The requirement that the vacuum breakers be closed ensures that there is no excessive bypass leakage should a LOCA occur.

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in excessive negative differential pressure across the drywell wall, caused by the rapid depressurization of the drywell. The event that results in the limiting rapid depressurization of the drywell is the primary system rupture that purges the drywell of air and fills the drywell free airspace with steam. Subsequent condensation of the steam would result in depressurization of the drywell. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. Excessive negative pressure inside the drywell could also occur due to inadvertent actuation of the Drywell Spray System.

In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES; therefore, maintaining suppression chamber-to-drywell vacuum breakers OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one of the required vacuum breakers inoperable for opening (e.g., the vacuum breaker is not open and may be stuck closed or not within its opening setpoint limit, so that it would not function as designed during an event that depressurized the drywell), the remaining eight OPERABLE vacuum breakers are capable of providing the vacuum relief function. However, overall system reliability is reduced (continued)

PBAPS UNIT 2 B 3.6-44 Revision No. 0

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS A.1 (continued) because a single failure in one of the remaining vacuum breakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA. Therefore, with one of the nine required vacuum breakers inoperable, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the inoperable vacuum breaker to OPERABLE status so that plant conditions are consistent with those assumed for the design basis analysis. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate.

B.1 An open vacuum breaker allows communication between the drywell and suppression chamber airspace, and, as a result, there is the potential for suppression chamber overpressurization due to this bypass leakage if a LOCA were to occur. Therefore, the open vacuum breaker must be closed. A short time is allowed to close the vacuum breaker due to the low probability of an event that would pressurize primary containment. If vacuum breaker position indication is not reliable, an alternate method of verifying that the vacuum breakers are closed must be performed within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . All suppression chamber-to-drywell vacuum breakers are considered closed, even if the "not fully seated" indication is shown, if a leak test confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole (Ref. 1). The required 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months Completion Time is considered adequate to perform this test. If the leak test fails, not only must the Actions be taken (close the open vacuum breaker within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ), but also the appropriate Condition and Required Actions of LCO 3.6.1.1, Primary Containment, must be entered.

C.1 and C.2 If the inoperable suppression chamber-to-drywell vacuum breaker cannot be closed or restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least (continued)

PBAPS UNIT 2 B 3.6-45 Revision No. 0

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES ACTIONS C.1 and C.2 (continued)

MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS Each vacuum breaker is verified closed to ensure that this potential large bypass leakage path is not present. This Surveillance is performed by observing the vacuum breaker position indication or by performing a leak test that confirms that the bypass area between the drywell and suppression chamber is less than or equivalent to a one-inch diameter hole. If the bypass test fails, not only must the vacuum breaker(s) be considered open and the appropriate Conditions and Required Actions of this LCO be entered, but also the appropriate Condition and Required Action of LCO 3.6.1.1 must be entered. The 14 day Frequency is based on engineering judgment, is considered adequate in view of other indications of vacuum breaker status available to operations personnel, and has been shown to be acceptable through operating experience.

A Note is added to this SR which allows suppression chamber-to-drywell vacuum breakers opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening vacuum breakers are controlled by plant procedures and do not represent inoperable vacuum breakers.

SR 3.6.1.6.2 Each required vacuum breaker must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This ensures that the safety analysis assumptions are valid. The 31 day Frequency of this SR was developed, based on Inservice Testing Program requirements to perform valve testing at least once every 92 days. A 31 day Frequency was chosen to provide additional assurance that the vacuum breakers are OPERABLE, since they are located in a harsh environment (the suppression chamber airspace).

(continued)

PBAPS UNIT 2 B 3.6-46 Revision No. 0

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.3 REQUIREMENTS (continued) Verification of the vacuum breaker setpoint for full opening is necessary to ensure that the safety analysis assumption regarding vacuum breaker full open differential pressure of 0.5 psid is valid. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. For this facility, the 24 month Frequency has been shown to be acceptable, based on operating experience, and is further justified because of other surveillances performed at shorter Frequencies that convey the proper functioning status of each vacuum breaker.

REFERENCES 1. Safety Evaluation by the Office of Nuclear Reactor Regulation Supporting Amendment Nos. 127 and 130 to Facility Operating License Nos. DPR-44 and DPR-56, dated February 18, 1988.

2. ME-0161, "Det. Actual # Wetwell to Drywell Vacuum Breakers Reqd" I PBAPS UNIT 2 B 3.6-47 Revision No. 44

Suppression Pool Average Temperature B 3.6.2.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.1 Suppression Pool Average Temperature BASES BACKGROUND The suppression chamber is a toroidal shaped, steel pressure vessel containing a volume of water called the suppression pool. The suppression pool is designed to absorb the decay heat and sensible energy released during a reactor blowdown from safety/relief valve discharges or from Design Basis Accidents (DBAs). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment that ensures that the peak containment pressure is maintained below the maximum allowable pressure for DBAs (56 psig). The suppression pool must also condense steam from steam exhaust lines in the turbine driven systems (i.e., the High Pressure Coolant Injection System and Reactor Core Isolation Cooling System). Suppression pool average temperature (along with LCO 3.6.2.2, "Suppression Pool Water Level") is a key indication of the capacity of the suppression pool to fulfill these requirements.

The technical concerns that lead to the development of suppression pool average temperature limits are as follows:

a. Complete steam condensation-the original limit for the end of a LOCA blowdown was 1700F, based on the Bodega Bay and Humboldt Bay Tests;

b. Primary containment peak pressure and temperature-design pressure is 56 psig and design temperature is 281F (Ref. 1);

c. Condensation oscillation loads-maximum allowable initial temperature is 110F.

APPLICABLE The postulated DBA against which the primary containment SAFETY ANALYSES performance is evaluated is the entire spectrum of postulated pipe breaks within the primary containment.

Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature (Ref. 2).

An initial pool temperature of 95F is assumed for the (continued)

PBAPS UNIT 2 B 3.6-48 Revision No. 0

Suppression Pool Average Temperature Suppression Pool Average Temperature B 3.6.2.1 BASES APPLICABLE Reference 1 and Reference 2 analyses. Reactor shutdown at a SAFETY ANALYSES pool temperature of 110'F and vessel depressurization at a (continued) pool temperature of 1200 F are assumed for the Reference 2 analyses. The limit of 105'F, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during unit testing.

Suppression pool average temperature satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limitation on the suppression pool average temperature is required to provide assurance that the containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated DBA or any transient resulting in heatup of the suppression pool. The LCO requirements are:

a. Average temperature

950 F when any OPERABLE wide range neutron monitor (WRNM) channel is at 1.OOEO %

power or above and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.

b. Average temperature s 105*F when any OPERABLE WRNM channel is at 1.OOEO % power or above and testing that adds heat to the suppression pool is being performed.

This required value ensures that the unit has testing flexibility, and was selected to provide margin below the 1100F limit at which reactor shutdown is required.

When testing ends, temperature must be restored to s 95'F within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months according to Required Action A.2. Therefore, the time period that the temperature is > 950 F is short enough not to cause a significant increase in unit risk.

c. Average temperature s 110'F when all OPERABLE WRNM channels are below 1.OOEO % power. This requirement ensures that the unit will be shut down at > 1100 F.

The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.

(continued)

PBAPS UNIT 2 B 3.6-49 Revision No. 24

Suppression Pool Average Temperature B 3.6.2.1 BASES I LCO Note that WRNM indication at 1.OOEO % power is a (continued) convenient measure of when the reactor is producing power essentially equivalent to 1% RTP. At this power level, heat input is approximately equal to normal system heat losses.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5.

ACTIONS A.1 and A.2 With the suppression pool average temperature above the specified limit when not performing testing that adds heat to the suppression pool and when above the specified power indication, the initial conditions exceed the conditions assumed for the Reference 1, 2, and 3 analyses. However, primary containment cooling capability still exists, and the primary containment pressure suppression function will occur at temperatures well above those assumed for safety analyses. Therefore, continued operation is allowed for a limited time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is adequate to allow the suppression pool average temperature to be restored below the limit. Additionally, when suppression pool temperature is > 950F, increased monitoring of the suppression pool temperature is required to ensure that it remains s 110 0F. The once per hour Completion Time is adequate based on past experience, which has shown that pool temperature increases relatively slowly except when testing that adds heat to the suppression pool is being performed.

Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

B.1 If the suppression pool average temperature cannot be' restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the power must be I reduced to below 1.OOEO % power for all OPERABLE WRNMs (conti nued)

PBAPS UNIT 2 B 3.6-50 Revision No. 24

Temperature Suppression Pool Average Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS B.1 (continued) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reduce power from full power conditions in an orderly manner and without challenging plant systems.

C.1 Suppression pool average temperature is allowed to be > 950 F when any OPERABLE WRNM channel is at I.00E0 % power or above, and when testing that adds heat to the suppression pool is being performed. However, if temperature is

> 105'F, all testing must be immediately suspended to preserve the heat absorption capability of the suppression pool. With the testing suspended, Condition A is entered and the Required Actions and associated Completion Times are applicable.

D.1. D.2. and D.3 Suppression pool average temperature > 1100 F requires that the reactor be shut down immediately. This is accomplished by placing the reactor mode switch in the shutdown position.

Further cooldown to MODE 4 is required at normal cooldown rates (provided pool temperature remains s 120 0F).

Additionally, when suppression pool temperature is > 110 0F, increased monitoring of pool temperature is required to ensure that it remains s 120 0F. The once per 30 minute Completion Time is adequate, based on operating experience.

Given the high suppression pool average temperature in this Condition, the monitoring Frequency is increased to twice that of Condition A. Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

E.1 and E.2 If suppression pool average temperature cannot be maintained at s 120 0F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to < 200 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and the plant must be brought to at least MODE 4 within (conti nued)

PBAPS UNIT 2 B 3.6-51 Revision No. 24

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS E.1 and E.2 (continued) 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Continued addition of heat to the suppression pool with suppression pool temperature > 120'F could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure. Furthermore, if a blowdown were to occur when the temperature was

> 120F, the maximum allowable bulk and local temperatures could be exceeded very quickly.

SURVEILLANCE SR 3.6.2.1.1 REQUI REMENTS The suppression pool average temperature is regularly monitored to ensure that the required limits are satisfied.

The average temperature is determined by taking an arithmetic average of OPERABLE suppression pool water temperature channels. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency has been shown, based on operating experience, to be acceptable. When heat is being added to the suppression pool by testing, however, it is necessary to monitor suppression pool temperature more frequently. The 5 minute Frequency during testing is justified by the rates at which tests will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The Frequencies are further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

REFERENCES 1. UFSAR, Section 5.2.

2. NEDC-32183P, 'Power Rerate Safety Analysis Report for -

Peach Bottom 2 & 3," May 1993.

3. NUREG-0783.

PBAPS UNIT 2 B 3.6-52 Revision No. 0

Suppression Pool Water Level B 3.6.2.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.2 Suppression Pool Water Level BASES BACKGROUND The suppression chamber is a toroidal shaped, steel pressure vessel containing a volume of water called the suppression pool. The suppression pool is designed to absorb the energy associated with decay heat and sensible heat released during a reactor blowdown from safety/relief valve (S/RV) discharges or from a Design Basis Accident (DBA). The suppression pool must quench all the steam released through the downcomer lines during a loss of coolant accident (LOCA). This is the essential mitigative feature of a pressure suppression containment, which ensures that the peak containment pressure is maintained below the maximum allowable pressure for DBAs (56 psig). The suppression pool must also condense steam from the steam exhaust lines in the turbine driven systems (i.e., High Pressure Coolant Injection (HPCI) System and Reactor Core Isolation Cooling (RCIC) System) and provides the main emergency water supply source for the reactor vessel. The suppression pool volume ranges between 122,900 ft at the low water level limit of 14.5 feet and 127,300 ft at the high water level limit of 14.9 feet.

If the suppression pool water level is too low, an insufficient amount of water would be available to adequately condense the steam from the S/RV quenchers, main vents, or HPCI and RCIC turbine exhaust lines. Low suppression pool water level could also result in an inadequate emergency makeup water source to the Emergency Core Cooling System. The lower volume would also absorb less steam energy before heating up excessively. Therefore, a minimum suppression pool water level is specified.

If the suppression pool water level is too high, it could result in excessive clearing loads from S/RV discharges and excessive pool swell loads during a DBA LOCA. Therefore, a maximum pool water level is specified. This LCO specifies an acceptable range to prevent the suppression pool water level from being either too high or too low.

(continued)

PBAPS UNIT 2 B 3.6-53 Revision No. 0

Suppression Pool Water Level B 3.6.2.2 BASES (continued)

APPLICABLE Initial suppression pool water level affects suppression SAFETY ANALYSES pool temperature response calculations, calculated drywell pressure during vent clearing for a DBA, calculated pool swell loads for a DBA LOCA, and calculated loads due to S/RV discharges. Suppression pool water level must be maintained within the limits specified so that the safety analysis of Reference 1 remains valid.

Suppression pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limit that suppression pool water level be 2 14.5 feet and s 14.9 feet is required to ensure that the primary containment conditions assumed for the safety analyses are met. Either the high or low water level limits were used in the safety analyses, depending upon which is more conservative for a particular calculation.

APPLICABILITY In MODES 1, 2, and 3, a DBA would cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. The requirement for maintaining suppression pool water level within limits in MODE 4 or 5 is addressed in LCO 3.5.2, "ECCS-Shutdown".

ACTIONS A.]

With suppression pool water level outside the limits, the conditions assumed for the safety analyses are not met. If water level is below the minimum level, the pressure suppression function still exists as long as main vents are covered, HPCI and RCIC turbine exhausts are covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and the capability of the Drywell Spray System. Therefore, continued operation for a limited time is allowed. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore suppression pool water level to within limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.

(continued)

PBAPS UNIT 2 B 3.6-54 Revision No. 0

Pool Water Level Suppression Suppression Pool Water Level B 3.6.2.2 BASES ACTIONS B.1 and B.2 (continued)

If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.2.1 REQUIREMENTS Verification of the suppression pool water level is to ensure that the required limits are satisfied. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR was developed considering operating experience related to trending variations in suppression pool water level and water level instrument drift during the applicable MODES and to assessing the proximity to the specified LCO level limits. Furthermore, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool water level condition.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.

PBAPS UNIT 2 B 3.6-55 Revision No. 0

RHR Suppression Pool Cooling B 3.6.2.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Cooling System removes heat from the suppression pool.

The suppression pool is designed to absorb the sudden input of heat from the primary system. In the long term, the pool continues to absorb residual heat generated by fuel in the reactor core. Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits. This function is provided by two redundant RHR suppression pool cooling subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR suppression pool cooling subsystems per RHR System loop. The four RHR suppression pool cooling subsystems are manually initiated and independently controlled. The four RHR suppression pool cooling subsystems perform the suppression pool cooling function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool via the full flow test lines. Each full flow test line is common to the two RHR suppression pool cooling subsystems in an RHR System loop. The High Pressure Service Water (HPSW) System circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink.

The heat removal capability of one RHR pump and one heat exchanger in one subsystem is sufficient to meet the overall DBA pool cooling requirement for loss of coolant accidents (LOCAs) and transient events such as a turbine trip or stuck open safety/relief valve (S/RV). As a result, any one of the four RHR suppression pool cooling subsystems can provide the required suppression pool cooling function. S/RV leakage and High Pressure Coolant Injection System and Reactor Core Isolation Cooling System testing increase suppression pool temperature more slowly. The RHR Suppression Pool Cooling System is also used to lower the suppression pool water bulk temperature following such events.

(continued)

PBAPS UNIT 2 B 3.6-56 Revision No. 0

RHR Suppression Pool Cooling B 3.6.2.3 BASES (continued)

APPLICABLE Reference I contains the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break LOCAs. The intent of the analyses is to demonstrate that the heat removal capacity of the RHR Suppression Pool Cooling System is adequate to maintain the primary containment conditions within design limits. The suppression pool temperature is calculated to remain below the design limit.

The RHR Suppression Pool Cooling System satisfies Criterion 3 of the NRC Policy Statement.

LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below design limits (Ref. 1).

To ensure that these requirements are met, two RHR suppression pool cooling subsystems (one in each loop) must be OPERABLE with power from two safety related independent power supplies. (The two subsystems must be in separate loops since the full flow test line valves are common to both subsystems in a loop.) Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when one of the pumps, the associated heat exchanger, a HPSW System pump capable of providing cooling to the heat exchanger and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.

ACTIONS A.I With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the (conti nued)

PBAPS UNIT 2 B 3.6-57 Revision No. 0

Pool Cooling RHR Suppression RHR Suppression Pool Cooling B 3.6.2.3 BASES ACTIONS A.1 (continued) overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

B.1 With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.

C.1 and C.2 If any Required Action and associated Completion Time cannot be met within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.3.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within (continued)

PBAPS UNIT 2 B 3.6-58 Revision No. 1

Pool Cooling RHR Suppression RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE SR 3.6.2.3.1 (continued)

REQUIREMENTS the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Frequency of 31 days is justified because the valves are operated under procedural control, improper valve position would affect only a single subsystem, the probability of an event requiring initiation of the system is low, and the subsystem is a manually initiated system. This Frequency has been shown to be acceptable based on operating experience.

SR 3.6.2.3.2 Verifying that each required RHR pump develops a flow rate

> 10,000 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded during the cycle.

Flow is a normal test of centrifugal pump performance required by ASME Code,Section XI (Ref. 2). This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

REFERENCES 1. UFSAR, Section 14.6.3.

2. ASME, Boiler and Pressure Vessel Code,Section XI.

PBAPS UNIT 2 B 3.6-59 Revision No. 0

RHR Suppression Pool Spray B 3.6.2.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray BASES BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool Spray System removes heat from the suppression chamber airspace. The suppression pool is designed to absorb the sudden input of heat from the primary system from a DBA or a rapid depressurization of the reactor pressure vessel (RPV) through safety/relief valves. The heat addition to the suppression pool results in increased steam in the suppression chamber, which increases primary containment pressure. Steam blowdown from a DBA can also bypass the suppression pool and end up in the suppression chamber airspace. Some means must be provided to remove heat from the suppression chamber so that the pressure and temperature inside primary containment remain within analyzed design limits. This function is provided by two redundant RHR suppression pool spray subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.

The RHR System has two loops with each loop consisting of two motor driven pumps, two heat exchangers, and associated piping and valves. There are two RHR suppression pool spray subsystems per RHR System loop. The four RHR suppression pool spray subsystems are manually, initiated and independently controlled. The four RHR suppression pool spray subsystems perform the suppression pool spray function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool spray spargers. Each suppression pool spray sparger line is common to the two RHR suppression pool spray subsystems in an RHR System loop. The spargers only accommodate a small portion of the total RHR pump flow; the remainder of the flow returns to the suppression pool through the suppression pool cooling return line. Thus, both suppression pool cooling and suppression pool spray functions are performed when the Suppression Pool Spray System is initiated. High Pressure Service Water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat (continued)

PBAPS UNIT 2 B 3.6-60 Revision No. 0

RHR Suppression Pool Spray B 3.6.2.4 BASES BACKGROUND sink. Any one of the four RHR suppression pool spray (continued) subsystems is sufficient to condense the steam from small bypass leaks from the drywell to the suppression chamber airspace during the postulated DBA.

APPLICABLE Reference 1 contains the results of analyses used to predict SAFETY ANALYSES primary containment pressure and temperature following large and small break loss of coolant accidents. The intent of the analyses is to demonstrate that the pressure reduction capacity of the RHR Suppression Pool Spray System is adequate to maintain the primary containment conditions within design limits. The time history for primary containment pressure is calculated to demonstrate that the maximum pressure remains below the design limit.

The RHR Suppression Pool Spray System satisfies Criterion 3 of the NRC Policy Statement.

LCO In the event of a DBA, a minimum of one RHR suppression pool spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool spray subsystems (one in each loop) must be OPERABLE with power from two safety related independent power supplies. (The two subsystems must be in separate loops since the suppression pool spray sparger line valves are common to both subsystems in a loop.) Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR suppression pool spray subsystem is OPERABLE when one of the pumps, the associated heat exchanger, a HPSW System pump capable of providing cooling to the heat exchanger and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR suppression pool spray subsystems OPERABLE is not required in MODE 4 or 5.

(continued)

PBAPS UNIT 2 B 3.6-61 Revision No. 0

Spray RHR Suppression Pool RHR Suppression Pool Spray B 3.6.2.4 BASES (continued)

ACTIONS A.1 With one RHR suppression pool spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR suppression pool spray subsystem is adequate to perform the primary containment bypass leakage mitigation function.

However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment bypass mitigation capability. The 7 day Completion Time was chosen in light of the redundant RHR suppression pool spray capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

B.1 With both RHR suppression pool spray subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this Condition, there is a substantial loss of the primary containment bypass leakage mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.

C.1 and C.2 If the inoperable RHR suppression pool spray subsystem cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.4.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR suppression pool spray mode flow path provides assurance that the proper flow paths will (continued)

PBAPS UNIT 2 B 3.6-62 Revision No. 0

Pool Spray RHR Suppression RHR Suppression Pool Spray B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.1 (continued)

REQUIREMENTS exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Frequency of 31 days is justified because the valves are operated under procedural control, improper valve position would affect only a single subsystem, the probability of an event requiring initiation of the system is low, and the subsystem is a manually initiated system. This Frequency has been shown to be acceptable based on operating experience.

SR 3.6.2.4.2 This Surveillance is performed every 10 years to verify that the spray nozzles are not obstructed and that flow will be provided when required. The 10 year Frequency is adequate to detect degradation in performance due to the passive nozzle design and its normally dry state and has been shown to be acceptable through operating experience.

REFERENCES 1. UFSAR, Sections 5.2 and 14.6.3.

PBAPS UNIT 2 B 3.6-63 Revision No. 0

CAD System B 3.6.3.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.1 Containment Atmospheric Dilution (CAD) System BASES BACKGROUND The CAD System functions to maintain combustible gas concentrations within the primary containment at or below the flammability limits following a postulated loss of coolant accident (LOCA) by purging hydrogen and oxygen with nitrogen. To ensure that a combustible gas mixture does not occur, oxygen concentration is kept < 5.0 volume percent (v/o)

The CAD System is manually initiated and consists of two 100% capacity subsystems. Each subsystem consists of the liquid nitrogen supply tank, the atmospheric vaporizer, an electric vaporizer, and connected piping to supply the drywell and suppression chamber volumes. The liquid nitrogen tank, the atmospheric vaporizer and electric vaporizer are common components which are shared between the CAD subsystems of the two units. Piping from the liquid nitrogen tank downstream of the vaporizers is routed into a common header where it is split and routed to each unit.

Two pipes are routed to each unit. Each of the two pipes to a particular unit divides to supply nitrogen to both the drywell and suppression chamber. The intent of this arrangement is to provide redundant nitrogen supplies to both the drywell and suppression chamber to satisfy single failure criteria. In order to purge primary containment of combustible gases, the original CAD System design provided two vents for each unit. One is to allow venting from the drywell and the other is to allow venting from the suppression chamber. The nitrogen storage tank contains >

3841 gallons (which corresponds to a level of 33 inches water column), which is adequate for 7 days of CAD System and Safety Grade Instrument Gas (SGIG) System operation for both units.

The SGIG System supplies pressurized nitrogen gas (from the CAD System liquid nitrogen storage tank) as a safety grade pneumatic source to the Containment Atmospheric Control (CAC) System purge and exhaust isolation valve inflatable seals, the reactor building-to-suppression chamber vacuum breaker air operated isolation valves and inflatable seal, and the CAC and CAD Systems vent control air operated valves. The SGIG System thus performs two distinct post-(continued)

PBAPS UNIT 2 B 3.6-64 Revision No. 37

CAD System B 3.6.3.1 BASES BACKGROUND LOCA functions: (1) supports containment isolation and (2)

(continued) supports CAD System vent operation. SGIG System requirements are addressed for each of the supported system and components in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," LCO 3.6.1.5, "Reactor Building-to-Suppression Chamber Vacuum Breakers," and LCO 3.6.3.1, "Containment Atmospheric Dilution (CAD) System." For the SGIG System, liquid nitrogen from the CAD System liquid nitrogen storage tank passes through the CAD System liquid nitrogen vaporizer where it is converted to a gas. The gas then flows into a Unit 2 header and a Unit 3 header separated by two manual globe valves. From each header, the gas then branches to each valve operator or valve seal supplied by the SGIG System. Each branch is separated from the header by a manual globe valve and a check valve.

The CAD System operates as directed in the emergency operating procedures to remove combustible gases from primary containment.

APPLICABLE The CAD System is manually initiated from the main control SAFETY ANALYSES room in the purge mode as directed by the emergency operating procedures (EOPs), if it is determined that the concentration of combustible gases in primary containment exceeds the action levels specified in the EOPs. The CAD System is used as directed in the EOPs, and when oxygen generation rates exceed the design basis assumptions.

The CAD System was originally designed to dilute containment oxygen by repressurizing primary containment with nitrogen to approximately 50% of the containment design pressure. Above this pressure, containment would be vented to maintain this pressure while CAD continued to supply diluting nitrogen.

The original design calculations demonstrated that, with oxygen generation rates specified in Regulatory Guide 1.7, Table 1 (Reference 3), and the CAD system operated per its original design mode (i.e., repressurization), oxygen concentrations would be maintained < 5 v/o and offsite doses would be maintained less than the requirements of 10 CFR50.44.

The PBAPS combustible gas control system has since been reevaluated with oxygen generation rates based on experimentally and analytically determined parameters as permitted in Regulatory Guide 1.7, and documented in NEDO-22155 and Reference 1. As a result it was found that the primary containment inerting alone is sufficient to maintain oxygen concentrations < 5 v/o and that CAD system operation would not be required to control combustible gases.

Therefore, the CAD system, and in particular containment venting, is no longer considered the primary means of combustible gas control. As a result, no releases or offsite doses are anticipated to result from design basis combustible gas control.

(continued)

Revision No. 37 UNIT 22 PBAPS UNIT B 3.6-65 B 3.6-65 Revision No. 37

CAD System B 3.6.3.1 BASES APPLICABLE Nevertheless, Reference 1 did direct that the CAD System be SAFETY ANALYSES maintained as it was originally designed to comply with the (continued) requirements of criteria 41, 42, and 43 of Appendix A of 10 CFR Part 50 and installed in accordance with 10CFR50.44 (Reference 2).

The CAD System satisfies the requirements of NRC Policy Statement (Reference 5) because through Reference 1 review, the CAD System has been determined to be important to public health and safety. Thus, it is retained in the Technical Specifications.

LCO Two CAD subsystems must be OPERABLE. This ensures operation of at least one CAD subsystem in the event of a worst case single active failure. Operation of at least one CAD subsystem is designed to maintain primary containment post-LOCA oxygen concentration < 5.0 v/o for 7 days.

For the CAD System vent control air operated valves and the CAC System vent control air operated valves which support CAD System operation to be considered OPERABLE, the SGIG System supplying nitrogen gas to the air operators of these valves must be OPERABLE.

APPLICABILITY In MODES 1 and 2, the CAD System is required to maintain the oxygen concentration within primary containment below the flammability limit of 5.0 v/o following a LOCA. This ensures that the relative leak tightness of primary containment is adequate and prevents damage to safety related equipment and instruments located within primary containment.

In MODE 3, both the hydrogen and oxygen production rates and the total amounts produced after a LOCA would be less than those calculated for the Design Basis Accident LOCA. Thus, if the analysis were to be performed starting with a LOCA in MODE 3, the time to reach a flammable concentration would be extended beyond the time conservatively calculated for MODES 1 and 2. The extended time would allow hydrogen removal from the primary containment atmosphere by other means and also allow repair of an inoperable CAD subsystem, if CAD were not available. Therefore, the CAD System is not required to be OPERABLE in MODE 3.

In MODES 4 and 5, the probability and consequences of a LOCA are reduced due to the pressure and temperature limitations of these MODES. Therefore, the CAD System is not required to be OPERABLE in MODES 4 and 5.

ACTIONS A.1 If one or both CAD subsystems (or one or more supply and vent paths) are inoperable, both subsystems must be restored to OPERABLE status within 30 days. In this Condition, the oxygen control function of the CAD System may be lost.

However, alternate oxygen control capabilities may be provided by the Primary Containment Inerting System. The (continued)

PBAPS UNIT 2 B 3.6-66 Revision No. 37

CAD System B 3.6.3.1 BASES ACTIONS A.1 (continued) 30 day Completion Time is based on the low probability of the occurrence of a LOCA that would generate hydrogen and oxygen in amounts capable of exceeding the flammability limit, the amount of time available after the event for operator action to prevent exceeding this limit, and the availability of other hydrogen mitigating systems.

Required Action A.1 has been modified by a Note that indicates that the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when one or both CAD subsystems are inoperable. This allowance is provided because of the low probability of the occurrence of a LOCA that would generate hydrogen and oxygen in amounts capable of exceeding the flammability limit, the amount of time available after a postulated LOCA for operator action to prevent exceeding the flammability limit, and the availability of other hydrogen mitigating systems.

B.1 If any Required Action cannot be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.1.1 REQUIREMENTS This SR ensures that the pressure in the SGIG System header is - 80 psig. This ensures that the post-LOCA nitrogen pressure provided to the valve operators and valve seals is adequate for the SGIG System to perform its design function.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency was developed considering the importance of the SGIG System for maintaining the containment isolation function and combustible gas control function of valves supplied by the SGIG System. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is also considered to be adequate to ensure timely detection of any breach in the SGIG System which would render the system incapable of performing its function.

(continued)

PBAPS UNIT 2 B 3.6-67 Revision No. 0

CAD System B 3.6.3.1 BASES SURVEILLANCE SR 3.6.3.1.2 REQUIREMENTS (continued) Verifying that the level in the CAD liquid nitrogen tank is

33 inches water column will ensure at least 7 days of post-LOCA CAD System and SGIG System operation for both units. This minimum volume of liquid nitrogen allows sufficient time after an accident to replenish the nitrogen supply for long term inerting. This is verified every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to ensure that the system is capable of performing its intended function when required. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on operating experience, which has shown 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to be an acceptable period to verify the liquid nitrogen supply and on the availability of other hydrogen mitigating systems.

SR 3.6.3.1.3 Verifying the correct alignment for manual, power operated, and automatic valves in each of the CAD subsystem flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing.

A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable because the CAD System is manually initiated.

This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day Frequency is appropriate because the valves are operated under procedural control, improper valve position would only affect a single subsystem, the probability of an event requiring initiation of the system is low, and the system is a manually initiated system.

(continued)

PBAPS UNIT 2 B 3.6-68 Revision No. 0

CAD System B 3.6.3.1 BASES SURVEILLANCE SR 3.6.3.1.4 REQUIREMENTS (continued) Verifying the correct alignment for each manual valve in the SGIG System required flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked or otherwise secured in position, since these valves were verified to be in the correct position prior to locking or securing. A valve is also allowed to be in the nonaccident position provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable because the CAD System is manually initiated. This SR does not apply to valves that cannot be inadvertently misaligned such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.6.3.1.5 This SR ensures that in case the non-safety grade instrument air system is unavailable, the SGIG System will perform its design function to supply nitrogen gas at the required pressure for valve operators and valve seals supported by the SGIG System. The 24 month Frequency was developed considering it is prudent that this Surveillance be performed only during a plant outage. Operating experience has shown that these components will usually pass this Surveillance when performed at the 24 month Frequency.

Thus, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. Nuclear Regulatory Commission (NRC) Letter (SER) from John E. Stolz (Chief, Operating Reactors Branch (Division of Licensing)) to Edward G. Bauer, Jr., Vice President and General Counsel, Philadelphia Electric Company "Recombiner Capability Requirements of 10CFR50.44(c)(3)(ii) Generic Letter 84-09" dated 6/26/85.

2. 10 CFR Part 50.

3. Regulatory Guide 1.7, Revision 0.

4. UFSAR, Section 5.2.3.9.5.

5. Final Policy statement on Technical Specification I Improvements July 22, 1993 (58 FR3913)

PBAPS UNIT 2 B 3.6-69 Revision No. 37

Primary Containment Oxygen Concentration B 3.6.3.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.2 Primary Containment Oxygen Concentration BASES BACKGROUND All nuclear reactors must be designed to withstand events that generate hydrogen either due to the zirconium metal water reaction in the core or due to radiolysis. The primary method to control hydrogen is to inert the primary containment. With the primary containment inert, that is, oxygen concentration < 4.0 volume percent (v/o), a combustible mixture cannot be present in the primary containment for any hydrogen concentration. The capability to inert the primary containment and maintain oxygen

< 4.0 v/o works together with the Containment Atmospheric Dilution System (LCO 3.6.3.1, 'Containment Atmospheric Dilution (CAD) System) to provide redundant and diverse methods to mitigate events that produce hydrogen. For example, an event that rapidly generates hydrogen from zirconium metal water reaction will result in excessive hydrogen in primary containment, but oxygen concentration will remain < 4.0 v/o and no combustion can occur. Long term generation of both hydrogen and oxygen from radiolytic decomposition of water may eventually result in a combustible mixture in primary containment, except that the CAD System dilutes and removes hydrogen and oxygen gases faster than they can be produced from radiolysis and again no combustion can occur. This LCO ensures that oxygen concentration does not exceed 4.0 v/o during operation in the applicable conditions.

APPLICABLE The Reference 1 calculations assume that the primary SAFETY ANALYSES containment is inerted when a Design Basis Accident loss of coolant accident occurs. Thus, the hydrogen assumed to be released to the primary containment as a result of,metal water reaction in the reactor core will not produce combustible gas mixtures in the primary containment.

Oxygen, which is subsequently generated by radiolytic decomposition of water, is diluted and removed by the CAD System more rapidly than it is produced.

Primary containment oxygen concentration satisfies Criterion 2 of the NRC Policy Statement.

(continued)

PBAPS UNIT 2 B 3.6-70 Revision No. 0

Primary Containment Oxygen Concentration B 3.6.3.2 BASES (continued)

LCO The primary containment oxygen concentration is maintained

< 4.0 v/o to ensure that an event that produces any amount of hydrogen does not result in a combustible mixture inside primary containment.

APPLICABILITY The primary containment oxygen concentration must be within the specified limit when primary containment is inerted, except as allowed by the relaxations during startup and shutdown addressed below. The primary containment must be inert in MODE 1, since this is the condition with the highest probability of an event that could produce hydrogen.

Inerting the primary containment is an operational problem because it prevents containment access without an appropriate breathing apparatus. Therefore, the primary containment is inerted as late as possible in the plant startup and de-inerted as soon as possible in the plant shutdown. As long as reactor power is < 15% RTP, the potential for an event that generates significant hydrogen is low and the primary containment need not be inert.

Furthermore, the probability of an event that generates hydrogen occurring within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of a startup, or within the last 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before a shutdown, is low enough that these 'windows," when the primary containment is not inerted, are also justified. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period is a reasonable amount of time to allow plant personnel to perform inerting or de-inerting.

ACTIONS A.1 If oxygen concentration is2 4.0 v/o at any time while operating in MODE 1, with the exception of the relaxations allowed during startup and shutdown, oxygen concentration must be restored to < 4.0 v/o within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is allowed when oxygen concentration is x 4.0 v/o because of the availability of other hydrogen mitigating systems (e.g., the CAD System) and the low probability and long duration of an event that would generate significant amounts of hydrogen occurring during this period.

(continued)

PBAPS UNIT 2 B 3.6-71 Revision No. 0

Primary Containment Oxygen Concentration B 3.6.3.2 BASES ACTIONS B.1 (continued)

If oxygen concentration cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, power must be reduced to < 15% RTP within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, based on operating experience, to reduce reactor power from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.2.1 REQUIREMENTS The primary containment (drywell and suppression chamber) must be determined to be inert by verifying that oxygen concentration is < 4.0 v/o. The 7 day Frequency is based on the slow rate at which oxygen concentration can change and on other indications of abnormal conditions (which would lead to more frequent checking by operators in accordance with plant procedures). Also, this Frequency has been shown to be acceptable through operating experience.

REFERENCES 1. UFSAR, Section 5.2.3.9.5.

PBAPS UNIT 2 B 3.6-72 Revision No. 0

Secondary Containment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment BASES BACKGROUND The function of the secondary containment is to contain and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be OPERABLE, or that take place outside primary containment.

The secondary containment is a structure that completely encloses the primary containment and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump and motor heat load additions). To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System."

APPLICABLE There are two principal accidents for which credit is taken SAFETY ANALYSES for secondary containment OPERABILITY. These are a loss of coolant accident (LOCA) (Ref. 1) and a fuel handling accident inside secondary containment (Ref. 2). The secondary containment performs no active function in response to each of these limiting events; however, its leak (continued)

PBAPS UNIT 2 B 3.6-73 Revision No. 0

Secondary Containment B 3.6.4.1 BASES APPLICABLE tightness is required to ensure that fission products SAFETY ANALYSES entrapped within the secondary containment structure will be (continued) treated by the SGT System prior to discharge to the environment.

Secondary containment satisfies Criterion 3 of the NRC Policy Statement.

LCO An OPERABLE secondary containment provides a control volume into which fission products that leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs), during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment.

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

(continued)

PBAPS UNIT 2 B 3.6-74 Revision No. 0

Secondary Containment B 3.6.4.1 BASES ACTIONS B.] and B.2 (continued)

If secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.I. C.2. and C.3 Movement of irradiated fuel assemblies in the secondary containment, CORE ALTERATIONS, and OPDRVs can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. CORE ALTERATIONS and movement of irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

(continued)

PBAPS UNIT 2 B 3.6-75 Revision No. 0

Secondary Containment Secondary Containment B 3.6.4.1 BASES (continued)

SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2 REQUIREMENTS Verifying that secondary containment equipment hatches and one access door in each access opening are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application, the term "sealed" has no connotation of leak tightness.

Maintaining secondary containment OPERABILITY requires verifying one door in the access opening is closed. An access opening contains one inner and one outer door. In some cases, secondary containment access openings are shared such that a secondary containment barrier may have multiple inner or multiple outer doors. The intent is to not breach secondary containment at any time when secondary containment is required. This is achieved by maintaining the inner or outer portion of the barrier closed at all times. However, all secondary containment access doors are normally kept closed, except when the access opening is being used for entry and exit or when maintenance is being performed on an access opening. The 31 day Frequency for these SRs has been shown to be adequate, based on operating experience, and is considered adequate in view of the other indications of door and hatch status that are available to the operator.

SR 3.6.4.1.3 and SR 3.6.4.1.4 The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment.

To ensure that fission products are treated, SR 3.6.4.1.3 verifies that the SGT System will rapidly establish and maintain a pressure in the secondary containment that is less than the pressure external to the secondary containment boundary. This is confirmed by demonstrating that one SGT subsystem will draw down the secondary containment to 2 0.25 inches of vacuum water gauge in

120 seconds. This cannot be accomplished if the secondary containment boundary is not intact.

SR 3.6.4.1.4 demonstrates that one SGT subsystem can maintain 2 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at a flow rate f 10,500 cfm. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months test period allows secondary containment to be in thermal equilibrium at steady (continued)

Revision No. 26 2 B 3.6-76 PBAPS UNIT UNIT 2 B 3.6-76 Revision No. 26

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.3 and SR 3.6.4.1.4 (continued)

REQUIREMENTS state conditions. Therefore, these two tests are used to ensure secondary containment boundary integrity. Since these SRs are secondary containment tests, they need not be performed with each SGT subsystem. The SGT subsystems are tested on a STAGGERED TEST BASIS, however, to ensure that in addition to the requirements of LCO 3.6.4.3, either SGT subsystem will perform this test. Operating experience has shown these components will usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 14.6.3.

2. UFSAR, Section 14.6.4.

PBAPS UNIT 2 B 3.6-77 Revision No. 26

SCIVs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs)

BASES BACKGROUND The function of the SCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. I and 2). Secondary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that fission products that leak from primary containment following a DBA, or that are released during certain operations when primary containment is not required to be OPERABLE or take place outside primary containment, are maintained within the secondary containment boundary.

The OPERABILITY requirements for SCIVs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. These isolation devices consist of either passive devices or active (automatic) devices. Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), and blind flanges are considered passive devices.

Automatic SCIVs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA or other accidents.

Other penetrations are isolated by the use of valves in the closed position or blind flanges.

APPLICABLE The SCIVs must be OPERABLE to ensure the secondary SAFETY ANALYSES containment barrier to fission product releases is established. The principal accidents for which the secondary containment boundary is required are a loss of coolant accident (Ref. 1) and a fuel handling accident inside secondary containment (Ref. 2). The secondary containment performs no active function in response to either of these limiting events, but the boundary (continued)

PBAPS UNIT 2 B 3.6-78 Revision No. 0

SCIVs SCIVs B 3.6.4.2 BASES APPLICABLE established by SCIVs is required to ensure that leakage from SAFETY ANALYSES the primary containment is processed by the Standby Gas (continued) Treatment (SGT) System before being released to the environment.

Maintaining SCIVs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.

SCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO SCIVs form a part of the secondary containment boundary.

The SCIV safety function is related to control of offsite radiation releases resulting from DBAs.

The power operated isolation valves are considered OPERABLE when their isolation times are within limits and the valves actuate on an automatic isolation signal. The valves covered by this LCO, along with their associated stroke times, are listed in Reference 3.

The normally closed isolation valves or blind flanges are considered OPERABLE when manual valves are closed or open in accordance with appropriate administrative controls, automatic SCIVs are de-activated and secured in their closed position, and blind flanges are in place. These passive isolation valves or devices are listed in Reference 3.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, the OPERABILITY of SCIVs is required.

In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIVs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant radioactive releases can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs), during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment. Moving irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3.

(continued)

PBAPS UNIT 2 B 3.6-79 Revision No. 0

SCIVs B 3.6.4.2 BASES (continued)

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when a need for secondary containment isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCIV. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCIV.

A.1 and A.2 In the event that there are one or more penetration flow paths with one SCIV inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic SCIV, a closed manual valve, and a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. The Required Action must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time. The specified time period is reasonable considering the time required to isolate the penetration, and the probability of a DBA, which requires the SCIVs to close, occurring during this short time is very low.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary (continued)

PBAPS UNIT 2 B 3.6-80 Revision No. 0

SC IVs SCIVs B 3.6.4.2 BASES ACTIONS A.1 and A.2 (continued) containment penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be in the isolation position should an event occur. The Completion Time of once per 31 days is appropriate because the isolation devices are operated under administrative controls and the probability of their misalignment is low. This Required Action does not require any testing or device manipulation. Rather, it involves verification that the affected penetration remains isolated.

Required Action A.2 is modified by a Note that applies to devices located in high radiation areas and allows them to be verified closed by use of administrative controls.

Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

B.1 With two SCIVs in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable considering the time required to isolate the penetration and the probability of a DBA, which requires the SCIVs to close, occurring during this short time, is very low.

The Condition has been modified by a Note stating that Condition B is only applicable to penetration flow paths with two isolation valves. This clarifies that only Condition A is entered if one SCIV is inoperable in each of two penetrations.

(continued)

PBAPS UNIT 2 B 3.6-81 Revision No. 0

SCIVs B 3.6.4.2 BASES ACTIONS C.1 and C.2 (continued)

If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1. D.2. and D.3 If any Required Action and associated Completion Time are not met, the plant must be placed in a condition in which the LCO does not apply. If applicable, CORE ALTERATIONS and the movement of irradiated fuel assemblies in the secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potential for fission product release.

Actions must continue until OPDRVs are suspended.

Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving fuel while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies that each secondary containment manual isolation valve and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those SCIVs in secondary containment that are capable of being mispositioned are in the correct position.

(continued)

PBAPS UNIT 2 B 3.6-82 Revision No. 0

SCIVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.1 (continued)

REQUIREMENTS Since these SCIVs are readily accessible to personnel during normal operation and verification of their position is relatively easy, the 31 day Frequency was chosen to provide added assurance that the SCIVs are in the correct positions.

Two Notes have been added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIVs, once they have been verified to be in the proper position, is low.

A second Note has been included to clarify that SCIVs that are open under administrative controls are not required to meet the SR during the time the SCIVs are open.

SR 3.6.4.2.2 Verifying that the isolation time of each power operated and each automatic SCIV is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCIV will isolate in a time period less than or equal to that assumed in the safety analyses. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.4.2.3 Verifying that each automatic SCIV closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a DBA or other accidents. This SR ensures that each automatic SCIV will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance (continued)

PBAPS UNIT 2 B 3.6-83 Revision No. 0

SCIVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.3 (continued)

REQUIREMENTS under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components will usually pass the Surveillance when performed at the 24 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 14.6.3.

2. UFSAR, Section 14.6.4.

3. Technical Requirements Manual.

PBAPS UNIT 2 B 3.6-84 Revision No. 0

SGT System B 3.6.4.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.3 Standby Gas Treatment (SGT) System BASES BACKGROUND The SGT System is required by UFSAR design criteria (Ref. 1). The function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment.

A single SGT System is common to both Unit 2 and Unit 3 and consists of two fully redundant subsystems, each with its own set of ductwork, dampers, valves, charcoal filter train, and controls. Both SGT subsystems share a common inlet plenum. This inlet plenum is connected to the refueling floor ventilation exhaust duct for each Unit and to the suppression chamber and drywell of each Unit. Both SGT subsystems exhaust to the plant offgas stack through a common exhaust duct served by three 100% capacity system fans. SGT System fans OAV020 and OBV020 automatically start on Unit 2 secondary containment isolation signals. SGT System fans OCV020 and OBV020 automatically start on Unit 3 secondary containment isolation signals.

Each charcoal filter train consists of (components listed in order of the direction of the air flow):

a. A demister or moisture separator;

b. An electric heater;

c. A prefilter;

d. A high efficiency particulate air (HEPA) filter;

e. A charcoal adsorber; and

f. A second HEPA filter.

The SGT System is sized such that each 100% capacity fan will provide a flow rate of 10,500 cfm at 20 inches water gauge static pressure to support the control of fission product releases. The SGT System is designed to restore and maintain secondary containment at a negative pressure of 0.25 inches water gauge relative to the atmosphere following (continued)

PBAPS UNIT 2 B 3.6-85 Revision No. 0

SGT System B 3.6.4.3 BASES BACKGROUND the receipt of a secondary containment isolation signal.

(continued) Maintaining this negative pressure is based upon the existence of calm wind conditions (up to 5 mph), a maximum SGT System flow rate of 10,500 cfm, outside air temperature of 95*F and a temperature of 150F for air entering the SGT System from inside secondary containment.

The demister is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70% (Ref. 2). The prefilter removes large particulate matter, while the HEPA filter removes fine particulate matter and protects the charcoal from fouling. The charcoal adsorber removes gaseous elemental iodine and organic iodides, and the final HEPA filter collects any carbon fines exhausted from the charcoal adsorber.

The SGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. Following initiation, two charcoal filter train fans (OAV020 and OBV020) start. Upon verification that both subsystems are operating, the redundant subsystem is normally shut down.

APPLICABLE The design basis for the SGT System is to mitigate the SAFETY ANALYSES consequences of a loss of coolant accident and fuel handling accidents (Ref. 2). For all events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.

The SGT System satisfies Criterion 3 of the NRC Policy Statement.

LCO Following a DBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two OPERABLE subsystems ensures operation of at least one SGT subsystem in the event of a single active failure.

(continued)

PBAPS UNIT 2 B 3.6-86 Revision No. 0

SGT System B 3.6.4.3 BASES LCO For Unit 2, one SGT subsystem is OPERABLE when one charcoal (continued) filter train, one fan (OAV020) and associated ductwork, dampers, valves, and controls are OPERABLE. The second SGT subsystem is OPERABLE when the other charcoal filter train, one fan (OBV020) and associated ductwork, damper, valves, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES.

In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System in OPERABLE status is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel (OPDRVs), during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the secondary containment.

ACTIONS A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status in 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period.

B.1 and B.2 If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within (continued)

PBAPS UNIT 2 B 3.6-87 Revision No. 0

SGT System B 3.6.4.3 BASES ACTIONS B.1 and B.2 (continued) 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1. C.2.1. C.2.2. and C.2.3 During movement of irradiated fuel assemblies, in the secondary containment, during CORE ALTERATIONS, or during OPDRVs, when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should immediately be placed in operation. This action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the plant in a condition that minimizes risk. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies must immediately be suspended. Suspension of these activities must not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

(continued)

PBAPS UNIT 2 B 3.6-88 Revision No. 0

SGT System B 3.6.4.3 BASES ACTIONS D.1 (continued)

If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT System may not be capable of supporting the required radioactivity release control function. Therefore, actions are required to enter LCO 3.0.3 immediately.

E.1. E.2. and E.3 When two SGT subsystems are inoperable, if applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in secondary containment must immediately be suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must immediately be initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

Required Action E.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem (including each filter train fan) for 2 15 minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on (automatic heater cycling to maintain temperature) for > 15 minutes every 31 days is sufficient to eliminate moisture on the adsorbers and HEPA filters since during idle periods instrument air is injected into the filter plenum to keep the filters dry. The 31 day Frequency was developed in consideration of the known reliability of fan motors and controls and the redundancy available in the system.

(continued)

PBAPS UNIT 2 B 3.6-89 Revision No. 0

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.2 REQUIREMENTS (continued) This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).

Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.6.4.3.3 This SR verifies that each SGT subsystem starts on receipt of an actual or simulated initiation signal. While this Surveillance can be performed with the reactor at power, operating experience has shown that these components will usually pass the Surveillance when performed at the 24 month Frequency. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.6.2, "Secondary Containment Isolation Instrumentation," overlaps this SR to provide complete testing of the safety function.

Therefore, the Frequency was found to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 1.5.1.6.

2. UFSAR, Section 14.9.

PBAPS UNIT 2 B 3.6-90 Revision No. 1 .

ML031250401

Text

Navigation menu

Search