ML042540319

Technical Specification, Amendment Regarding Changes to the Boration, Emergency Core Cooling, Containment Spray and Cooling, and Auxiliary Feedwater Systems

ML042540319
Person / Time
Site:	Millstone
Issue date:	09/09/2004
From:	NRC/NRR/DLPM/LPD1
To:
References
TAC MB5019
Download: ML042540319 (48)

Text

INDEX LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS SECTION PAGE 3/4.0 APPLICABILITY...............

3/4 0-1 3/4.1 REACTIVITY CONTROL SYSTEMS 3/4.1.1 REACTIVITY CONTROL.34 1-1 Shutdown Margin (SDM).

3/41-1 Reactivity Balance.34 1-2 DELETED.

3/41-3 Boron Dilution.

3/41-4 Moderator Temperature Coefficient (MTC).34 1-5 Minimum Temperature for Criticality.3/4 1-7 3/4.1.2 BORATION SYSTEMS.34 1-8 DELETED.

3/4 1-8 DELETED.

3/4 1-9 DELETED.

3/4 1-11 DELETED.

3/4 1-13 DELETED.

3/4 1-14 DELETED.

3/4 1-15 DELETED.3/4 1-16 DELETED.

3/4 1-18 3/4.1.3 MOVABLE CONTROL ASSEMBLIES.

3/4 1-20 CEA Group Position.3/4 1-20 Position Indicator Channels.3/4 1-24 CEA Drop Time.

3/4 1-26 Shutdown CEA Insertion Limit.

3/4 1-27 Regulating CEA Insertion Limits.3/4 1-28 Control Rod Drive Mechanisms 3/4 1-31 MILLSTONE - UNIT 2 IV Amendment No. 8,4-04, 4-16,543, A8, p80, 283

INDEX BASES SECTION PAGE 3/4.0 APPLICABILITY..................................................................................................... B 3/4 0-1 3/4.1 REACTIVITY CONTROL SYSTEMS 3/4.1.1 BORATION CONTROL............................................................................ B 3/4 1-1 3/4.1.2 Deleted 3/4.1.3 MOVABLE CONTROL ASSEMBLIES......................

................ B 3/4 1-2 3/4.2 POWER DISTRIBUTION LIMITS 3/4.2.1 LINEAR HEAT RATE.B 3/4 2-1 3/4.2.2 Deleted 3/4.2.3 TOTAL INTEGRATED RADIAL PEAKING FACTOR - F B 3/4 2-1 3/4.2.4 AZIMUTHAL POWER TILT.B 3/4 2-1 3/4.2.5 Deleted 3/4.2.6 DNB MARGIN.......................................................................................... B 3/4 2-2 3/4.3 INSTRUMENTATION I

3/4.3.1 3/4.3.2 3/4.3.3 3/4.3.4 PROTECTIVE INSTRUMENTATION........................................... B 3/4 3-1 ENGINEERED SAFETY FEATURE INSTRUMENTATION................. B 3/4 3-1 MONITORING INSTRUMENTATION...........................................

B 3/4 3-2 CONTAINMENT PURGE VALVE ISOLATION SIGNAL.................... B 3/4 3-5 MILLSTONE - UNIT 2 XI Amendment No. -3, 49, 104, 49, 45, a4&, 283

REACTIVITY CONTROL SYSTEMS BORON DILUTION LIMITING CONDITION FOR OPERATION 3.1.1.3 The following boron dilution restrictions shall be met:

a.

The flow rate of reactor coolant through the core shall be 2 1000 gpm whenever a reduction in Reactor Coolant System boron concentration is being made.

b.

A maximum of two charging pumps shall be capable of injecting into the Reactor Coolant System whenever the temperature of one or more of the Reactor Coolant System cold legs is < 3007F.

APPLICABILITY:

ALL MODES.

ACTION:

a.

With the flow rate of reactor coolant through the core < 1000 gpm, immediately suspend all operations involving a reduction in boron concentration of the Reactor Coolant System.

b.

With more than two charging pumps capable of injecting into the Reactor Coolant System and the temperature of one or more of the Reactor Coolant System cold legs is < 300'F, take immediate action to comply with 3.1.1.3.b.

SURVEILLANCE REQUIREMENTS 4.1.1.3.1* The reactor coolant flow rate through the core shall be determined to be 2 1000 gpm prior to the start of and at least once per hour during a reduction in the Reactor Coolant System boron concentration by either:

a.

Verifying at least one reactor coolant pump is in operation, or

b.

Verifying that at least one low pressure safety injection pump is in operation and supplying 2 1000 gpm through the core.

4.1.1.3.2 One charging pump shall be demonstrated not capable of injecting into the Reactor Coolant System at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> whenever the temperature of one or more of the Reactor Coolant System cold legs is < 300'F.

When the plant is in MODE 1 or 2, reactor coolant pumps are required to be in operation.

Therefore, Surveillance Requirement 4.1.1.3.1 does not have to be performed in MODES I and 2.

MILLSTONE - UNIT 2 3/4 14 Amendment No. 415, 241, 28, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-8 Amendment No. m,

, i2-1-,

283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-9 Amendment No. 4--33, i, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 314 1-10 Amendment No. 89,4-34,4-73,4-18, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-11 Amendment No. 41 Q, 2gs, 2-1-g, A43, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-13 Amendment No. 4aS,.149, 4-, 243, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-14 Amendment No. 2-l-9,283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-15 Amendment No. a, 4, 24-8, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-16 Amendment No. aM, 13-3, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-16a Amendment No. 4i3, 283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-17 Amendment No. 39 434,283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-18 Amendment No. 4-i, -145,283

THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE - UNIT 2 3/4 1-19 Amendment No. 43, a4-8, 283

EMERGENCY CORE COOLING SYSTEMS ECCS SUBSYSTEMS - Tavg > 3000F LIMITING CONDITION FOR OPERATION 3.5.2 Two ECCS subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2 and 3*.

ACTION:

a.

With one ECCS subsystem inoperable, restore the inoperable subsystem to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce pressurizer pressure to less than 1750 psia within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

b.

In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describing the circumstances of the actuation and the total accumulated actuation cycles to date.

With pressurizer pressure > 1750 psia.

MILLSTONE - UNIT 2 3/4 5-3 Amendment No. A, 283

EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS 4.5.2 Each ECCS subsystem shall be demonstrated OPERABLE:

a.

At least once per 31 days by verifying each Emergency Core Cooling System manual, power operated, and automatic valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

b.

At least once per 31 days by verifying that the following valves are in the indicated position with power to the valve operator removed:

Valve Number Valve Function Valve Position 2-SI-306 Shutdown Cooling Open*

Flow Control 2-SI-659 SRAS Recirc.

Open**

2-SI-660 SRAS Recirc.

Open**

Pinned and locked at preset throttle open position.

To be closed prior to recirculation following LOCA.

c.

By verifying the developed head of each high pressure safety injection pump at the flow test point is greater than or equal to the required developed head when tested pursuant to Specification 4.0.5.

d.

By verifying the developed head of each low pressure safety injection pump at the flow test point is greater than or equal to the required developed head when tested pursuant to Specification 4.0.5.

e.

By verifying the delivered flow of each charging pump at the required discharge pressure is greater than or equal to the required flow when tested pursuant to Specification 4.0.5.

f.

At least once per 18 months by verifying each Emergency Core Cooling System automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

g.

At least once per 18 months by verifying each high pressure safety injection pump and low pressure safety injection pump starts automatically on an actual or simulated actuation signal.

MILLSTONE - UNIT 2 3/4 5-4 Amendment No. A, 4-59, 26, 283

EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE REQUIREMENTS(Continued)

h.

At least once per 18 months by verifying each low pressure safety injection pump stops automatically on an actual or simulated actuation signal.

i.

By verifying the correct position of each electrical and/or mechanical position stop for each injection valve in Table 4.5-1:

1.

Within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after completion of valve operations.

2.

At least once per 18 months.

j.

At least once per 18 months by verifying through visual inspection of the containment sump that each Emergency Core Cooling System subsystem suction inlet is not restricted by debris and the suction inlet trash racks and screens show no evidence of structural distress or abnormal corrosion.

k.

At least once per 18 months by verifying the Shutdown Cooling System open permissive interlock prevents the Shutdown Cooling System inlet isolation valves from being opened with an actual or simulated Reactor Coolant System pressure signal of> 300 psia.

MILLSTONE - UNIT 2 3/4 5-5 Amendment No. :, 4;,

4 2, 64A, 40, 283

Page 3/4 5-5a has been removed from Tech Specs as a result of this LBDCR

Table 4.5-1 I

ECCS INJECTION VALVES

1.

2-SI-617 "A" HPSI Header - Loop IA Injection

2.

2-SI-627 "A" HPSI Header - Loop IB Injection

3.

2-SI-637 "A" HPSI Header - Loop 2A Injection

4.

2-SI-647 "A" HPSI Header - Loop 2B Injection

5.

2-SI-616 "B" HPSI Header - Loop IA Injection

6.

2-SI-626 "B" HPSI Header - Loop lB Injection

7.

2-SI-636 "B" HPSI Header - Loop 2A Injection

8.

2-SI-646 "B" HPSI Header - Loop 2B Injection

9.

2-SI-615 LPSI Header - Loop IA Injection

10.

2-SI-625 LPSI Header - Loop IB Injection

11.

2-SI-635 LPSI Header - Loop 2A Injection

12.

2-SI-645 LPSI Header - Loop 2B Injection MILLSTONE - UNIT 2 3/4 5-6 Amendment No. 4-5,4, 459, 2-5, 238, 283

Page 3/4 5-6a has been removed from Tech Specs as a result of this LBDCR

EMERGENCY CORE COOLING SYSTEMS ECCS SUBSYSTEMS - T

<3000 F LIMITING CONDITION FOR OPERATION 3.5.3 One high pressure safety injection subsystem shall be OPERABLE.

NOTES---------

1.

The provisions of Specifications 3.0.4 and 4.0.4 are not applicable for entry into MODE 4 for the high pressure safety injection pump that is inoperable pursuant to Specification 3.4.9.3 provided the high pressure safety injection pump is restored to OPERABLE status within I hour after entering MODE 4.

2.

In MODE 4, the requirement for OPERABLE safety injection and sump recirculation actuation signals is satisfied by use of the safety injection and sump recirculation trip pushbuttons.

3.

In MODE 4, the OPERABLE HPSI pump is not required to start automatically on a SIAS.

Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lock position without affecting the OPERABILITY of this pump.

APPLICABILITY:

MODES 3* and 4.

ACTION:

a.

With no high pressure safety injection subsystem OPERABLE, restore at least one high pressure safety injection subsystem to OPERABLE status within one hour or be in COLD SHUTDOWN within the next 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

b.

In the event the ECCS is actuated and injects water into the Reactor Coolant System, a Special Report shall be prepared and submitted to the Commission pursuant to Specification 6.9.2 within 90 days describing the circumstances of the actuation and the total accumulated actuation cycles to date.

SURVEILLANCE REQUIREMENTS 4.5.3.1 The high pressure safety injection subsystem shall be demonstrated OPERABLE per the applicable portions of Surveillance Requirements 4.5.2.a, 4.5.2.b, 4.5.2.c, 4.5.2.f, 4.5.2.g, 4.5.2.i, and 4.5.2.j.

• WVith pressurizer pressure < 1750 psia.

MILLSTONE - UNIT 2 3/4 5-7 Amendment No. 9, 4i-, 24-6, 24-8, 2IL, 283

CONTAINMENT SYSTEMS 3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS CONTAINMENT SPRAY AND COOLING SYSTEMS LIMITING CONDITION FOR OPERATION 3.6.2.1 Two containment spray trains and two containment cooling trains, with each cooling train consisting of two containment air recirculation and cooling units, shall be OPERABLE.

APPLICABILITY:

MODES 1, 2 and 3*.

ACTION:

Inoperable Equipment Required Action

a.

Onecontainment a.l Restore the inoperable containment spray train to spray train OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce pressurizer pressure to less than 1750 psia within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

b.

One containment b.l Restore the inoperable containment cooling train to cooling train OPERABLE status within 7 days or be in HOT SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

c.

One containment c. I Restore the inoperable containment spray train or the spray train inoperable containment cooling train to OPERABLE status AND within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in HOT SHUTDOWN within the next One containment 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

cooling train

d.

Two d.1 Restore at least one inoperable containment cooling train to containment OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in HOT cooling trains SHUTDOWN within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

e.

All other

e. 1 Enter LCO 3.0.3 immediately.

combinations SURVEILLANCE REQUIREMENTS I

4.6.2.1.1 Each containment spray train shall be demonstrated OPERABLE:

a.

At least once per 31 days by verifying each containment spray manual, power operated, and automatic valve in the spray train flow path, that is not locked, sealed, or otherwise secured in position, is in the correct position.

• The Containment Spray System is not required to be OPERABLE in MODE 3 if pressurizer pressure is < 1750 psia.

MILLSTONE - UNIT 2 3/4 6-12 Amendment No. 2-1, 22I, 236, 283

CONTAINMENT SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

b.

By verifying the developed head of each containment spray pump at the flow test point is greater than or equal to the required developed head when tested pursuant to Specification 4.0.5.

c.

At least once per 18 months by verifying each automatic containment spray valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

d.

At least once per 18 months by verifying each containment spray pump starts automatically on an actual or simulated actuation signal.

e.

At least once per 10 years by verifying each spray nozzle is unobstructed.

4.6.2.1.2 Each containment air recirculation and cooling unit shall be demonstrated OPERABLE:

a.

At least once per 31 days by operating each containment air recirculation and cooling unit in slow speed for > 15 minutes.

b.

At least once per 31 days by verifying each containment air recirculation and cooling unit cooling water flow rate is > 500 gpm.

c.

At least once per 18 months by verifying each containment air recirculation and cooling unit starts automatically on an actual or simulated actuation signal.

MILLSTONE - UNIT 2 3/4 6-13 Amendment No. 2-15, 283

PLANT SYSTEMS AUXILIARY FEEDWATER PUMPS LIMITING CONDITION FOR OPERATION 3.7.1.2 At least three steam generator auxiliary feedwater pumps shall be OPERABLE with:

a.

Two feedwater pumps capable of being powered from separate OPERABLE emergency busses, and

b.

One feedwater pump capable of being powered from an OPERABLE steam supply system.

APPLICABILITY:

MODES 1, 2 and 3.

ACTION:

a.

With one auxiliary feedwater pump inoperable, restore the required auxiliary feedwater pumps to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

b.

With two auxiliary feedwater pumps inoperable be in at least HOT STANDBY within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

c.

With three auxiliary feedwater pumps inoperable, immediately initiate corrective action to restore at least one auxiliary feedwater pump to OPERABLE status as soon as possible. Entry into an OPERATIONAL MODE or other specified condition under the provisions of Specification 3.0.4 shall not be made with three auxiliary feedwater pumps inoperable.

SURVEILLANCE REQUIREMENTS 4.7.1.2 Each auxiliary feedwater pump shall be demonstrated OPERABLE:

a.

At least once per 31 days by verifying each auxiliary feedwater manual, power operated, and automatic valve in each water flow path and in each steam supply flow path to the steam turbine driven pump, that is not locked, sealed, or otherwise secured in position, is in the correct position.

b.

By verifying the developed head of each auxiliary feedwater pump at the flow test point is greater than or equal to the required developed head when tested pursuant to Specification 4.0.5. (Not required to be performed for the steam turbine driven auxiliary feedwater pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 800 psig in the steam generators. The provisions of Specification 4.0.4 are not applicable to the steam turbine driven auxiliary feedwater pump for entry into MODE 3.)

MILLSTONE - UNIT 2 3/4 7-4 Amendment No. 63, 6, 90, 41-5, 236, 283

PLANT SYSTEMS SURVEILLANCE REQUIREMENTS (Continued)

c.

At least once per 18 months by verifying each auxiliary feedwater automatic valve that is not locked, sealed, or otherwise secured in position, actuates to the correct position, as designed, on an actual or simulated actuation signal.

d.

At least once per 18 months by verifying each auxiliary feedwater pump starts automatically, as designed, on an actual or simulated actuation signal.

e.

By verifying the proper alignment of the required auxiliary feedwater flow paths by verifying flow from the condensate storage tank to each steam generator prior to entering MODE 2 whenever the unit has been in MODE 5, MODE 6, or defueled for a cumulative period of greater than 30 days.

MILLSTONE - UNIT 2 3/4 7-5 Amendment No. 3,

}63, 283

3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 REACTIVITY CONTROL SYSTEMS (Continued) 3/4.1.1.2 REACTIVITY BALANCE (Continued) reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.

When measured core reactivity is within +I% Ak/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits.

The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. This Specification does not apply in MODES 3, 4 and 5 because the reactor is shut down and the reactivity balance is not changing.

In MODE 6, fuel loading results in a continually changing core reactivity. Boron concentration requirements (LCO 3.9.1, "Boron Concentration") ensure that fuel movements are performed within the bounds of the safety analysis.

3/4.1.1.3 BORON DILUTION A minimum flow rate of at least 1000 GPM provides adequate mixing, prevents stratification and ensures that reactivity changes will be gradual during reductions in Reactor Coolant System boron concentration. The 1000 GPM limit is the minimum required shutdown cooling flow to satisfy the boron dilution accident analysis. This 1000 GPM flow is an analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommodate flow measurement uncertainties. While the plant is operating in reduced inventory operations, plant operating procedures also specify an upper flow limit to prevent vortexing in the shutdown cooling system. A flow rate of at least 1000 GPM will circulate the full Reactor Coolant System volume in approximately 90 minutes. With the RCS in mid-loop operation, the Reactor Coolant System volume will circulate in approximately 25 minutes. The reactivity change rate associated with reductions in Reactor Coolant System boron concentration will be within the capability for operator recognition and control.

A maximum of two charging pumps capable of injecting into the RCS when RCS cold leg temperature is < 300'F ensures that the maximum inadvertent dilution flow rate assumed in the boron dilution analysis is not exceeded.

MILLSTONE - UNIT 2 B 3/4 I-la Amendment No. 4-39, 44, 4-,

28M, 283

REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1.3 BORON DILUTION (Continued)

A charging pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the appropriate administrative controls.

1.

Placing the motor circuit breaker in the open position.

2.

Removing the charging pump motor overload heaters from the charging pump circuit.

3.

Removing the charging pump motor controller from the motor control center.

3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)

The limitations on MTC are provided to ensure that the assumptions used in the accident and transient analyses remain valid through each fuiel cycle. The surveillance requirements for measurement of the MTC during each fuel cycle are adequate to confirm the MTC value since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel bumup. The confirmation that the measured MTC value is within its limit provides assurance that the coefficient will be maintained within acceptable values throughout each fuel cycle.

3/4.1.1.5 MINIMUM TEMPERATURE FOR CRITICALITY The MTC is expected to be slightly negative at operating conditions. However, at the beginning of the fuel cycle, the MTC may be slightly positive at operating conditions and since it will become more positive at lower temperatures, this specification is provided to restrict reactor operation when Tavg is significantly below the normal operating temperature.

3/4.1.2 DELETED 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES The specifications of this section ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of a CEA ejection accident are limited to acceptable levels.

The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original criteria are met.

MILLSTONE - UNIT 2 B 3/4 1-2 Amendment No. 34, 3, 439, 448, 2--,

283

Page B 3/4 1-3 has been removed from Tech Specs as a result of this LBDCR

Page B 3/4 1-3a has been removed from Tech Specs as a result of this LBDCR

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.1 SAFETY INJECTION TANKS (continued) within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and pressurizer pressure reduced to < 1750 psia within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed completion times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.

If more than one SIT is inoperable, the unit is in a condition outside the accident analyses.

Therefore, LCO 3.0.3 must be entered immediately.

LCO 3.5.l.a requires that each reactor coolant system safety injection tank shall be OPERABLE with the isolation valve open and the power to the valve operator removed.

This is to ensure that the valve is open and cannot be inadvertently closed. To meet LCO 3.5.1.a requirements, the valve operator is considered to be the valve motor and not the motor control circuit. Removing the closing coil while maintaining the breaker closed meets the intent of the Technical Specification by ensuring that the valve cannot be inadvertently closed.

Removing the closing coil and verifying that the closing coil is removed (Per SR 4.5.1.e) meets the Technical Specification because it prevents energizing the valve operator to position the valve in the close direction.

Opening the breaker, in lieu of removing the closing coil, to remove power to the valve operator is not a viable option since:

1.

Millstone Unit 2 Safety Evaluation Report (SER) Docket No. 50-336, dated May 10, 1974, requires two independent means of position indication.

2.

Surveillance Requirement 4.5.1.a requires the control/indication circuit to be energized, to verify that the valve is open.

3.

Technical Specification 3/4.3.2, Engineered Safety Feature Actuation System Instrumentation, requires these valves to open on a SIAS signal.

Opening the breaker would eliminate the ability to satisfy the above three items.

3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two separate and independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the safety injection tanks is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward.

MILLSTONE - UNIT 2 B 3/4 5-2 Amendment No. a, S, 4-i9, 24I, 22, i36, 283

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)

Each Emergency Core Cooling System (ECCS) subsystem required by Technical Specification 3.5.2 for design basis accident mitigation includes an OPERABLE high pressure safety injection (HPSI) pump and a low pressure safety injection (LPSI) pump. Each of these pumps requires an OPERABLE flow path capable of taking suction from the refueling water storage tank (RWST) on a safety injection actuation signal (SIAS). Upon depletion of the inventory in the RWST, as indicated by the generation of a Sump Recirculation Actuation Signal (SRAS), the suction for the HPSI pumps will automatically be transferred to the containment sump. The SRAS will also secure the LPSI pumps. The ECCS subsystems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment.

Flow from the charging pumps is no longer required for design basis accident mitigation. The loss of coolant accident analysis has been revised and no credit is taken for charging pump flow.

As a result, the charging pumps no longer meet the first three criteria of 1 OCFR 50.36 (c)(2)(ii) as design basis accident mitigation equipment required to be controlled by Technical Specifications.

In addition, risk evaluations have been performed to demonstrate that the charging system is not risk significant as defined in 10CFR 50.36(c)(2)(ii) Criterion 4. However, the charging system is credited in the PRA model for mitigating two beyond design basis events, Anticipated Transients Without Scram (ATWS) and Complete Loss of Secondary Heat Sink. On this basis, the requirements for charging pump operability will be retained in Technical Specification 3.5.2.

Consistent with the surveillance requirements, only the charging pump will be included in determining ECCS subsystem operability.

As a result of the risk insight, the charging pump will be included as an Emergency Core Cooling System subsystem required by Technical Specification 3.5.2. That is, an ECCS subsystem will include one OPERABLE charging pump. The charging pump credited for each ECCS subsystem must meet the surveillance requirements specified in Section 4.5.2. Consistent with the risk insights, automatic start of the charging pump is not required for compliance to TS 3.5.2. Thus, Section 4.5.2 does not specify any testing requirements for the automatic start of the credited charging pump. Similarly, since the ECCS flow path is not credited in the risk evaluation, there are no charging flow path requirements included in TS 3.5.2.

The requirements for automatic actuation of the charging pumps and the associated boration system components (boric acid pumps, gravity feed valves, boric acid flow path valves), which align the boric acid storage tanks to the charging pump suction on a SIAS have been relocated to the Technical Requirements Manual. These relocated requirements do not affect the OPERABILITY of the charging pumps for Technical Specification 3.5.2 MILLSTONE - UNIT 2 B 3/4 5-2a Amendment No. 6A, S, 4-59, 2-, 220, A36, 283

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.2 and 3/4.5:3 ECCS SUBSYSTEMS (continued)

Surveillance Requirement 4.5.2.a verifies the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths to provide assurance that the proper flow paths will exist for ECCS operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time.

This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

Surveillance Requirement 4.5.2.b verifies proper valve position to ensure that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removing power to the valve operator ensures that the valves cannot be inadvertently misaligned or change position as the result of an active failure. A 31 day frequency is considered reasonable in view of other administrative controls ensuring that a mispositioned valve is an unlikely possibility.

Surveillance Requirements 4.5.2.c and 4.5.2.d, which address periodic surveillance testing of the ECCS pumps (high pressure and low pressure safety injection pumps) to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by Section XI of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and frequencies necessary to satisfy the requirements.

Surveillance Requirement 4.5.2.e, which addresses periodic surveillance testing of the charging pumps to detect gross degradation caused by hydraulic component problems, is required by Section XI of the ASME Code. For positive displacement pumps, this type of testing may be accomplished by comparing the measured pump flow, discharge pressure and vibration to their respective acceptance criteria. Acceptance criteria are verified to bound the assumptions utilized in accident analyses. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test point is greater than or equal to the performance assumed for mitigation of the beyond design basis events. The surveillance requirements are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and frequencies necessary to satisfy the requirements.

MILLSTONE - UNIT 2 B 3/4 5-2b Amendment No. 4S, 6, =, 4-59, 1°5, 215, 216, 24I, 220, 22A, 236, 283

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued)

Surveillance Requirements 4.5.2.f, 4.5.2.g, and 4.5.2.h demonstrate that each automatic ECCS flow path valve actuates to the required position on an actual or simulated actuation signal (SIAS or SRAS), that each ECCS pump starts on receipt of an actual or simulated actuation signal (SIAS), and that the LPSI pumps stop on receipt of an actual or simulated actuation signal (SRAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage, and the potential for unplanned transients if the surveillances were performed with the reactor at power.

The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

Surveillance Requirement 4.5.2.i verifies the high and low pressure safety injection valves listed in Table 4.5-1 will align to the required positions on an SIAS for proper ECCS performance. The safety injection valves have stops to position them properly so that flow is restricted to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillances were performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

Surveillance Requirement 4.5.2.j addresses periodic inspection of the containment sump to ensure that it is unrestricted and stays in proper operating condition. The 18 month frequency is based on the need to perform this surveillance under the conditions that apply during an outage, and the need to have access to the location. This frequency is sufficient to detect abnormal degradation and is confirmed by operating experience.

Surveillance Requirement 4.5.2.k verifies that the Shutdown Cooling (SDC) System open permissive interlock is OPERABLE to ensure the SDC suction isolation valves are prevented from being remotely opened when RCS pressure is at or above the SDC suction design pressure of 300 psia. The suction piping of the SDC pumps (low pressure safety injection pumps) is the SDC component with the limiting design pressure rating. The interlock provides assurance that double isolation of the SDC System from the RCS is preserved whenever RCS pressure is at or above the design pressure. The 18 month frequency is based on the need to perform this surveillance under the conditions that apply during an outage. The.18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

MILLSTONE - UNIT 2 B 3/4 5-2c Amendment No. 4, 1-59, 4-1, 2-4-5, 246, 24G, 2-4,-26, 283

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued Only one ECCS subsystem is required by Technical Specification 3.5.3 for design basis accident mitigation. This ECCS subsystem requires one OPERABLE HPSI pump and an OPERABLE flow path capable of taking suction from the RWST on a SIAS. Upon depletion of the inventory in the RWST, as indicated by the generation of a SRAS, the suction for the HPSI pump will automatically be transferred to the containment sump. This ECCS subsystem satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii) as design basis accident mitigation equipment.

Surveillance Requirement 4.5.3.1 specifies the surveillance requirements of Technical Specification 3.5.3 that are required to demonstrate that the required ECCS subsystem of Technical Specification 3.5.3 is OPERABLE. The required ECCS subsystem of Technical Specification 3.5.3 does not include any LPSI components. LPSI components are not required when Technical Specification 3.5.3 is applicable to allow the LPSI components to be used for SDC System operation.

In MODE 4 the automatic safety injection signal generated by low pressurizer pressure and high containment pressure and the automatic sump recirculation actuation signal generation by low refueling water storage tank level are not required to be OPERABLE. Automatic actuation in MODE 4 is not required because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating engineered safety features components. Since the manual actuation (trip pushbuttons) portion of the safety injection and sump recirculation actuation signal generation is required to be OPERABLE in MODE 4, the plant operators can use the manual trip pushbuttons to rapidly position all components to the required accident position.

Therefore, the safety injection and sump recirculation actuation trip pushbuttons satisfy the requirement for generation of safety injection and sump recirculation actuation signals in MODE 4.

In MODE 4, the OPERABLE HPSI pump is not required to start automatically on a SIAS.

Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lock position without affecting the OPERABILITY of the pump. This will prevent the pump from starting automatically, which could result in overpressurization of the Shutdown Cooling System.

Only one HPSI pump may be OPERABLE in MODE 4 with RCS temperatures less than or equal to 2750F due to the restricted relief capacity with Low-Temperature Overpressure Protection System. To reduce shutdown risk by having additional pumping capacity readily available, a HPSI pump may be made inoperable but available at short notice by shutting its discharge valve with the key lock on the control panel.

MILLSTONE - UNIT 2 B 3/4 5-2d Amendment No. 4-, 459, 4-5, 245, 246, 248, 220, 22, 236, 283

3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued The provision in Specification 3.5.3 that Specifications 3.0.4 and 4.0.4 are not applicable for entry into MODE 4 is provided to allow for connecting the HPSI pump breaker to the respective power supply or to remove the tag and open the discharge valve, and perform the subsequent testing necessary to declare the inoperable HPSI pump OPERABLE. Specification 3.4.9.3 requires all HPSI pumps to be not capable of injecting into the RCS when RCS temperature is at or below 190'F. Once RCS temperature is above 1900F one HPSI pump can be capable of injecting into the RCS. However, sufficient time may not be available to ensure one HPSI pump is OPERABLE prior to entering MODE 4 as required by Specification 3.5.3. Since Specifications 3.0.4 and 4.0.4 prohibit a MODE change in this situation, this exemption will allow Millstone Unit No. 2 to enter MODE 4, take the steps necessary to make the HPSI pump capable of injecting into the RCS, and then declare the pump OPERABLE. If it is necessary to use this exemption during plant heatup, the appropriate action statement of Specification 3.5.3 should be entered as soon as MODE 4 is reached.

3/4.5.4 REFUELING WATER STORAGE TANK (RWST)

The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ensure that 1) sufficient water is available within containment to permit recirculation cooling flow to the core, and 2) after a LOCA the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes. Small break LOCAs assume that all control rods are inserted, except for the control element assembly (CEA) of highest worth, which remains withdrawn from the core. Large break LOCAs assume that all CEAs remain withdrawn from the core.

MILLSTONE - UNIT 2 B 3/4 5-2e Amendment No. 283

CONTAINMENT SYSTEMS BASES 3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS The OPERABILITY of the containment spray system ensures that containment depressurization and cooling capability will be available in the event of a LOCA. The pressure reduction and resultant lower containment leakage rate are consistent with the assumptions used in the accident analyses.

The OPERABILITY of the containment cooling system ensures that 1) the containment air temperature will be maintained within limits during normal operation, and 2) adequate heat removal capacity is available when operated in conjunction with the containment spray system during post-LOCA conditions.

To be OPERABLE, the two trains of the containment spray system shall be capable of taking a suction from the refueling water storage tank on a containment spray actuation signal and automatically transferring suction to the containment sump on a sump recirculation actuation signal. Each containment spray train flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.

The containment cooling system consists of two containment cooling trains. Each containment cooling train has two containment air recirculation and cooling units. For the purpose of applying the appropriate action statement, the loss of a single containment air recirculation and cooling unit will make the respective containment cooling train inoperable.

Either the containment spray system or the containment cooling system is sufficient to mitigate a loss of coolant accident. The containment spray system is more effective than the containment cooling system in reducing the temperature of superheated steam inside containment following a main steam line break. Because of this, the containment spray system is required to mitigate a main steam line break accident inside containment. In addition, the containment spray system provides a mechanism for removing iodine from the containment atmosphere. Therefore, at least one train of containment spray is required to be OPERABLE when pressurizer pressure is 2 1750 psia, and the allowed outage time for one train of containment spray reflects the dual function of containment spray for heat removal and iodine removal.

Surveillance Requirement 4.6.2.1.l.a verifies the correct alignment for manual, power operated, and automatic valves in the Containment Spray System flow paths to provide assurance that the proper flow paths will exist for containment spray operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

MILLSTONE - UNIT 2 B 3/4 6-3 Amendment No.

, 61, 240, 24, 228, I26, 283

CONTAINMENT SYSTEMS BASES*

3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)

Surveillance Requirement 4.6.2.1.1.b, which addresses periodic surveillance testing of the containment spray pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by Section XI of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and frequencies necessary to satisfy the requirements.

Surveillance Requirements 4.6.2.1. c and 4.6.2.1.1.d demonstrate that each automatic containment spray valve actuates to the required position on an actual or simulated actuation signal (CSAS or SRAS), and that each containment spray pump starts on receipt of an actual or simulated actuation signal (CSAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillances were performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

Surveillance Requirement 4.6.2..1. Le demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded.

This surveillance is normally performed by blowing low pressure air or smoke through test connections with the containment spray inlet valves closed and the spray header drained of any solution. Due to the passive design of the nozzles, a test at 10 year intervals is considered adequate to detect obstruction of the spray nozzles.

Surveillance Requirement 4.6.2.1.2.a demonstrates that each containment air recirculation and cooling unit can be operated in slow speed for > 15 minutes to ensure OPERABILITY and that all associated controls are functioning properly. It also ensures fan or motor failure can be detected and corrective action taken. The 31 day frequency considers the known reliability of the fan units and controls, the two train redundancy available, and the low probability of a significant degradation of the containment air recirculation and cooling unit occurring between surveillances.

This frequency has been shown to be acceptable through operating experience.

MILLSTONE - UNIT 2 B 3/4 6-3a Amendment No. 240, 2--5, 236, 247, 283

CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued)

Surveillance Requirement 4.6.2.1.2.b demonstrates a cooling water flow rate of > 500 gpm to each containment air recirculation and cooling unit to provide assurance a cooling water flow path through the cooling unit is available. The 31 day frequency considers the known reliability of the cooling water system, the two train redundancy available, and the low probability of a significant degradation of flow occurring between surveillances. This frequency has been shown to be acceptable through operating experience.

Surveillance Requirement 4.6.2.1.2.c demonstrates that each containment air recirculation and cooling unit starts on receipt of an actual or simulated actuation signal (SIAS). The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillances were performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

3/4.6.3 CONTAINMENT ISOLATION VALVES The Technical Requirements Manual contains the list of containment isolation valves (except the containment air lock and equipment hatch). Any changes to this list will be reviewed under 10CFR50.59 and approved by the committee(s) as described in the QAP Topical Report.

The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment. Containment isolation within the time limits specified ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA.

The containment isolation valves are used to close all fluid (liquid and gas) penetrations not required for operation of the engineered safety feature systems, to prevent the leakage of radioactive materials to the environment. The fluid penetrations which may require isolation after an accident are categorized as Type P, 0, or N. The penetration types are listed with the containment isolation valves in the Technical Requirements Manual.

Type P penetrations are lines that connect to the reactor coolant pressure boundary (Criterion 55 of 10CFR50, Appendix A). These lines are provided with two containment isolation valves, one inside containment, and one outside containment.

Type 0 penetrations are lines that are open to the containment internal atmosphere (Criterion 56 of 1 OCFR50, Appendix A). These lines are provided with two containment isolation valves, one inside containment, and one outside containment.

MILLSTONE - UNIT 2 B 3/4 6-3b Amendment No. 2-0, 2-5,

, 2 S, 283

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

Type N penetrations are lines that neither connect to the reactor coolant pressure boundary nor are open to the containment internal atmosphere, but do form a closed system within the containment structure (Criterion 57 of 10CFR50, Appendix A). These lines are provided with single containment isolation valves outside containment. These valves are either remotely operated or locked closed manual valves.

With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration.

If the containment isolation valve on a closed system becomes inoperable, the remaining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.

However, actions must still be taken to meet Technical Specification ACTION 3.6.3.l.d and the valve, not normally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the action statement. Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance. Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.1.d are included in FSAR Table 5.2-11, and are the isolation valves for those penetrations credited as General Design Criteria 57, (Type N penetrations). The specified time (i.e., 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) of Technical Specification ACTION 3.6.3.1.d is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with 3.6.3.l.d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.1.1.a). This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The frequency of once per 31 days in this surveillance for verifying that each affected penetration flow path is isolated is appropriate considering the valves are operated under administrative controls and the probability of their misalignment is low.

For the purposes of meeting this LCO, neither the containment isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve operability.

MILLSTONE - UNIT 2 B 3/4 6-3c Amendment No. 20, 24I-, 26, 279, 283

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

Containment isolation valves may be opened on an intermittent basis provided appropriate administrative controls are established. The position of the NRC concerning acceptable administrative controls is contained in Generic Letter 91-08, "Removal of Component Lists from Technical Specifications," and includes the following considerations:

(1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valve and that this action will prevent the release of radioactivity outside the containment.

The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened and closed. However, it is not necessary to log into any Technical Specification Action Statement for these valves, provided the appropriate administrative controls have been established.

If a containment isolation valve is opened while operating in accordance with Abnormal or Emergency Operating Procedures (AOPs and EOPs), it is not necessary to establish a dedicated operator. The AOPs and EOPs provide sufficient procedural control over the operation of the containment isolation valves.

Opening a closed containment isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the containment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. As a general guideline, a closed containment isolation valve should not be opened longer than the time allowed to restore the valve to OPERABLE status, as stated in the action statement for LCO 3.6.3.1 "Containment Isolation Valves."

A discussion of the appropriate administrative controls for the containment isolation valves, that are expected to be opened during operation in MODES 1 through 4, is presented below.

Manual containment isolation valve 2-SI-463, safety injection tank (SIT) recirculation header stop valve, is opened to fill or drain the SITs and for Shutdown Cooling System (SDC) boron equalization. While 2-SI-463 is open, a dedicated operator, in continuous communication with the control room, is required.

MILLSTONE - UNIT 2 B 3/4 6-3d Amendment No. 240, 2-5, 236, 2-,

283

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

When SDC is initiated, SDC suction isolation remotely operated valves 2-SI-652 and 2-SI-651 (inside containment isolation valve) and manual valve 2-SI-709 (outside containment isolation valve) are opened. 2-SI-651 is normally operated from the control room. While in Modes 1, 2 or 3, 2-SI-651 is closed with manual disconnect switch NSI631 locked open to satisfy Appendix R requirements. It does not receive an automatic containment isolation closure signal, but is interlocked to prevent opening if Reactor Coolant System (RCS) pressure is greater than approximately 275 psia. When 2-SI-651 is opened from the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.

When valve 2-SI-709 is opened locally, a separate dedicated operator is not required to remain at the valve. 2-SI-709 is opened before 2-SI-651. Therefore, opening 2-SI-709 will not establish a connection between the RCS and the SDC System. Opening 2-SI-651 will connect the RCS and SDC System. If a problem then develops, 2-SI-651 can be closed from the control room.

The administrative controls for valves 2-SI-651 and 2-SI-709 apply only during preparations for initiation of SDC, and during SDC operations. They are acceptable because RCS pressure and temperature are significantly below normal operating pressure and temperature when 2-SI-651 and 2-SI-709 are opened, and these valves are not opened until shortly before SDC flow is initiated. The penetration flowpath can be isolated from the control room by closing either 2-SI-652 or 2-SI-651, and the manipulation of these valves, during this evolution, is controlled by plant procedures.

The pressurizer auxiliary spray valve, 2-CH-517, can be used as an alternate method to decrease pressurizer pressure, or for boron precipitation control following a loss of coolant accident. When this valve is opened from the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.

The exception for 2-CH-517 is acceptable because the fluid that passes through this valve will be collected in the Pressurizer (reverse flow from the Pressurizer to the charging system is prevented by check valve 2-CH-43 1), and the penetration associated with 2-CH-517 is open during accident conditions to allow flow from the charging pumps. Also, this valve is normally operated from the control room, under the supervision of the licensed control room operators, in accordance with plant procedures.

A dedicated operator is not required when opening remotely operated valves associated with Type N fluid penetrations (Criterion 57 of IOCFR50, Appendix A). Operating these valves from the control room is sufficient. The main steam isolation valves (2-MS-64A and 64B),

atmospheric steam dump valves (2-MS-190A and 190B), and the containment air recirculation cooler RBCCW discharge valves (2-RB-28.2A-D) are examples of remotely operated containment isolation valves associated with Type N fluid penetrations.

MILLSTONE - UNIT 2 B 3/4 6-3e Amendment No. 2410, 2-5, 26, 2-73, 278, 283

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

MSIV bypass valves 2-MS-65A and 65B are remotely operated MOVs, but while in MODE I, they are closed with power to the valve motors removed via lockable disconnect switches located at their respective MCC to satisfy Appendix "R" requirements.

Local operation of the atmospheric steam dump valves (2-MS-19OA and 190B), or other remotely operated valves associated with Type N fluid penetrations, will require a dedicated operator in constant communication with the control room, except when operating in accordance with AOPs or EOPs. Even though these valves can not be classified as locked or sealed closed, the use of a dedicated operator will satisfy administrative control requirements. Local operation of these valves with a dedicated operator is equivalent to the operation of other manual (locked or sealed closed) containment isolation valves with a dedicated operator.

The main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and 2-MS-202) are remotely operated valves associated with Type N fluidpenetrations. These valves are maintained open during power operation. 2-MS-201 is maintained energized, so it can be closed from the control room, if necessary, for containment isolation. However, 2-MS-202 is decnergized open by removing power to the valve's motor via a lockable disconnect switch to satisfy Appendix R requirements. Therefore, 2-MS-202 cannot be closed immediately from the control room, if necessary, for containment isolation. The disconnect switch key to power for 2-MS-202 is stored in the Unit 2 control room, and can be used to re-power the valve at the MCC; this will allow the valve to be closed from the control room. It is not necessary to maintain a dedicated operator at 2-MS-202 because this valve is already in the required accident position.

Also, the steam that passes through this valve should not contain any radioactivity. The steam generators provide the barrier between the containment and the atmosphere. Therefore, it would take an additional structural failure for radioactivity to be released to the environment through this valve.

Steam generator chemical addition valves, 2-FW-15A and 2-FW-15B, are opened to add chemicals to the steam generators using the Auxiliary Feedwater System (AFW). When either 2-FW-1 5A or 2-FW-15B is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of these valves is expected during plant startup and shutdown.

The bypasses around the main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and 2-MS-202), 2-MS-458 and 2-MS-459, are opened to drain water from the steam supply lines. When either 2-MS-458 or 2-MS-459 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of these valves is expected during plant startup.

The containment station air header isolation, 2-SA-19, is opened to supply station air to containment. When 2-SA-19 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected for maintenance activities inside containment.

The backup air supply master stop, 2-IA-566, is opened to supply backup air to 2-CH-5 17, 2-CH-518, 2-CH-519, 2-EB-88, and 2-EB-89. When 2-IA-566 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected in response to a loss of the normal air supply to the valves listed.

MILLSTONE - UNIT 2 B 3/4 6-3f Amendment No. 21-0, 2-1, 246, 2I, 2I8, 283

CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (continued)

The nitrogen header drain valve, 2-SI-045, is opened to depressurize the containment side of the nitrogen supply header stop valve, 2-SI-312. When 2-SI-045 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected after using the high pressure nitrogen system to raise SIT nitrogen pressure.

The containment waste gas header test connection isolation valve, 2-GR-63, is opened to sample the primary drain tank for oxygen and nitrogen. When 2-GR-63 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is expected during plant startup and shutdown.

The upstream vent valves for the steam generator atmospheric dump valves, 2-MS-369 and 2-MS-37 1, are opened during steam generator safety valve set point testing to allow steam header pressure instrumentation to be placed in service. When either 2-MS-369 or 2-MS-371 is opened, a dedicated operator in continuous communication with the control room is required.

The determination of the appropriate administrative controls for these containment isolation valves included an evaluation of the expected environmental conditions. This evaluation has concluded environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of containment through the respective penetration.

The containment purge supply and exhaust isolation valves are required to be sealed closed during plant operation since these valves have not been demonstrated capable of closing during a LOCA or steam line break accident. Such a demonstration would require justification of the mechanical operability of the purge valves and consideration of the appropriateness of the electrical override circuits. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the containment purge system. The containment purge supply and exhaust isolation valves are sealed closed by removing power from the valves. This is accomplished by pulling the control power fuses for each of the valves. The associated fuse blocks are then locked. This is consistent with the guidance contained in NUREG-0737 Item II.E.4.2 and Standard Review Plan 6.2.4, "Containment Isolation System," Item II.f.

Surveillance Requirement 4.6.3.1.a verifies the isolation time of each power operated automatic containment isolation valve is within limits to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and surveillance frequency are in accordance with the Inservice Testing Program.

Surveillance Requirement 4.6.3.l.b demonstrate that each automatic containment isolation valve actuates to the isolation position on an actual or simulated containment isolation signal [containment isolation actuation signal (CIAS) or containment high radiation actuation signal (containment purge valves only)]. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillance was performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.

MILLSTONE - UNIT 2 B 3/4 6-3g Amendment No. 283

3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS The OPERABILITY of the auxiliary feedwater pumps ensures that the Reactor Coolant System can be cooled down to less than 300'F from normal operating conditions in the event of a total loss of off-site power.

The FSAR Chapter 14 Loss of Normal Feedwater: (LONF) analysis evaluates the event occurring with and without offsite power available, and a single active failure. This analysis has determined that one motor driven AFW pump is not sufficient to meet the acceptance criteria.

Therefore, two AFW pumps (two motor-driven AFW pumps, or one-motor driven AFW pump and the steam-driven AFW pump) are required to meet the acceptance criteria for this moderate frequency event. To meet the requirement of two AFW pumps available for mitigation, all three pumps must be OPERABLE to accommodate the failure of one pump. This is consistent with the limiting condition for operation and action statements of Technical Specification 3.7.1.2.

Although not part of the bases of Technical Specification 3.7.1.2, the less conservative FSAR Chapter 10 Best Estimate Analysis of the LONF event was performed to demonstrate that one motor-driven AFW pump is adequate to remove decay heat, prevent steam generator dryout, maintain Reactor Coolant System (RCS) subcooling, and prevent pressurizer level from exceeding acceptable limits. From this best estimate analysis of the LONF event, an evaluation was performed to demonstrate that a single motor-driven AFW pump has sufficient capacity to reduce the RCS temperature to 300'F (in addition to decay heat removal) where the Shutdown Cooling System may be placed into operation for continued cooldown. As a result of these evaluations, one motor-driven AFW pump (or the steam-driven AFW pump which has twice the capacity of a motor-driven AFW pump) can meet the requirements to remove decay heat, prevent steam generator dryout, maintain RCS subcooling, prevent the pressurizer from exceeding acceptable limits, and reduce RCS temperature to 3001F.

The Auxiliary Feed Water (AFW) system is OPERABLE when the AFW pumps and flow paths required to provide AFW to the steam generators are OPERABLE. Technical Specification 3.7.1.2 requires three AFW pumps to be OPERABLE and provides ACTIONS to address inoperable AFW pumps. The AFW flow path requirements are separated into AFW pump suction flow path requirements, AFW pump discharge flow path to the common discharge header requirements, and common discharge header to the steam generators flow path requirements.

There are two AFW pump suction flow paths from the Condensate Storage Tank to the AFW pumps. One flow path to the turbine driven AFW pump, and one flow path to both motor driven AFW pumps. There are three AFW pump discharge flow paths to the common discharge header, one flow path from each of the three AFW pumps. There are two AFW discharge flow paths from the common discharge header to the steam generators, one flow path to each steam generator. With 2-FW-44 open (normal position), the discharge from any AFW pump will be supplied to both steam generators through the associated AFW regulating valves.

MILLSTONE - UNIT 2 B 3/4 7-2 Amendment No. 5, 64-, 63, 244, 224, 236, 283

PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS (Continued) 2-FW-44 should remain open when the AFW system is required to be OPERABLE (MODES 1, 2, and 3). Closing 2-FW-44 places the plant in a configuration not considered as an initial condition in the Chapter 14 accident analyses. Therefore, if 2-FW-44 is closed while the plant is operating in MODES 1, 2, or 3, two AFW pumps should be considered inoperable and the appropriate action requirement of Technical Specification 3.7.1.2 entered to limit plant operation in this configuration.

A flow path may be considered inoperable as the result of closing a manual valve, failure of an automatic valve to respond correctly to an actuation signal, or failure of the piping. In the case of an inoperable automatic AFW regulating valve (2-FW-43A or B), flow path OPERABILITY can be restored by use of a dedicated operator stationed at the associated bypass valve (2-FW-56A or B) as directed by OP 2322. Failure of the common discharge header piping' will cause both discharge flow paths to the steam generators to be inoperable.

An inoperable suction flow path to the turbine driven AFW pump will result in one inoperable AFW pump. An inoperable suction flow path to the motor driven AFW pumps will result in two inoperable AFW pumps. The ACTION requirements of Technical Specification 3.7.1.2 are applicable based on the number of inoperable AFW pumps.

An inoperable pump discharge flow path from an AFW pump to the common discharge header will cause the associated AFW pump to be inoperable. The ACTION requirements of Technical Specification 3.7.1.2 for one AFW pump are applicable for each affected pump discharge flow path.

AFW must be capable of being delivered to both steam generators for design basis accident mitigation. Certain design basis events, such as a main steam line break or steam generator tube rupture, require that the affected steam generator be isolated, and the RCS decay heat removal safety function be satisfied by feeding and steaming the unaffected steam generator.

If a failure in an AFW discharge flow path from the common discharge header to a steam generator prevents delivery of AFW to a steam generator, then the design basis events may not be effectively mitigated. In this situation, the ACTION requirements of Technical Specification 3.0.3 are applicable and an immediate plant shutdown is appropriate.

Two inoperable AFW System discharge flow paths from the common discharge header to both steam generators will result in a complete loss of the ability to supply AFW flow to the steam generators. In this situation, all three AFW pumps are inoperable and the ACTION requirements of Technical Specification 3.7.1.2. are applicable. Immediate corrective action is required.

However, a plant shutdown is not appropriate until a discharge flow path from the common discharge header to one steam generator is restored.

MILLSTONE - UNIT 2 B 3/4 7-2a Amendment No. 283

3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS (Continued)

During quarterly surveillance testing of the turbine driven AFW pump, valve 2-CN-27A is closed and valve 2-CN-28 is opened to prevent overheating the water being circulated. In this configuration, the suction of the turbine driven AFW pump is aligned to the Condensate Storage Tank via the motor driven AFW pump suction flow path, and the pump minimum flow is directed to the Condensate Storage Tank by the turbine driven AFW pump suction path upstream of 2-CN-27A in the reverse direction. During this surveillance, the suction path to the motor driven AFW pump suction path remains OPERABLE, and the turbine driven AFW suction path is inoperable. In this situation, the ACTION requirements of Technical Specification 3.7.1.2 for one AFW pump are applicable.

Surveillance Requirement 4.7.1.2.a verifies the correct alignment for manual, power operated, and automatic valves in the Auxiliary Feedwater (AFW) System flow paths (water and steam) to provide assurance that the proper flow paths will exist for AFW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

Surveillance Requirement 4.7.1.2.b, which addresses periodic surveillance testing of the AFW pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by Section XI of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.

Section XI of the ASME Code provides the activities and frequencies necessary to satisfy the requirements. This surveillance is modified to indicate that the test can be deferred for the steam driven AFW pump until suitable plant conditions are established. This deferral is required because steam pressure is not sufficient to perform the test until after MODE 3 is entered.

However, the test, if required, must be performed prior to entering MODE 2.

MILLSTONE - UNIT 2 B 3/4 7-2b Amendment No. -2, 64, 63, 244-, 236, 283

3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS (Continued)

Surveillance Requirements 4.7.1.2.c and 4.7.1.2.d demonstrate that each automatic AFW valve actuates to the required position on an actual or simulated actuation signal (AFWAS) and that each AFW pump starts on receipt of an actual or simulated actuation signal (AFWAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned transients if the surveillances were performed with the reactor at power. The 18 month frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program. These surveillances do not apply to the steam driven AFW pump and associated valves which are not automatically actuated.

Surveillance Requirement 4.7.1.2.e demonstrates the AFW System is properly aligned by verifying the flow path to each steam generator prior to entering MODE 2, after 30 cumulative days in MODE 5, MODE 6, or a defueled condition. OPERABILITY of the AFW flow paths must be verified before sufficient core heat is generated that would require operation of the AFW System during a subsequent shutdown. To further ensure AFW System alignment, the OPERABILITY of the flow paths is verified following extended outages to determine that no misalignment of valves has occurred. The frequency is reasonable, based on engineering judgment, and other administrative controls to ensure the flow paths are OPERABLE.

3/4.7.1.3 CONDENSATE STORAGE TANK The OPERABILITY of the condensate storage tank with the minimum water volume ensures that sufficient water is available for cooldown of the Reactor Coolant System to less than 300'F in the event of a total loss of off-site power. The minimum water volume is sufficient to maintain the RCS at HOT STANDBY conditions for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> with steam discharge to atmosphere. The contained water volume limit includes an allowance for water not usable due to discharge nozzle pipe elevation above tank bottom, plus an allowance for vortex formation.

3/4.7.1.4 ACTIVITY The limitations on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small fraction MILLSTONE - UNIT 2 B 3/4 7-2c Amendment No. 283