Text

Technical Specifications Bases Changes
	ML042530077
Person / Time
Site:	Mcguire, McGuire
Issue date:	08/30/2004
From:	Gordon Peterson; Duke Power Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML042530077 (135)
	v • d • e

Duke GARY R. PETERSON (aPowere Vice President McGuire Nuclear Station A Duke Energy Company Duke Power MGOIVP / 12700 Hagers Ferry Road Huntersville, NC 28078-9340 704 875 5333 704 875 4809 fax grpeters@duke-energy. corn August 30, 2004 U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 ATTENTION: Document Control Desk

Subject:

Duke Energy Corporation McGuire Nuclear Station, Units 1 and 2 Docket Numbers 50-369 and 50-370 Technical Specifications Bases Changes Attached is a revision to McGuire Technical Specifications Bases Section 3.0., "Limiting Condition for Operation (LCO)

Applicability." Specifically, the Bases for LCO 3.0.4 and SR 3.0.4 are revised to conform with NRC-approved Amendments Nos. 221/203 for the McGuire Units 1 and 2 Technical Specifications. These amendments were issued by NRC letter dated April 29, 2004. The amendments implement increased flexibility in MODE restraints using the Consolidated Line Item Improvement Process (CLIIP).

Also included in this package are changes to the Bases for the McGuire TS listed below.

3.3.3, Post Accident Monitoring Instrumentation 3.3.4, Remote Shutdown System 3.4.11, Pressurizer Power Operated Relief Valves 3.4.12, Low Temperature Overpressure Protection System 3.4.15, RCS Leakage Detection Instrumentation 3.4.16, RCS Specific Activity 3.5.3, Emergency Core Cooling System - Shutdown 3.6.7, Hydrogen Recombiners 3.6.8, Hydrogen Skimmer System 3.7.4, Steam Generator Power Operated Relief Valves 3.7.5, Auxiliary Feedwater System 3.8.1, AC Sources-Operating The Bases listed above are revised to conform with the changes to LCO 3.0.4 in accordance with the CLIIP.

740Q www. duke-energy. corn

U.S. Nuclear Regulatory Commission August 30, 2004 Page 2 contains revised TS Bases. Attachment 2 contains a List of Effective pages.

Inquiries on this matter should be directed to J. S. Warren at (704) 875-5171.

Very truly you G. R. Peterson xc w/Attachments:

W. D. Travers, Regional Administrator U. S. Nuclear Regulatory Commission, Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, GA 30303 J. J. Shea (Addressee Only)

NRC Project Manager (MNS)

U. S. Nuclear Regulatory Commission Mail Stop 0-7 Dll Washington, DC 20555-0001 J. B. Brady Senior Resident Inspector (MNS)

U. S. Nuclear Regulatory Commission McGuire Nuclear Site Beverly 0. Hall, Section Chief Radiation Protection Section 1645 Mail Service Center Raleigh, NC 27699-1645

U.S. Nuclear Regulatory Commission August 30, 2004 Page 3 G. R. Peterson, affirms that he is the person who subscribed his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

G. R. Peterson, Site Vice President Subscribed and sworn to me: AU1U 569 5 , w Date h WaI /- , Notary Public My commission expires: &4 Aas/ Date P,2 L) Date SEAL

Attachment 1 Revised Technical Specifications Bases

LCO B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.8 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:

a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and

b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.

There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. Ifthis type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.

McGuire Units 1 and 2 B 3.0-1 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued)

Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.

The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits."

The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, modifications, or investigation of operational problems. Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Alternatives that would not result in redundant equipment being inoperable should be used instead. Doing so limits the time both subsystems/trains of a safety function are inoperable and limits the time other conditions exist which result in LCO 3.0.3 being entered. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.

When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable, and the ACTIONS Condition(s) are entered.

LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:

a. An associated Required Action and Completion Time is not met and no other Condition applies; or McGuire Units 1 and 2 B 3.0-2 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued)

b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.

This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

Upon entering LCO 3.0.3, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. If at the end of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , corrective measures which would allow existing LCO 3.0.3 are not complete, but there is reasonable assurance that corrective measures will be completed in time to still allow for an orderly unit shutdown, commencing a load decrease may be delayed until that time. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.

A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met.

b. A Condition exists for which the Required Actions have now been performed.

c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.

McGuire Units 1 and 2 B 3.0-3 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued)

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , then the time allowed for reaching MODE 4 is the next 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.13, "Spent Fuel Pool (SFP) Water Level."

LCO 3.7.13 has an Applicability of "During movement of irradiated fuel assemblies in the spent fuel pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.13 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.13 of "Suspend movement of irradiated fuel assemblies in the spent fuel pool' is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.

LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be McGuire Units 1 and 2 B 3.0-4 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued) entered permit continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change.

Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions.

LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.

The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessments, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specifications equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01,

'Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.

LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.

McGuire Units 1 and 2 B 3.0-5 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued)

The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.

The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.

LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS Specific Activity).

The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.

McGuire Units 1 and 2 B 3.0-6 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued)

Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.

Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the SRs.

An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.

McGuire Units 1 and 2 B 3.0-7 Revision No. 57

LCO Applicability B 3.0 BASES LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.

However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.

This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

Specification 5.5.15, nSafety Function Determination Program (SFDP),'

ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.

Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.

The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of McGuire Units 1 and 2 B 3.0-8 Revision No. 57

LCO Applicability B 3.0 BASES LCO (continued) safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.

Test Exception LCOs 3.1.8 and 3.4.17 allow specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS.

Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.

The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.

Compliance with Test Exception LCOs is optional. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.

LCO 3.0.8 LCO 3.0.8 delineates the applicability of each specification to Unit 1 and Unit 2 operations.

McGuire Units 1 and 2 B 3.0-9 Revision No. 57

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.5 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:

a. The systems or components are known to be inoperable, although still meeting the SRs; or

b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are only applicable when the test exception is used as an allowable exception to the requirements of a Specification.

Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition.

Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.

McGuire Units 1 and 2 B 3.0-1 0 Revision No. 57

SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued)

Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a Nonce per . . ." interval.

SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply.

These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS.

An example of where SR 3.0.2 does not apply is in the Containment Leakage Rate Testing Program. This program establishes testing requirements and frequencies in accordance with requirements of regulations. The TS cannot in and of themselves extend a test interval specified in regulations.

As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a McGuire Units 1 and 2 B 3.0-1 1 Revision No. 57

SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued)

"once per ..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%

extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or the action accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.

This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 McGuire Units 1 and 2 B 3.0-12 Revision No. 57

SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued) allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.

SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.

Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, 'Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants.' This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.

If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance McGuire Units 1 and 2 B 3.0-13 Revision No. 57

SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued) is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.

However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed.

Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability.

However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.

McGuire Units 1 and 2 B 3.0-14 Revision No. 57

SR Applicability B 3.0 BASES SURVEILLANCE REQUIREMENT (continued)

The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.

The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not 'due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.

SR 3.0.5 SR 3.0.5 delineates the applicability of the surveillance activities to Unit 1 and Unit 2 operations.

McGuire Units 1 and 2 B 3.0-15 Revision No. 57

PAM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs).

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.

The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined.

These essential instruments are identified by unit specific documents (Ref. 1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3).

The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables.

Type A variables are included in this LCO because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs.

Category I variables are the key variables deemed risk significant because they are needed to:

Determine whether other systems important to safety are performing their intended functions;

Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and McGuire Units 1 and 2 B 3.3.3-1 Revision No. 57

PAM Instrumentation B 3.3.3 BASES BACKGROUND (continued)

Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat.

These key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref. 1). These analyses identify the unit specific Type A and Category I variables and provide justification for deviating from the NRC proposed list of Category I variables.

The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.

APPLICABLE The PAM instrumentation ensures the operability of Regulatory Guide SAFETY ANALYSES 1.97 Type A and Category I variables so that the control room operating staff can:

Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g., loss of coolant accident (LOCA);

Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function;

Determine whether systems important to safety are performing their intended functions;

Determine the likelihood of a gross breach of the barriers to radioactivity release;

Determine if a gross breach of a barrier has occurred; and

Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.

PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4). Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents.

Therefore, Category I, non-Type A, variables are important for reducing public risk.

McGuire Units 1 and 2 B 3.3.3-2 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the unit Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.

The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident. This capability is consistent with the recommendations of Reference 1.

LCO 3.3.3 requires two OPERABLE channels for most Functions. Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.

Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.

In some cases, the total number of channels exceeds the number of required channels, e.g., pressurizer level has a total of three channels, however only two channels are required OPERABLE. This provides additional redundancy beyond that required by this LCO, i.e., when one channel of pressurizer level is inoperable, the required number of two channels can still be met. The ACTIONS of this LCO are only entered when the required number of channels cannot be met.

Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.

Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.

1. Neutron Flux - (Wide Range)

Wide Range Neutron Flux indication is provided to verify reactor shutdown.

McGuire Units 1 and 2 B 3.3.3-3 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued)

Neutron flux is used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.

Two channels of wide range neutron flux are required OPERABLE.

2, 3. Reactor Coolant System (RCS) Hot and Cold Leg Temperatures RCS Hot and Cold Leg Temperatures are Category I variables provided for verification of core cooling and long term surveillance.

RCS hot and cold leg temperatures are used to determine RCS subcooling margin. RCS subcooling margin will allow termination of safety injection (SI), if still in progress, or reinitiation of SI if it has been stopped. RCS subcooling margin is also used for unit stabilization and cooldown control.

In addition, RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify the unit conditions necessary to establish natural circulation in the RCS.

Reactor coolant hot and cold leg temperature inputs are provided by fast response resistance elements and associated transmitters in each loop.

Two channels of RCS Hot Leg Temperature and two channels of RCS Cold Leg Temperature are required OPERABLE by the LCO.

RCS Hot Leg and Cold Leg Temperature are diverse indications of RCS temperature. Core exit thermocouples also provide diverse indication of RCS temperature.

4. Reactor Coolant System Pressure (Wide Range)

RCS wide range pressure is a Category I variable provided for verification of core cooling and RCS integrity long term surveillance.

RCS pressure is used to verify delivery of SI flow to RCS from at least one train when the RCS pressure is below the pump shutoff head. RCS pressure is also used to verify closure of manually closed spray line valves and pressurizer power operated relief valves (PORVs).

McGuire Units 1 and 2 B 3.3.3-4 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued)

In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS pressure can also be used:

to determine whether to terminate actuated Si or to reinitiate stopped SI;

to determine when to reset Si and shut off low head SI;

to manually restart low head SI;

as reactor coolant pump (RCP) trip criteria; and

to make a determination on the nature of the accident in progress and where to go next in the procedure.

RCS pressure is also related to three decisions about depressurization. They are:

to determine whether to proceed with primary system depressurization;

to verify termination of depressurization; and

to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.

A final use of RCS pressure is to determine whether to operate the pressurizer heaters.

RCS pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication.

Furthermore, RCS pressure is one factor that may be used in decisions to terminate RCP operation.

Two channels of wide range RCS pressure are required OPERABLE.

McGuire Units 1 and 2 B 3.3.3-5 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued) 5, 6. Reactor Vessel Water Level Reactor Vessel Water Level is provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.

The Reactor Vessel Water Level Monitoring System provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core.

Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.

Two channels of Reactor Vessel Water Level are provided in both the core region (lower range) and the head region (wide range) with indication in the unit control room. Each channel uses differential pressure transmitters and a microprocessor to calculate true vessel level or relative void content of the primary coolant.

7. Containment Sump Water Level (Wide Range)

Containment Sump Water Level is provided for verification and long term surveillance of RCS integrity.

Containment Sump Water Level is used to determine:

containment sump level accident diagnosis;

when to begin the recirculation procedure; and

whether to terminate Si, if still in progress.

Two channels of wide range level are required OPERABLE.

8. Containment Pressure (Wide Ranae)

Containment Pressure (Wide Range) is provided for verification of RCS and containment OPERABILITY.

Containment pressure is used to verify closure of main steam isolation valves (MSIVs), and containment spray Phase B isolation when Containment Pressure - High High is reached.

McGuire Units 1 and 2 B 3.3.3-6 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued)

Two channels of wide range containment pressure are required OPERABLE.

9. Containment Atmosphere Radiation (High Range)

Containment Atmosphere Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Containment radiation level is used to determine if a high energy line break (HELB) has occurred, and whether the event is inside or outside of containment.

Two channels of high range containment atmosphere radiation are provided. One channel is required OPERABLE. Diversity is provided by portable instrumentation or by sampling and analysis.

10. Hydrogen Monitors Hydrogen Monitors are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion. This variable is also important in verifying the adequacy of mitigating actions.

Two channels of hydrogen monitors are required OPERABLE.

11. Pressurizer Level Pressurizer Level is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped.

Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition.

Three channels of pressurizer level are provided. Two channels are required OPERABLE.

12. Steam Generator Water Level (Narrow Range)

SG Water Level is provided to monitor operation of decay heat removal via the SGs. The Category I indication of SG level is the narrow range level instrumentation.

McGuire Units 1 and 2 B 3.3.3-7 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued)

SG Water Level (Narrow Range) is used to:

identify the faulted SG following a tube rupture;

verify that the intact SGs are an adequate heat sink for the reactor;

determine the nature of the accident in progress (e.g., verify an SGTR); and

verify unit conditions for termination of SI during secondary unit HELBs outside containment.

Four channels per SG of narrow range water level are provided.

Only two channels are required OPERABLE by the LCO.

13, 14,15,16. Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling.

Adequate core cooling is ensured with two valid Core Exit Temperature channels per quadrant with two CETs per required channel. Core inlet temperature data is used with core exit temperature to give radial distribution of coolant enthalpy rise across the core. Core Exit Temperature is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Core Exit Temperature is also used for unit stabilization and cooldown control.

Two OPERABLE channels of Core Exit Temperature are required in each quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core.

Two sets of two thermocouples (1 set from each redundant power train) ensure a single failure will not disable the ability to determine the radial temperature gradient.

17. Auxiliary Feedwater Flow AFW Flow is provided to monitor operation of decay heat removal via the SGs.

McGuire Units 1 and 2 B 3.3.3-8 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued)

The AFW Flow to each SG is determined by flow indicators, pump operational status indicators, and NSWS and condensate supply valve indicators in the control room. The AFW flow indicators are category 2, type D variables which are used to demonstrate the category 1 variable of AFW assured source.

AFW flow is used three ways:

to verify delivery of AFW flow to the SGs;

to determine whether to terminate Si if still in progress, in conjunction with SG water level (narrow range); and

to regulate AFW flow so that the SG tubes remain covered.

18. RCS Subcoolinq Margin Monitor RCS subcooling is provided to allow unit stabilization and cooldown control. RCS subcooling will allow termination of SI, if still in progress, or reinitiation of Si if it has been stopped.

The margin to saturation is calculated from RCS pressure and temperature measurements. The average of the five highest core exit thermocouples are used to represent core conditions and the wide range hot leg RTDs are used to measure loop hot leg temperatures. The plant computer performs the calculations and comparisons to saturation curves. A graphic display over the required range gives the operator a representation of primary system conditions compared to various curves of importance (saturation, NDT, etc.).

A backup program exists to ensure the capability to accurately monitor RCS subcooling. The program includes training and a procedure to manually calculate subcooling margin, using control room pressure and temperature instruments.

19. Steam Line Pressure Steam Line Pressure is provided to monitor operation of decay heat removal via the SGs. Steam line pressure is also used to determine if a high energy secondary line rupture occurred and which SG is faulted.

McGuire Units 1 and 2 B 3.3.3-9 Revision No. 57

PAM Instrumentation B 3.3.3 BASES LCO (continued)

Two channels of Steam Line Pressure are required OPERABLE.

20. Refueling Water Storage Tank Level RWST level monitoring is provided to ensure an adequate supply of water to the safety injection and spray pumps during the switchover to cold leg recirculation.

Three channels of RWST level are provided. Two channels are required OPERABLE by the LCO.

21. DG Heat Exchanger NSWS Flow Flow indicators are provided in each of the NSWS trains to indicate cooling water flow through the respective train DG. These indicators are provided for operators to manually control flow to the DG heat exchanger. One flow indicator is required OPERABLE on each train.

22. Containment Spray Heat Exchanger NSWS Flow Flow indicators are provided in each of the NSWS trains to indicate cooling water flow through the respective train containment spray heat exchangers. These indicators are provided for operators to manually control flow to the heat exchanger. One flow indicator is required OPERABLE on each train.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.

These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.

ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.3-1. When the Required Channels in Table 3.3.3-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.

The Completion Time(s) of the inoperable channel(s) of a Function will be McGuire Units 1 and 2 B 3.3.3-1 0 Revision No. 57

PAM Instrumentation B 3.3.3 BASES ACTIONS (continued) tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to all PAM instrument Functions. Condition A addresses the situation when one or more required channels for one or more Functions are inoperable. The Required Action is to refer to Table 3.3.3-1 and take the appropriate Required Actions for the PAM instrumentation affected. The Completion Times are those from the referenced Conditions and Required Actions.

B.1 Condition B applies when one or more Functions have one required channel that is inoperable. Required Action B.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval. Condition B is not applicable to functions with a single required channel.

C.1 Condition C applies when the Required Action and associated Completion Time for Condition B are not met. This Required Action specifies initiation of actions in Specification 5.6.7, which requires a written report to be submitted to the NRC immediately. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation.

McGuire Units 1 and 2 B 3.3.3-1 1 Revision No. 57

PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)

D.1 Condition D applies when a single require channel is inoperable.

Required Action D.1 requires restoring the required channel to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with the required channel inoperable is not acceptable. Therefore, requiring restoration of the required channel to OPERABLE status limits the risk that the PAM function will be in a degraded condition should an event occur.

E.1 Condition E applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function).

Required Action E.1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

Condition E does not apply to hydrogen monitor channels and functions with single channels.

F.1 Condition F applies when two hydrogen monitor channels are inoperable.

Required Action F.1 requires restoring one hydrogen monitor channel to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable based on the low probability that an accident causing core damage would occur during this time.

McGuire Units 1 and 2 B 3.3.3-1 2 Revision No. 57

PAM Instrumentation B 3.3.3 BASES ACTIONS (continued)

G.1 and G.2 If the Required Action and associated Completion Time of Conditions D, E, or F are not met, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

H.1 Alternate means of monitoring Containment Area Radiation have been developed and tested. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.7, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-1.

Performing the Neutron Flux Instrumentation and Containment Atmosphere Radiation (High-Range) surveillances meets the License Renewal Commitments for License Renewal Program for High-Range Radiation and Neutron Flux Instrumentation Circuits per UFSAR Chapter 18, Table 18-1 and License Renewal Commitments Specification MCS-1274.00-00-0016, Section 4.44.

SR 3.3.3.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a McGuire Units 1 and 2 B 3.3.3-13 Revision No. 57

PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued) similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar unit instruments located throughout the unit.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.

As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.

The Frequency of 31 days is based on operating experience that demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.3.2 A CHANNEL CALIBRATION is performed every 92 days on the Hydrogen Monitor channels. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor using hydrogen gas mixtures to obtain calibration points at 0 volume percent (v/o) and 9 v/o hydrogen.

The test verifies that the channel responds to measured parameter with the necessary range and accuracy. The Frequency is based on operating experience associated with these monitors.

SR 3.3.3.3 A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter with the McGuire Units 1 and 2 B 3.3.3-14 Revision No. 57

PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued) necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors. The calibration method for neutron detectors is specified in the Bases of LCO 3.3.1, 'Reactor Trip System (RTS)

Instrumentation." The Frequency is based on operating experience and consistency with the typical industry refueling cycle.

REFERENCES 1. UFSAR Section 1.8.

2. Regulatory Guide 1.97, Rev. 2.

3. NUREG-0737, Supplement 1, 'TMI Action Items."

4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

McGuire Units 1 and 2 B 3.3.3-1 5 Revision No. 57

Remote Shutdown System B 3.3.4 BASES B 3.3 INSTRUMENTATION B 3.3.4 Remote Shutdown System BASES BACKGROUND The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3. With the unit.in MODE 3, the Auxiliary Feedwater (AFW)

System and the steam generator (SG) safety valves or the SG power operated relief valves (SG PORVs) can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.

If the control room becomes inaccessible due to reasons other than fire or security, the operators can establish control at the remote shutdown panel, and place and maintain the unit in MODE.3. The safe shutdown facility provides shutdown capability during a fire in the control room or security events. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.

The OPERABILITY of the remote shutdown control and instrumentation functions ensures there is sufficient information available on selected unit parameters to place and maintain the unit in MODE 3 should the control room become inaccessible.

APPLICABLE The Remote Shutdown System is required to provide equipment at SAFETY ANALYSES appropriate locations outside the control room with a capability to promptly shut down and maintain the unit in a safe condition in MODE 3.

The criteria governing the design and specific system requirements of the Remote Shutdown System are located in 10 CFR 50, Appendix A, GDC 19 (Ref. 1).

McGuire Units 1 and 2 B 3.3.4-1 Revision No. 57

Remote Shutdown System B 3.3.4 BASES APPLICABLE SAFETY ANALYSES (continued)

The Remote Shutdown System is considered an important contributor to the reduction of unit risk to accidents and as such it has been retained in the Technical Specifications as indicated in the NRC Policy Statement.

LCO The Remote Shutdown System LCO provides the OPERABILITY requirements of the instrumentation and controls necessary to place and maintain the unit in MODE 3 from a location other than the control room.

The instrumentation and controls required are listed in Table 3.3.4-1 in the accompanying LCO.

The controls, instrumentation, and transfer switches are required for:

Core reactivity control;

RCS pressure control;

Decay heat removal via the AFW System and the SG safety valves or SG PORVs; and

RCS inventory control.

A Function of a Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the Remote Shutdown System Function are OPERABLE. In some cases, Table 3.3.4-1 may indicate that the required information or control capability is available from several alternate sources. In these cases, the Function is OPERABLE as long as one channel of any of the alternate information or control sources is OPERABLE.

The remote shutdown instrument and control circuits covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure the instruments and control circuits will be OPERABLE if unit conditions require that the Remote Shutdown System be placed in operation.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3.

This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.

McGuire Units 1 and 2 B 3.3.4-2 Revision No. 57

Remote Shutdown System B 3.3.4 BASES APPLICABILITY (continued)

This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the facility is already subcritical and in a condition of reduced RCS energy.

Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.

ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each Function listed on Table 3.3.4-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A addresses the situation where one or more required Functions of the Remote Shutdown System are inoperable. This includes any Function listed in Table 3.3.4-1 as well as the control and transfer switches.

The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.

B.1 and B.2 If the Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

McGuire Units 1 and 2 B 3.3.4-3 Revision No. 57

Remote Shutdown System B 3.3.4 BASES SURVEILLANCE SR 3.3.4.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

As specified in the Surveillance, a CHANNEL CHECK is only required for those channels which are normally energized.

The Frequency of 31 days is based upon operating experience which demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.4.2 SR 3.3.4.2 verifies each required Remote Shutdown System control circuit and transfer switch performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel is not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the unit can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. (However, this Surveillance is not required to be performed only McGuire Units 1 and 2 B 3.3.4-4 Revision No. 57

Remote Shutdown System B 3.3.4 BASES SURVEILLANCE REQUIREMENTS (continued) during a unit outage.) Operating experience demonstrates that remote shutdown control channels usually pass the Surveillance test when performed at the 18 month Frequency.

SR 3.3.4.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency of 18 months is based upon operating experience and consistency with the typical industry refueling cycle.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

McGuire Units 1 and 2 B 3.3.4-5 Revision No. 57

Pressurizer PORVs B 3.4.1 1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

BASES BACKGROUND The pressurizer is equipped with two types of devices for pressure relief:

pressurizer safety valves and PORVs. The PORVs are air operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.

Block valves, which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.

The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.

The PORVs, their block valves, and their controls are powered from the vital buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. Three PORVs and their associated block valves are powered from two separate safety trains (Ref. 1).

The plant has three PORVs, each having a relief capacity of 210,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer Pressure-High reactor trip setpoint following a step reduction of 50% of full load with steam dump.

In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP). See LCO 3.4.12, 'Low Temperature Overpressure Protection (LTOP) System.'

McGuire Units 1 and 2 B 3.4.1 1-1 Revision No. 57

Pressurizer PORVs B 3.4.11 BASES APPLICABLE Plant operators employ the PORVs to depressurize the RCS in response SAFETY ANALYSES to certain plant transients if normal pressurizer spray is not available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event.

A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for manual RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.

The PORVs are assumed to operate in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical. By assuming PORV automatic actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative.

Events that assume this condition include uncontrolled bank withdrawal at power, uncontrolled bank withdrawal from subcritical, and single rod withdrawal at power (Ref. 2).

Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.

By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied. Three PORVs are required to be OPERABLE to meet RCS pressure boundary requirements. The block valves are available to isolate the flow path through either a failed open PORV or a PORV with excessive leakage.

Satisfying the LCO helps minimize challenges to fission product barriers.

APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2.

McGuire Units 1 and 2 B 3.4.1 1-2 Revision No. 57

Pressurizer PORVs B 3.4.1 1 BASES APPLICABILITY (continued)

Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the LCO is applicable in MODES 1, 2, and 3. The LCO is not applicable in MODE 4 when both pressure and core energy are decreased and the pressure surges become much less significant. The PORV setpoint is reduced for LTOP in MODES 4

3001F, 5, and 6 with the reactor vessel head in place. LCO 3.4.12 addresses the PORV requirements in these MODES.

ACTIONS A Note has been added to clarify that all pressurizer PORVs are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis).

A.1 With the PORVs inoperable and capable of being manually cycled, either the PORVs must be restored or the flow path isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The block valves should be closed but power must be maintained to the associated block valves, since removal of power would render the block valve inoperable. Although a PORV may be designated inoperable, it may be able to be manually opened and closed, and therefore, able to perform its function. PORV inoperability may be due to seat leakage or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. For these reasons, the block valve may be closed but the Action requires power be maintained to the valve.

This Condition is only intended to permit operation of the plant for a limited period of time not to exceed the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem condition. Normally, the PORVs should be available for automatic mitigation of overpressure events and should be returned to OPERABLE status prior to entering startup (MODE 2).

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

McGuire Units 1 and 2 B 3.4.1 1-3 Revision No. 57

Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued)

B.1, B.2, and B.3 If one or two PORVs are inoperable and not capable of being manually cycled, it must be either restored or isolated by closing the associated block valve and removing the power to the associated block valve. If one PORV is inoperable as a result of the Required Action C.2, then Required Actions B.1 and B.2 are not applicable. The Completion Times of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months are reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation. If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time. Because there is one PORV that remains OPERABLE, an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is provided to restore an additional PORV to OPERABLE status when two PORVs are inoperable.

If the PORV cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D. With only one PORV inoperable, operation may continue provided Required Actions B.1 and B.2 are met.

C.1 and C.2 If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the associated PORV in the closed position. The prime importance for the capability to close the block valve is to isolate a stuck open PORV.

Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the Required Action is to place the PORV in the closed position and remove power from the solenoid to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. The actions for an inoperable PORV are not entered due to these actions, however, the associated PORV is inoperable and must be included in subsequent inoperability determinations. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation.

D.1 and D.2 If the Required Action of Condition A, B, or C is not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times McGuire Units 1 and 2 B 3.4.1 1-4 Revision No. 57

Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued) are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required. See LCO 3.4.12.

E.1, E.2, E.3, and E.4 If three PORVs are inoperable and not capable of being manually cycled, it is necessary to either restore at least one valve within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation. If one PORV is restored and two PORVs remain inoperable, then the plant will be in Condition B with the time clock started at the original declaration of having two PORVs inoperable. If no PORVs are restored within the Completion Time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

In MODES 4 and 5, maintaining PORV OPERABILITY may be required.

See LCO 3.4.12.

F.1 and F.2 If two block valves are inoperable, it is necessary to either restore one block valve within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , or place the associated PORVs in the closed position and restore one block valve within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Completion Times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.

G.1 and G.2 If three block valves are inoperable, it is necessary to place the associated PORVs in the closed position and verify the PORVs closed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and restore at least one block valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The Completion Times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.

McGuire Units 1 and 2 B 3.4.1 1-5 Revision No. 57

Pressurizer PORVs B 3.4.11 BASES ACTIONS (continued)

H.1 and H.2 If the Required Actions of Condition F or G are not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, maintaining PORV OPERABILITY may be required. See LCO 3.4.12.

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that the valve(s) can be closed if needed. The basis for the Frequency of 92 days is the ASME Code, Section Xl (Ref. 4). If the block valve is closed to isolate a PORV that is capable of being manually cycled, the OPERABILITY of the block valve is of importance, because opening the block valve is necessary to permit the PORV to be used for manual control of reactor pressure. If the block valve is closed to isolate an otherwise inoperable PORV, the maximum Completion Time to restore the PORV and open the block valve is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , which is well within the allowable limits (25%) to extend the block valve Frequency of 92 days. Furthermore, these test requirements would be completed by the reopening of a recently closed block valve upon restoration of the PORV to OPERABLE status (i.e., completion of the Required Actions fulfills the SR).

The Note modifies this SR by stating that it is not required to be met with the block valve closed, in accordance with the Required Action of this LCO.

SR 3.4.11.2 SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice.

The SR is modified by a Note which states that the SR is required to be performed in MODE 3 or 4 when the temperature of the RCS cold legs is

> 300OF consistent with Generic Letter 90-06 (Ref. 5).

McGuire Units 1 and 2 B 3.4.1 1-6 Revision No. 57

Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.11.3 The Surveillance demonstrates that the emergency nitrogen supply can be provided and is performed by transferring power from normal air supply to emergency nitrogen supply and cycling the valves. The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice.

REFERENCES 1. Regulatory Guide 1.32, February 1977.

2. UFSAR, Section 15.4.

3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

4. ASME, Boiler and Pressure Vessel Code, Section Xl.

5. Resolution of Generic Issue 70, "Power-Operated Relief Valve and Block Valve Reliability," and Generic Issue 94, "Additional Low-Temperature Overpressure Protection for Light-Water Reactors,"

Pursuant to 10 CFR 50.54(f) (Generic Letter 90-06).

McGuire Units 1 and 2 B 3.4.1 1-7 Revision No. 57

LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection. This specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits,' provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.

The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.

Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the specified limits.

This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity.

Limiting coolant input capability requires all but one centrifugal charging pump or one safety injection pump incapable of injection into the RCS and isolating the accumulators. The pressure relief capacity requires either two redundant PORVs or a depressurized RCS and an RCS vent of sufficient size. One PORV or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.

With minimum coolant input capability, the ability to provide core coolant addition is restricted. The LCO does not require the makeup control McGuire Units 1 and 2 B 3.4.12-1 Revision No. 57

LTOP System B 3.4.12 BASES BACKGROUND (continued) system deactivated or the safety injection (SI) actuation circuits blocked.

Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one centrifugal charging pump for makeup in the event of loss of inventory, then pumps can be made available through manual actions.

PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure reaches 385 psig when the PORVS are in the "lo-press' mode of operation. If the PORVs are being used to meet the requirements of this specification, then RCS cold leg temperature is limited in accordance with the LTOP analysis. For cases where no reactor coolant pumps are in operation, this temperature limit is met by monitoring of BOTH the Wide Range Cold Leg temperatures and Residual Heat Removal Heat Exchanger discharge temperature. These temperatures are the most representative of the fluid in the reactor vessel downcomer region. The LTOP actuation logic monitors both RCS temperature and RCS pressure. The signals used to generate the pressure setpoints originate from the safety related narrow range pressure transmitters. The signals used to generate the temperature permissives originate from the wide range RTDs on cold leg C and hot leg D. Each signal is input to the appropriate NSSS protection system cabinet where it is converted to an internal signal and then input to a comparator to generate an actuation signal. If the indicated pressure meets or exceeds the bistable setpoint, a PORV is signaled to open.

This Specification presents the PORV setpoints for LTOP. Having the setpoints of both valves within the limits ensures that the Reference 1 limits will not be exceeded in any analyzed event.

When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.

RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be McGuire Units 1 and 2 B 3.4.12-2 Revision No. 57

LTOP System B 3.4.12 BASES BACKGROUND (continued) capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.

APPLICABLE Safety analyses (Ref. 4) demonstrate that the reactor vessel is SAFETY ANALYSES adequately protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 3000F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 3000 F and below, overpressure prevention falls to two OPERABLE PORVs or to a depressurized RCS and a sufficient sized RCS vent. Each of these means has a limited overpressure relief capability.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the PORV method or the depressurized and vented RCS condition.

Any change to the RCS must be evaluated against the Reference 4 analyses to determine the impact of the change on the LTOP acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:

Mass Input Type Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

Heat Input Type Transients

a. Inadvertent actuation of pressurizer heaters;

b. Loss of RHR cooling; or McGuire Units 1 and 2 B 3.4.12-3 Revision No. 57

LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)

c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle:

a. Rendering all but one centrifugal charging pump or one safety injection pump incapable of injection;

b. Deactivating the accumulator discharge isolation valves in their closed positions; and

c. Disallowing start of an RCP if secondary temperature is more than 500 F above primary temperature in any one loop. LCO 3.4.6, "RCS Loops-MODE 4," and LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," provide this protection.

The Reference 4 analyses demonstrate that either one PORV or the depressurized RCS and RCS vent can maintain RCS pressure below limits when only one centrifugal charging pump or one safety injection pump are actuated. Thus, the LCO allows only one centrifugal charging pump or one safety injection pump OPERABLE during the LTOP MODES. Since neither one PORV nor the RCS vent can handle the pressure transient from accumulator injection when RCS temperature is low the LCO also requires the accumulators isolation when accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.

The isolated accumulators must have their discharge valves closed and power removed.

Fracture mechanics analyses established the temperature of LTOP Applicability at 300 0F.

The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 5 and 6), requirements by having a maximum of one centrifugal charging pump OPERABLE and SI actuation enabled.

McGuire Units 1 and 2 B 3.4.12-4 Revision No. 57

LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)

PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified limit. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one centrifugal charging pump or one safety injection pump injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met.

The PORV setpoints will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3, NRCS Pressure and Temperature (P/T) Limits," discuss these examinations.

The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.

RCS Vent Performance With the RCS depressurized, analyses show a vent size of 2.75 square inches is capable of mitigating the allowed LTOP overpressure transient.

The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one centrifugal charging pump or one safety injection pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve.

The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.

The RCS vent is passive and is not subject to active failure.

The LTOP System satisfies Criterion 2 of 10 CFR 50.36 (Ref. 7).

McGuire Units 1 and 2 B 3.4.12-5 Revision No. 57

LTOP System B 3.4.12 BASES LCO This LCO requires that the LTOP System is OPERABLE. The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.

To limit the coolant input capability, the LCO permits a maximum of one centrifugal charging pump or one safety injection pump capable of injecting into the RCS and requires all accumulator discharge isolation valves closed and immobilized when accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.

The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:

a. Two OPERABLE PORVs (NC-32B and NC-34A); or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit and testing proves its automatic ability to open at this setpoint, and motive power is available to the valve and its control circuit.

b. A depressurized RCS and an RCS vent.

An RCS vent is OPERABLE when open with an area of 2 2.75 square inches.

Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

The LCO is modified with a note that specifies that a PORV secured in the open position may be used to meet the RCS vent requirement provided that its associated block valve is open and power removed.

With the PORV physically secured or locked in the open position with its associated block valve open and power removed, this vent path is passive and is not subject to active failure.

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is S 300 0F, in MODE 5, and in MODE 6 when the reactor vessel head is on.

The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 300 0F. When the reactor vessel head is off, overpressurization cannot occur.

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of McGuire Units 1 and 2 B 3.4.12-6 Revision No. 57

LTOP System B 3.4.12 BASES APPLICABILITY (continued) the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 300 0F.

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

The Applicability is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1. A.2.1. A.2.2.1. A.2.2.2, A.3, A.4. A.5.1, and A.5.2 With two centrifugal charging pumps, safety injection pumps, or a combination of each, capable of injecting into the RCS, RCS overpressurization is possible.

To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.

Two pumps may be capable of injecting into the RCS provided the RHR suction relief valve is OPERABLE with:

1. RCS cold leg temperature > 1740 F (Unit 1), or

2. RCS cold leg temperature > 890 F (Unit 2), or

3. RCS cold leg temperature > 740 F and cooldown rate < 200 F/hr (Unit 1),

or

4. RCS cold leg temperature > 740 F and cooldown rate < 60'F/hr (Unit 2),

or

5. two PORVs secured open with associated block valves open and power removed, or

6. a RCS vent of > 4.5 square inches, or McGuire Units 1 and 2 B 3.4.12-7 Revision No. 57

LTOP System B 3.4.12 BASES ACTIONS (continued)

7. a RCS vent of > 2.75 square inches and two OPERABLE PORVs (the RCS vent shall not be one of the two OPERABLE PORVs).

For cases where no reactor coolant pumps are in operation, RCS cold leg temperature limits are to be met by monitoring of BOTH the WR Cold Leg temperatures and Residual Heat Removal Heat Exchanger discharge temperature. With both PORVS and block valves secured open, or with an RCS vent of 4.5 square inches, there are no credible single failures to limit the flow relief capacity. For the RHR relief valve to be OPERABLE, the RHR suction isolation valves must be open and the relief valve setpoint at 450 psig consistent with the safety analysis. The RHR suction relief valves are spring loaded, bellows type water relief valves with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 3) for Class 2 relief valves.

Required Action A.1 is modified by a Note that permits two centrifugal charging pumps capable of RCS injection for < 15 minutes to allow for pump swaps.

B.1, C.1, and C.2 An unisolated accumulator requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.

If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , Required Action C.1 and Required Action C.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By increasing the RCS temperature to > 300 0F, an accumulator pressure of 639 psig cannot exceed the LTOP limits if the accumulators are fully injected.

Depressurizing the accumulators below the LTOP limit also gives this protection.

The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.

D.1 In MODE 4 when any RCS cold leg temperature is < 3000F, with one PORV inoperable, the PORV must be restored to OPERABLE status McGuire Units 1 and 2 B 3.4.12-8 Revision No. 57

LTOP System B 3.4.12 BASES ACTIONS (continued) within a Completion Time of 7 days. Two PORVS are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.

The Completion Time considers the facts that only one of the PORVs is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.

E.1 and E.2 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 8). Thus, with one of the two PORVs inoperable in MODE 5 or in MODE 6 with the head on, all operations which could lead to a water solid pressurizer must be suspended immediately and the Completion Time to restore two valves to OPERABLE status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE PORV to protect against overpressure events.

F.1 and F.2 If the Required Actions and associated Completion Times of Condition E are not met, then alternative actions are necessary to establish the required redundancy in relief capacity. This is accomplished by verifying that the RHR relief valve is OPERABLE and the RHR suction isolation valves open and the RCS cold leg temperature > 1741F (Unit 1) or > 890 F (Unit 2). For cases where no reactor coolant pumps are in operation, RCS cold leg temperature limits are to be met by monitoring of BOTH the WR Cold Leg temperatures and Residual Heat Removal Heat Exchanger discharge temperature. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months reflects the importance of restoring the required redundancy at lower RCS temperatures.

G.1 The RCS must be depressurized and a vent must be established within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months when:

McGuire Units 1 and 2 B 3.4.12-9 Revision No. 57

LTOP System B 3.4.12 BASES ACTIONS (continued)

a. Both required PORVs are inoperable; or

b. A Required Action and associated Completion Time of Condition C, D, E, or F is not met; or

c. The LTOP System is inoperable for any reason other than Condition A, B, C, D, E, or F.

The vent must be sized Ž 2.75 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

SURVEILLANCE SR 3.4.12.1 and SR 3.4.12.2 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all but one centrifugal charging pump or one safety injection pump are verified incapable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and power removed (See Ref. 10).

The centrifugal charging pump and safety injection pump are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through two valves in the discharge flow path being closed.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment.

SR 3.4.12.3 The RHR suction relief valve shall be demonstrated OPERABLE by verifying the RHR suction isolation valves are open and by testing it in McGuire Units 1 and 2 B 3.4.12-1 0 Revision No. 57

LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) accordance with the Inservice Testing Program. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet the Required Actions of this LCO.

The RHR suction valves are verified to be opened every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Frequency is considered adequate in view of other administrative controls such as valve status indications available to the operator in the control room that verify the RHR suction valves remain open.

The ASME Code, Section Xl (Ref. 9), test per Inservice Testing Program verifies OPERABILITY by proving proper relief valve mechanical motion and by measuring and, if required, adjusting the lift setpoint.

SR 3.4.12.4 The RCS vent of 2 2.75 square inches is proven OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for a valve that cannot be locked.

b. Once every 31 days for a valve that is locked, sealed, or secured in position. A removed pressurizer safety valve fits this category.

The passive vent arrangement must only be open to be OPERABLE.

This Surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO 3.4.12b.

SR 3.4.12.5 The PORV block valve must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve must be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.

The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is considered adequate in view of other administrative controls available to the operator in the control room, such as valve position indication, that verify that the PORV block valve remains open.

McGuire Units 1 and 2 B 3.4.12-1 1 Revision No. 57

LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.12.6 Performance of a COT is required within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS temperature to < 300OF and every 31 days on each required PORV to verify and, as necessary, adjust its lift setpoint. The COT will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency considers the unlikelihood of a low temperature overpressure event during this time.

A Note has been added indicating that this SR is required to be met 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS cold leg temperature to < 3000F. The test must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the LTOP MODES.

SR 3.4.12.7 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 18 months to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.

REFERENCES 1. 10 CFR 50, Appendix G.

2. Generic Letter 88-11.

3. ASME, Boiler and Pressure Vessel Code, Section 1I1.

4. UFSAR, Section 5.2.

5. 10 CFR 50, Section 50.46.

6. 10 CFR 50, Appendix K.

7. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

8. Generic Letter 90-06.

9. ASME, Boiler and Pressure Vessel Code, Section Xl.

10. Duke letter to NRC, uCold Leg Accumulator Isolation Valves', dated September 8,1987.

McGuire Units 1 and 2 B 3.4.12-12 Revision No. 57

RCS Leakage Detection Instrumentation B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.15 RCS Leakage Detection Instrumentation BASES BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.

The primary method of detecting leakage into the Containment is measurement of the Containment floor and equipment sump level. There are small sumps located on either side of the containment outside the crane wall. Any leakage would fall to the floor inside the crane wall and run by a sump drain line to one of the two sumps. Any leakage outside the crane wall would fall into the floor and gravity drain to these sumps.

The sump level rate of change, as calculated by the plant computer, would indicate the leakage rate. This method of detection would indicate in the Control Room a water leak from either the Reactor Coolant System or the Main Steam and Feedwater Systems. A 1 gpm leak (cumulative in both sump A and B) is detectable in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The containment ventilation condensate drain tank (CVCDT) level change offers another means of detecting leakage into the containment. An abnormal level increase would indicate removal of moisture from the containment by the containment air coolers. When the CVCDT is used as a leakage detection method, manual hourly logging of the CVCDT level and calculation of reactor coolant leakage (if CVCDT level shows > 1 gpm increase) are required to satisfy the LCO requirements.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation.

Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. Instrument sensitivities of 10 9pCI/cc radioactivity for particulate monitoring and of 106 pCi/cc radioactivity for McGuire Units 1 and 2 B 3.4.1 5-1 Revision No. 57

RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND (continued) gaseous monitoring are practical for these leakage detection systems.

Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE. When either the particulate or gaseous radioactivity monitor is out of service for maintenance or failure, both monitors may be affected because they share common sample tubing and pump and flow instrumentation.

An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS LEAKAGE. A 1IF increase in dew point is well within the sensitivity range of available instruments.

Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid level into the containment floor and equipment sump and condensate level from air coolers. Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment.

Temperature and pressure monitors are not required by this LCO.

APPLICABLE The need to evaluate the severity of an alarm or an indication is important SAFETY ANALYSES to the operators, and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the UFSAR (Ref. 3). Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.

McGuire Units 1 and 2 B 3.4.1 5-2 Revision No. 57

RCS Leakage Detection Instrumentation B 3.4.15 BASES APPLICABLE SAFETY ANALYSES (continued)

The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public.

RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36 (Ref. 4).

LCO One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are available. Thus, the containment floor and equipment sump level monitoring system and a gaseous radioactivity monitor, in combination with a containment ventilation condensate drain tank level monitor or particulate radioactivity monitor, provides an acceptable minimum.

APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.

In MODE 5 or 6, the temperature is to be < 200OF and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

ACTIONS A.1 and A.2 I With the containment floor and equipment sump level monitoring system inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere radioactivity monitor will provide indications of changes in leakage. Together with the atmosphere monitor, the periodic surveillance for RCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to provide information that is adequate to detect leakage.

McGuire Units 1 and 2 B 3.4.15-3 Revision No. 57

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)

Restoration of the containment floor and equipment sump level monitoring system to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.

B.1 and B.2 With the gaseous containment atmosphere radioactivity monitoring instrumentation channels inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information.

With a sample obtained and analyzed or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , continued operation is allowed since diverse indications of RCS LEAKAGE remain OPERABLE.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect leakage.

C.1 and C.2 With the containment atmosphere particulate radioactivity monitor and the containment ventilation condensate drain tank level monitor inoperable, the only means of detecting leakage is the containment floor and equipment sump level monitoring system or the containment atmosphere gaseous monitor. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable monitors to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a reduced configuration for a lengthy time period.

D.1 and D.2 If a Required Action of Condition A, B, or C cannot be met, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

McGuire Units 1 and 2 B 3.4.1 5-4 Revision No. 57

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)

E.1 With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.15.1 REQUIREMENTS SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives reasonable confidence that the channel is operating properly. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

SR 3.4.15.2 SR 3.4.15.2 requires the performance of a COT on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency of 92 days considers instrument reliability, and operating experience has shown that it is proper for detecting degradation.

SR 3.4.15.3. SR 3.4.15.4. and SR 3.4.15.5 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 18 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A, Section IV, GDC 30.

2. Regulatory Guide 1.45.

3. UFSAR, Section 5.2.7.

4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

5. UFSAR, Table 18-1.

6. McGuire License Renewal Commitments MCS-1274.00-00-0016, Section 4.29, RCS Operational Leakage Monitoring Program.

McGuire Units 1 and 2 B 3.4.15-5 Revision No. 57

RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.16 RCS Specific Activity BASES BACKGROUND The maximum dose to the whole body and the thyroid that an individual at the site boundary can receive for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during an accident is specified in 10 CFR 100 (Ref. 1). The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 limits during analyzed transients and accidents.

The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant. The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LCO are standardized, based on parametric evaluations of offsite radioactivity dose consequences for typical site locations.

The parametric evaluations showed the potential offsite dose levels for a SGTR accident were an appropriately small fraction of the 10 CFR 100 dose guideline limits. Each evaluation assumes a broad range of site applicable atmospheric dispersion factors in a parametric evaluation.

APPLICABLE The LCO limits on the specific activity of the reactor coolant ensures that SAFETY ANALYSES the resulting 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following a SGTR accident. The SGTR safety analysis (Ref. 2) assumes the specific activity of the reactor coolant at the LCO limit and an existing reactor coolant steam generator (SG) tube leakage rate of 389 gpd. The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.1 ,pClgm DOSE EQUIVALENT 1-131 from LCO 3.7.16, "Secondary Specific Activity."

The analysis for the SGTR accident establishes the acceptance limits for RCS specific activity. Reference to this analysis is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.

McGuire Units 1 and 2 B 3.4.16-1 Revision No. 57

RCS Specific Activity B 3.4.16 BASES APPLICABLE SAFETY ANALYSES (continued)

The analysis is for two cases of reactor coolant specific activity.

One case assumes specific activity at 1.0 pCi/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the 1-131 activity in the reactor coolant by a factor of about 50 immediately after the accident. The second case assumes the initial reactor coolant iodine activity at 60.0 pCigm DOSE EQUIVALENT 1-131 due to a pre-accident iodine spike caused by an RCS transient. In both cases, the noble gas activity in the reactor coolant assumes 1% failed fuel, which closely equals the LCO limit of 100/E puCigm for gross specific activity.

The analysis also assumes a loss of offsite power at the same time as the SGTR event. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal if the leakage continues for a long enough time, although a manual trip is also credited after a conservatively long delay.

The coincident loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends.

The safety analysis shows the radiological consequences of an SGTR accident are within a small fraction of the Reference 1 dose guideline limits. Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed the limits shown in Figure 3.4.16-1, in the applicable specification, for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The safety analysis has concurrent and pre-accident iodine spiking levels up to 60.0 pCigm DOSE EQUIVALENT 1-131.

The remainder of the above limit permissible iodine levels shown in Figure 3.4.16-1 are acceptable because of the low probability of a SGTR accident occurring during the established 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time limit. The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 100 dose guideline limits.

The limits on RCS specific activity are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.

RCS specific activity satisfies Criterion 2 of 10 CFR 50.36 (Ref. 3).

McGuire Units 1 and 2 B 3.4.16-2 Revision No. 57

RCS Specific Activity B 3.4.16 BASES LCO The specific iodine activity is limited to 1.0 pCVgm DOSE EQUIVALENT 1-131, and the gross specific activity in the reactor coolant is limited to the number of uCi/gm equal to 100 divided by E (average disintegration energy of the sum of the average beta and gamma energies of the coolant nuclides). The limit on DOSE EQUIVALENT 1-131 ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the allowed thyroid dose.

The limit on gross specific activity ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.

The SGTR accident analysis (Ref. 2) shows that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months site boundary dose levels are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 100 dose guideline limits.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature 2 5000F, operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity are necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values.

For operation in MODE 3 with RCS average temperature < 500'F, and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves.

ACTIONS A.1 and A.2 With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate that the limits of Figure 3.4.16-1 are not exceeded. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze a sample. Sampling is done to continue to provide a trend.

The DOSE EQUIVALENT 1-131 must be restored to within limits within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is required, if the limit violation resulted from normal iodine spiking.

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS.

McGuire Units 1 and 2 B 3.4.1 6-3 Revision No. 57

RCS Specific Activity B 3.4.16 BASES ACTIONS (continued)

B.1 With the gross specific activity in excess of the allowed limit, the unit must be placed in a MODE in which the requirement does not apply.

The change within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to MODE 3 and RCS average temperature

< 5000 F lowers the saturation pressure of the reactor coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 5001F from full power conditions in an orderly manner and without challenging plant systems.

C.1 If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT 1-131 is in the unacceptable region of Figure 3.4.16-1, the reactor must be brought to MODE 3 with RCS average temperature < 5000F within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 500OF from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant at least once every 7 days. A gross radioactivity analysis shall consist of the quantitative measurement of the total specific activity of the reactor coolant except for radionuclides with half-lives less than 10 minutes and all radioiodines.

The total specific activity shall be the sum of the beta-gamma activity in the sample within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after the sample is taken and extrapolated back to when the sample was taken. Determination of the contributors to the gross specific activity shall be based upon those energy peaks identifiable with a 95% confidence level. The latest available data may be used for pure beta-emitting radionuclides. This Surveillance provides an indication of any increase in gross specific activity.

McGuire Units 1 and 2 B 3.4.16-4 Revision No. 57

RCS Specific Activity B 3.4.16 BASES SURVEILLANCE REQUIREMENTS (continued)

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and 2, and in MODE 3 with Tavg at least 5000F. The 7 day Frequency considers the unlikelihood of a gross fuel failure during the time.

SR 3.4.1 6.2 This Surveillance is performed in MODE 1 only to ensure iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level, considering gross activity is monitored every 7 days. The Frequency, between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change 2 15% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results.

SR 3.4.16.3 A radiochemical analysis for Ef determination is required every 184 days (6 months) with the plant operating in MODE 1 equilibrium conditions.

The E determination directly relates to the LCO and is required to verify plant operation within the specified gross activity LCO limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than 10 minutes, excluding iodines. The Frequency of 184 days recognizes E does not change rapidly.

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This ensures that the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.

REFERENCES 1. 10 CFR 100.1 1, 1973.

2. UFSAR, Section 15.6.3.

3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

McGuire Units 1 and 2 B 3.4.1 6-5 Revision No. 57

ECCS-Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS-Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, 'ECCS-Operating," is applicable to these Bases, with the following modifications.

In MODE 4, the required ECCS train consists of two separate subsystems: centrifugal charging (high head) and residual heat removal (RHR) (low head).

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 also applies SAFETY ANALYSES to this Bases section.

Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation. The ECCS trains satisfy Criterion 3 of 10 CFR 50.36.

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of a centrifugal charging subsystem and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the containment sump. During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the McGuire Units 1 and 2 B 3.5.3-1 Revision No.57

ECCS - Shutdown B 3.5.3 BASES LCO (continued)

ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot and cold legs.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.

In MODE 4 with RCS temperature below 3501F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, 'RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, *Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable ECCS centrifugal charging subsystem when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS centrifugal charging subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators. The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.

McGuire Units 1 and 2 B 3.5.3-2 Revision No. 57

ECCS - Shutdown B 3.5.3 BASES ACTIONS With both RHR pumps and heat exchangers inoperable, it would be (continued) unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.

B.1 With no ECCS high head subsystem OPERABLE, due to the inoperability of the centrifugal charging pump or flow path from the RWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring SI. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore at least one ECCS high head subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.

C.1 When the Required Actions of Condition B cannot be completed within the required Completion Time, a controlled shutdown should be initiated.

Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems or operators.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply. This SR is modified by a Note that allows an RHR train to be considered OPERABLE during PIV testing and alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4, if necessary.

REFERENCES The applicable references from Bases 3.5.2 apply.

McGuire Units 1 and 2 B 3.5.3-3 Revision No. 57

Hydrogen Recombiners B 3.6.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.7 Hydrogen Recombiners BASES BACKGROUND The function of the hydrogen recombiners is to eliminate the potential breach of containment due to a hydrogen oxygen reaction.

Per 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light-Water-Cooled Reactors" (Ref. 1), and GDC 41, "Containment Atmosphere Cleanup" (Ref. 2), hydrogen recombiners are required to reduce the hydrogen concentration in the containment following a loss of coolant accident (LOCA). The recombiners accomplish this by recombining hydrogen and oxygen to form water vapor. The vapor remains in containment, thus eliminating any discharge to the environment. The hydrogen recombiners are manually initiated since flammable limits would not be reached until several days after a Design Basis Accident (DBA).

Two 100% capacity independent hydrogen recombiner systems are provided. Each consists of controls located outside containment in an area not exposed to the post LOCA environment, a power supply and a recombiner. Recombination is accomplished by heating a hydrogen air mixture above 11 50 0F. The resulting water vapor and discharge gases are cooled prior to discharge from the recombiner. A single recombiner is capable of maintaining the hydrogen concentration in containment below the 4.0 volume percent (vlo) flammability limit. Two recombiners are provided to meet the requirement for redundancy and independence.

Each recombiner is powered from a separate Engineered Safety Features bus, and is provided with a separate power panel and control panel.

APPLICABLE The hydrogen recombiners provide for the capability of controlling the SAFETY ANALYSES bulk hydrogen concentration in containment to less than the lower flammable concentration of 4.0 v/o following a DBA. This control would prevent a containment wide hydrogen burn, thus ensuring the pressure and temperature assumed in the analyses are not exceeded. The limiting DBA relative to hydrogen generation is a LOCA. Hydrogen may accumulate in containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant; McGuire Units 1 and 2 B 3.6.7-1 Revision No. 57

Hydrogen Recombiners B 3.6.7 BASES APPLICABLE SAFETY ANALYSES (continued)

b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;

c. Hydrogen in the RCS at the time of the LOCA (i.e., hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space); or

d. Corrosion of metals exposed to containment spray and Emergency Core Cooling System solutions.

To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 3 are used to maximize the amount of hydrogen calculated.

Based on the conservative assumptions used to calculate the hydrogen concentration versus time after a LOCA, the hydrogen concentration increases at different rates depending on the region of the containment being measured. The initiation of the Air Return System and Hydrogen Skimmer System along with the hydrogen recombiners will maintain the hydrogen concentration in the primary containment below flammability limits.

The hydrogen recombiners are designed such that, with the conservatively calculated hydrogen generation rates, a single recombiner is capable of limiting the peak hydrogen concentration in containment to less than 4.0 vfo (Ref. 3).

The hydrogen recombiners satisfy Criterion 3 of 10 CFR 50.36 (Ref. 4).

LCO Two hydrogen recombiners must be OPERABLE. This ensures operation of at least one hydrogen recombiner in the event of a worst case single active failure.

Operation with at least one hydrogen recombiner ensures that the post LOCA hydrogen concentration can be prevented from exceeding the flammability limit.

APPLICABILITY In MODES 1 and 2, two hydrogen recombiners are required to control the hydrogen concentration within containment below its flammability limit of 4.0 v/o following a LOCA, assuming a worst case single failure.

McGuire Units 1 and 2 B 3.6.7-2 Revision No. 57

Hydrogen Recombiners B 3.6.7 BASES APPLICABILITY (continued)

In MODES 3 and 4, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that calculated for the DBA LOCA. Also, because of the limited time in these MODES, the probability of an accident requiring the hydrogen recombiners is low.

Therefore, the hydrogen recombiners are not required in MODE 3 or 4.

In MODES 5 and 6, the probability and consequences of a LOCA are low, due to the pressure and temperature limitations in these MODES.

Therefore, hydrogen recombiners are not required in these MODES.

ACTIONS A.1 With one containment hydrogen recombiner inoperable, the inoperable recombiner must be restored to OPERABLE status within 30 days. In this condition, the remaining OPERABLE hydrogen recombiner is adequate to perform the hydrogen control function. However, the overall reliability is reduced because a single failure in the OPERABLE recombiner could result in reduced hydrogen control capability. The 30 day Completion Time is based on the availability of the other hydrogen recombiner, the small probability of a LOCA occurring (that would generate an amount of hydrogen that exceeds the flammability limit), and the amount of time available after a LOCA (should one occur) for operator action to prevent hydrogen accumulation from exceeding the flammability limit.

B.1 If the inoperable hydrogen recombiner(s) cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

McGuire Units 1 and 2 B 3.6.7-3 Revision No. 57

Hydrogen Recombiners B 3.6.7 BASES SURVEILLANCE SR 3.6.7.1 REQUIREMENTS Performance of a system functional test for each hydrogen recombiner ensures the recombiners are operational and can attain and sustain the temperature necessary for hydrogen recombination. In particular, this SR verifies that the minimum heater sheath temperature increases to 2 7000 F in S 90 minutes. After reaching 700'F, the power is increased to maximum power (not to exceed maximum rated power) for approximately 2 minutes and power is verified to be > 60 kW.

Industry operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.7.2 This SR ensures there are no physical problems that could affect recombiner operation. Since the recombiners are mechanically passive, they are not subject to mechanical failure. The only credible failure involves loose wiring or structural connections, deposits of foreign materials, etc.

A visual inspection is sufficient to determine abnormal conditions that could cause such failures. The 18 month Frequency for this SR was developed considering the incidence of hydrogen recombiners failing the SR in the past is low.

SR 3.6.7.3 This SR requires performance of a resistance to ground test for each heater phase to ensure that there are no detectable grounds in any heater phase. This SR should be performed following SR 3.6.7.1. This is accomplished by verifying that the resistance to ground for any heater phase is > 10,000 ohms.

The 18 month Frequency for this Surveillance was developed considering the incidence of hydrogen recombiners failing the SR in the past is low.

McGuire Units 1 and 2 B 3.6.7-4 Revision No. 57

Hydrogen Recombiners B 3.6.7 BASES REFERENCES 1. 10 CFR 50.44.

2. 10 CFR 50, Appendix A, GDC 41.

3. UFSAR Section 6.2.

4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

McGuire Units 1 and 2 B 3.6.7-5 Revision No. 57

HSS B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Hydrogen Skimmer System (HSS)

BASES BACKGROUND The HSS reduces the potential for breach of containment due to a hydrogen oxygen reaction by providing a uniformly mixed post accident containment atmosphere, thereby minimizing the potential for local hydrogen burns due to a pocket of hydrogen above the flammable concentration. Maintaining a uniformly mixed containment atmosphere also ensures that the hydrogen monitors will give an accurate measure of the bulk hydrogen concentration and give the operator the capability of preventing the occurrence of a bulk hydrogen burn inside containment per 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light-Water-Cooled Reactors" (Ref. 1), and 10 CFR 50, GDC 41,

'Containment Atmosphere Cleanup' (Ref. 2).

The post accident HSS is an Engineered Safety Feature (ESF) and is designed to withstand a loss of coolant accident (LOCA) without loss of function. The System has two independent trains, each consisting of two fans with their own motors and controls. Each train is sized for 3000 cfm.

There is a normally closed, motor-operated valve on the hydrogen skimmer suction line to reduce ice condenser bypass during initial blowdown. The two trains are initiated automatically on a containment pressure high-high signal. The automatic action is to open the motor operated valve on the hydrogen skimmer suction line after a 9 + 1 minute delay. Once the valve has fully opened, the hydrogen skimmer fan will start. Each train is powered from a separate emergency power supply.

Since each train fan can provide 100% of the mixing requirements, the System will provide its design function with a limiting single active failure.

Air is drawn from the dead ended compartments by the mixing fans and is discharged toward the upper regions of the containment. This complements the air patterns established by the containment air return fans, which take suction from the operating floor level and discharge to the lower regions of the containment, and the containment spray, which cools the air and causes it to drop to lower elevations. The systems work together such that potentially stagnant areas where hydrogen pockets could develop are eliminated.

McGuire Units 1 and 2 B 3.6.8-1 Revision No. 57

HSS B 3.6.8 BASES APPLICABLE The HSS provides the capability for reducing the local hydrogen SAFETY ANALYSES concentration to approximately the bulk average concentration. The limiting DBA relative to hydrogen concentration is a LOCA.

Hydrogen may accumulate in containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant;

b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;

c. Hydrogen in the RCS at the time of the LOCA (i.e., hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space); or

d. Corrosion of metals exposed to containment spray and Emergency Core Cooling System solutions.

To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 3 are used to maximize the amount of hydrogen calculated.

The HSS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).

LCO Two HSS trains must be OPERABLE, with power to each from an independent, safety related power supply. Each train consists of one fan with its own motor and controls and is automatically initiated by a containment pressure high-high signal.

Operation with at least one HSS train provides the mixing necessary to ensure uniform hydrogen concentration throughout containment.

APPLICABILITY In MODES 1 and 2, the two HSS trains ensure the capability to prevent localized hydrogen concentrations above the flammability limit of 4.0 volume percent in containment assuming a worst case single active failure.

In MODE 3 or 4, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that calculated for McGuire Units 1 and 2 B 3.6.8-2 Revision No. 57

HSS B 3.6.8 BASES APPLICABILITY (continued) the DBA LOCA. Also, because of the limited time in these MODES, the probability of an accident requiring the HSS is low. Therefore, the HSS is not required in MODE 3 or 4.

In MODES 5 and 6, the probability and consequences of a LOCA or steam line break (SLB) are reduced due to the pressure and temperature limitations in these MODES. Therefore, the HSS is not required in these MODES.

ACTIONS A.1 With one HSS train inoperable, the inoperable train must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE HSS train is adequate to perform the hydrogen mixing function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in reduced hydrogen mixing capability. The 30 day Completion Time is based on the availability of the other HSS train, the small probability of a LOCA or SLB occurring (that would generate an amount of hydrogen that exceeds the flammability limit), the amount of time available after a LOCA or SLB (should one occur) for operator action to prevent hydrogen accumulation from exceeding the flammability limit, and the availability of the hydrogen recombiners and Hydrogen Mitigation System.

B.1 If an inoperable HSS train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

McGuire Units 1 and 2 B 3.6.8-3 Revision No. 57

HSS B 3.6.8 BASES SURVEILLANCE SR 3.6.8.1 REQUIREMENTS Operating each HSS train for 2 15 minutes ensures that each train is OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan and/or motor failure, or excessive vibration can be detected for corrective action. The 92 day Frequency is consistent with Inservice Testing Program Surveillance Frequencies, operating experience, the known reliability of the fan motors and controls, and the two train redundancy available.

SR 3.6.8.2 Verifying HSS fan motor current at rated speed with the motor operated suction valves closed is indicative of overall fan motor performance and system flow. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of 92 days was based on operating experience which has shown this Frequency to be acceptable.

SR 3.6.8.3 This SR verifies the operation of the motor operated suction valves and HSS fans in response to a start permissive from the Containment Pressure Control System (CPCS). The CPCS is described in the Bases for LCO 3.3.2, 'ESFAS.' The Frequency of 92 days was based on operating experience which has shown this Frequency to be acceptable.

SR 3.6.8.4 This SR ensures that each HSS train responds properly to a containment pressure high-high actuation signal. The Surveillance verifies that each fan starts after a delay of 2 8 minutes and 5 10 minutes. The Frequency of 92 days conforms with the testing requirements for similar ESF equipment and considers the known reliability of fan motors and controls and the two train redundancy available. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

McGuire Units 1 and 2 B, 3.6.8-4 Revision No. 57

HSS B 3.6.8 BASES REFERENCES 1. 10 CFR 50.44.

2. 10 CFR 50, Appendix A, GDC 41.

3. Regulatory Guide 1.7, Revision 0.

4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

McGuire Units 1 and 2 B 3.6.8-5 Revision No. 57

SG PORVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Steam Generator Power Operated Relief Valves (SG PORVs)

BASES BACKGROUND The SG PORVs provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Dump System to the condenser not be available, as discussed in the UFSAR, Section 10.3 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the condensate storage system (CSS). The SG PORVs may also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Steam Dump System.

One SG PORV line for each of the four steam generators is provided.

Each SG PORV line consists of one SG PORV and an associated block valve.

The SG PORVs are provided with upstream block valves to permit their being tested at power, and to provide an alternate means of isolation.

The SG PORVs are equipped with pneumatic controllers to permit control of the cooldown rate.

A description of the SG PORVs is found in Reference 1. The SG PORVs are OPERABLE when they are capable of fully opening and closing manually using the handwheel.

APPLICABLE The design basis of the SG PORVs is established by the capability to SAFETY ANALYSES cool the unit to RHR entry conditions. The PORVs were sized to achieve a 50° F/hr cooldown rate. At cooldown inception, the PORVs will slowly open to maintain the desired cooldown rate. As S/G pressure decreases, the PORVs will eventually be wide open and the cooldown rate will gradually decrease. Therefore, the cooldown time from hot standby to RHR initiation is a function of the chosen maximum cooldown rate, the number of PORVs operating, and the time spent at MODE 3.

In the accident analysis presented in Reference 2, the SG PORVs are assumed to be used by the operator to cool down the unit to RHR entry conditions for accidents accompanied by a loss of offsite power. Prior to operator actions to cool down the unit, the SG PORVs and main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design McGuire Units 1 and 2 B 3.7.4-1 Revision No. 57

SG PORVs SG PORVs B 3.7.4 BASES APPLICABLE SAFETY ANALYSES (continued) value. For the recovery from a steam generator tube rupture (SGTR) event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for the SG PORVs. The number of SG PORVs required to be OPERABLE to satisfy the SGTR accident analysis requirements depends upon the number of unit loops and consideration of any single failure assumptions regarding the failure of one SG PORV to open on demand. SG PORVs are credited to be operated manually using the handwheel for safety analysis assumptions.

The SG PORVs are equipped with block valves in the event an SG PORV spuriously fails to close during use.

The SG PORVs satisfy Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO Three SG PORV lines are required to be OPERABLE. One SG PORV line is required from each of three steam generators to ensure that at least one SG PORV line is available to conduct a unit cooldown following an SGTR, in which one steam generator becomes unavailable, accompanied by a single, active failure of a second SG PORV line on an unaffected steam generator. The block valves must be OPERABLE to isolate a failed open SG PORV line. A closed block valve does not render it or its SG PORV line inoperable if operator action time to open the block valve is supported in the accident analysis.

Failure to meet the LCO can result in the inability to cool the unit to RHR entry conditions following an event in which the condenser is unavailable for use with the Steam Dump System.

An SG PORV line is considered OPERABLE when the SG PORV and its associated block valve are capable of fully opening and closing manually using the handwheel.

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal, the SG PORVs are required to be OPERABLE.

In MODE 5 or 6, an SGTR is not a credible event.

McGuire Units 1 and 2 B 3.7.4-2 Revision No. 57

SG PORVs B 3.7.4 BASES ACTIONS A.1 With one required SG PORV line inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE SG PORV lines, a nonsafety grade backup in the Steam Dump System, and MSSVs.

B.1 With two or more SG PORV lines inoperable, action must be taken to restore all but one SG PORV line to OPERABLE status. Since the block valve can be closed to isolate an SG PORV, some repairs may be possible with the unit at power. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to repair inoperable SG PORV lines, based on the availability of the Steam Dump System and MSSVs, and the low probability of an event occurring during this period that would require the SG PORV lines.

C.1 and C.2 If the SG PORV lines cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4, without reliance upon steam generator for heat removal, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the SG PORVs must be able to be opened manually using the handwheel and throttled through their full range. This SR ensures that the SG PORVs are tested through a full cycle at least once per fuel cycle. Performance of inservice testing or use of an SG PORV during a unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

McGuire Units 1 and 2 B 3.7.4-3 Revision No. 57

SG PORVs B 3.7.4 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.4.2 The function of the block valve is to isolate a failed open SG PORV.

Cycling the block valve manually using the handwheel both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 10.3.

2. UFSAR, Chapter 15.

3. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

McGuire Units 1 and 2 B 3.7.4-4 Revision No. 57

AFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps take suction from the non-safety related AFW Storage Tank (Water Tower). The assured source of water to the AFW System is the Standby Nuclear Service Water Pond (SNSWP). The turbine and motor driven pump discharge lines to each individual steam generator join into a single line outside containment. These individual lines penetrate the containment and enter each steam generator through the auxiliary feedwater nozzle. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1) or SG PORVs (LCO 3.7.4). If the main condenser is available, steam may be released via the steam dump valves and recirculated to the condensate storage system (CSS).

The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains. Each of the motor driven pumps supply 100% of the flow requirements to two steam generators, although each pump has the capability to be realigned to feed other steam generators. The turbine driven pump provides 200% of the flow requirements and supplies water to all four steam generators. Travel stops are set on the steam generator flow control valves such that the pumps can supply the minimum flow required without exceeding the maximum flow allowed. The pumps are equipped with independent recirculation lines to prevent pump operation against a closed system.

Each motor driven AFW pump is powered from an independent Class 1E power supply. The steam turbine driven AFW pump receives steam from two main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump.

The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby McGuire Units 1 and 2 B 3.7.5-1 Revision No. 57

BASES AFW System B 3.

7.5 BACKGROUND

(continued) conditions. One turbine driven pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions. During unit cooldown, SG pressures and Main Steam pressures decrease simultaneously. Thus, the turbine driven AFW pump with a reduced steam supply pressure remains fully capable of providing flow to all SGs. Thus, the requirement for diversity in motive power sources for the AFW System is met.

The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the lowest setpoint of the MSSVs plus 3% accumulation. Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the SG PORVs or MSSVs.

The motor driven AFW pumps actuate automatically on steam generator water level low-low in 1 out of 4 steam generators by the ESFAS (LCO 3.3.2). The motor driven pumps also actuates on loss of offsite power, safety injection, and trip of all MFW pumps. The turbine driven AFW pump actuates automatically on steam generator water level low-low in 2 out of 4 steam generators and on loss of offsite power.

The AFW System is discussed in the UFSAR, Section 10.4.7 (Ref. 1).

APPLICABLE The AFW System mitigates the consequences of any event with loss of SAFETY ANALYSES normal feedwater.

The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators.

In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to account for flow losses such as pump recirculation valve leakage and line breaks.

The limiting Design Basis Accidents (DBAs) and transients for the AFW System are as follows:

a. Feedwater Line Break (FWLB);

b. Steam Generator Tube Rupture (SGTR);

McGuire Units 1 and 2 B 3.7.5-2 Revision No. 57

BASES AFW System B 3.7.5 APPLICABLE SAFETY ANALYSES (continued)

c. Main Steam Line Break (MSLB);

d. Small Break Loss of Coolant Accident (SBLOCA); and

e. Loss of Offsite AC Power.

The AFW System design is such that it can perform its function following a FWLB between the Steam Generator and the feedwater isolation valve, combined with a loss of offsite power following turbine trip, and a single active failure of the steam turbine driven AFW pump. In such a case, one motor driven AFW pump will deliver nearly all of its flow to the steam generator with the broken MFW header until flow to that steam generator can be terminated by the operator. Sufficient flow is delivered to the intact steam generators by the redundant AFW pump.

The ESFAS automatically actuates the AFW turbine driven pump and associated power operated valves and controls when required to ensure an adequate feedwater supply to the steam generators during loss of offsite power.

The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36 (Ref. 2).

LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of RHR capability for all events accompanied by a loss of offsite power and a single failure.

This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs.

The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.

This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to separate steam generators.

The turbine driven AFW pump is required to be OPERABLE with redundant steam supplies from two main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to any of the steam generators. The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE.

McGuire Units 1 and 2 B 3.7.5-3 Revision No. 57

BASES AFW System B 3.7.5 LCO (continued)

The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODE 4 the AFW System may be used for heat removal via the steam generators.

In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train when entering MODE 1. There is an increased risk associated with entering MODE 1 with an AFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If one of the two steam supplies to the turbine driven AFW train is inoperable, action must be taken to restore OPERABLE status within 7 days in MODES 1, 2, and 3. The 7 day Completion Time is reasonable, based on the following reasons:

a. The redundant OPERABLE steam supply to the turbine driven AFW pump;

b. The availability of redundant OPERABLE motor driven AFW pumps; and

c. The low probability of an event occurring that requires the inoperable steam supply to the turbine driven AFW pump.

McGuire Units 1 and 2 B 3.7.5-4 Revision No. 57

BASES AFW System B 3.7.5 ACTIONS (continued)

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

B.1 With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

C.1 and C.2 When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE 1, 2, or 3, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in McGuire Units 1 and 2 B 3.7.5-5 Revision No. 57

BASES AFW System B 3.7.5 ACTIONS (continued) accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.

D.1 If all three AFW trains are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.

Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.

E.1 In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6, 'RCS Loops-MODE 4." With one required AFW train with a motor driven pump inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The SR is also modified by a note that excludes automatic valves when THERMAL POWER is <

10% RTP. Some automatic valves may be in a throttled position to support low power operation.

McGuire Units 1 and 2 B 3.7.5-6 Revision No. 57

BASES AFW System B 3.7.5 SURVEILLANCE REQUIREMENTS (continued)

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by Section Xl of the ASME Code (Ref 3). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. Performance of inservice testing discussed in the ASME Code, Section Xi (Ref. 3) (only required at 3 month intervals) satisfies this requirement.

The Frequency for this SR is in accordance with the Inservice Testing Program.

This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test. The test should be conducted within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the steam pressure exceeding 900 psig.

SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is acceptable based on operating experience and the design reliability of the equipment.

This SR is modified by a Note that states the SR is not required in MODE

4. In MODE 4, the required AFW train may already be aligned and operating.

McGuire Units 1 and 2 B 3.7.5-7 Revision No. 57

AFW System BASES BASES AFW System B 3.7.5 SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1, 2, and 3. In MODE 4, the required pump may already be operating and the autostart function is not required. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

This SR is modified by two Notes. Note 1 indicates that the SR can be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam-pressure to perform the test.

The test should be conducted within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the steam pressure exceeding 900 psig. Note 2 states that the SR is not required in MODE 4.

In MODE 4, the required pump may already be operating and the autostart function is not required. In MODE 4, the heat removal requirements would be less providing more time for operator action to manually start the required AFW pump if it were not in operation.

REFERENCES 1. UFSAR, Section 10.4.7.

2. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

3. ASME, Boiler and Pressure Vessel Code, Section Xl.

McGuire Units 1 and 2 B 3.7.5-8 Revision No. 57

AC Sources-Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating BASES.

BACKGROUND The unit Essential Auxiliary or Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate(s)), and the onsite standby power sources (Train A and Train B diesel generators (DGs)). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The onsite Class 1E AC Distribution System is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed. Each train has connections to two preferred offsite power sources and a single DG.

Offsite power is supplied to the unit switchyard(s) from the transmission network by two transmission lines. From the switchyard(s), two electrically and physically separated circuits provide AC power, through step down station auxiliary transformers, to the 4.16 kV ESF buses. A detailed description of the offsite power network and the circuits to the Class 1E ESF buses is found in the UFSAR, Chapter 8 (Ref. 2).

A qualified offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E ESF bus(es).

The offsite transmission systems normally supply their respective unit's onsite power supply requirements. However, in the event that one or both buslines of a unit become unavailable, or by operational desire, it is acceptable to supply that unit's offsite to onsite power requirements by aligning the affected 41 60V bus of the opposite unit via the standby transformers, SATA and SATB in accordance with Regulatory Guides 1.6 and 1.81 (Ref. 12 and 13). In this alignment, each unit's offsite transmission system could simultaneously supply its own 41 60V buses and one (or both) of the buses of the other unit.

Although a single auxiliary transformer (1ATA, 1ATB, 2ATA, 2ATB) is sized to carry all of the auxiliary loads of its unit plus both trains of essential 41 60V loads of the opposite unit, the LCO would not be met in this alignment due to separation criteria.

McGuire Units 1 and 2 B 3.8.1 -1 Revision No. 57

AC Sources-Operating B 3.8.1 BASES BACKGROUND (continued)

Each unit's Train A and B 41 60V bus must be derived from separate offsite buslines. The first offsite power supply can be derived from any of the four buslines (1A, 1B, 2A, or 2B). The second offsite power supply must not derive its power from the same busline as the first.

Acceptable train and unit specific breaker alignment options are described below:

Unit 1 A Train

1. BL1 A-1 ATA-1 TA-1 ATC-1 ETA

2. BLI B-1 ATB-1 TA-1 ATC-1 ETA

3. BL1A-1ATA-1TC-SATA-1 ETA

4. BL1 B-1 ATB-1 TC-SATA-1 ETA

5. BL2A-2ATA-2TC-SATA-1 ETA

6. BL2B-2ATB-2TC-SATA-1 ETA Unit 1 B Train

1. BL1 B-1 ATB-1 TD-1 ATD-1 ETB

2. BL1A-1ATA-1TD-1 ATD-1 ETB

3. BL1 B-1 ATB-1TB-SATB-1 ETB

4. BL1 A-1 ATA-1 TB-SATB-1 ETB

5. BL2B-2ATB-2TB-SATB-1 ETB

6. BL2A-2ATA-2TB-SATB-1 ETB Unit 2 A Train

1. BL2A-2ATA-2TA-2ATC-2ETA

2. BL2B-2ATB-2TA-2ATC-2ETA

3. BL2A-2ATA-2TC-SATA-2ETA

4. BL2B-2ATB-2TC-SATA-2ETA

5. BL1A-1ATA-1TC-SATA-2ETA

6. BLI B-1 ATB-lTC-SATA-2ETA Unit 2 B Train

1. BL2B-2ATB-2TD-2ATD-2ETB

2. BL2A-2ATA-2TD-2ATD-2ETB

3. BL2B-2ATB-2TB-SATB-2ETB

4. BL2A-2ATA-2TB-SATB-2ETB

5. BL1 B-1 ATB-i TB-SATB-2ETB

6. BL1 A-1 ATA-1 TB-SATB-2ETB McGuire Units 1 and 2 B 3.8.1-2 Revision No. 57

AC Sources-Operating B 3.8.1 BASES BACKGROUND (continued)

Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class 1E Distribution System. Typically (via accelerated sequencing), within 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.

The onsite standby power source for each 4.16 kV ESF bus is a dedicated DG. DGs A and B are dedicated to ESF buses ETA and ETB, respectively.

A DG starts automatically on a safety injection (SI) signal (i.e., low pressurizer pressure or high containment pressure signals) or on an ESF bus degraded voltage or undervoltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage or degraded voltage, independent of or coincident with an SI signal. The DGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal alone. Following the trip of offsite power, a sequencer strips loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.

In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).

Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the DG in the process.

Typically (via accelerated sequencing), within 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.

Ratings for Train A and Train B DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3). The continuous service rating of each DG is 4000 kW with 10% overload permissible for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period. The ESF loads that are powered from the 4.16 kV ESF buses are listed in Reference 2.

APPLICABLE The initial conditions of DBA and transient analyses in the UFSAR, SAFETY ANALYSES Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor McGuire Units 1 and 2 B 3.8.1 -3 Revision No. 57

AC Sources-Operating B 3.8.1 BASES APPLICABLE SAFETY ANALYSES (continued)

Coolant System (RCS), and containment design limits are not exceeded.

These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS);

and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the Accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at least one train of the onsite or offsite AC sources OPERABLE during Accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power; and

b. A worst case single failure.

The AC sources satisfy Criterion 3 of 10 CFR 50.36 (Ref. 6).

LCO Two qualified circuits between the offsite transmission network and the onsite Class 1E Electrical Power System and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.

Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the unit.

In addition, one required automatic load sequencer per train must be OPERABLE.

Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses.

The 4.16 kV essential system is divided into two completely redundant and independent trains designated A and B, each consisting of one 4.16 kV switchgear assembly, two 4.16 kV/600 V load centers, and associated loads.

Normally, each Class 1E 4.16 kV switchgear is powered from its associated non-Class 1E train of the 6.9 kV Normal Auxiliary Power System as discussed in "6.9 kV Normal Auxiliary Power System" in Chapter 8 of the UFSAR (Ref. 2). Additionally, an alternate source of power to each 4.16 kV essential switchgear is provided from the 6.9 kV system via a separate and independent 6.9/4.16 kV transformer. Two transformers are shared between units and provide the capability to supply an alternate source of power to each unit's 4.16 kV essential McGuire Units 1 and 2 B 3.8.1-4 Revision No. 57

AC Sources-Operating B 3.8.1 BASES LCO (continued) switchgear from either unit's 6.9 kV system. A key interlock scheme is provided to preclude the possibility of connecting the two units together at either the 6.9 or 4.16 kV level.

Each train of the 4.16 kV Essential Auxiliary Power System is also provided with a separate and independent emergency diesel generator. to supply the Class 1E loads required to safely shut down the unit following a design basis accident.

Each DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This will be accomplished within 11 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with the engine hot and DG in standby with the engine at ambient conditions.

Additional DG capabilities must be demonstrated to meet required Surveillance, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.

Proper sequencing of loads is a function of Sequencer OPERABILITY.

Proper load shedding is a function of DG OPERABILITY. Proper tripping of non-essential loads is a function of AC Bus OPERABILITY (Condition A of Technical Specification 3.8.9).

The AC sources in one train must be separate and independent (to the extent possible) of the AC sources in the other train. For the DGs, separation and independence are complete.

APPLICABILITY The AC sources and sequencers are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

The AC power requirements for MODES 5 and 6 are covered in LCO 3.8.2, "AC Sources-Shutdown."

McGuire Units 1 and 2 B 3.8.1-5 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.

There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

A.2 Required Action A.2, which only applies if the train cannot be powered from an offsite source, is intended to provide assurance that an event coincident with a single failure of the associated DG will not result in a complete loss of safety function of critical redundant required features. These features are powered from the redundant AC electrical power train. This includes motor driven auxiliary feedwater pumps. The turbine driven auxiliary feedwater pump is required to be considered a redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action. Three independent AFW pumps are required to ensure the availability of decay heat removal capability for all events accompanied by a loss of offsite power and a single failure. System design is such that the remaining OPERABLE motor driven auxiliary feedwater pump is not by itself capable of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.

The Completion Time for Required Action A.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. The train has no offsite power supplying its loads; and

b. A required feature on the other train is inoperable.

If at any time during the existence of Condition A (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

McGuire Units 1 and 2 B 3.8.1-6 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

Discovering no offsite power to one train of the onsite Class 1E Electrical Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with the other train that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to Train A and Train B of the onsite Class 1E Distribution System. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

A.3 According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action A.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The 'AND" connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

McGuire Units 1 and 2 B 3.8.1-7 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

As in Required Action A.2, the Completion Time allows for an exception to the normal *time zero" for beginning the allowed outage time "clock."

This will result in establishing the time zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.

B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of off site power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. This includes motor driven auxiliary feedwater pumps. The turbine driven auxiliary feedwater pump is required to be considered a redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action. Three independent AFW pumps are required to ensure the availability of decay heat removal capability for all events accompanied by a loss of offsite power and a single failure. System design is such that the remaining OPERABLE motor driven auxiliary feedwater pump is not by itself capable of providing 100% of the auxiliary feedwater flow assumed in the safety analysis. Redundant required feature failures consist of inoperable features associated with a train, redundant to the train that has an inoperable DG.

The Completion Time for Required Action B.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time 'clock." In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature on the other train (Train A or Train B) is inoperable.

McGuire Units 1 and 2 B 3.8.1-8 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

If at any time during the existence of this Condition (one DG inoperable) a required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is Acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

In this Condition, the remaining OPERABLE DG and offsite circuits-are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DG(s). If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), the other DG(s) would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists, and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),

performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the problem investigation process will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

These Conditions are not required to be entered if the inoperability of the DG is due to an inoperable support system, an independently testable component, or preplanned testing or maintenance. If required, these McGuire Units 1 and 2 B 3.8.1-9 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

Required Actions are to be completed regardless of when the inoperable DG is restored to OPERABLE status.

According to Generic Letter 84-15 (Ref. 8), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.

B.4 According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition B for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

This could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

C.1 and C.2 Required Action C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant McGuire Units 1 and 2 B 3.8.1-1 0 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued) required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 7) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are powered from redundant AC safety trains. This includes motor driven auxiliary feedwater pumps.

Single train features, such as turbine driven auxiliary pumps, are not included in the list.

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action the Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable; and

b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits inoperable) a required feature becomes inoperable, this Completion Time begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable.

However, two factors tend to decrease the severity of this level of degradation:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and McGuire Units 1 and 2 B 3.8.1 -1 1 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

According to Reference 6, with the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems-Operating,' must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG, without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.

According to Regulatory Guide 1.93 (Ref. 7), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

McGuire Units 1 and 2 B 3.8.1-12 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Reference 7, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 The sequencer(s) is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated ESF bus.

Therefore, loss of an ESF bus sequencer affects every major ESF system in the train. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining sequencer OPERABILITY. This time period also ensures that the probability of an accident (requiring sequencer OPERABILITY) occurring during periods when the sequencer is inoperable is minimal.

G.1 and G.2 If the inoperable AC electric power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.

McGuire Units 1 and 2 B 3.8.1-1 3 Revision No. 57

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

H.1 Condition H corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 9).

Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Regulatory Guide 1.137 (Ref. 11), as addressed in the UFSAR.

Since the McGuire DG manufacturer, Nordberg, is no longer in business, McGuire engineering is the designer of record. Therefore, the term "manufacturers or vendor's recommendations" is taken to mean the recommendations as determined by McGuire engineering, with specific Nordberg input as it is available, that were intended for the DGs, taking into account the maintenance, operating history, and industry experience, when available.

Where the SRs discussed herein specify voltage and frequency tolerances, the following is applicable. The minimum steady state output voltage of 3740 V is 90% of the nominal 4160 V output voltage. This value allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 90% or 3600 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90%

of name plate rating. The specified maximum steady state output voltage of 4580 V is equal to the maximum operating voltage specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages. The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to

+/- 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).

McGuire Units 1 and 2 B 3.8.1-14 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are started from standby conditions using a manual start, loss of offsite power signal, safety injection signal, or loss of offsite power coincident with a safety injection signal. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear, the manufacturer recommends a modified start in which the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 3, which is only applicable when such modified start procedures are recommended by the manufacturer.

SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 11 seconds. The 11 second start requirement supports the assumptions of the design basis LOCA analysis in the UFSAR, Chapter 15 (Ref. 5).

McGuire Units 1 and 2 B 3.8.1-15 Revision No. 57

AC Sources-Operating 6 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

The 11 second start requirement is not applicable to SR 3.8.1.2 (see Note 3) when a modified start procedure as described above is used. If a modified start is not used, the 11 second start requirement of SR 3.8.1.7 applies.

Since SR 3.8.1.7 requires a 11 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. This is the intent of Note 1 of SR 3.8.1.2.

The normal 31 day Frequency for SR 3.8.1.2 and the 184 day Frequency for SR 3.8.1.7 are consistent with Regulatory Guide 1.9 (Ref. 3) Table 1.

These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.

SR 3.8.1.3 This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0.

The 0.8 value is the design rating of the machine, while the 1.0 is an operational limitation to ensure circulating currents are minimized. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 31 day Frequency for this Surveillance is consistent with Regulatory Guide 1.9 (Ref. 3) Table 1.

This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients, because of changing bus loads, do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

McGuire Units 1 and 2 B 3.8.1-16 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, and is adequate for approximately 30 minutes of DG operation at full load.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 11). This SR is for preventative maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The design of fuel transfer systems is such that pumps operate automatically or may be started manually in order to maintain an adequate volume of fuel oil in the day tanks during or following DG testing. Therefore, a 31 day Frequency is appropriate.

McGuire Units 1 and 2 B 3.8.1-17 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads.

The 18 month Frequency of the Surveillance is based on engineering judgment, taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. For this unit, the single load for each DG and its kilowatt rating is as follows: Nuclear Service Water Pump which is a 576 kW motor. This Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.

As required by Regulatory Guide 1.9 (Ref. 3), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the McGuire Units 1 and 2 B 3.8.1-1 8 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.

The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals. The 3 seconds specified is equal to 60% of a typical 5 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG.

SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency values to which the system must recover following load rejection. The 18 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3) Table 1.

This Surveillance is performed with the DG connected to its bus in parallel with offsite power supply. The DG is tested under maximum kVAR loading, which is defined as being as close to design basis conditions as practical subject to offsite power conditions. Design basis conditions have been calculated to be greater than 0.9 power factor. During DG testing, equipment ratings are not to be exceeded (i.e., without creating an overvoltage condition on the DG or 4 kV emergency buses, over-excitation in the generator, or overloading the DG emergency feeder while maintaining the power factor greater than or equal to 0.9).

This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits.

The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance criteria provide for DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

McGuire Units 1 and 2 B 3.8.1-1 9 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

Although not representative of the design basis inductive loading that the DG would experience, a power factor of approximately unity (1.0) is used for testing. This power factor is chosen in accordance with manufacturer's recommendations to minimize DG overvoltage during testing.

The 18 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3) and is intended to be consistent with expected fuel cycle lengths.

This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies the de-energization of the emergency buses, load shedding from the emergency buses and energization of the emergency buses and blackout loads from the DG. Tripping of non-essential loads is not verified in this test. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG autostart time of 11 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved.

The requirement to verify the connection and power supply of the emergency bus and autoconnected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or residual heat removal (RHR) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG systems to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

McGuire Units 1 and 2 B 3.8.1-20 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) Table 1, takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (11 seconds) from the design basis actuation signal (LOCA signal) and operates for 2 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.12.d ensures that the emergency bus remains energized from the offsite electrical power system on an ESF signal without loss of offsite power. This Surveillance also verified the tripping of non-essential loads. Tripping of non-essential loads is verified only once, either in this SR or in SR 3.8.1.19, since the same circuitry is tested in each SR.

The Frequency of 18 months is consistent with Regulatory Guide 1.9 (Ref. 3) Table 1 and takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. This SR is modified by a Note. The reason for the Note is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

SR 3.8.1.13 This Surveillance demonstrates that DG noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage McGuire Units 1 and 2 B 3.8.1-21 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) signal concurrent with an ESF actuation test signal, and critical protective functions (engine overspeed, generator differential current, low lube oil pressure, generator voltage-controlled overcurrent) trip the DG to avert substantial damage to the DG unit. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition.

This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The 18 month Frequency is consistent with Regulatory Guide 1.9 (Ref. 3)

Table 1, taking into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is not normally performed in MODE 1 or 2, but it may be performed in conjunction with periodic preplanned preventative maintenance activity that causes the DG to be inoperable. This is acceptable provided that performance of the SR does not increase the time the DG would be inoperable for the preplanned preventative maintenance activity.

SR 3.8.1.14 Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.9, requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent from 105% to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

This Surveillance is performed with the DG connected to its bus in parallel with offsite power supply. The DG is tested under maximum kVAR loading, which is defined as being as close to design basis conditions as practical subject to offsite power conditions. Design basis conditions have been calculated to be greater than 0.9 power factor. During DG testing, equipment ratings are not to be exceeded (i.e., without creating an overvoltage condition on the DG or 4 kV emergency buses, over-excitation in the generator, or overloading the DG emergency feeder while maintaining the power factor greater than or equal to 0.9).

McGuire Units 1 and 2 B 3.8.1-22 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

The load band is provided to avoid routine overloading of the DG.

Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) Table 1, takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Note 2 allows gradual loading of the DG in accordance with recommendation from the manufacturer.

This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

SR 3.8.1.1 5 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 11 seconds. The 11 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) Table 1.

This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

McGuire Units 1 and 2 B 3.8.1-23 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.16 As required by Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.11, this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and the DG can be returned to standby operation when offsite power is restored. It also ensures that the autostart logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in standby operation when the DG is at rated speed and voltage, the output breaker is open and can receive an autoclose signal on bus undervoltage, and the load sequence timers are reset.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) Table 1, and takes into consideration unit conditions required to perform the Surveillance. This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.17 Demonstration of the test mode override ensures that the DG availability under accident conditions will not be compromised as the result of testing and the DG will automatically reset to standby operation if a LOCA actuation signal is received during operation in the test mode. Standby operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by Regulatory Guide 1.9 (Ref. 3), paragraph 2.2.13. The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12. The intent in the requirement associated with SR 3.8.1.1 7.b is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) Table 1, takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

McGuire Units 1 and 2 B 3.8.1-24 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.1 8 Under accident and loss of offsite power conditions loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The load sequence time interval tolerance in Table 8-16 of Reference 2 ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.

Table 8-1 of Reference 2 provides a summary of the automatic loading of ESF buses. The sequencing times of Table 8-16 are committed and required for OPERABILITY. The typical 1 minute loading duration seen by the accelerated sequencing scheme is NOT required for OPERABILITY.

Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

SR 3.8.1.1 9 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance verifies the de-energization of the emergency buses, load shedding from the emergency buses, tripping of non-essential loads and energization of the emergency buses and ESF loads from the DG.

Tripping of non-essential loads is verified only once, either in this SR or in SR 3.8.1.12, since the same circuitry is tested in each SR. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the IDG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

McGuire Units 1 and 2 B3812 B 3.8.1-25 eiinN.5 Revision No. 57

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

The Frequency of 18 months is consistent with Regulatory Guide 1.9 (Ref. 3) Table 1.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 is that the performance of the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) Table 1.

This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. UFSAR, Chapter 8.

3. Regulatory Guide 1.9, Rev. 3, July 1993.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

7. Regulatory Guide 1.93, Rev. 0, December 1974.

8. Generic Letter 84-15, nProposed Staff Actions to Improve and Maintain Diesel Generator Reliability," July 2, 1984.

9. 10 CFR 50, Appendix A, GDC 18.

McGuire Units 1 and 2 B 3.8.1-26 Revision No. 57

AC Sources-Operating B 3.8.1 BASES

10. Regulatory Guide 1.137, Rev. 1, October 1979.

11. IEEE Standard 308-1971.

12. Regulatory Guide 1.6, Rev. 0, March 1971.

13. Regulatory Guide 1.8.1, Rev. 1, January 1975.

McGuire Units 1 and 2 B 3.8.1-27 Revision No. 57

Attachment 2 Revised List of Effective Pages

McGuire Nuclear Station Technical Specifications List of Affected Pages I Sections Page Number Amendment Revision Date 184/166 9/30/98 ii 184/166 9/30/98 iii 184/166 9/30/98 iv 184/166 9/30/98 1.1-1 184/166 9/30/98 1.1-2 184/166 9/30/98 1.1-3 206/187 8/23/02 1.1-4 194/175 9/18/00 1.1-5 206/187 8/23/02 1.1-6 206/187 8/23/02 1.1-7 194/175 9/18/00 1.2-1 184/166 9/30/98 1.2-2 184/166 9/30/98 1.2-3 184/166 9/30/98 1.3-1 184/166 9/30/98 1.3-2 184/166 9/30/98 1.3-3 184/166 9/30/98 1.3-4 184/166 9/30/98 1.3-5 184/166 9/30/98 1.3-6 184/166 9/30/98 1.3-7 184/166 9/30/98 1.3-8 184/166 9/30/98 1.3-9 184/166 9/30/98 1.3-10 184/166 9/30/98 1.3-11 184/166 9/30/98 1.3-12 184/166 9/30/98 1.3-13 184/166 9/30/98 1.4-1 184/166 9/30/98 1.4-2 184/166 9/30/98 1.4-3 184/166 9/30/98 1.4-4 184/166 9/30/98 McGuire Units 1 and 2 Page I Revision 54

Page Number Amendment Revision Date 2.0-1 219/201 1/14/04 3.0-1 221/203 4/29/04 3.0-2 221/203 4/29/04 3.0-3 221/203 4/29/04 Il 3.0-4 205/186 8/12/02 3.0-5 221/203 4/29/04 3.1.1-1 184/166 9/30/98 3.1.2-1 184/166 9/30/98 3.1.2-2 184/166 9/30/98 3.1.3-1 184/166 9/30/98 3.1.3-2 184/166 9/30/98 3.1.3-3 184/166 9/30/98 3.1.4-1 184/166 9/30/98 3.1.4-2 184/166 9/30/98 3.1.4-3 184/166 9/30/98 3.1.4-4 186/167 9/8/99 3.1.5-1 184/166 9/30/98 3.1.5-2 184/166 9/30/98 3.1.6-1 184/166 9/30/98 3.1.6-2 184/166 9/30/98 3.1.6-3 184/166 9/30/98 3.1.7-1 184/166 9/30/98 3.1.7-2 184/166 9/30/98 3.1.8-1 184/166 9/30/98 3.1.8-2 184/166 9/30/98 3.2.1-1 184/166 9/30/98 3.2.1-2 184/166 9/30/98 3.2.1-3 184/166 9/30/98 3.2.1-4 188/169 9/22/99 3.2.1-5 188/169 9/22/99 3.2.2-1 184/166 9/30/98 3.2.2-2 184/166 9/30/98 3.2.2-3 184/166 9/30/98 McGuire Units 1 and 2 Page 2 Revision 54

Page Number Amendment Revision Date 3.2.2-4 188/169 9/22/99 3.2.3-1 184/166 9/30/98 3.2.4-1 184/166 9/30/98 3.2.4-2 184/166 9/30/98 3.2.4-3 184/166 9/30/98 3.2.4-4 184/166 9/30/98 3.3.1-1 184/166 9/30/98 3.3.1-2 184/166 9/30/98 3.3.1-3 216/197 7/29/03 3.3.1-4 216/197 7/29/03 3.3.1-5 184/166 9/30/98 3.3.1-6 184/166 9/30/98 3.3.1-7 184/166 9/30/98 3.3.1-8 184/166 9/30/98 3.3.1-9 184/166 9/30/98 3.3.1-10 184/166 9/30/98 3.3.1-11 184/166 9/30/98 3.3.1-12 184/166 9/30/98 3.3.1 -13 184/166 9/30/98 3.3.1-14 194/175 9/18/00 3.3.1 -15 222/204 6/21/04 I 3.3.1-16 194/175 9/18/00 3.3.1-17 194/175 9/18/00 3.3.1-18 219/201 1/14/04 3.3.1-19 219/201 1/14/04 3.3.1-20 184/166 9/30/98 3.3.2-1 184/166 9/30/98 3.3.2-2 184/166 9/30/98 3.3.2-3 184/166 9/30/98 3.3.2-4 184/166 9/30/98 3.3.2-5 184/166 9/30/98 3.3.2-6 198/179 4/12/01 3.3.2-7 198/179 4/12/01 McGuire Units 1 and 2 Page 3 Revision 54

Page Number Amendment Revision Date 3.3.2-8 184/166 9/30/98 3.3.2-9 184/166 9/30/98 3.3.2-10 220/202 3/18/04 3.3.2-11 220/202 3/18/04 3.3.2-12 220/202 3/18/04 3.3.2-13 220/202 3/18/04 3.3.2-14 220/202 3/18/04 3.3.3-1 221/203 4/29/04 I 3.3.3-2 184/166 9/30/98 3.3.3-3 184/166 9/30/98 3.3.3-4 184/166 9/30/98 3.3.4-1 221/203 4/29/04 I 3.3.4-2 184/166 9/30/98 3.3.4-3 184/166 9/30/98 3.3.5-1 184/166 9/30/98 3.3.5-2 194/175 9/18/00 3.3.6-1 184/166 9/30/98 3.3.6-2 184/166 9/30/98 3.3.6-3 194/175 9/18/00 3.4.1-1 219/201 1/14/04 3.4.1-2 219/201 1/14/04 3.4.1-3 184/166 9/30/98 3.4.1-4 219/201 1/14/04 3.4.2-1 184/166 9/30/98 3.4.3-1 214/195 7/3/03 3.4.3-2 184/166 9/30/98 3.4.3-3 214/195 7/3/03 3.4.3-4 214/195 7/3/03 3.4.3-5 214/195 7/3/03 3.4.3-6 214/195 7/3/03 3.4.3-7 214/195 7/3/03 3.4.3-8 214/195 7/3/03 3.4.4-1 184/166 9/30/98 McGuire Units 1 and 2 Page 4 Revision 54

Page Number Amendment Revision Date 3.4.5-1 216/197 7/29/03 3.4.5-2 216/197 7/29/03 3.4.5-3 184/166 9/30/98 3.4.6-1 216/197 7/29/03 3.4.6-2 216/197 7/29/03 3.4.7-1 216/197 7/29/03 3.4.7-2 216/197 7/29/03 3.4.7-3 216/197 7/29/03 3.4.8-1 216/197 7/29/03 3.4.8-2 216/197 7/29/03 3.4.9-1 184/166 9/30/98 3.4.9-2 184/166 9/30/98 3.4.10-1 184/166 9/30/98 3.4.10-2 184/166 9/30/98 3.4-11-1 221/203 4/29/04 I 3.4.11-2 184/166 9/30/98 3.4-11-3 184/166 9/30/98 3.4.11-4 184/166 9/30/98 3.4.12-1 184/166 9/30/98 3.4.12-2 221/203 4/29/04 I 3.4.12-3 214/195 7/3/03 3.4.12-4 214/195 7/3/03 3.4.12-5 184/166 9/30/98 3.4.12-6 184/166 9/30/98 3.4.13-1 184/166 9/30/98 3.4.13-2 184/166 9/30/98 3.4.14-1 184/166 9/30/98 3.4.14-2 184/166 9/30/98 3.4.14-3 184/166 9/30/98 3.4.14-4 184/166 9/30/98 3.4.15-1 221/203 4/29/04 I 3.4.15-2 184/166 9/30/98 3.4.15-3 184/166 9/30/98 McGuire Units I and 2 Page 5 Revision 54

Page Number Amendment Revision Date 3.4.16-1 221/203 4/29/04 I 3.4.16-2 184/166 9/30/98 3.4.16-3 184/166 9/30/98 3.4.16-4 184/166 9/30/98 3.4.17-1 184/166 9/30/98 3.5.1-1 218/200 12/23/03 3.5.1-2 184/166 9/30/98 3.5.2-1 184/166 9/30/98 3.5.2-2 184/166 9/30/98 3.5.2-3 184/166 9/30/98 3.5.3-1 221/203 4/29/04 I 3.5.3-2 184/166 9/30/98 3.5.4-1 184/166 9/30/98 3.5.4-2 184/166 9/30/98 3.5.5-1 184/166 9/30/98 3.5.5-2 184/166 9/30/98 3.6.1-1 207/188 9/4/02 3.6.1-2 207/188 9/4/02 3.6.2-1 184/166 9/30/98 3.6.2-2 184/166 9/30/98 3.6.2-3 184/166 9/30/98 3.6.2-4 184/166 9/30/98 3.6.2-5 207/188 9/4/02 3.6.3-1 184/166 9/30/98 3.6.3-2 184/166 9/30/98 3.6.3-3 184/166 9/30/98 3.6.3-4 184/166 9/30/98 3.6.3-5 184/166 9/30/98 3.6.3-6 207/188 9/4/02 3.6.3-7 207/188 9/4/02 3.6.4-1 184/166 9/30/98 3.6.5-1 184/166 9/30/98 3.6.5-2 184/166 9/30/98 McGuire Units 1 and 2 Page 6 Revision 54

Page Number Amendment Revision Date 3.6.6-1 184/166 9/30/98 3.6.6-2 184/166 9/30/98 3.6.7-1 221/203 4/29/04 I 3.6.7-2 184/166 9130/98 3.6.8-1 221/203 4/29/04 I 3.6.8-2 184/166 9/30/98 3.6.9-1 184/166 9/30/98 3.6.9-2 184/166 9130/98 3.6.10-1 184/166 9/30/98 3.6.10-2 184/166 9/30/98 3.6.11-1 184/166 9/30/98 3.6.11-2 184/166 9/30/98 3.6.12-1 184/166 9/30/98 3.6.12-2 217/199 9/29/03 3.6.12-3 217/199 9/29/03 3.6.13-1 184/166 9/30/98 3.6.13-2 184/166 9/30/98 3.6.13-3 184/166 9/30/98 3.6.14-1 184/166 9/30/98 3.6.14-2 184/166 9/30/98 3.6.14-3 184/166 9130/98 3.6.15-1 184/166 9/30/98 3.6.15-2 184/166 9/30/98 3.6.16-1 212/193 5/8/03 3.6.16-2 212/193 5/8/03 3.7.1-1 184/166 9/30/98 3.7.1-2 184/166 9/30/98 3.7.1-3 184/166 9/30/98 3.7.2-1 184/166 9/30/98 3.7.2-2 184/166 9/30/98 3.7.3-1 184/166 9/30/98 3.7.3-2 184/166 9/30/98 3.7.4-1 221/203 4/29/04 McGuire Units 1 and 2 Page 7 Revision 54

Page Number Amendment Revision Date 3.7.4-2 184/166 9/30/98 3.7.5-1 221/203 4/29/04 I 3.7.5-2 184/166 9/30/98 3.7.5-3 184/166 9/30/98 3.7.5-4 184/166 9/30/98 3.7.6-1 184/166 9/30/98 3.7.6-2 184/166 9/30/98 3.7.7-1 184/166 9/30/98 3.7.7-2 184/166 9/30/98 3.7.8-1 184/166 9/30/98 3.7.8-2 184/166 9/30/98 3.7.9-1 187/168 9/22/99 3.7.9-2 187/168 9/22/99 3.7.9-3 184/166 9/30/98 3.7.10-1 184/166 9/30/98 3.7.10-2 184/166 9/30/98 3.7.11-1 184/166 9/30/98 3.7.11-2 184/166 9/30/98 3.7.12-1 184/166 9/30/98 3.7.12-2 184/166 9/30/98 3.7.13-1 184/166 9/30/98 3.7.14-1 184/166 9/30/98 3.7.15-1 197/178 11/27/00 3.7.15-2 197/178 11/27/00 3.7.15-3 197/178 11/27/00 3.7.15-4 197/178 11/27/00 3.7.15-5 197/178 11/27/00 3.7.15-6 197/178 11/27/00 3.7.15-7 197/178 11/27/00 3.7.15-8 197/178 11/27/00 3.7.15-9 210/191 2/4/03 3.7.15-10 210/191 2/4/03 3.7.15-11 210/191 2/4/03 McGuire Units 1 and 2 Page 8 Revision 54

Page Number Amendment Revision Date 3.7.15-12 197/178 11/27/00 3.7.15-13 197/178 11/27/00 3.7.15-14 197/178 11/27/00 3.7.15-15 197/178 11/27/00 3.7.15-16 210/191 2/4/03 3.7.15-17 210/191 2/4/03 3.7.15-18 210/191 2/4/03 3.7.15-19 210/191 2/4/03 3.7.15-20 197/178 11/27/00 3.7.15-21 197/178 11/27/00 3.7.16-1 184/166 9/30/98 3.8.1-1 221/203 4/29/04 3.8.1-2 184/166 9/30/98 3.8.1-3 184/166 9/30/98 3.8.1-4 184/166 9/30/98 3.8.1-5 184/166 9/30/98 3.8.1-6 184/166 9/30/98 3.8.1-7 184/166 9/30/98 3.8.1-8 192/173 3/15/00 3.8.1-9 184/166 9/30/98 3.8.1-10 184/166 9/30/98 3.8.1-11 192/173 3/15/00 3.8.1-12 184/166 9/30/98 3.8.1-13 184/166 9/30/98 3.8.1-14 184/166 9/30/98 3.8.1-15 184/166 9/30/98 3.8.2-1 184/166 9/30/98 3.8.2-2 216/197 7/29/03 3.8.2-3 184/166 9/30/98 3.8.3-1 184/166 9/30/98 3.8.3-2 184/1 66 9/30/98 3.8.3-3 215/196 8/4/03 3.8.4-1 184/166 9/30/98 McGuire Units 1 and 2 Page 9 Revision 54

Page Number Amendment .Revision Date 3.8.4-2 184/166 9/30/98 3.8.4-3 209/190 12/17/02 3.8.5-1 184/166 9/30/98 3.8.5-2 216/197 7/29/03 3.8.6-1 184/166 9/30/98 3.8.6-2 184/166 9/30/98 3.8.6-3 184/166 9/30/98 3.8.6-4 184/166 9/30/98 3.8.7-1 184/166 9/30/98 3.8.8-1 184/166 9/30/98 3.8.8-2 216/197 7/29/03 3.8.9-1 184/166 9/30/98 3.8.9-2 184/166 9/30/98 3.8.10-1 216/197 7/29/03 3.8.10-2 184/166 9/30/98 3.9.1-1 184/166 9/30/98 3.9.2-1 184/166 9/30/98 3.9.3-1 2161197 7/29/03 3.9.3-2 184/166 9/30/98 3.9.4-1 184/166 9/30/98 3.9.4-2 184/166 9/30/98 3.9.5-1 216/197 7/29/03 3.9.5-2 184/166 9/30/98 3.9.6-1 216/197 7/29/03 3.9.6-2 184/166 9/30/98 3.9.7-1 184/166 9/30/98 4.0.1 222/204 6/21/04 4.0.2 197/178 11/27/00 5.1-1 213/194 6/6/03 5.2-1 184/166 9/30/98 5.2-2 184/166 9/30/98 5.2-3 213/194 6/6/03 5.3-1 213/194 6/6/03 McGuire Units 1 and 2 Page 10 Revision 54

Page Number Amendment Revision Date 5.4-1 184/166 9/30/98 5.5-1 212/193 5/8/03 5.5-2 212/193 5/8/03 5.5-3 184/166 9/30/98 5.5-4 184/166 9/30/98 5.5-5 190/171 12/21/99 5.5-6 184/166 9/30/98 5.5-7 184/166 9/30/98 5.5-8 184/166 9/30/98 5.5-9 184/166 9/30/98 5.5-10 184/166 9/30/98 5.5-11 184/166 9/30/98 5.5-12 184/166 9/30/98 5.5-13 184/166 9/30/98 5.5-14 196/177 11/2/00 5.5-15 184/166 9/30/98 5.5-16 215/196 8/4/03 5.5-17 215/196 8/4/03 5.5-18 184/166 9/30/98 5.6-1 184/166 9/30/98 5.6-2 219/201 1/14/04 5.6-3 219/201 1/14/04 5.6-4 203/184 7/10/02 5.6-5 184/166 9/30/98 5.7-1 213/194 6/6/03 5.7-2 184/166 9/30/98 BASES (Revised per section) i Revision 0 9/30/98 ii Revision 0 9/30/98 iii Revision 0 9/30/98 B 2.1.1 Revision 51 1/14/04 McGuire Units 1 and 2 Page 11 Revision 54

Page Number Amendment Revision Date B 2.1.2 Revision 0 9/30/98 B3.0 Revision 57 4/29/04 I B 3.1.1 Revision 0 9/30/98 B 3.1.2 Revision 10 9/22/00 B 3.1.3 Revision 10 9/22/00 B 3.1.4 Revision 0 9/30/98 B 3.1.5 Revision 19 1/10/02 B 3.1.6 Revision 0 9/30/98 B 3.1.7 Revision 58 06/23/04 B 3.1.8 Revision 0 9/30/98 B 3.2.1 Revision 34 10/1/02 B 3.2.2 Revision 10 9/22/00 B 3.2.3 Revision 34 10/1/02 B 3.2.4 Revision 10 9/22/00 B 3.3.1 Revision 53 2/17/04 B 3.3.2 Revision 55 3/18/04 B 3.3.3 Revision 57 4/29/04 I B 3.3.4 Revision 57 4/29/04 I B 3.3.5 Revision 11 9/18/00 B 3.3.6 Revision 0 9/30/98 B 3.4.1 Revision 51 1/14/04 B 3.4.2 Revision 0 9/30/98 B 3.4.3 Revision 44 7/3/03 B 3.4.4 Revision 0 9/30/98 B 3.4.5 Revision 41 7/29/03 B 3.4.6 Revision 41 7/29/03 B 3.4.7 Revision 41 7/29/03 B 3.4.8 Revision 41 7/29/03 B 3.4.9 Revision 0 9/30/98 B 3.4.10 Revision 0 9/30/98 B 3.4.11 Revision 57 4/29/04 I B 3.4.12 Revision 57 4/29/04 I B 3.4.13 Revision 53 2/17/04 McGuire Units 1 and 2 Page 12 Revision 54

Page Number Amendment Revision Date B 3.4.14 Revision 0 9/30/98 B 3.4.15 Revision 57 4/29/04 B 3.4.16 Revision 57 4/29/04 B 3.4.17 Revision 0 9/30/98 B 3.5.1 Revision 48 12/23/03 B 3.5.2 Revision 45 8/20/03 B 3.5.3 Revision 57 4/29/04 B 3.5.4 Revision 0 9/30/98 B 3.5.5 Revision 0 9/30/98 B 3.6.1 Revision 53 2/17/04 B 3.6.2 Revision 32 10/4/02 B 3.6.3 Revision 32 10/4/02 B 3.6.4 Revision 0 9/30/98 B 3.6.5 Revision 0 9/30/98 B 3.6.6 Revision 0 9/30/98 B 3.6.7 Revision 57 4/29/04 B 3.6.8 Revision 57 4/29/04 B 3.6.9 Revision 0 9/30/98 B 3.6.10 Revision 43 5/28/03 B 3.6.11 Revision 0 9/30/98 B 3.6.12 Revision 53 2/17/04 B 3.6.13 Revision 0 9/30/98 B 3.6.14 Revision 0 9/30/98 B 3.6.15 Revision 0 9/30/98 B 3.6.16 Revision 40 5/8/03 B 3.7.1 Revision 0 9/30/98 B 3.7.2 Revision 0 9/30/98 B 3.7.3 Revision 0 9/30/98 B 3.7.4 Revision 57 4/29/04 B 3.7.5 Revision 57 4/29/04 B 3.7.6 Revision 0 9/30/98 B 3.7.7 Revision 0 9/30/98 B 3.7.8 Revision 0 9/30/98 McGuire Units I and 2 Page 13 Revision, 54

Page Number Amendment Revision Date B 3.7.9 Revision 43 5/28/03 B 3.7.10 Revision 0 9/30/98 B 3.7.11 Revision 39 3/19/03 B 3.7.12 Revision 28 5/17/02 B 3.7.13 Revision 0 9/30/98 B 3.7.14 Revision 52 1/7/04 B 3.7.15 Revision 52 1/7/04 B 3.7.16 Revision 0 9130/98 B 3.8.1 Revision 57 4/29/04 B 3.8.2 Revision 49 10/22/03 B 3.8.3 Revision 53 2/17/04 B 3.8.4 Revision 36 12/17/02 B 3.8.5 Revision 41 7/29/03 B 3.8.6 Revision 0 9/30/98 B 3.8.7 Revision 20 1/10/02 B 3.8.8 Revision 41 7/29/03 B 3.8.9 Revision 24 2/4/02 B 3.8.10 Revision 41 7/29/03 B 3.9.1 Revision 41 7/29/03 B 3.9.2 Revision 41 7/29/03 B 3.9.3 Revision 41 7/29/03 B 3.9.4 Revision 0 9/30/98 B 3.9.5 Revision 41 7/29/03 B 3.9.6 Revision 41 7/29/03 B 3.9.7 Revision 0 9/30/98 McGuire Units 1 and 2 Page 14 Revision 54

ML042530077

Text

Subject:

7.5 BACKGROUND

Navigation menu

Search