ML040820671

Tech Spec Pages for Amendment 219, Selective Implementation of Alternate Source Term

ML040820671
Person / Time
Site:	Millstone
Issue date:	03/17/2004
From:	Office of Nuclear Reactor Regulation
To:
References
TAC MB8137
Download: ML040820671 (38)

Text

INDEX LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS SECTION PAGE 3/4.9.6 REFUELING MACHINE .................................................. 3/4 9-6 3/4.9.7 CRANE TRAVEL - SPENT FUEL STORAGE AREAS ............................ 3/4 9-7 3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION High Water Level .................................................. 3/4 9-8 Low Water Level ................................................. 3/4 9-9 3/4.9.9 DELETED .................................................. 3/4 9-10 I 3/4.9.10 WATER LEVEL - REACTOR VESSEL ................................................. 3/4 9-11 3/4.9.11 WATER LEVEL - STORAGE POOL ................................................. 3/4 9-12 3/4.9.12 DELETED .................................................. 3/4 9-13 I 3/4.9.13 SPENT FUEL POOL - REACTIVITY ................................................. 3/4 9-16 3/4.9.14 SPENT FUEL POOL - STORAGE PATTERN ......................................... 3/4 9-17 FIGURE 3.9-1 MINIMUM FUEL ASSEMBLY BURNUP VERSUS NOMINAL INITIAL ENRICHMENT FOR REGION I 4-OUT-OF-4 STORAGE CONFIGURATION ................................................. 3/4 9-18 FIGURE 3.9-2 REGION 1 3-OUT-OF-4 STORAGE FUEL ASSEMBLY LOADING SCHEMATIC .................... ............................. 3/4 9-19 FIGURE 3.9-3 MINIMUM FUEL ASSEMBLY BURNUP VERSUS NOMINAL INITIAL ENRICHMENT FOR REGION 2 STORAGE CONFIGURATION ................................................. 3/4 9-20 FIGURE 3.9-4 MINIMUM FUEL ASSEMBLY BURNUP AND DECAY TIME VERSUS NOMINAL INITIAL ENRICHMENT FOR REGION 3 STORAGE CONFIGURATION .................................................. 3/4 9-21 3/4.10 SPECIAL TEST EXCEPTIONS 3/4.10.1 SHUTDOWN MARGIN ............. .................................... 3/4 10-l 3/4.10.2 GROUP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS 3/4 10-2 3/4.10.3 PHYSICS TESTS ...................... 3/4 10-4 3/4.10.4 REACTOR COOLANT LOOPS ...................... 3/4 10-5 3/4.10.5 DELETED 3/4.11 DELETED 3/4.11.1 DELETED 3/4.11.2 DELETED 3/4.11.3 DELETED MILLSTONE - UNIT 3 xii Amendment No. 39, 89, 48, 4-89, 207-,

219

INDEX BASES SECTION PAGE 3/4.7.11 DELETED ................................................. B 3/4 7-25 3/4.7.12 DELETED 3/4.7.13 DELETED 314.7.14 AREA TEMPERATURE MONITORING.................................................... B 3/4 7-25 3/4.8 ELECTRICAL POWER SYSTEMS 3/4.8.1, 3/4.8.2, and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, AND ONSITE POWER DISTRIBUTION ................................ ................. B 3/4 8-1 3/4.8.4 DELETED ................................................. B 3/4 8-3 3/4.9 REFUELING OPERATIONS 3/4.9.1 BORON CONCENTRATION . B 3/4 9-1 3/4.9.2 INSTRUMENTATION .B 3/4 9-1 3/4.9.3 DECAY TIME................................................................................................. B 3/4 9-1 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS . B 3/4 9-1 3/4.9.5 COMMUNICATIONS .B 3/4 9-1 3/4.9.6 REFUELING MACHINE................................................................................ B 3/4 9-2 3/4.9.7 CRANE TRAVEL - SPENT FUEL STORAGE AREAS .B 3/4 9-2 3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION . B 3/4 9-2 3/4.9.9 DELETED .B 3/4 9-7 3/4.9.10 and 3/4.9.11 WATER LEVEL - REACTOR VESSEL AND STORAGE POOL............................................................................................ B 3/4 9-8 3/4.9.12 DELETED ........................................... B 3/4 9-8 3/4.9.13 SPENT FUEL POOL - REACTIVITY ................. ........................ B 3/4 9-8 3/4.9.14 SPENT FUEL POOL - STORAGE PATTERN ......................................... B 3/4 9-8 3/4.10 SPECIAL TEST EXCEPTIONS 3/4.10.1 SHUTDOWN MARGIN .B 3/4 10-1 3/4.10.2 GROUP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS. B 3/4 10-1 3/4.10.3 PHYSICS TESTS .B 3/4 10-1 3/4.10.4 REACTOR COOLANT LOOPS .B 3/4 10-1 3/4.10.5 DELETED. B 3/4 10-1 MILLSTONE - UNIT 3 xv Amendment No. 84, 89, 4-0, 40, 44-19, 4-6,4-89, 492, 24, -44, 219

TABLE 3.3-3 (Continued)

EN( NEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATTON MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE 2 FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION 3

w 3. Containment Isolation (Continued)

3. Containment 4 2 3 1,2,3,4 17 Pressure-High-3

c. DELETED I

W

4. Steam Line Isolation

a. Manual Initiation

1. Individual I/steam line I/steam line I/operating 1,2,3,4 24 steam line

2. System 2 1 2 1,2,3,4 23

b. Automatic Actuation 2 1 2 1,2,3,4 22 Logic and Actuation Relays

-3

c. Containment 3 2 2 1, 2,3,4 20 ca.

AD Pressure--

B High-2 z0 d. Steam Line Pressure-- 3/steam line in 2/steam line in 2/steam line in 1,2,3# 20 Low each operating any operating each operating loop loop loop

e. Steam Line Pressure - 3/steam line in 2/steam line in 2/steam line in 20 Negative Rate--High each operating any operating each operating loop loop loop

%D

TABLE 3.3-3 (Continued)

TABLE NOTATIONS

1. TheSteamline Isolation Logic and Safety Injection Logic for this trip function may be blocked in this MODE below the P-i I (Pressurizer Pressure Interlock) Setpoint.

• MODES 1,2, 3, and 4. I During fuel movement within containment or the spent fuel pool.

• • • • Trip function automatically blocked above P- Il and may be blocked below P-I I when Safety Injection on low steam line pressure is not blocked.

I ACTION STATEMENTS ACTION 14- With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> or be in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />; however, one channel may be bypassed for up to 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE.

ACTION 15- (not used).

ACTION 16- With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed until performance of the next required ANALOG CHANNEL OPERATIONAL TEST provided the inoperable channel is placed in the tripped condition within I hour.

ACTION 17- With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the inoperable channel is placed in the bypassed condition and the Minimum Channels OPERABLE requirement is met. One additional channel may be bypassed for up to 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for surveillance testing per Specification 4.3.2.1.

ACTION 18- With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 7 days.

After 7 days, or if no channels are OPERABLE, immediately suspend fuel I movement, if applicable, and be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

ACTION 19- With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours2 days <br />0.286 weeks <br />0.0658 months <br /> or be in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

MILLSTONE - UNIT 3 3/4 3-24 Amendment No. -, XG, 89, 429, 2, 219

TABLE 3.3-3 (Continued)

ACTION STATEMENTS (Continued)

ACTION 20 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br />, and

b. the Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for surveillance testing of other channels per Specification 4.3.2. 1.

ACTION 21 - With less than the Minimum Number of Channels OPERABLE, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or apply Specification 3.0.3.

ACTION 22 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> or be in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in at least HOT SHUTDOWN within the following 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br />; however, one channel may be bypassed for up to 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE.

ACTION 23 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours2 days <br />0.286 weeks <br />0.0658 months <br /> or be in at least HOT STANDBY within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in at least HOT SHUTDOWN within the following 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br />.

ACTION 24 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours2 days <br />0.286 weeks <br />0.0658 months <br /> or declare the associated valve inoperable and take the ACTION required by Specification 3.7.1.5.

ACTION 25 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> or be in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br />; however, one channel may be bypassed for up to 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE.

ACTION 26 - DELETED I MILLSTONE - UNIT 3 3/4 3-25 Amendment No. 70, -29,219

TABLE 3.3-4 H TURES ACTUATION SYSTEM INSTRUMENTATION TRIP SETPOINTS g ENGINEERED SAFECTY FEA' Z

NOMINAL C FUNCTIONAL UNIT TRIP SETPOINT ALLOWABLE VALUE 3 3. Containment Isolation (Continued)

'-3

2. Automatic Actuation Logic N.A. N.A.

and Actuation Relays

3. Safety Injection See Item 1. above for all Safety Injection Trip Setpoints and Allowable Values.

W

b. Phase "B" Isolation

'J

1. Manual Initiation N.A. N.A.

2. Automatic Actuation N.A. N.A.

Logic and Actuation Relays

3. Containment Pressure- 22.7 psia < 22.9 psia High-3

c. DELETED I

4. Steam Line Isolation

-3 a. Manual Initiation N.A. N.A.

AD b. Automatic Actuation Logic N.A. N.A.

0:z and Actuation Relays ok

c. Containment Pressure-High-2 17.7 psia < 17.9 psia

d. Steam Line Pressure--Low 658.6 psig* 2 654.7 psig*

'0 e. Steam Line Pressure - 100 ps/s** < 103.9 psi/s**

%O Negative Rate--High

TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REOUIREMENTS TRIP ANALOG ACTUATING MODES CHANNEL DEVICE MASTER SLAVE FOR WHICH 0 CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELAY SURVEILLANCE S FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST TEST TEST IS REOUIRED 2 3. Containment Isolation H a. Phase "A" Isolation

1. Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1,2,3,4

2. Automatic Actuation N.A. N.A. N.A. N.A. M(l) M(l) Q (4) 1,2,3,4 Logic and Actuation Relays

3. Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements.

4 b. Phase "B" Isolation

1. Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1,2,3,4

2. Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(l) Q (4) 1,2,3,4 Logic and Actuation

> Relays 3 3. Containment S R Q N.A. N.A. N.A. N.A. 1,2,3,4 Pressure-High-3 CD

c. DELETED I Z 4. Steam Line Isolation p

&; d. Manual Initiation

1. Individual N.A. N.A. N.A. R N.A. N.A. N.A. 1,2,3,4

2. System N.A. N.A. N.A. R N.A. N.A. N.A. 1,2,3,4

TABLE 4.3-2 (Continued)

TABLE NOTATION

1. Each train shall be tested at least every 62 days on a STAGGERED TEST BASIS.

2. This surveillance may be performed continuously by the emergency generator load sequencer auto test system as long as the EGLS auto test system is demonstrated operable by the performance of an ACTUATION LOGIC TEST at least once per 92 days.

3. On a monthly basis, a loss of voltage condition will be initiated at each undervoltage monitoring relay to verify individual relay operation. Setpoint verification and actuation of the associated logic and alarm relays will be performed as part of the channel calibration required once per 18 months.

4. For Engineered Safety Features Actuation System functional units with only Potter &

Brumfield MDR series relays used in a clean, environmentally controlled cabinet, as discussed in Westinghouse Owners Group Report WCAP- 13900, the surveillance interval for slave relay testing is R.

• MODES 1, 2,3, and 4.

During fuel movement within containment or the spent fuel pool.

MILLSTONE - UNIT 3 3/4 3-41 Amendment No. 41, 74, 79, 400, 429, 498,20, 219

PLANT SYSTEMS 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM LIMITING CONDITION FOR OPERATION 3.7.7 Two independent Control Room Emergency Air Filtration Systems shall be OPERABLE#

APPLICABILITY: MODES 1, 2,3,4,5 and 6.

During fuel movement within containment or the spent fuel pool.

ACTION:

MODES 1, 2,3 and 4:

a. With one Control Room Emergency Air Filtration System inoperable, restore the inoperable system to OPERABLE status within 7 days or be in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

b. With both Control Room Emergency Air Filtration Systems inoperable, except as specified in ACTION c., immediately suspend the movement of fuel within the spent fuel pool. Restore at least one inoperable system to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

c. With both Control Room Emergency Air Filtration Systems inoperable due to an inoperable Control Room boundary, immediately suspend the movement of fuel within the spent fuel pool and restore the Control Room boundary to OPERABLE status within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> or be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

MODES 5 and 6, and durimg fuel movement within containment or the spent fuel pool:

d. With one Control Room Emergency Air Filtration System inoperable, restore the inoperable system to OPERABLE status within 7 days. After 7 days, either initiate and maintain operation of the remaining OPERABLE Control Room Emergency Air Filtration System in the recirculation mode of operation, or immediately suspend the movement of fuel.

e. With both Control Room Emergency Air Filtration Systems inoperable, or with the OPERABLE Control Room Emergency Air Filtration System required to be in the recirculation mode by ACTION d. not capable of being powered by an OPERABLE emergency power source, immediately suspend the movement of fuel.

1. The Control Room boundary may be opened intermittently under administrative control.

MILLSTONE - UNIT 3 3/4 7-15 Amendment No. I4-84, 203, 219

PLANT SYSTEMS 3/4.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM LIMITING CONDITION FOR OPERATION 3.7.8 Two independent Control Room Envelope Pressurization Systems shall be OPERABLE.#

APPLICABILITY: MODES 1, 2, 3,4,5 and 6.

During fuel movement within containment or the spent fuel pool.

ACTION:

MODES 1, 2, 3,and 4:

a. With one Control Room Envelope Pressurization System inoperable, restore the system to OPERABLE status within 7 days, or be in HOT STANDBY within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

b. With both Control Room Envelope Pressurization Systems inoperable, except as specified in ACTION c. or ACTION d., immediately suspend the movement of fuel within the spent fuel pool. Restore at least one inoperable system to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

c. With both Control Room Envelope Pressurization Systems inoperable due to an inoperable Control Room boundary, immediately suspend the movement of fuel within the spent fuel pool. Restore the Control Room boundary to OPERABLE status within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> or be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

d. With both Control Room Envelope Pressurization Systems inoperable during the performance of Surveillance Requirement 4.7.8.c and the system not being tested under administrative control, immediately suspend the movement of fuel within the spent fuel pool. Restore at least one inoperable system to OPERABLE status within 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> or be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

MODES 5 and 6, and fuel movement within containment or the spent fuel pool:

e. With one Control Room Envelope Pressurization System inoperable, restore the inoperable system to OPERABLE status within 7 days. After 7 days, immediately suspend the movement of fuel.

f. With both Control Room Envelope Pressurization Systems inoperable, immediately suspend the movement of fuel.

I The Control Room boundary may be opened intermittently under administrative control.

MILLSTONE - UNIT 3 3/4 7-18 Amendment No. 184-, 23, 219

REFUELING OPERATIONS 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS LIMITING CONDITION FOR OPERATION 3.9.4 The containment building penetrations shall be in the following status:

a. The equipment access hatch shall be either:

1. closed and held in place by a minimum of four bolts, or

2. open under administrative control

• and capable of being closed and held in place by a minimum of four bolts,

b. A personnel access hatch shall be either:

l. closed by one personnel access hatch door, or

2. capable of being closed by an OPERABLE personnel access hatch door, under administrative control,* and

c. Each penetration providing direct access from the containment atmosphere to the outside atmosphere shall be either:

I. Closed by an isolation valve, blind flange, or manual valve, or

2. Be capable of being closed under administrative control.*

APPLICABILITY: During movement of fuel within the containment building.

ACTION:

With the requirements of the above specification not satisfied, immediately suspend all operations involving movement of fuel in the containment building.

SURVEILLANCE REQUIREMENTS 4.9.4.a Verify each required containment penetrations is in the required status at least once per 7 days.

4.9.4.b DELETED

• Administrative controls shall ensure that appropriate personnel are aware that the equipment access hatch penetration, personnel access hatch doors and/or other containment penetrations are open, and that a specific individual(s) is designated and available to close the equipment access hatch penetration, a personnel access hatch door and/or other containment penetrations within 30 minutes if a fuel handling accident occurs. Any obstructions (e.g. cables and hoses) that could prevent closure of the equipment access hatch penetration, a personnel access hatch door and/or other containment penetrations must be capable of being quickly removed.

MILLSTONE - UNIT 3 3/4 9-4 Amendment No. 2O3, 219

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3 3/4 9-10 Amendment No. -, iO, 219

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3 3/4 9-13 Amendment No. -, a, 405, i2, 4-7, 20,2-G6, 219

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 3 3/4 9-14 Amendment No. 2, 42, 4-84, 206, 219

THIS PAGE INTENTIONALLY LEFI BLANK MILLSTONE - UNIT 3 3/4 9-15 Amendment 4i3, i3, 219

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

The methodology, as defined in WCAP-10991 to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties in the channels. Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation.

The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESF Table (Item 7E). For these radiation monitors the allowable values are essentially nominal values. Due to the uncertainties involved in radiological parameters, the methodologies of WCAP-10991 were not applied. Actual trip setpoints will be reestablished below the allowable value based on calibration accuracies and good practices.

The operability requirements for Table 3.3-3, Functional Units 7.a, "Control Building Isolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building Inlet Ventilation Radiation," are defined by table notation "*". These functional units are required to be OPERABLE at all times during plant operation in MODES 1, 2, 3, and 4. These functional units are also required to be OPERABLE during fuel movement within containment or the spent fuel pool, as specified by table notation "*". This table notation is also applicable during fuel movement within containment or the spent fuel pool. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged. Therefore, the movement of either new or irradiated fuel (assemblies or individual fuel rods) can cause a fuel handling accident, and functional units 7.a and 7.e are required to be OPERABLE whenever new or irradiated fuel is moved within the containment or the storage pool. Table notation "*" of Table 4.3-2 has the same applicability.

The verification of response time at the specified frequencies provides assurance that the reactor trip and the engineered safety features actuation associated with each channel is completed within the time limit assumed in the safety analysis. No credit is taken in the analysis for those channels with response times indicated as not applicable (i.e., N.A.).

MILLSTONE - UNIT 3 B 3/4 3-2 Amendment No. 3,-94-, 49, 47, 4-8, 219

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-1 3632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test. Detector response times may be measured by the in-situ online noise analysis-response time degradation method described in the Westinghouse Topical Report, "The Use of Process Noise Measurements to Determine Response Characteristics of Protection Sensors in U.S. Plants," dated August 1983.

WCAP-14036, Revision I, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.

The allocations for sensor, signal conditioning and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

The Engineered Safety Features Actuation System senses selected plant parameters and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents, events, and transients. Once the required logic combination is completed, the system sends actuation signals to those Engineered Safety Features components whose aggregate function best serves the requirements of the condition. As an example, the following actions may be initiated by the Engineered Safety Features Actuation System to mitigate the consequences of a steam line break or loss-of-coolant accident: (1) Safety Injection pumps start and automatic valves position, (2)

Reactor trip, (3) feed-water isolation, (4) startup of the emergency diesel generators, (5) quench spray pumps start and automatic valves position, (6) containment isolation, (7) steam line isolation, (8) Turbine trip, (9) auxiliary feedwater pumps start, (10) service water pumps start and automatic valves position, and (1 1) Control Room isolates.

MILLSTONE - UNIT 3 B 3/4 3-2a Amendment No. 3, 93, 499, 219

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

For slave relays, or any auxiliary relays in ESFAS circuits that are of the type Potter & Brumfield MDR series relays, the SLAVE RELAY TEST is performed at an "R" frequency (at least once every 18 months) provided the relays meet the reliability assessment criteria presented in WCAP-13878, "Reliability Assessment of Potter and Brumfield MDR series relays," and WCAP-13900, "Extension of Slave Relay Surveillance Test Intervals." The reliability assessments performed as part of the aforementioned WCAPs are relay specific and apply only to Potter and Brumfield MDR series relays. Note that for normally energized applications, the relays may have to be replaced periodically in accordance with the guidance given in WCAP-13878 for MDR relays.

REACTOR TRIP BREAKER This trip function applies to the reactor trip breakers (RTBs) exclusive of individual trip mechanisms. The LCO requires two operable trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the control rod drive (CRD) system. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability.

These trip functions must be OPERABLE in MODE I or 2 when the reactor is critical. In MODE 3,4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD system is capable of rod withdrawal .

BYPASSED CHANNEL* - Technical Specifications 3.3.1 and 3.3.2 often allow the bypassing of instrument channels in the case of an inoperable instrument or for surveillance testing .

A BYPASSED CHANNEL shall be a channel which is:

• Required to be in its accident or tripped condition, but is not presently in its accident or tripped condition using a method described below; or

• Prevented from tripping.

MILLSTONE - UNIT 3 B 3/4 3-2b Amendment No. 219

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

A channel may be bypassed by:

• Insertion of a simulated signal to the bistable; or

• Failing the transmitter or input device to the bypassed condition; or

• Returning a channel to service in a untripped condition; or

• An equivalent method, as determined by Engineering and I&C

• Bypass switches exist only for NIS source range, NIS intermediate range, and containment pressure Hi-3.

TRIPPED CHANNEL - Technical Specifications 3.3.1 and 3.3.2 often require the tripping of instrument channels in the case of an inoperable instrument or for surveillance testing.

A TRIPPED CHANNEL shall be a channel which is in its required accident or tripped condition.

A channel may be placed in trip by:

• The Bistable Trip Switches; or

• Insertion of a simulated signal to the bistable; or

• Failing the transmitter or input device to the tripped condition; or

• An equivalent method, as determined by Engineering and I&C The Engineered Safety Features Actuation System interlocks perform the following functions:

PA Reactor tripped - Actuates Turbine trip, closes main feedwater valves on Tavg below Setpoint, prevents the opening of the main feedwater valves which were closed by a Safety Injection or High Steam Generator Water Level signal, allows Safety Injection block so that components can be reset or tripped.

Reactor not tripped - prevents manual block of Safety Injection.

MILLSTONE - UNIT 3 B 3/4 3-3 Amendment No. 4-3+, 464,219

INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEEREDl SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

P-I 1 On increasing pressurizer pressure, P-I I automatically reinstates Safety Injection actuation on low pressurizer pressure and low steam line pressure. On decreasing pressure, P-I 1 allows the manual block of Safety Injection actuation on low pressurizer pressure and low steam line pressure.

P-12 On increasing reactor coolant loop temperature, P-12 automatically provides an arming signal to the Steam Dump System. On decreasing reactor coolant loop temperature, P-12 automatically removes the arming signal from the Steam Dump System.

P-14 On increasing steam generator water level, P-14 automatically trips all feedwater isolation valves, main feed pumps and main turbine, and inhibits feedwater control valve modulation.

3/4.3.3 MONITORING INSTRUMENTATION 3/4.3.3.1 RADIATION MONITORING FOR PLANT OPERATIONS The OPERABILITY of the radiation monitoring instrumentation for plant operations ensures that: (1) the associated action will be initiated when the radiation level monitored by each channel or combination thereof reaches its Setpoint, (2) the specified coincidence logic is maintained, and (3) sufficient redundancy is maintained to permit a channel to be out-of-service for testing or maintenance. The radiation monitors for plant operations senses radiation levels in selected plant systems and locations and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents and abnormal conditions. Once the required logic combination is completed, the system sends actuation signals to initiate alarms.

3/4.3.3.2 DELETED 3/4.3.3.3 DELETED 3/4.3.3.4 DELETED MILLSTONE - UNIT 3 B 3/4 3-4 Amendment No. 49-3, 219

INSTRUMENTATION BASES 3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the Remote Shutdown Instrumentation ensures that sufficient capability is available to permit safe shutdown of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criterion 19 of 10 CFR Part 50.

Calibration of the Intermediate Range Neutron Amps channel from Table 4.3-6 applies to the signal that originates from the output of the isolation amplifier within the intermediate range neutron flux processor drawers in the control room and terminates at the displays within the Auxiliary Shutdown Panel.

The OPERABILITY of the Remote Shutdown Instrumentation ensures that a fire will not preclude achieving safe shutdown. The remote shutdown monitoring instrumentation, control, and power circuits and transfer switches necessary to eliminate effects of the fire and allow operation of instrumentation, control and power circuits required to achieve and maintain a safe shutdown condition are independent of areas where a fire could damage systems normally used to shut down the reactor. This capability is consistent with General Design Criterion 3 and Appendix R to 10 CFR Part 50.

3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables following an accident. The instrumentation included in this specification are those instruments provided to monitor key variables, designated as Category 1 instruments following the guidance for classification contained in Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident."'

MILLSTONE - UNIT 3 B 3/4 3-5 Amendment No. , 6, g4,44-2, 219

INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)

Action Statement "a":

The use of one main control board indicator and one computer point, total of two indicators per steam generator, meets the requirements for the total number of channels for Auxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification for each steam generator are as follows:

team Instrument (MB5) Instrument (Computer)

Generator 3/G 1 FWA*FI5lAl (Orange) FWA - F33A3 (Purple) 3/G 2 FWA*FI33B1 (Purple) FWA - F51B3 (Orange) i/G 3 FWA*FI33C1 (Purple) FWA - F51C3 (Orange) 3/G 4 FWA*FI5 ID 1 (Orange) FWA - F33D3 (Purple)

The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes following an LOP when the power supply for the plant computer is lost. However, this design configuration

- one continuous main control board indicator and one indication via the SPDS/plant computer, total of two per steam generator - was submitted to the NRC via "Response to question 420.6" dated January 13, 1984, B 11002. NRC review and approval was obtained with the acceptance of MP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (dated November 1985).

LCO 3.3.3.6, Table 3.3.10, Item (17), requires 2 OPERABLE reactor vessel water level (heated junction thermocouples - HJTC) channels. An OPERABLE reactor vessel water level channel shall be defined as:

1. Four or more total sensors operating.

2. At least one of two operating sensors in the upper head.

3. At least three of six operating sensors in the upper plenum.

MILLSTONE - UNIT 3 B 3/4 3-5a Amendment No. , 76, 84, 44I, 219

INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)

A channel is operable if four or more sensors, half or more in the upper head region and half or more in the upper plenum region, are OPERABLE.

In the event more than four sensors in a Reactor Vessel Level channel are inoperable, repairs may only be possible during the next refueling outage. This is because the sensors are accessible only after the missile shield and reactor vessel head are removed. It is not feasible to repair a channel except during a refueling outage when the missile shield and reactor vessel head are removed to refuel the core. If only one channel is inoperable, it should be restored to OPERABLE status in a refueling outage as soon as reasonably possible. If both channels are inoperable, at least one channel shall be restored to OPERABLE status in the nearest refueling outage.

The Reactor Coolant System Subcooling Margin Monitor, Core Exit Thermocouples, and Reactor Vessel Water Level instruments are processed by two separate trains of ICC (Inadequate Core Cooling) and HJTC (Heated Junction ThermoCouple) processors. The preferred indication for these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC (Plant Process Computer) but qualified indication is provided in the instrument rack room. When the PPC data links cease to transmit data, the processors must be reset in order to restore the flow of data to the PPC. During reset, the qualified indication in the instrument rack room is lost. These instruments are OPERABLE during this reset since the indication is only briefly interrupted while the processors reset and the indication is promptly restored. The sensors are not removed from service during this reset. The train should be considered inoperable only if the qualified indication fails to be restored following reset. Except for the non-qualified PPC display, the instruments operate as required.

Hydrogen Monitors are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion. Containment hydrogen concentration is also important in verifying the adequacy of mitigating actions. The requirement to perform a hydrogen sensor calibration at least once every 92 days is based upon vendor recommendations to maintain sensor calibration. This calibration consists of a two point calibration, utilizing gas containing approximately one percent hydrogen gas for one of the calibration points, and gas containing approximately four percent hydrogen gas for the other calibration point.

3/4.3.3.7 Deleted.

3/4.3.3.8 DELETED 3/4.3.3.9 DELETED 3/4.3.3.1 0 DELETED 3/4.3.4 DELETED MILLSTONE - UNIT 3 B 3/4 3-6 Amendment No. 48, 9-93, 219

PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

BACKGROUND (Continued)

Post Accident Operation The control room emergency ventilation system is required to operate during post-accident operations to ensure the temperature of the control room is maintained and to ensure the control room will remain habitable during and following accident conditions.

The following sequence of events occurs upon receipt of a control building isolation (CBI) signal or a signal indicating high radiation in the air supply duct to the control room envelope.

1. The control room boundary is isolated to prevent outside air from entering the control room to prevent the operators from being exposed to the radiological conditions that may exist outside the control room. The analysis for a loss of coolant accident assumes that the highest releases occur in the first hour after a loss of coolant accident.

2. After 60 seconds, the control room envelope pressurizes to 1/8 inch water gauge by the control room emergency pressurization system. This action provides a continuous purge of the control room envelope and prevents inleakage from the outside environment.

Technical Specification 3/4.7.8 provides the requirements for the control room envelope pressurization system.

3. Control room pressurization continues for the first hour.

4. After one hour, the control room emergency ventilation system will be placed in service in either the 100% recirculation mode (isolated from the outside environment) or filtered pressurization mode (outside air is diverted through the filters to the control room envelope to maintain a positive pressure). The mode of service for the filtration will be based on the radiological conditions that exist outside the control room. To run the control room emergency air filtration system in the filtered pressurization mode, the air supply line must be manually opened.

APPLICABLE SAFETY ANALYSIS The OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty rating for the equipment and instrumentation cooled by this system, and (2) the control room will remain habitable for operations personnel during and following all credible accident conditions. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room. For all postulated design basis accidents except a Fuel Handling Accident, the radiation exposure to personnel occupying the control room shall be 5 rem or less whole body, or its equivalent for the duration of the accident, consistent with the requirements of General Design Criterion 19 of Appendix "A,"

10 CFR 50. For a Fuel Handling Accident, the radiation exposure to personnel occupying the control room shall be 5 rem TEDE or less, consistent with the requirements of 10 CFR 50.67.

This limitation is consistent with the requirements of General Design Criterion 19 of Appendix A, 10 CFR Part 50.

MILLSTONE - UNIT 3 B 3/4 7-1 1 Amendment No. -36, 219

PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

LIMITING CONDITION FOR OPERATION Two independent control room emergency air filtration systems are required to be operable to ensure that at least one is available in the event the other system is disabled.

A control room emergency air filtration system is OPERABLE when the associated:

a. Fan is OPERABLE;

b. HEPA filters and charcoal adsorbers are not excessively restricting flow and are capable of performing their filtration functions; and

c. moisture separator, heater, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

The integrity of the control room habitability boundary (i.e., walls, floors, ceilings, ductwork, and access doors) must be maintained such that the control building habitability zone can be maintained at its design positive pressure if required to be aligned in the filtration pressurization mode. However, the LCO is modified by a footnote allowing the control room boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in constant communication with the control room. This individual will have a method to rapidly close the opening when a need for control room isolation is indicated.

APPLICABILITY InMODES 1,2,3,4,5,and6.

During fuel movement within containment or the spent fuel pool.

Actions a., b., and c. of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. Actions d. and e. are applicable in MODES 5 and 6, and whenever fuel is being moved within containment or the spent fuel pool. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged. Therefore, the movement of either new or irradiated fuel (assemblies or individual fuel rods) can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment or the storage pool.

MILLSTONE - UNIT 3 B 3/4 7-12 Amendment No. 4i6, 203, 219

PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

ACTIONS Modes 1. 2. 3. and 4

a. With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. In this condition, the remaining control room emergency air filtration system is adequate to perform the control room protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room emergency air filtration system function. The 7-day completion time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability.

If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unit must be placed in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. These completion times are reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems.

b. With both control room emergency air filtration systems inoperable, except due to an inoperable control room boundary, the movement of fuel within the spent fuel pool must be immediately suspended. At least one control room emergency air filtration system must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. These completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

c. With both control room emergency air filtration systems inoperable due to an inoperable control room boundary, the movement of fuel within the spent fuel pool must be immediately suspended. The control room boundary must be restored to OPERABLE status within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

If the control room boundary is inoperable in MODES 1, 2, 3, and 4, the control room emergency air filtration systems cannot perform their intended functions. Actions must be taken to restore on OPERABLE control room boundary within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect control room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplanned measures should be MILLSTONE - UNIT 3 B 3/4 7-13 Amendment No. 4A3, I3 219

PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

ACTIONS (Continued) available to address these concerns for intentional and unintentional entry in to this condition. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is a typically reasonable time to diagnose, plan, and possibly repair, and test most problems with the control room boundary.

MODES 5 and 6. and fuel movement within containment or the spent fuel pool

d. With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. After 7 days, either initiate and maintain operation of the remaining OPERABLE control room emergency air filtration system in the recirculation mode or suspend the movement of fuel. Initiating and maintaining operation of the OPERABLE train in the recirculation mode ensures:

(i) operability of the train will not be compromised by a failure of the automatic actuation logic; and (ii) active failures will be readily detected.

e. With both control room emergency air filtration systems inoperable, or with the train required by ACTION 'd' not capable of being powered by an OPERABLE emergency power source, actions must be taken to suspend all operations involving the movement of fuel. This action places the unit in a condition that minimizes risk. This action does not preclude the movement of fuel to a safe position.

SURVEILLANCE REQUIREMENTS 4.7.7.a The control room environment should be checked periodically to ensure that the control room temperature control system is functioning properly. Verifying that the control room air temperature is less than or equal to 950 F at least once per 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> is sufficient. It is not necessary to cycle the control room ventilation chillers. The control room is manned during operations covered by the technical specifications. Typically, temperature aberrations will be readily apparent.

4.7.7.

Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing the trains once every 31 days on a STAGGERED TEST BASIS provides an adequate check of this system. This surveillance requirement verifies a system flow rate of 1,120 cfm + 20%.

Additionally, the system is required to operate for at least 10 continuous hours with the heaters energized. These operations are sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters due to the humidity in the ambient air.

MILLSTONE - UNIT 3 B 3/4 7-13a Amendment No. -36, 4-81-, 203, 219

PLANT SYSTEMS BASES 3/4.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM (Continued)

APPLICABLE SAFETY ANALYSIS The OPERABILITY of the control room envelope pressurization system ensures that:

(1) breathable air is supplied to the control room, instrumentation rack room, and computer room, and (2) a positive pressure is created and maintained within the control room envelope during control building isolation for the first hour following any event with the potential for radioactive releases. Each system is capable of providing an adequate air supply to the control room for one hour following an initiation of a control building isolation signal. After one hour, operation of the control room emergency ventilation system would be initiated.

LIMITING CONDITION FOR OPERATION Two independent control room envelope pressurization systems are required to be operable to ensure that at least one is available in the event the other system is disabled.

A control room envelope pressurization system is OPERABLE when the associated:

a. air storage bottles are OPERABLE; and

b. piping and valves are OPERABLE.

The integrity of the control room habitability boundary (i.e., walls, floors, ceilings, ductwork, and access doors) must be maintained. However, the LCO is modified by a footnote allowing the control room boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in constant communication with the control room. This individual will have a method to rapidly close the opening when a need for control room isolation is indicated.

MILLSTONE - UNIT 3 B 3/4 7-18 Amendment No. 4-6,203 219

PLANT SYSTEMS BASES 3/4.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM (Continued)

APPLICABILITY In MODES 1,2,3,4,5, and 6.

During fuel movement within containment or the spent fuel pool.

Actions a., b., c., and d. of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. Actions e. and f. are applicable in MODES 5 and 6, and whenever fuel is being moved within containment or the spent fuel pool. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel that is impacted upon is damaged. Therefore, the movement of either new or irradiated fuel (assemblies or individual fuel rods) can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment or the storage pool.

ACTIONS MODES 1, 2, 3, and 4

a. With one control room envelope pressurization system inoperable, action must be taken either to restore the inoperable system to an OPERABLE status within 7 days, or place the unit in HOT STANDBY within six hours and COLD SHUTDOWN within the next 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

The remaining control room envelope pressurization system is adequate to perform the control room protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room envelope pressurization system. The 7-day completion time is based on the low probability of a design basis accident occurring during this time period and the ability of the remaining train to provide the required capability.

The completion times for the unit to be placed in HOT STANDBY and COLD SHUTDOWN are reasonable. They are based on operating experience, and they permit the unit to be placed in the required conditions from full power conditions in an orderly manner and without challenging unit systems.

b. With both control room envelope pressurization systems inoperable, except due to an inoperable control room boundary or during performance of Surveillance Requirement 4.7.8.c, the movement of fuel within the spent fuel pool must be immediately suspended.

At least one control room envelope pressurization system must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. These completion times are reasonable, based in operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

MILLSTONE - UNIT 3 B 3/4 7-19 Amendment No. 436, IO3, 219

PLANT SYSTEMS BASES 3/4.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM (Continued)

ACTIONS (Continued)

c. With both control room envelope pressurization systems inoperable due to an inoperable control room boundary, the movement of fuel within the spent fuel pool must be immediately suspended. The control room boundary must be restored to OPERABLE status within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

If the control room boundary is inoperable in MODES 1, 2, 3, and 4, the control room envelope pressurization systems cannot perform their intended functions. Actions must be taken to restore an OPERABLE control room boundary within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect control room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplanned measures should be available to address these concerns for intentional and unintentional entry in to this condition. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is a typically reasonable time to diagnose, plan, and possibly repair, and test most problems with the control room boundary.

d. With both control room envelope pressurization systems inoperable during the performance of Surveillance Requirement 4.7.8.c and the system not being tested under administrative control, the movement of fuel within the spent fuel pool must be immediately suspended. At least one control room envelope pressurization system must be restored to OPERABLE status within 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. The administrative controls for the system not being tested consist of a dedicated operator, in constant communication with the control room, who can rapidly restore this system to OPERABLE status. Allowing both control room envelope pressurization systems to be inoperable for 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> under administrative control is acceptable since the system not being tested is inoperable only because it is isolated. Therefore, the system can be rapidly restored if needed. The other completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

MILLSTONE - UNIT 3 B 3/4 7-20 Amendment No. -36, 4-8, 203, 219

PLANT SYSTEMS BASES 3/4.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM (Continued)

ACTIONS (Continued)

MODES 5 and 6. and fuel movement within containment or the spent fuel pool

e. With one control room envelope pressurization system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. After 7 days, immediately suspend the movement of fuel. This action places the unit in a condition that minimizes potential radiological exposure to Control Room personnel. This action does not preclude the movement of fuel to a safe position.

The remaining control room envelope pressurization system is adequate to perform the control room protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room envelope pressurization system. The 7-day completion time is based on the low probability of a design basis accident occurring during this time period and the ability of the remaining train to provide the required capability.

Stud tensioning may continue in MODE 6 and a MODE change to MODE 5 is permitted with a control room envelope pressurization system inoperable (Reference 1).

f. With both control room envelope pressurization systems inoperable, immediately suspend the movement of fuel. This action places the unit in a condition that minimizes potential radiological exposure to Control Room personnel. This action does not preclude the movement of fuel to a safe position.

SURVEILLANCE REOUIREMENTS 4.7.8.a This surveillance requires verification that the air bottles are properly pressurized.

Verifying that the air bottles are pressurized to greater than or equal to 2200 psig will ensure that a control room envelope pressurization system will be capable of supplying the required flow rate.

The frequency of the surveillance is at least once per 7 days. It is based on engineering judgment and has been shown to be appropriate through operating experience.

4.7.8.b This surveillance requires verification of the correct position of each valve (manual, power operated, or automatic) in the control room envelope pressurization system flow path. It helps ensure that the control room envelope pressurization system is capable of performing its intended safety function by verifying that an appropriate flow path will exist. The surveillance applies to those valves that could be mispositioned. This surveillance does not apply to valves that have been locked, sealed, or secured in position, because these positions are verified prior to locking, sealing, or securing.

The frequency of the surveillance is at least once per 31 days on a STAGGERED TEST BASIS. It is based on engineering judgment and has been shown to be appropriate through operating experience.

MILLSTONE - UNIT 3 B 3/4 7-20a Amendment No. 36, 481, 203, 219

3/4.9 REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS The requirements on containment penetration closure and OPERABILITY ensure that a release of radioactive material within containment to the environment will be minimized. The OPERABILITY, closure restrictions, and administrative controls are sufficient to minimize the release of radioactive material from a fuel element rupture based upon the lack of containment pressurization potential during the movement of fuel within containment. The containment purge valves are containment penetrations and must satisfy all requirements specified for a containment penetration.

This specification is applicable during the movement of new and spent fuel assemblies within the containment building. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged.

Therefore, the movement of either new or irradiated fuel can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment.

Containment penetrations, including the personnel access hatch doors and equipment access hatch, can be open during the movement of fuel provided that sufficient administrative controls are in place such that any of these containment penetrations can be closed within 30 minutes.

Following a Fuel Handling Accident, each penetration, including the equipment access hatch, is closed such that a containment atmosphere boundary can be established. However, if it is determined that closure of all containment penetrations would represent a significant radiological hazard to the personnel involved, the decision may be made to forgo the closure of the affected penetration(s). The containment atmosphere boundary is established when any penetration which provides direct access to the outside atmosphere is closed such that at least one barrier between the containment atmosphere and the outside atmosphere is established. Additional actions beyond establishing the containment atmosphere boundary, such as installing flange bolts for the equipment access hatch or a containment penetration, are not necessary.

Administrative controls for opening a containment penetration require that one or more designated persons, as needed, be available for isolation of containment from the outside atmosphere. Procedural controls are also in place to ensure cables or hoses which pass through a containment opening can be quickly removed. The location of each cable and hose isolation device for those cables and hoses which pass through a containment opening is recorded to ensure timely closure of the containment boundary. Additionally, a closure plan is developed for each containment opening which includes an estimated time to close the containment opening. A log of personnel designated for containment closure is maintained, including identification of which containment openings each person has responsibility for closing. As necessary, equipment will be pre-staged to support timely closure of a containment penetration.

MILLSTONE - UNIT 3 B 3/4 9-l a Amendment No. 4-, 60, l-58, 203-, 219

3/4.9 REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued)

The ability to close the equipment access hatch penetration within 30 minutes is verified each refueling outage prior to the first fuel movement in containment with the equipment access hatch open. Prior to opening a containment penetration, a review of containment penetrations currently open is performed to verify that sufficient personnel are designated such that all containment penetrations can be closed within 30 minutes. Designated personnel may have other duties, however, they must be available such that their assigned containment openings can be closed within 30 minutes. Additionally, each new work activity inside containment is reviewed to consider its effect on the closure of the equipment access hatch, at least one personnel access hatch door, and/or other open containment penetrations. The required number of designated personnel are continuously available to perform closure of their assigned containment openings whenever fuel is being moved within the containment.

Controls for monitoring radioactivity within containment and in effluent paths from containment are maintained consistent with General Design Criterion 64. Local area radiation monitors, effluent discharge radiation monitors, and containment gaseous and particulate radiation monitors provide a defense-in-depth monitoring of the containment atmosphere and effluent releases to the environment. These monitors are adequate to identify the need for establishing the containment atmosphere boundary. When containment penetrations are open during a refueling outage under administrative control for extended periods of time, routine grab samples of the containment atmosphere, equipment access hatch, and personnel access hatch will be required.

The containment atmosphere is monitored during normal and transient operations of the reactor plant by the containment structure particulate and gas monitor located in the upper level of the Auxiliary Building or by grab sampling. Normal effluent discharge paths are monitored during plant operation by the ventilation particulate samples and gas monitors in the Auxiliary Building.

Administrative controls are also in place to ensure that the containment atmosphere boundary is established if adverse weather conditions which could present a potential missile hazard threaten the plant. Weather conditions are monitored during fuel movement whenever a containment penetration, including the equipment access hatch and personnel access hatch, is open and a storm center is within the plant monitoring radius of 150 miles.

The administrative controls ensure that the containment atmosphere boundary can be quickly established (i.e. within 30 minutes) upon determination that adverse weather conditions exist which pose a significant threat to the Millstone Site. A significant threat exists when a hurricane warning or tornado warning is issued which applies to the Millstone Site, or if an average wind speed of 60 miles an hour or greater is recorded by plant meteorological equipment at the meteorological tower. If the meteorological equipment is inoperable, information from the National Weather Service can be used as a backup in determining plant wind speeds. Closure of containment penetrations, including the equipment access hatch penetration and at least one personnel access hatch door, begin immediately upon determination that a significant threat exists.

MILLSTONE - UNIT 3 B 3/4 9-2 Amendment No, +9:7, 219

3/4.9 REFUELING OPERATIONS BASES 3/4.9.5 COMMUNICATIONS The requirement for communications capability ensures that refueling station personnel can be promptly informed of significant changes in the facility status or core reactivity conditions during CORE ALTERATIONS.

3/4.9.6 REFUELING MACHINE The OPERABILITY requirements for the refueling machine ensure that: (1) refueling machines will be used for movement of drive rods and fuel assemblies, (2) each crane has sufficient load capacity to lift a drive rod or fuel assembly, and (3) the core internals and reactor vessel are protected from excessive lifting force in the event they are inadvertently engaged during lifting operations.

3/4.9.7 CRANE TRAVEL - SPENT FUEL STORAGE AREAS The restriction on movement of loads over fuel assemblies in the storage pool ensures that in the event this load is dropped: (1) the activity release will be less than the activity release assumed in the design basis fuel handling accident, and (2) the resulting geometry will not result in a critical array.

3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION 3/4.9.8.1 HIGH WATER LEVEL BACKGROUND The purpose of the Residual Heat Removal (RHR) System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Reactor Plant Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR system for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR system.

MILLSTONE - UNIT 3 B 3/4 9-2a Amendment No.219 1

3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVEL (continued)

APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200'F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is fission product barrier. One train of the RHR system is required to be operational in MODE 6, with the water level > 23 ft above the top of the reactor vessel flange to prevent this challenge. The LCO does permit deenergizing the RHR pump for short durations, under the conditions that the boron concentration is not diluted. This conditional deenergizing of the RHR pump does not result in a challenge to the fission product barrier.

APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level 2 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.10, "Water Level - Reactor Vessel." Requirements for the RHR system in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.8.2, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

LIMITING CONDITION FOR OPERATION The requirement that at least one RHR loop be in operation ensures that: (I) sufficient cooling capacity is available to remove decay heat an maintain the water in the reactor vessel below 140 0 F as required during the REFUELING MODE, and (2) sufficient coolant circulation is maintained through the core to minimize the effect of a boron dilution incident and prevent stratification.

An OPERABLE RHR loop includes an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path. An operating RHR flow path should be capable of determining the low-end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs.

The LCO is modified by a note that allows the required operating RHR loop to be removed from service for up to I hour per 8-hour period. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzle and RCS to RHR isolation valve testing. During this 1-hour period, decay heat is removed by natural connection to the large mass of water in the refueling cavity.

MILLSTONE - UNIT 3 B 3/4 9-3 Amendment No.4107-, 219

3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVEL (continued)

ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operations, except as permitted in the Note to the LCO.

If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Reduced boron concentrations cannot occur by the addition of water with a lower boron concentration than that contained in the RCS because all of unborated water sources are isolated.

Reduced boron concentrations can occur by the addition of water with lower boron concentration that contained in the RCS. Therefore, actions that result in an unplanned boron dilution shall be suspended immediately.

If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.

A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition.

If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level 2 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.

If RHR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.

The Completion Time of 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> is reasonable, based on the low probability of the coolant boiling in that time.

Surveillance Requirement This Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant.

The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The frequency of 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator in the control room for monitoring the RHR system.

MILLSTONE - UNIT 3 B 3/4 94 Amendment No. 4I0, 219

3/4.9 REFUELING OPERATIONS BASES Surveillance Requirement This Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant.

The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met. The Frequency of 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator for monitoring the RHR System in the control room.

MILLSTONE - UNIT 3 B 3/4 9-7 Amendment No. 407, 219

3/4.9 REFUELING OPERATIONS BASES 3/4.9.10 AND 3/4.9.11 WATER LEVEL - REACTOR VESSEL AND STORAGE POOL The restrictions on minimum water level ensure that sufficient water depth is available to remove 99% of the assumed 10% iodine gap activity released from the rupture of an irradiated fuel assembly. The minimum water depth is consistent with the assumptions of the safety analysis.

I MILLSTONE - UNIT 3 B 3/4 9-8 Amendment No. 39,4-05,407, 4-5, 4-e4,4 9, 20, 219