ML052410281

TS Bases Pages Regarding Limiting Safety System Settings

ML052410281
Person / Time
Site:	Millstone
Issue date:	08/25/2005
From:	NRC/NRR/DLPM
To:
References
TAC MC8076
Download: ML052410281 (74)

Text

LBDCR No. 04-MP3-015 February 24, 2005 2.2 LIMITING SAFETY SYSTEM SETINGS BASES 2.2.1 REACTOR TRIP SYSTEM TNSTRUMENTATION SETPOINTS The Nominal Trip Setpoints specified in Table 2.2-1 are the nominal values at which the reactor trips are set for each functional unit. The Allowable Values (Nominal Trip Setpoints :k the calibration tolerance) are considered the Limiting Safety System Settings as identified in I0CFR50.36 and have been selected to ensure that the core and Reactor Coolant System are prevented from exceeding their safety limits during normal operation and design basis anticipated operational occurrences and to assist the Engineered Safety Features Actuation System in mitigating the consequences of accidents. The Setpoint for a Reactor Trip System or interlock function is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (X)calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged.

Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP-10991.

OPERABILITY determinations are based on the use of Measurement and Test Equipment that conforms with the accuracy used in the plant uncertainty calculation.

The Allowable Value specified in Table 2.2-1 defines the limit beyond which a channel is inoperable. If the process rack bistable settinig is measured within the "as lft" calibration tolerance, which specifies the difference between the Allowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE.

The methodology, as defined in WCAP-1 0991 to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties in the channels. Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation.

The various reactor trip circuits automatically open the reactor trip breakers whenever a condition monitored by the Reactor Trip System reaches a preset or calculated level. In addition to the redundant channels and trains, the design approach provides Reactor Trip System functional diversity. The MILLSTONE - UNIT 3 B 2-3 Amendment No. 4-59,

LBDCR 04-MP3-010 November 18, 2004 LIMITING SAFETY SYSTEM SETTINGS BASES Reactor Trip System Interlocks (Continued)

P-8 On increasing power, P-8 automatically enables Reactor trips on low flow in one or more reactor coolant loops. On decreasing power, the P-8 automatically blocks the above listed trips.

P-9 On increasing power, P-9 automatically enables Reactor trip on Turbine trip. On decreasing power, P-9 automatically blocks Reactor trip on Turbine trip.

P-10 On increasing power, P-10 provides input to P-7 to ensure that Reactor Trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level are active when power reaches 11%. It also allows the manual block of the Intermediate Range trip and the Low Setpoint Power Range trip; and automatically blocks the Source Range trip and deenergizes the Source Range high voltage power.

On decreasing power, P-10 resets to automatically reactivate the Intermediate Range trip and the Low Setpoint Power Range trip before power drops below 9%. It also provides input to reset P-7.

P-13 On increasing power, P-13 provides input to P-7 to ensure that Reactor trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level are active when power reaches 10%.

On decreasing power, P-13 resets when power drops below 10% and provides input, along with P-10, to reset P-7.

MILLSTONE -UNIT 3 B 2-8 Amendment No. W, *4-7,2O,

LBDCR No. 04-MP3-015 February 24,2005 314.0 APPLICABILITY BASES Some examples of this process are:

a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressure > 800 psi. However, ifother appropriate testing is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the testing.

b. High pressure safety injection (HPSI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE.

This allows operation to reach the specified pressure to complete the necessary post maintenance testing.

Specification 4.0.2 This specification establishes the limit for which the specified time interval for surveillance requirements may be extended. It permits an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified typically with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outage. The limitation of 4.0.2 is based on engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the surveillance requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified surveillance interval.

Specification 4.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified surveillance interval. A delay period of up to 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> or up to the limit of the specified surveillance interval, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with Specification 4.0.2, and not at the time that the specified surveillance interval was not met.

This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with ACTION requirements or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability ofpersonnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

MILLSTONE - UNIT 3 B 3/4 0-5 Amendment No. A-v, 4-2, I, 43,

LBDCR No. 04-MP3-0 15 February 24, 2005 3/4.0 APPLICABILITY BASES When a Surveillance with a surveillance interval based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations, (e.g., prior to entering MODE I after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, Specification 4.0.3 allows for the full delay period of up to the specified surveillance interval to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.

Specification 4.0.3 provides a time limit for, and allowances forthe performance of, Surveillances that become applicable as a consequence of MODE changes imposed by ACTION requirements.

Failure to comply with specified surveillance intervals for the Surveillance Requirements is expected to be an infrequent occurrence. Use of the delay period established by Specification 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> or the limit of the specified surveillance interval is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear PowerPlants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.

Ifa Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and entry into the ACTION requirements for the applicable Limiting Conditions for Operation begins immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period allowed by this Specification, or within the Allowed Outage Time of the applicable ACMIONS, restores compliance with Specification 4.0.1.

MILLSTONE - UNIT 3 B 314 0-5a Amendment No. i4,

L33DCR 04-MP3 002 March25,2004 314.1 REACVITY CONTROLSYSTEMS BASES 314.1.1 BORATION CONTROL 314.1.1.1 and 3/4.1.1.2 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that: (1) the reactor can be made subcritical from all operating conditions, (2) the reactivity transiknts associated with postulated accident conditions art controllable within acceptable limits, and (3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.

SHUTDOWN MARGIN requirements vary throughout core life as a function of uel depletion, RCS boron concentration, and RCS Tg,. In MODES I and 2, the most rstrictive condition occurs at EOL with T8vs at no load operating emperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.1 is required to control the reactivity transient. Accordingly, the SHDOWN MARGIN requirement is based upon this limiting condition and is consistent with PSAR safety analysis assumptions.

In MODES 3, 4 and 5, the most restrictive condition occurs at BOLI, associated with a boron dilutlonaccident. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.2 is required to allow the operator 15 minutes from the initiation of the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting requirement and is consistent with the accident analysis assumption.

The locking closed of the required valves in MODE 5 (with the loops not filled) will preclude the possibility of uncontrolled boron dilution of the Reactor Coolant System by preventing flow of unborated water to the RCS.

14.1.1.3 MODBRAT0R TMPERTR COFFDICN 0 The limitations on moderator temperature coefficient (MTC) are provided to ensure that the value of this coefficient remains within the limiting condition assumed in the FSAR accident and transient analyses.

The MTC values of this specification are applicable to a specific set of plant conditions; accordingly, verification of MTC values at conditions other than those explicitly stated will require extrapolation to those conditions in order to permit an accurate comparison.

The most negative MTC, value equivalent to the most positive moderator density coefficient (MDC), was obtained by incrementally correcting the MDC used in the FSAR analyses to nominal operating conditions.

MILLSTONE-UNIT3 B 3/4 1-1 Amendment No. 29,0, 99,44-7,

LBDCR No. 04-MP3-015 February 24, 2005 EACTIVITY CONTROL SYSTEMS BASES MOVABLE CONTROL ASSEMBLIES (Continued)

For Specification 3.1.3.1 ACTIONS b. and c., it is incumbent upon the plant to verify the trippability of the inoperable control rod(s). Trippability is defined in Attachment C to a letter dated December 21, 1984, from E. P. Rahe (Westinghouse) to C. O. Thomas (NRC). This may be by verification of a control system failure, usually electrical in nature, or that the failure is associated with the control rod stepping mechanism. In the event the plant is unable to verify the rod(s) trippability, it must be assumed to be untrippable and thus falls under the requirements of ACTION a. Assuming a controlled shutdown from 100% RATED THERMAL POWER, this allows approximately 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> for this verification.

For LCO 3.1.3.6 the control bank insertion limits are specified in the CORE OPERATING LIMITS REPORT (COLR). These insertionilimits are the initial assumptions in safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions, assumptions of available SHUTDOWN MARGIN, and initial reactivity insertion rate.

The applicable I&C calibration procedure (Reference l.) being current indicates the associated circuitry is OPERABLE.

There are conditions when the Lo-Lo and Lo alarms of the RIL Monitor are limited below the RIL specified in the COLR. The RIL Monitor remains OPERABLE because the lead control rod bank still has the Lo and Lo-Lo alarms greater than or equal to the RIL.

When rods are at the top of the core, the Lo-Lo alarm is limited below the RIL to prevent spurious alarms. The RIL is equal to the Lo-Lo alarm until the adjustable upper limit setpoint on the RIL Monitor is reached, then the alarm remains at the adjustable upper limit setpoint. When the RIL is in the region above the adjustable upper limit setpoint, theLo-Lo alarm is below the RIL.

References:

1. IC 3469N08, Rod Control Speed, Insertion Limit, and Control TAVE Auctioneered/Deviation Alarms.

2. LetterNS-OPLS-OPL-1-91-226, (Westinghouse LetterNEU-91-563), dated April 24, 1991.

3. Millstone Unit 3 Technical Requirements Manual, Appendix 8.1, "CORE OPERATING LIMITS REPORT'.

4. Westinghouse Letter NEU-97-298, "Millstone Unit 3 - RCCA Drop Time," dated November 13, 1997.

5. Westinghouse Letter 98NEU-G-0060, "Millstone Unit 3 - Robust Fuel Assembly (Design Report) and Generic SECL," dated October 2, 1998.

MILLSTONE - UNIT 3 B 314 1-6 Amendment No.

LBDCRNo. 04-MP3-015 February 24,2005 3/4.2 POWER DISTRIBUTION LIMITS BASES The specifications of this section provide assurance of fuel integrity during Condition I (Normal Operation) and II (Incidents of Moderate Frequency) events by: (1) maintaining the minimum DNBR in the core greater than or equal to the design limit during normal operation and in short-term transients, and (2) limiting the fission gas release, fuel pellet temperature, and cladding mechanical properties to within assumed design criteria. In addition, limiting the peak linear power density during Condition I events provides assurance that the initial conditions assumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 22001F is not exceeded.

The definitions of certain hot channel and peaking factors as used in these specifications are as follows:

FQ(Z) Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on the surface of a fuel rod at core elevation Z divided by the average fuel rod heat flux, allowing for manufacturing tolerances on fuel pellets and rods; and FN NuclearEnthalpy Rise Hot Channel Factor, is defined as the ratio of the integral of AH linear power along the rod with the highest integrated power to the average rod power.

314.2.1 AXIAL FLUXJ DIFFERENCE The limits on AXIAL FLUX DIFFERENCE (AFD) assure that the FQ(Z) upper bound envelope of the FQ limit specified in the CORE OPERATING LIMITS REPORT (COLR) times the normalized axial peaking factor is not exceeded during cithernormal operation or in the event of xenon redistribution following power changes.

Target flux difference is determined at equilibrium xenon conditions. The full-length rods may be positioned within the core in accordance with their respective insertion limits and should be inserted near their normal position for steady-state operation at high power levels. The value of the target flux difference obtained under these conditions divided by the fraction of RATED THERMAL POWER is the target flux difference at RATED THERMAL POWER for the associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RATED THERMAL POWER value by the appropriate fractional THERMAL POWER level. The periodic updating of the target flux difference value is necessary to reflect core bumup considerations.

MILLSTONE - UNIT 3 B 3/4 2-1 Amendment No. AR, 60,

• LBDCR No. 04-MP3-015 February 24,2005 POWER DISTRIBUTION LIMITS BASES AXIAL FLUX DIFFERENCE (Continued)

At power levels below APLND, the limits on AFD are defined in the COLR consistent with the Relaxed Axial Offset Control (RAOC operating procedure and limits. These limits were calculated in a manner such that expected operational transients, e.g., load follow operations, would not result in the AFD deviating outside of those limits. However, in the event such a deviation occurs, the short period of time allowed outside of the limits at reduced power levels will not result in significant xenon redistribution such that the envelope of pealdng factors would change sufficiently to prevent operation in the vicinity of the APLND power level.

At power levels greater than APLND, two modes of operation are permissible: (1) RAOC, the AFD limit ofwhich are defined in the COLR, and (2) base load operation, which is defined as the maintenance of the AFD within COLR specifications band about a target value. The RAOC operating procedure above APLND is the same as that defined for operation below APLND.

However, it is possible when following extended load following maneuvers that the AFD limits may result in restrictions in the maximum allowed power or AFD in order to guarantee operation with FQ(Z) less than its limiting value. To allow operation at the maximum permissible power level, the base load operating procedure restricts the indicated AFD to relatively small target band (as specified in the COLR) and power swings (APLND

• power

• APLBL or 100% RATED THERMAL POWER, whichever is lower). For base load operation, it is expected that the plant will operate within the target band. Operation outside of the target band for the short time period allowed will not result in significant xenon redistribution such that the envelope of peaking factors would change sufficiently to prohibit continued operation in the power region defined above. To assure there is no residual xenon redistribution impact from past operation on the base load operation, a 24-hour waiting period at a power level above APLND and allowed by RAOC is necessary. During this time period load changes and rod motion are restricted to that allowed by the base load procedure. After the waiting period, extended base load operation is permissible.

The computer determines the 1-minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3 OPERABLE excore channels are: (1) outside the allowed delta-I power operating space (for RAOC operation), or (2) outside the allowed delta-I target band (for base load operation). These alarms are active when power is greater than (1) 50% of RATED THERMAL POWER (for RAOC operation), or MILLSTONE - UNIT 3 B 3/4 2-2 Amendment No. -0, 60,

LBDCR No. 04-MP3-015 February 24,2005 POWER DISTRIBUTION LMITS BASES HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued)

The 12-hour periodic surveillance of indicated RCS flow is sufficient to detect only flow degradation which could lead to operation outside the acceptable region of operation defined in Specifications 32.3.1.

3/4.2.4 QUADRANT POWER TILT RATIO The QUADRANT POWER TILT RATIO limit assures that the radial power distribution satisfies the design values used in the power capability analysis. Radial power distribution measurements are made during STARTUP testing and periodically during POWER OPERATION.

The limit of 1.02, at which corrective action is required, provides DNB and linear heat generation rate protection with x-y plane power tilts. A limiting tilt of 1.025 can be tolerated before the margin for uncertainty in FQ is depleted. A limit of 1.02 was selected to provide an allowance for the uncertainty associated with the indicated power tilt.

The 2-hour time allowance for operation with a tilt condition greater than 1.02 but less than 1.09 is provided to allow identification and correction of a dropped or misaligned control rod. In the event such action does not correct the tilt, the margin for uncertainty on FQ is reinstated by reducing the maximum allowed power by 3% for each percent of tilt in excess of 1.

For purposes of monitoring QUADRANT POWER TILT RATIO when one excore detector is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the QUADRANT POWER TILT RATIO. The incore detector monitoring is done with a full incore flux map or two sets of four symmetric thimbles. The two sets of four symmetric thimbles is a unique set of eight detector locations.

These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, N-8.

3/4,2.5 DNB PARAMETERS The limits on the DNB-related parameters assure that each of the parameters are maintained within the normal steady-state envelope of operation assumed in the transient and accident analyses. The limits are consistent with the initial FSAR assumptions and have been analytically demonstrated adequate to maintain a minimum DNBR greater than the design limit throughout each analyzed transient. The indicated Tavg values MILLSTONE - UNIT 3 B 3/4 2-5 Amendment No. A, ", 60, 211,

L1BDCR 04-MP3-002 March 25, 2004 POWER DISTRIBUTION LIMITS BASES DNB PARAMETERS (Continued) and the indicated pressurizer pressure values are specified in the CORE OPERATING LIMITS REPORT. The calculated values of the DNB related parameters will be an average of the indicated values for the OPERABLE channels.

The 12-hour periodic surveillance of these parameters through instrument readout is sufficient to ensure that the parameters are restored within their limits following load changes and other expected transient operation. Measurement uncertainties have been accounted for in determining the parameter limits.

MILLSTONE - UNIT 3 B 314 2-6 Amendment No. 4, 60, I

LBDCRNo. 04-MP3-015 February 24, 2005 3/4.3 INSTRUMENTATION BASES 314.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGTNEERED SAFETY FEATURES ACTUATION SYSTEM TNSTRUMENTATION The OPERABILITY of the Reactor Trip System and the Engineered Safety Features Actuation System instrumentation and interlocks ensures that: (1) the associated action and/or Reactor trip will be initiated when the parameter monitored by each channel or combination thereof reaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and (4) sufficient system functional capability is available from diverse parameters.

The OPERABILITY of these systems is required to provide the overall reliability, redundancy, and diversity assumed available in the facility design for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the safety analyses. The Surveillance Requirements specified for these systems ensure that the overall system functional capability is maintained comparable to the original design standards. The periodic surveillance tests performed at the minimum frequencies are sufficient to demoistrate this capability.

The Engineered Safety Features Actuation System Nominal Trip Setpoints specified in Table 3.3.4 are the nominal values of which the bistables are set for each functional unit. The Allowable Values (Nominal Trip Setpoints + the calibration tolerance) are considered the Limiting Safety System Settings as identified in 10CFR50.36 and have been selected to mitigate the consequences of accidents. A Setpoint is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (d) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged.

Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP-10991.

OPERABILITY determinations are based on the use of Measurement and Test Equipment that conforms with the accuracy used in the plant uncertainty calculation.

The Allowable Value specified in Table 3.3-4 defines the limit beyond which a channel is inoperable. If the process rack bistable setting is measured within the "as left" calibration tolerance, which specifies the difference between the Allowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE. I MILLSTONE - UNIT 3 B 3/4 3-1 Amendment No. 4-5,

LBDCRNo. 04-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.1 and 314.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

The methodology, as defined in WCAP-10991 to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties in the channels. Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics. Device drift in excess ofthe allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation.

The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESF Table (Item 7E). For these radiation monitors the allowable values are essentially nominal values. Due to the uncertainties involved in radiological parameters, the methodologies of WCAP-10991 were not applied. Actual trip setpoints will be reestablished below the allowable value based on calibration accuracies and good practices.

The OPERABILITY requirements for Table 3.3-3, Functional Units 7.a, "Control Building Isolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building Inlet Ventilation Radiation," are defined by table notation "*". These functional units are required to be OPERABLE at all times during plant operation in MODES 1,2, 3, and 4. These functional units are also required to be OPERABLE during fuel movement within containment or the spent fuel pool, as specified by table notation "*". This table notation is also applicable during fuel movement within containment or the spent fuel pool. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged. Therefore, the movement of either new or irradiated fuel (assemblies or individual fuel rods) can cause a fuel handling accident, and functional units 7.a and 7.e are required to be OPERABLE whenever new or irradiated fuel is moved within the containment or the storage pool. Table notation "" of Table 43-2 has the same applicability.

The verification of response time at the specified frequencies provides assurance that the reactor trip and the engineered safety features actuation associated with each channel is completed within the time limit assumed in the safety analysis. No credit is taken in the analysis for those channels with response times indicated as not applicable (i.e., N.A.).

MILLSTONE - UNIT 3 B 3/4 3-2 Amendment No. 4,94-, 4i9, 477, 4P, 249,

LBDCRNo. 04-MP3-015 February 24, 2005 INSTRUMENTATION BASES 314.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUAT7ON SYSTEM INSTRUMENTATION (Continued)

For slave relays, or any auxiliary relays in ESFAS circuits that are of the type Potter & Brumfield MDR series relays, the SLAVE RELAY TEST is performed at an 'WR" frequency (at least once every 18 months) provided the relays meet the reliability assessment criteria presented in WCAP-13878, "Reliability Assessment of Potter and Brumfield MDR series relays," and WCAP-13900, "Extension of Slave Relay Surveillance Test Intervals." The reliability assessments performed as part of the aforementioned WCAPs are relay specific and apply only to Potter and Brumfield MDR series relays. Noie that for normally energized applications, the relays may have to be replaced periodically in accordance with the guidance given in WCAP-13878 for MDR relays.

REACTOR TRIP BREAKER This trip function applies to the reactor trip breakers (RTBs) exclusive of individual trip mechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable ofsupplying power to the control rod drive (CRD) system. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability.

These trip functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3,4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD system is capable of rod withdrawal.

BYPASSED CHANNEL* - Technical Specifications 3.3.1 and 33.2 often allow the bypassing of instrument channels in the case of an inoperable instrument or for surveillance testing.

A BYPASSED CHANNEL shall be a channel which is:

• Required to be in its accident or tripped condition, but is nQo presently in its accident or tripped condition using a method described below; or

• Prevented from tripping.

MILLSTONE - UNIT 3 B 314 3-2b Amendment No. I24,

LBDCR No. 04-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORG INSTRUMENTATION (Continued)

ACTION Statement "a":

The use of one main control board indicator and one computer point, total of two indicators per steam generator, meets the requirements for the total number of channels for Auxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification for each steam generator are as follows:

team Instrument (MBS) Instrument (Computer)

Generator IG 1 FWA*FISIAl (Orange) FWA-F33A3 (Purple)

IG 2 FWA*FI33BI (Purple) FWA-F511B3 (Orange) 1G3 FWA*FI33C1 (Purple) FWA-F51C3 (Orange)

IG 4 FWA*FI5lD1 (Orange) FWA -F33D3 (Purple)

The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes following an LOP when the power supply for the plant computer is lost. However, this design configuration

- one continuous main control board indicator aid 6ne indication via the SPDSlplant computer, total of two per steam generator - was submitted to the NRC via "Response to question 420.6" dated January 13, 1984, B 11002. NRC review and approval was obtained with the acceptance of MP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (dated November 1985).

LCO 3.3.3.6, Table 3.3-10, Item (17), requires 2 OPERABLE reactor vessel water level (heated junction thermocouples - HJTC) channels. An OPERABLE reactor vessel water level channel shall be defined as:

1. Four or more total sensors operating.

2. At least one of two operating sensors in the upper head.

3. At least three of six operating sensors in the upper plenum.

MILLSTONE -UNIT 3 B 3/4 3-5a Amendment No. A,46, 84, 44, I49,

LBDCR No. 04-MP3-015 February 24, 2005 INSTRUMENTATION BASES 314.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued)

A channel is OPERABLE if four or more sensors, half or more in the upper head region and half or more in the upper plenum region, are OPERABLE.

In the event more than four sensors in a Reactor Vessel Level channel are inoperable, repairs may only be possible during the next refueling outage. This is because the sensors are accessible only after the missile shield and reactor vessel head are removed. It is not feasible to repair a channel except during a refueling 6utage when the missile shield and reactor vessel head are removed to refuel the core. If only one channel is inoperable, it should be restored to OPERABLE status in a refueling outage as soon as reasonably possible. If both channels are inoperable, at least one channel shall be restored to OPERABLE status in the nearest refueling outage.

The Reactor Coolant System Subcooling Margin Monitor, Core Exit Thermocouples, and Reactor Vessel Water Level instruments are processed by two separate trains of ICC (Inadequate Core Cooling) and HJTC (Heated Junction ThermoCouple) processors. The preferred indication for these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC (Plant Process Computer) but qualified indication is provided in the instrument rack room. When the PPC data links cease to transmit data, the processors must be reset in order to restore the flow of data to the PPC. During reset, the qualified indication in the instrument rack room is lost. These instruments are OPERABLE during this reset since the indication is only briefly interrupted while the processors reset and the indication is promptly restored. The sensors are not removed from service during this reset. The train should be considered inoperable only if the qualified indication fails to be restored following reset. Except for the non-qualified PPC display, the instruments operate as required.

Hydrogen Monitors are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion. Containment hydrogen concentration is also important in verifying the adequacy of mitigating actions. The requirement to perform a hydrogen sensor calibration at least once every 92 days is based upon vendor recommendations to maintain sensor calibration. This calibration consists of a two point calibration, utilizing gas containing approximately one percent hydrogen gas for one of the calibration points, and gas containing approximately four percent hydrogen gas for the other calibration point.

3/4.3.3.7 DELETED 314.3.3.8 DELETED 3/4.3.3.9 DELETED 3/4.3.3.10 DELETED 314.3.4 DELETED MILLSTONE - UNIT 3 B 3/4 3-6 Amendment No. 4iSe, 49A, 49,

LBDCR No. 04-MP3-015 February 24, 2005

]NSTRUMNTATION BASES 3/4.3.5 SHUTDOWN MARGIN MONITOR The Shutdown Margin Monitors provide an alarm that a Boron Dilution Event may be in progress. The minimum count rate of Specification 3/4.3.5 and the SHUTDOWN MARGIN requirements specified in the CORE OPERATING LIMITS REPORT for MODE 3, MODE 4 and MODE 5 ensure that at least 15 minutes are available for operator action from the time of the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. By borating an additional 150 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT forMODE 3 or 350 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT fdr MODE 4, MODE 5with RCS loops filled, or MODE 5 with RCS loops not filled, lower values of minimum count rate are accepted.

Shutdown Margin Monitors

Background:

The purpose of the Shutdown Margin Monitors (SMM) is to annunciate an increase in core subcritical multiplication allowing the operator at least 15 minutes response time to mitigate the consequences of the inadvertent addition ofunborated primary grade water (boron dilution event) into the Reactor Coolant System (RCS) when the reactor is shut down (MODES 3, 4, and 5).

The SMMs utilizes two channels of source range instrumentation (GM detectors). Each channel provides a signal to its applicable train of SMM. The SMM channel uses the last 600 or more counts to calculate the count rate and updates the measurement after 30 new counts or 1 second, whichever is longer. Each channel has 20 registers that hold the counts (20 registers X 30 count =

600 counts) for averaging the rate. As the count rate decreases, the longer it takes to fill the registers (fill the 30 count minimum). As the instrument's measured count rate decreases, the delay time in the instrument's response increases. This delay time leads to the requirement of a minimum count rate for OPERABILITY.

During the dilution event, count rate will increase to a level above the normal steady state count rate. When this new count rate level increases above the instruments setpoint, the channel will alarm alerting the operator of the event.

Applicable SafetM Analysis The SMM senses abnormal increases in the source range count per second and alarms the operator of an inadvertent dilution event. This alarm will occur at least 15 minutes prior to the reactor achieving criticality. This 15 minute window allows adequate operator response time to terminate the dilution, FSAR Section 15A.6.

LCO 3.3.5 provides the requirements for OPERABILITY of the instrumentation of the SMMs that are used to mitigate the boron dilution event. Two trains are required to be OPERABLE to provide protection against single failure.

MILLSTONE - UNIT 3 B 3/4 3-7 Amendment No. 4.64, 4,

LBDCR No. 04-MP3-015 February 24,2005 BASES (continued)

,Applicability The SMM must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies this system as the primary means to alert the operator and mitigate the event. The SMMs are allowed to be blocked during start up activities in MODE 3 in accordance with approved plant procedures.

The alarm is blocked to allow the SMM channels to be used to monitor the l/M approach to criticality.

The SMM are not required to be OPERABLE in MODES I and 2 as other RPS is credited with accident mitigation, over temperature delta temperature and power range neutron flux high (low setpoint of 25 percent RTP) respectively. The SMMs are not required to be OPERABLE in MODE 6 as the dilution event is precluded by administrative controls over all dilution flow paths (Technical Specification 4.1.1.2.2).

ACTIONS Channel inoperability of the SMMs can be caused by failure of the channel's electronics, failure of the channel to pass its calibration procedure, or by the channel's count rate falling below the minimum count rate for OPERABILITY. This can occur when the count rate is so low that the channel's delay time is in excess of that assumed in the safety analysis. In any of the above conditions, the channel must be declared inoperable and the appropriate ACTION statement entered. If the SMMs are declared inoperable due to low count rates, an RCS heatup will cause the SMM channel count rate to increase to above the minimum count rate for OPERABILITY.

Allowing the plant to increase modes will actually return the SMMs to OPERABLE status. Once the SMM channels are above the minimum count rate for OPERABILlTY, the channels can be declared OPERABLE and the LCO ACTION statements can be exited.

LCO 3.3.5, ACTION a. - With one train of SMM inoperable, ACTION a. requires the inoperable train to be returned to OPERABLE status within 48 hours2 days <br />0.286 weeks <br />0.0658 months <br />. In this condition, the remaining SMM train is adequate to provide protection. If the above required ACTION cannot be met, alternate compensatory actions must be performed to provide adequate protection from the boron dilution event. All operations involving positive reactivity changes associated with RCS dilutions and rod withdrawal must be suspended, and all dilution flowpaths must be closed and secured in position (locked closed per Technical Specification 4.1.1.2.2) within the following 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />.

LCO 3.3.5, ACTION b. -With both trains of SMM inoperable, alternate protection must be provided:

I. Positive reactivity operations via dilutions and rod withdrawal are suspended. The intent of this ACTION is to stop any planned dilutions of the RCS. The SMMs are not intended to monitor core reactivity during RCS temperature changes. The alarm setpoint is routinely reset during the plant heatup due to the increasing count rate. During cooldowns as the count rate decreases, baseline count rates are continually lowered automatically by the SMMs. The Millstone Unit No; 3 boron dilution analysis assumes steady state RCS temperature conditions.

MILLSTONE - UNIT 3 B 3/4 3-8 Amendment No. 4i4,

LBDCR No. 04-MP3-015 February 24, 2005 BASES (continued)

2. All dilution flowpaths are isolated and placed under administrative control (locked closed). This action provides redundant protection and defense in depth (safety overlap) to the SMMs. In this configuration, a boron dilution event (DDE) cannot occur. This is the basis for not having to analyze for BDE in MODE 6. Since the BDE cannot occur with the dilution flow paths isolated, the SMMs are not required to be OPERABLE as the event cannot occur and OPERABLE SMMs provide no benefit.

3. Increase the SHUTDOWN MARGIN surveillance frequency from every 24 hours1 days <br />0.143 weeks <br />0.0329 months <br /> to every 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />. This action in combination with the above, provide defense in depth and overlap to the loss of the SMMs.

Surveillance Requirements The SMMs are subject to an ACOT every 92 days to ensure each train of SMM is fully operational. This test shall include verification that the SMMs are set per the CORE OPERATING LIMITS REPORT.

MILLSTONE - UNIT 3 B 3/43-9 Amendment ND. 4-(A,

LBDCRNo. 04-MP3-015 February 24, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 REACTOR COOLANTLOOPS AND COOLANT1CIRCULATION The purpose of Specification 3.4.1.1 is to require adequate forced flow rate for core heat removal in MODES 1 and 2 during all normal operations and anticipated transients. Flow is represented by the number of reactor coolant pumps inoperation for removal of heat by the steam generators. To meet safety analysis acceptance criteria for DNB, four reactor coolant pumps are required at rated power. An OPERABLE reactor coolant loop consists of an OPERABLE reactor coolant pump in operation providing forced flow for heat transport and an OPERABLE steam generator in accordance with Specification 3A45. With less than the required reactor coolant loops in operation this specification requires that the plant be in at least HOT STANDBY within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br />.

In MODE 3, three reactor coolant loops, and in MODE 4, two reactor coolant loops l provide sufficient heat removal capability for removing core decay heat even in the event of a bank withdrawal accident; however, in MODE 3 a single reactor coolant loop provides sufficient heat removal capacity if a bank withdrawal accident can be prevented, i.e., the Control Rod Drive System is not capable ofrod withdrawal.

In MODE 4, if a bank withdrawal accident can be prevented, a single reactor coolant loop or RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two loops (any combination of RHR or RCS) be OPERABLE.

In MODE 5, with reactor coolant loops filled, a single RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two RHR loops or at least one RHR loop and two steam generators be OPERABLE.

In MODE 5 with reactor coolant loops not filled, a single RHR loop provides sufficient beat removal capability for removing decay heat; but single failure considerations, and the unavailability of the steam generators as a heat removing component, require that at least two RHR loops be OPERABLE.

In MODE 5, during a planned heatup to MODE 4 with all RHR loops removed from operation, an RCS loop, OPERABLE and in operation, meets the requirements of an OPERABLE and operating RHR loop to circulate reactor coolant. During the heatup there is no requirement forheat removal capability so the OPERABLE and operating RCS loop meets all of the required functions for the heatup condition. Since failure of the RCS loop, which is OPERABLE and operating, could also cause the associated steam generator to be inoperable, the associated steam generator cannot be used as one of the steam generators used to meet the requirement of LCO 3.4.1.4.1.b.

MILLSTONE - UNIT 3 B 3/4 4-1 Amendment No.6, 0, 99, 4-54, +97, 217,

LBDCR No. 04-MP3-015 February 24, 2005 314.4 REACTOR COOLANT SYSTEM BASES (Continued)

The operation of one reactor coolant pump (RCP) or one RHR pump provides adequate flow to ensure mixing, prevent stratification and produce gradual reactivity changes during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reduction will, therefore, be within the capability of operator recognition and control.

The restrictions on starting the first RCP in MODE 4 below the cold overpressure protection enable temperature (2260F), and in MODE 5 are provided to prevent RCS pressure transients. These transients, energy additions due to the differential temperature between the steam generator secondary side and the RCS, can result in pressure excursions which could challenge the PST limits. The RCS will be protected against overpressure transients and will not exceed the reactor vessel isothermal beltline P/T limit by restricting RCP starts based on the differential water temperature between the secondary side of each steam generator and the RCS cold legs. The restrictions on starting the first RCP only apply to RCPs in RCS loops that are not isolated. The restoration of isolated RCS loops is normally accomplished with all RCPs secured.

If an isolated RCS loop is to be restored when an RCP is operating, the appropriate temperature differential limit between the secondary side of the isolated loop steam generator and the in service RCS cold legs is applicable, and shall be met prior to opening the loop isolation valves.

The temperature differential limit between the secondary side of the steam generators and the RCS cold legs is based on the equipment providing cold overpressure protection as required by Technical Specification 3.4.9.3. If the pressurizer PORVs are providing cold overpressure protection, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50 0F. If any RHR relief valve is providing cold overpressure protection and RCS cold leg temperature is above 150 0F, the steam generator secondary water temperature must be at or below RCS cold leg water temperature. If any RHR relief valve is providing cold overpressure protection and RCS cold leg temperature is at or below 150 0F, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 501F.

Specification 3.4.1.5 The reactor coolant loops are equipped with loop stop valves that permit any loop to be isolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg.

The loop stop valves are used to perform maintenance on an isolated loop. Operation in MODES 1-4 with a RCS loop stop valve closed is not permitted except for the mitigation of emergency or abnormal events. If a loop stop valve is closed for any reason, the required ACTIONS of this specification must be completed. To ensure that inadvertent closure ofa loop stop valve does not occur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and 4.

MILLSTONE - UNIT 3 B 3/4 4-la Amendment No. 60, ;G, 99, 4A, 49, Mn 4,

LBDCR No. 04-MP3-015 February 24,2005 3/4.4 REACTOR COOLANT SYSTEM BASES The safety analyses performed for the reactor at power assume that all reactor coolant loops are initially in operation and the loop stop valves are open. This LCO places controls on the loop stop valves to ensure that the valves are not inadvertently closed in MODES 1,2, 3 and 4.

The inadvertent closure of a loop stop valve when the Reactor Coolant Pumps (RCPs) are operating will result in a partial loss offorced reactor coolant flow. If the reactor is at rated power at the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase in the coolant temperature which could result in DNB with subsequent fuel damage if the reactor is not tripped by the Low Flow reactor trip. If the reactor is shutdown and a RCS loop is in operation removing decay heat, closure of the loop stop valve associated with the operating loop could also result in increasing coolant temperature and the possibility of fuel damage.

The loop stop valves have motor operators. If power is inadvertently restored to one or more loop stop valve operators, the potential exists for accidental closure ofthe affected loop stop valve(s) and the partial loss of forced reactor coolant flow. With power applied to a valve operator, only the interlocks prevent the valve from being operated. Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop stop valve operators. The time period of 30 minutes to remove power from the loop stop valve operators is sufficient considering the complexity of the task.

Should a loop stop valve be closed in MODES 1 through 4, the affected valve must be maintained closed and the plant placed in MODE 5. Once in MODE 5, the isolated loop may be started in a controlled manner in accordance with LCO 3.4.1.6, "Reactor Coolant System Isolated Loop Startup." Opening the closed loop stop valve in MODES 1 through 4 could result in colder water or water at a lowerboron concentration being mixed with the operating RCS loops resulting in positive reactivity insertion. The time period provided in ACTION 3A.1.5.b allows time for borating the operating loops to a shutdown boration level such that the plant can be brought to MODE 3 within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and MODES within 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. The allowed ACTION times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Surveillance Requirement 4.4.1.5 is performed at least once per 31 days to ensure that the RCS loop stop valves are open, with power removed from the loop stop valve operators. The primary function of this Surveillance is to ensure that power is removed from the valve operators, since Surveillance Requirement 4.4.1.1 requires verification every 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> that all loops are operating and circulating reactor coolant, thereby ensuring that the loop stop valves are open. The frequency of 31 days ensures that the required flow is available, is based on engineering judgernent, and has proven to be acceptable. Operating experience has shown that the failure rate is so low that the 31 day frequency is justified..

MILLSTONE - UNIT 3 B 3/4 4-lb Amendment No. 60, X, 99, 41, 49, S, 44*,

LBDCR No. 04-MP3-015 February 24, 2005 314.4 REACTOR COOLANT SYSTEM BASES (Continued)

Specification 3A.1.6 The requirement to maintain the isolated loop stop valves shut with power removed ensures that no reactivity addition to the core could occur due to the startup of an isolated loop.

Verification of the boron concentration in an isolated loop prior to opening the first stop valve provides a reassurance of the adequacy of the boron concentration in the isolated loop.

RCS Loops Filled/Not Filled:

In MODE 5, any RHR train with only one cold leg injection path is sufficient to provide adequate core cooling and prevent stratification of boron in the Reactor Coolant System.

The definition of OPERABILITY states that the system or subsystem must be capable of performing its specified function(s). The reason for the operation of one reactor coolant pump (RCP) or one RHR pump is to:

• Provide sufficient decay heat removal capability

• Provide adequate flow to ensure mixing to:

• Prevent stratification

• Produce gradual reactivity changes due to boron concentration changes in the RCS The definition of "Reactor coolant loops filled" includes a loop that is filled, swept, and vented, and capable of supporting natural circulation heat transfer. This allows the non-operating RHR loop to be removed from service while filling and unisolating loops as long as steam generators on the OPERABLE reactor coolant loops are available to support decay heat removal.

Any loop being unisolated is not OPERABLE until the loop has been swept and vented. The process of sweep and vent will make the previously OPERABLE loops inoperable and the requirements ofLCO 34A.1.A.2, 'Reactor Coolant System, COLD SHUTDOWN - Loops Not Filled," are applicable. When the RCS has been filled, swept and vented using an approved procedure, all unisolated loops may be declared OPERABLE.

One cold leg injection isolation valve on an RHR train may be closed without considering the train to be inoperable, as long as the following conditions exist:

• CCP temperature is at orbelow 950 F

• Initial RHR temperature is below 1841F MILLSTONE - UNIT 3 B 3/4 4-1 c Amendment No. I4-,

LBDCR 04-MP3001 3144 ELA COLATYSTEM BASES (Continued) ..

• The singtc RHR cold leg injection flow path is nt utized until aminximum of24 I.

hours afer reactor shutdown

. CCPflo01satleaCt6,60Bgprn - . '. . t a RHR flovis at least 2,000 gpm lii 11i &lio'e syss'neiifflftos~toteb~ore i eu'cea~ corup to' tlie wwhen two cold legs are in seiviie!. 'ii is dipEc it1 due h it&da i ibe 6n the. flow required for ccoling and the flow ayailable, eve thrug a sighl=l iesfrcclRd Wir. .

I J8

• :rRiiR oat~~k ~ain it ~eW@oo thosde iuaan linc; indlcatis the:*itW notlfc siA 'nit~id'-^E f .the,;Wyi core, so-thiiois iobitnintcaeilcccrn~tio tstfihficahlof:

6 6~r +

.5

.or.6 h,1jc Flow velocity, which is high, is not a concern fiom a flow erosion oy ppe9,load. .n; standpoint. There are no loads imposed on the piping system which wduld-exICe *

'dl-a' experienced in a seistik event. Ike ,ernperature pf.the fluid is lowy.and isoig frbm a flow erionfio ij6int. -- . ,...  :

• The boron dilution accident analysis, for Millstone Unit 3 MODl'S rheas en fui RHR.Syste flow of approximately 4,90O,gpmW Wes at .ou

e.na4yis, Reference,.l fgr R flows at~wn t ;000

! t cjdtan. .Aillrc tin.

a PWR~fld* s.27;t WjhtfyJzeii 4.'046 gpmt~ i~s' no. C~tn"ei rg iist'a botS ,

• ~~~1 0 kiuinien . . .. ; ...- ,4 Ihe basis fPdr the reqtuirnit btvocis .s opera

• circulation hiaiasiAi in Ihe 6vn-flfe opietating His ,.

• I..

two loops swept and vented and two loops air bound, natural bliriiuiii W-r6-d1`be established ini the two swept loops.

.. .Nateairculatio~nwoild hqtd W stiblij ed li. ,obuid Ioojce thereoil.die no circailatiotn tii le;irboufid l&ops, ithere woYbgd b tmec ia foif ,the i aob. be lo'ojpsto carried to the veisis, and subs ietlyifif&(die swegpf li ror hSt sinkeqrcments. .

The LCO is met as long as at least two reactor coolant l6bps ire OPflkBLf and the following conditions are satisfied:

• One RR loop is OPEkABLE and in operation, with cxceptions asa16iowed in Technical Specifications; and I

MILLSTONE - UNIT 3 B 314 4-1d Amendment No,-244,

LBDCR04-MP3-0021 March 25, 2004 3/4.4 REACTOR COOLANT SYSTEM BASES (continued)

For the isolated loop being restored, the power to both loop stop valves has been restored Surveillance 4.4..6.2 indicates that the reactor shall be determined subcritical by at least the amountrequited by Specifications 3.1.1.1.2 or3.1.I.2 forMODE 5 or Specification 3.9.1.1 for MODE 6 within 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> of opening the cold leg or hot leg stop valve.

The SHUTDOWN MARGIN requirement in Specification 3.1.1.1.2 is specified in the Core Operating Limits Report for MODBS with RCS loops filled. Specification 3.1.1.1.2 cnot be used to determine the required SHUTDOWN MARGIN for MODE 5 loops isolated condition.

Specification 3.1.1.2 requires the SHUTDOWN MARGIN to be greater than or equal to the limits specified in the Core Operating iiits Report for MODE 5 with RCS loops not filled provided CVCS is aligned to preclude boron dilution. This specification is for loops not filled and therefore is applicable to an all loops isolated condition.

Specification 3.9.1.1 requires Kefof0.95 orless,oraboronconcentration ofgreaterthanorequal to the limit specified in the COLR in MODE 6.

Specification 3.1.1.1.2 or 3.1.1.2 for MODE 5, both require boron concentration to be determined at least once each 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. SR 4.1.1.12.1.b.2 and 4.1.1.2.1.b.1 satisfy the requirements of Specifications 3.1.1.1.2 and 3.1.1.2 respectfully. Specification 3.9.1.1 for MODE 6 requires boron concentration to be determined at least once each 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />. S.R. 4.9.1.1.2 satisfy the requirements of Specification 3.9.1.1.

References:

1. Letter NEU-94-623, dated July 13, 1994; Mixing Evaluation for Boron Dilution Accident in Modes 4 and 5, Westinghouse HR-59782.

2. Memo No. MP3-E-93-821, dated October 7, 1993.

MILLSTONE - UNIT 3 B 314 4-If AmendmentNo.-244,

LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES 3/4.4.2 SAFETY VAVES The pressurizer Code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 420,000 lbs perhour of saturated steam at the valve Setpoint. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown. If any pressurizer Code safety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statement requires the plant to be shut down and cooled down such that Technical Specification 3 .4.93 will become applicable and require cold overpressure protection to be placed in service.

During operation, all pressurizer Code safety valves must be OPERABLE to prevent the RCS from being pressurized above its Safety Limit of 2750 psia. The combined relief capacity of all of these valves is greater than the maximum surge rate resulting from a complete loss-of-load assuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., no credit is taken for a direct Reactor trip on the'loss-of-load) and also assuming no operation of the power-operated relief valves or steam dump valves.

Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of Section XI of the ASME Boiler and Pressure Code.

314.4.3 PRESSURIZER The pressurizer provides a point in the RCS when liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during load transients.

MODES 1 AND 2 The requirement for the pressurizer to be OPERABLE, with pressurizer level maintained at programmed level within i 6% of full scale is consistent with the accident analysis in Chapter 15 of the FSAR. The accident analysis assumes that pressurizer level is being maintained at the programmed level by the automatic control system, and when in manual control, similar limits are established. The programmed level ensures the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure and pressurizer overfill transients. A pressurizer level control error based upon automatic level control has been taken into account for those transients where pressurizer overfill is a concern (e.g., loss of feedwater, feedwater line break, and inadvertent ECCS actuation atpower). When in manual control, the goal is to maintain pressurizer level at the program level value. Themh 6 % of full scale acceptance criterion in the Technical Specification establishes a band for operation to accommodate variations between level measurements. This value is bounded by the margin applied to the pressurizer overfill events.

MILLSTONE - UNIT 3 B 3/4 4-2 Amendment No. 4-6,497,

LBDCR No. 04-MP3-015 February 24,2005 REACTOR COOLANT SYSTEM BASES 314.4.3 PRESSURIZER (cont'd.)

The 12-hour periodic surveillance requires that during MODE 3 operation, pressurizer level is maintained below the nominal upperlimit to provide a minimum space for a steam bubble. The surveillance is performed by observing the indicated level. The 12-hour interval has been shown by operating practice to be sufficient to regularly assess level for any deviation and to ensure that a steam bubble exists in the pressurizer. Alarms are also available for early detection of abnormal level indications.

The basis for the pressurizer heater requirements is identical to MODES I and 2.

314.4.4 RELIEF VALVES The power-operated relief valves (PORVs) and steam bubble function to relieve RCS pressure during all design transients up to and including the design step load decrease with steam dump. Operation of the PORVs minimizes the undesirable opening of the spring-loaded pressurizer Code safety valves. Each PORV has a remotely operated block valve to provide a positive shutoff capability should a relief valve become inoperable. Requiring the PORVs to be OPERABLE ensures that the capability for depressurization during safety grade cold shutdown is met.

ACTION statements a, b, and c distinguishes the inoperability of the power operated relief valves (PORV). Specifically, a PORV may be designated inoperable but it may be able to automatically and manually open and close and therefore, able to perform its function. PORV inoperability may be due to seat leakage which does not prevent automatic or manual use and does not create the possibility for a small-break LOCA. For these reasons, the block valve may be closed but the action requires power to be maintained to the valve. This allows quick access to the PORV for pressure control. On the other hand if a PORV is inoperable and not capable of being automatically and manually cycled, it must be either restored or isolated by closing the associated block valve and removing power.

Note: PORV position indication does not affect the ability of the PORV to perform any of its safety functions. Therefore, the failure of PORV position indication does not cause the PORV to be inoperable. However, failed position indication of these valves must be restored "as soon as practicable" as required by Technical Specification 6.84.e.3.

Automatic operation of the PORVs is created to allow more time for operators to terminate an Inadvertent ECCS Actuation at Power. The FORVs and associated piping have been demonstrated to be qualified for water relief. Operation of the PORVs will prevent water relief from the pressurizer safety valves for which qualification for water relief has not been demonstrated. If the PORVs are capable of automatic operation but have been declared inoperable, closure of the PORV block valve is acceptable since the Emerg'ency'Operating Procedures provide guidance to assure that the PORVs would be available to mitigate the event.

OPERABILITY and setpoint controls for the safety grade PORV opening logic are maintained in the Technical Requirements Manual.

MILLSTONE - UNIT 3 B 3/4 4-2b Amendment No. 160, 44

• LBDCRNo. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES RELIEF VALVES (Continued)

The prime importance for the capability to close the block valve is to isolate a stuck-open PORV.

Therefore, if the block valve(s) cannot be restored to OPERABLE status within I hour, the remedial action is to place the PORV in manual control (i.e. the control switch in the "CLOSE" position) to preclude its automatic opening for an overpressure event and to avoid the potential of a stuck-open PORV at a time that the blockvalve is inoperable. The time allowed to restore the block valve(s) to OPERABLE status is based upon the remedial action time limits for inoperable PORV per ACTION requirements b. and c. ACTION statement d. does not specify closure of the block valves because such action would not likely be possible when the block valve is inoperable.

For the same reasons, reference is not made to ACTION statements b. and c. for the required remedial actions.

MILLSTONE - UNIT 3 B 3144-2c Amendment No. 88, 460,464-

LBDCR No. 04-MP3-015 February 24,2005 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 314.4.6.1 LEAKAGE DETECION SYSTEMS The RCS Leakage Detection Systems required by this specification are provided to monitor and detect leakage from the reactor coolant pressure boundary. These Detection Systems are consistent with the recommendations of Regulatory Guide I.A5, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973.

LCO 3.4.6.1 .b. Containment Sump Drain Level or Pumped Capacity Monitoring System The intent of LCO 3.4.6.1.b is to have a system able to monitor and detect leakage from the reactor coolant pressure boundary (RCPB). The system can use sump level, pump capacity or both as the LCO implies. It does not have to have two separate systems. The "Containment Drain Sump Level orPumped CapacityMonitoring" System is defined as any one of the following three Systems:

A. 3DAS-P10, Unidentified Leakage Sump Pump, and associated local and main board annunciation.

B. 3DAS-P10, Unidentified Leakage Sump Pump, and computer point 3DAS-L39 and CVLKR2.

C. 3DAS-P2A or 3DAS-P2B, Containment Drains Sump Pump, and computer points 3DAS-L22 and CVLKR2 or CVLKR3I.

To mdeet Regulatory Guide 1.45 recommendations, the Containment Drain Sump Level or Pumped Capacity Monitoring System must meet the following five criteria:

1. Must monitor changes in sump water level, changes in flow rate or changes in the operating frequency of pumps.

2. Be able to detect an UNIDENTIFIED LEAKAGE rate of 1 gpm in less thah one hour.

3. Remain OPERABLE following an Operating Basis Earthquake (OBE).

4. Provide indication and alarm in the Control Room.

5. Procedures for converting various indications to a common leakage equivalent must be available to the Operators.

The three Containment Drain Sump Level or Pumped Capacity Monitoring Systems identified above meet these five requirements as follows:

A. 3DAS-P1O. Unidentified Leakige Sump Pump, and associated main board annunciation.

1. Sump level is monitored at two locations by the starting and stopping of 3DAS-P10, Unidentified Leakage Sump Pump. Flow is measured as a function of time between pump starts/stops and the known sump levels at which these occur.

MILLSTONE - UNIT 3 B 3/4 4-4 AmendmentNo.

LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES 314.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued'

2. Two timer relays in the control circuitry of 3DAS-PI0 are set to identify a 1 gpm leak rate within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACON according to Technical Specifications will be taken. This position has been reviewed by the NRC and documented as acceptable in the Safety Evaluation Report.

4. If the control circuitry of 3DAS-PI0 identifies a I gpm leak rate within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, Liquid Radwaste Panel Annunciator LWS 4-5, CTMT UNIDENT LEAKAGE TROUBLE and Main Board Annunciator MBI B 4-3, RAD LIQUID WASTE SYS TRObJBLE, will alarm. These control circuits and alarms operate independently from the plant process computer.

If the computer is inoperable, these control circuits and alarms meet the Technical Specification requirements for the Containment Drain Sump Level or Pumped Capacity Monitoring System.

5. To convert the unidentified leakage sump pump run times to a leakage rate, use the following formula:

(3DAS-PIO run times in minutes - [numberof 3DAS-P l0 starts x.5 minutes x 20 gpm Elapsed monitored Time in minutes B. 3DAS-P0. Unidentified Leakage Sump Pump. and computer points 3DAS-L39 and QELKR2.

1. Sump level is monitored by 3DAS-LI39, the Unidentified Leakage Sump Level indicator. This level indicatorprovides an input to computer point 3DAS-L39.

2. The plant process computer calculates a leakage rate every 30 seconds when 3DASPIO indicates stop. This leakage rate is displayed via computer Point CVLKR2. When pump P10 does run, the leakage rate calculation is stopped and resumes 10 minutes afler pump Pl0 stops. If it cannot provide a value of the leakage rate within any 54 minute interval, CVDASPIONC (UNDNT LKG RT NOT CALC) alarms which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.

4. A priority computer alam (CVLKR2) is generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. 'This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm MILLSTONE - UNIT 3 B 3/4 4 4a AmendmentNo.

LBDCR No. 044W3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued) value may be set at one gallon per minute or less above the rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the unidentified leakage sump. The rate of IDENTIFIED LEAKAGE may be determined by either measurement or analysis. If the Priority Alarm Point Log is adjusted, the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage rate alarm to be reset. The priority alarm setpoint shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the identified leakage sump level monitoring system alarm operating range which has a maximum setpoint of2.3 gallons per minute.

To convert unidentified leakage sump level changes to leakage rate, use the following formula:

Note: Wait 10 minutes after 3DAS-PIO stops before taking level readings.

.08315gallons x %change in level from 3DAS-L39 1% time between level readings in minutes C. 3DAS-P2A or 3DAS-P2B. Containment Drains Sump Pump. and computer points 3DAS-L22 and CVLKR2 or CVLKR3I.

l. Sump level is monitored by 3DAS-LI22, the Containment Drains Sump Level Indicator. This level indicator provides an input to computerpoint 3DAS-L22.

This method can be used to monitor UNIDENTIFIED LEAKAGE when Pump PIO and its associated equipment is inoperable provided Pump Pl0 is out of service and 3DAS-L139 indicates that the unidentified leakage sump is overflowing to the containment drains sump (approximately 36% level on 3DAS-L139). In this case, CVLKR2 and CVLKR3I monitor flow rate by comparing level indications on the containment drains sump when Pumps PlO, P2A, P2B and P1 are not running.

2. The plant process computer calculates a leakage rate every 30 seconds when 3DAS-PIO, 3DAS-PI, 3DAS-P2A and 3DAS-P2B indicate stop. This leakage rate is displayed via computer points CVLKR3I and CVLKR2 when 3DAS-PI0 is off and when the unidentified leakage sump is overflowing to the containment drains sump. When one of these pumps does run, the leakage rate calculation is stopped and resumes 10 minutes after all pumps stop. If it cannot provide a value of the leakage rate within any 54 minute interval, two -computer - point alarms (CVDASP2NC, UNDNT LKG RT NOT CALC and CVDASP2NC, SMP 3 LKG RT NT CALC) are generated which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.

MILLSTONE - UNIT 3 B 3/4 44b Amendment ND.

LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES 314.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.

4. Two priority computer alarms (CVLKR2 and CVLKR31) are generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon perminute or less above the rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the containment drains sump. The rate of IDENTIMFED LEAKAGE may be determined by either measurement or by analysis. If the Priority Alarm Point Log is adjusted, the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage rate alarm to be reset. The priority alarm setpoint shall be no greater than 2 gallons per minute. This ensures that the IDENT1FIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the containment drains sump level monitoring system alarm operating range which has a maximum setpoint of 2.5 gallons per minute.

5. To convert containment drains sump run times to a leakage rate, refer to procedure SP3670.1 for guidance on the conversion method.

3/4.4.6.2 OPERATIONAL LEAKAGE PRESSURE BOUNDARY LEAKAGE of any magnitude is unacceptable since it may be indicative of an impending gross failure of the pressureboundaxy. Therefore, the presence of any PRESSURE BOUNDARY LEAKAGE requires the unit to be promptly placed in COLD SHUTDOWN.

Industry experience has shown that while a limited amount of leakage is expected from the RCS, the unidentifiedyportion of this leakage can be reduced to a threshold value ofless than I gpm Thie i threshld vluxe1s suffiiently lw to ensure early detection of additional leakage.

The total steam generator tube leakage limit of I gpm for all steam generators not isolated from the RCS ensures that the dosage contribution from the tube leakage will be limited to a small fraction of 10 CFR Part 100 dose guideline values in the event of either a steam generator tube rupture or steam line break. The I gpm limit is consistent with the assumptions used in the analysis of these accidents. The 500 gpd leakage limit per steam generator ensures that steam generator tube integrity is maintained in the event of a main steam line rupture or under LOCA conditions.

MILLSTONE - UNIT 3 B 3144-4c AmendmentNo.

LBDCRNo. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES 314.4.6.2 OPERATIONAL LEAKAGE (Continued)

The 10 gpm IDENTIFIED LEAKAGE limitation provides allowance for a limited amount of leakage from known sources whose presence will not interfere with the detection of UNIDENTIFIED LEAKAGE by the Leakage Detection Systems.

The CONTROLLED LEAKAGE limitation restricts operation when the total flow supplied to the reactor coolant pump seals exceeds 40 gpm with the modulating valve in the supply line fully open at a nominal RCS pressure of 2250 psia. This limitation ensures that in the event of a LOCA, the safety injection flow will not be less than assumed in the safety analyses.

A Limit of 40 gpm is placed on CONTROLLED LEAKAGE. CONTROLLED LEAKAGE is determined under a set of reference conditions, listed below:

a. One Charging Pump in operation.

b. RCS pressure at 2250 +1-20 psia.

By limiting CONTROLLED LEAKAGE to 40 gpm during normal operation, we can be assured that during an SI with only one charging pump injecting, RCP seal injection flow will continue to remain less than 80 gpm as assumed in accident analysis. When the seal injection throttle valves are set with a normal charging line up, the throttle valve position bounds conditions where higher charging header pressures could exist. Therefore, conditions which create higher charging header pressures such as an isolated charging line, or two pumps in service are bounded by the single pump-normal system lineup surveillance configuration. Basic accident analysis assumptions are that 80 gpm flow is provided to the seals by a single pump in a runout condition.

The specified allowable leakage from any RCS pressure isolation valve is sufficiently low to ensure early detection of possible in-series valve failure. It is apparent that when pressure isolation is provided by two in-series valves and when failure of one valve in the pair can go undetected for a substantial length of time, verification ofvalve integrity is required. Since these valves are important in preventing overpressurization and rupture of the ECCS low pressure piping which could result in a LOCA, these valves should be tested periodically to ensure low probability of gross failure.

Steady state operation is required to perform a proper inventory balance since calculations during maneuvering are not useful. For RCS Operational Leakage determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and reactor coolant pump seal injection and return flows.

The Surveillance Requirements for RCS pressure isolation valves provide assurance of valve integrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA. Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be considered as a portion of the allowed limit.

MILLSTONE - UNIT 3 B 3/444d Amendment No. I0,

LBDCR No. 04-MP3-009 December 9,2004 REACTOR COOLANT SYSTEM BASES SPECIFIC ACIEVIT (Continued) for the limits on specific activity represent limits based upon a parametric evaluation by the NRC of typical site locations. These values are conservative in that specific site parameters of the Millstone site, such as SITE BOUNDARY location and meteorological conditions, were not considered in this evaluation.

The ACTION statement permitting POWER OPERATION to continue for limited time periods with the reactor coolant's specific activity greater than 1 microCurie/gram DOSE EQUIVALENT 1-131, but within the allowable limit shown on Figure 3.4-1, accommodates possible iodine spiking phenomenon which may occur following changes in THERMAL POWER.

The sample analysis for determining the gross specific activity and E can exclude the radioiodines because of the low reactor coolant limit of 1 microCurie/gram DOSE EQUIVALENT 1-13 1,and because, if the limit is exceeded, the radiolodine level is to be determined every 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />. If the gross specific activity level and radioiodine level in the reactor coolant were at their limits, the radioiodine contribution would be approximately 1%. In a release of reactor coolant with a typical mixture of radioactivity, the actual radioiodine contribution would probably be about 20%. The exclusion ofradionuclides with half-lives less than 10 minutes from these determinations has been made for several reasons. The first consideration is the difficulty to identify short-lived radionuclides in a sample that requires a significant time to collect, transport, and analyze. The second consideration is the predictable delay time between the postulated release of radioactivity from the reactor coolant to its release to the environment and transport to the SITE BOUNDARY, which is relatable to at least 30 minutes decay time. The choice of 10 minutes for the half-life cutoff was made because of the nuclear characteristics of the typical reactor coolant radioactivity. The radionuclides in the typical reactor coolant have half-lives of less than 4 minutes or half-lives of greater than 14 minutes, which allows a distinction between the radionuclides above and below a half-life of 10 minutes. For these reasons the radionuclides that are excluded from consideration are expected to decay to very low levels before they could be transported from the reactor coolant to the SITE BOUNDARY under any accident condition.

MILLSTONE - UNIT 3 B 3/4 4-6 Amendment No.

LBDCR 3-4-03 May 20, 2004 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)

Steady state thermal conditions exist when temperature increases or decreases are <1 00F in any one hour period and when the plant is not performing a planned heatup or cooldown in accordance with a procedure.

The LCO establishes operating limits that provide a margin to brittle failure, applicable to the ferritic material of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the Pressurizer.

T1he P/T limits have been established for the ferritic materials of the RCS considering ASME Boiler and Pressure Vessel Code Section Xl, Appendix G (Reference 1) as modified by ASME Code Case N-640 (Reference 2), and the additional requirements of 10 CFR 50 Appendix G (Reference 3). Implementation ofthe specific requirements provide adequate margin to brittle fracture of ferritic materials during normal operation, anticipated operational occurrences, and system leak and hydrostatic tests.

The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating PIT limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 6).

The PIT limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive.

At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations may be more restrictive, and thus, the curves are composites of the most restrictive regions.

The heatup curve represents a different set ofrestrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall arereversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.

The PIT limits include uncertainty margins to ensure that the calculated limits are not inadvertently exceeded. These margins include gauge and system loop uncertainties, elevation differences, containment pressure conditions and system pressure drops between the beltline region of the vessel and the pressure gauge or relief valve location.

MILLSTONE - UNIT 3 B 3/44-8 Amendment No. 4, 4-57, I4W,

• . a

• LBDCR04-MP3001 3EAC10L COOIJN EM4 BlASES P- bR.EIM , *t .=E Vioiating th tCQO i splk ' reactor vessIl didt s of hie boutids of he analysea'niccan increas stesses imothirRCPB cooAnts;:t1hcTconb4uieces d6pend on seralfactos, is fatlows: ,

a..'

• haroevetityof the dt.paho 'omwthoattotableop.era ngPt/rrbeime orthe-b.- - ItiteIn~ bf timc fi.& i wore ndolited,(long fiovilatio~ns allow the tempd~entina l

.- hickkyessas-walls toiWcme bec6mried)-gnd

c. The existences, siS,'ind orijttlohs of ffWs in th6 vessel 6atednia APELCBLlY ThenROS Ptr i~mtA dctLye. r-o&vjdes D§ a deOtio1 .00t¢ o.} l pub CtMbtatiF af vpendb G ~oii by Codv Cae eNWOAnd e.i i ¢ kal

• lisaiits weisedevoefi e nptsgU rdurik9eg btopp~r°Y$ ,r.cijdldozk(bODES-3, 4, an~d 5jo'M ttg,2in keingiy (i6 Oouceri fornodfiidtcle failie. The Umits do Dot applytotbeP izei. '  ;..,.. *. * * ...

During MODES 1 and 2, otherTechnical Specifications provide 1imitsforopera.tion thatcan be nior~erestrictive than orcan supplement te PtI/ limits. LCO 3.2;5, 1) .Patametser', ILCO 3.23.1, "RCS Flow Rate and Nuclear EnthalpyRise Rot Channel Factoe'; LCO 3.1.1A,

'Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits,' also provide operational restrictions for pressure.and eierW ture.and m , pressre.

m Furtbermore,

AODES ='d2.tare arboye anhe:teretrege of concern for nondl1c.tilcef'ailu1ndisttess analyses iVa{been pWiformedfi6i noma1 miu'erin profiles; such a nsionor descent.

• AClONS-.

Operation o.utsideihe -E Untits~nidM it.ecorrected sothat the RCPE isretrne2.to.ccndition jhat has beeniveiifles.by stress amalyses. Tlhe Allowmrd Outage Times (AOTs) reflects the, rgency of restoring e parameters t. ivthin thc ahAldrange. Mosl violations will nbt be severe, and the

• activity*c be aconpplisliid Iii Whis timie in a contrfOlled hannir.

Besides restoring operation *ithin linilts an evatuationis required to determine if RCS operation can continue. The evaluation must verifi tbe RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed fansients in the stress analyses, new analyses, or inspection of the components.

mmLISnO4E-UN1T2 B 3/44-10 Amendment No. 4-', 4-,24-7,

LBDCR No. 04-MP3-015 February 24,2005 REACTOR COOLANT SYSTEM BASES pRESSUREflTEMPERTURE LIMITS (continued)

ASME Code,Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT when operating in MODES I through 4 is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.

This evaluation must be completed whenever a limit is exceeded. Restoration within the AOT alone is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

If the required remedial actions are not completed within the allowed times, the plant must be placed in a lower MODE or not allowed to enter MODE 4 because either the RCS remained in an unacceptable P/I region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature.

In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.

If the required evaluation for continued operation in MODES I through 4 cannot be accomplished within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br /> or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in the ACTION statement. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.

Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and to MODE 5 with RCS pressure < 500 psia within the next 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

Completion of the required evaluation following limit violation in other than MODES I through 4 is required before plant startup to MODE 4 can proceed.

The AOTs are reasonable, based on operating experience to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS Verification that operation is within the LCO limits as well as the limits of Figures 3.4-2 and 3.4-3 is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This frequency is considered reasonable in view of the control room indication available to monitor RCS status.

MILLSTONE - UNIT 3 B 3/4 4-11 Amendment No. 48, 89, 4i-, 4I9,

LBDCRNo. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES PRESSURE1IEMPERATURE LIMITS (continued)

Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.

This Surveillance Requirement is only required to be performed during system heatup, cooldown, and ISLH testing. No Surveillance Requirement is given for criticality operations because LCO 3.1.1.4 contains a more restrictive requirement.

It is not necessary to perform Surveillance Requirement 4.4.9.1.1 to verify compliance with Figures 3.4-2 and 3.4-3 when the reactor vessel is fully detensioned. During REFUELING with the head fully detensioned or off the reactor vessel, the RCS is not capable of being pressurized to any significant value. The limiting thermal stresses which could be encountered during this time would be limited to flood-up using RWST water as low as 400 F. It is not possible to cause crack growth ofpostulated flaws in the reactor vessel at normal REFUELING temperatures even injecting 40'F Water.

REFERENCE I. ASME Boiler and Pressure Vessel Code,Section XI, Appendix G."Fracture Toughness for Protection Against Failure,' 1995 Edition.

2. ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughness for Development of P-T Limit Curves," dated February 26, 1999.

3. 10 CFR 50 Appendix G 'Fracture Toughness Requirements."

4. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear PoweriReactor Vessels, E 706."

5. 10 CFR 50 Appendix H, "Reactor Vessel Material Surveillance Program Requirements."

6. Regulatory Guide 1.99 Revision 2, "Radiation Embrittlement of Reactor Vessel Materials," dated May 1988.

7. ASME Boiler and Pressure Vessel Code,Section XI, Appendix E, "Evaluation of Unanticipated Operating Events," 1995 Edition.

MILLSTONE - UNIT 3 B 3/4 4-12 AmendmentNo. 4,415-7,197, 04,

-24,

LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)

The use of a PORV for Cold Overpressure Protection is limited to those conditions when no more than one RCS loop is isolated from the reactor vessel. When two or more loops are isolated, Cold Overpressure Protection must be provided by either the two RHR suction relief valves or a depressurized and vented RCS.

The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to stress at low temperatures (Ref. 3). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause nonductile cracking of the reactor vessel. LCO 3.4.9.1, "Pressureflemperature Limits - Reactor Coolant System," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the limits provided in Figures 3.4-2 and 3.4-3.

This LCO provides RCS overpressure protection by limiting mass input capability and requiring adequate pressure relief capacity. Limiting mass input capability requires all Safety Injection (SIH) pumps and all but one centrifugal charging pump to be incapable of injection into the RCS.

The pressure relief capacity requires either two redundant relief valves or a depressurized RCS and an RCS vent of sufficient size. One relief valve or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.

With minimum mass input capability, the ability to provide core coolant addition is restricted.

'The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the Cold Overpressure Protection modes and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve.

If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriate response will be to correct the situation by starting RCS makeup pumps. If the loss of inventory or SHUTDOWN MARGIN is significant, this may necessitate the use ofadditional RCS makeup pumps that are being maintained not capable of injecting into the RCS in accordance with Technical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION statement requires immediate action to comply with the specification. The restoration of RCS inventory or SHUTDOWN MARGIN can be considered to be part of the immediate action to restore the additional RCS makeup pumps to a not capable of injecting status. While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the P/T limits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumps should be immediately made not capable of injecting and the ACTION statement exited.

MILLSTONE - UNIT 3 B 3/4 4-16 Amendment No. 48, g, 499, 4-5, 1-9-,

LBDCR No. 04-MP3-015 February 24, 2005 REAMFOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued APPLICABLE SAFETY ANALYSIS Safety analyses (Ref. 5) demonstrate that the reactor vessel is adequately protected against exceeding the P/T limits for the analyzed isothermal events. In MODES 1, 2, AND 3, and in MODE 4, with RCS cold leg temperature exceeding 2260 F, the pressurizer safety valves will provide ROS overpressure protection in the ductile region. At 226 0F and below, overpressure prevention is provided bytwo means: (I) two OPERABLE relief valves, or (2) a depressurized ROS with a sufficiently sized RCS vent, consistent with ASME Section XI, Appendix G for temperatures less than RTw4DT+ 50'F. Each of these means has a limited overpressure relief capability.

The required RCS temperature for a given pressure increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the Technical Specification curves.

are revised, the cold overpressure protection must be re-evaluated to ensure its functional requirements continue to be met using the RCS reliefvalve method or the depressurized and vented RCS condition.

Transients capable of overpressurizing the`RCS are categorized as either mass orheat input transients, examples of which follow:

Mass Input Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch Heat Input Transients

a. Inadvertent actuation of Pressurizer heaters;

b. Loss of RHR cooling; or

c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The Technical Specifications ensure that mass input transients beyond the OPERABILITY of the cold overpressure protection means do not occur by rendering all Safety Injection Pumps and all but one centrifugal charging pump incapable of injecting into the RCS whenever an RCS cold leg is *: 2260F.

The Technical Specifications ensure that energy addition transients beyond the OPERABILITY of the cold overpressure protection means do not occur by limiting reactor coolant pump starts.

LCO 3.4.1.4.1, "Reactor Coolant Loops and Coolant Circulation - COLD SHUTDOWN - Loops Filled," LCO 3A.1.4.2, "Reactor Coolant MILLSTONE -UNIT 3 B 3/44-18 Amendment No. 4I,4,

• LBDCR No. 04-MP3-015 February 24,2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued!

Loops and Coolant Circulation - COLD SHUTDOWN - Loops Not Filled," and LCO 3.4.1.3, "Reactor Coolant Loops and Coolant Circulation - HOT SHUTDOWN" limit starting the first reactor coolant pump such that it shall not be started when any RCS loop wide range cold leg temperature is S 226TF unless the secondary side water temperature of each steam generator is

< 501F above each RCS cold leg temperature. The restrictions ensure the potential energy addition to the RCS from the secondary side of the steam generators will not result in an RCS overpressurization event beyond the capability of the COPPS to mitigate. The COPPS utilizes the pressurizer PORVs and the RHR relief valves to mitigate the limiting mass and energy addition events, thereby protecting the isothermal reactor vessel beltline P/T limits. The restrictions will ensure the reactor vessel will be protected from a cold overpressure event when starting the first RCP. If at least one RCP is operating, no restrictions are necessary to start additional RCPs for reactor vessel protection. In addition, this restriction only applies to RCS loops and associated components that are not isolated from the reactor vessel.

The RCP starting criteria are based on the equipment used to provide cold overpressure protection. A maximum temperature differential of 501F between the steam generator secondary sides and RCS cold legs will limit the potential energy addition to within the capability of the pressurizer PORVs to mitigate the transient. The RHR relief valve are also adequate to mitigate energy addition transients constrained by this temperature differenitial limit, provided all RCS cold leg temperature are at or below 150 0F. The ability of the RHR relief valves to mitigate energy addition transients when RCS cold leg temperature is above 1501F has not been analyzed.

As a result, the temperature of the steam generator secondary sides must be at or below the RCS cold leg temperature if the RHR relief valves are providing cold overpressure protection and the RCS cold leg temperature is above 150'F.

MILLSTONE - UNIT 3 B 3/4 4-19 Amendment No. 4i, 49I,

LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued)

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is

• 2260F, in MODE 5, and in MODE 6 when the head is on the reactor vessel. The Pressurizer safety valves provide RCS overpressure protection in the ductile region (i.e. > 226 0F). When the reactor head is off, overpressurization cannot occur.

LCO 3.4.9.1 'Pressure/Temperature Limits" provides the operational PIT limits for all MODES.

LCO 3.4.2, "Safety Valves," requires the OPERABILITY of the Pressurizer safety valves that provide overpressure protection during MODES 1,2, and 3, and 4 when all RCS cold leg temperatures are > 2261F.

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a rapid increase in RCS pressure when little or no time exists for operator action to mitigate the event.

ACTIONS

a. and b.

With two ormore centrifugal charging pumps capable of injecting into the RCS, or with any SIH pump capable of injecting into the RCS, RCS overpressurization is possible.

To immediately initiate action to restore restricted mass input capability to the RCS reflects the urgency ofrernoving the RCS from this condition.

Required ACTION a. is modified by a Note that permits two centrifugal charging pumps capable ofRCS injection for c 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to allow for pump swaps. This is a controlled evolution of short duration and the procedure prevents having two charging pumps simultaneously out of pull-to-lock while both charging pumps are capable of injecting into the RCS.

In MODE 4 when any RCS cold leg temperature is S 226 0F, with one required relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within an allowed outage time (AOT) of 7 days. Two relief valves iniany-coinbin'ation of the PORVs and the-RHR suction relief valves are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component. I MULSTONE-UNIT3 B 3/4 4-23 Amendment No. 457, 49I,

LBDCR No. 04-MP3-015 February 24, 2005 314.5 EMERGENCY CORE COOLiNG SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficient volume of borated water will be immediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.

The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met.

The accumulator power operated isolation valves are required to meet the guidance of "operating bypasses" in the context ofIEEE Std. 279-1971, whichrequires that bypasses of a protective function be removed automaticallywheneverpermissive conditions are not met. The "operating bypass" designed for the isolation valves is applicable to MODES 1, 2, and 3 with Pressurizer pressure above P-1I setpoint. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required.

The limits for operation with an accumulator inoperable for any reason except an isolation valve closed minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be immediately opened, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required.

3/4.5.2 AND 314.5.3 ECCS SUBSYSTEMS The OPERABILITY of two independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event ofa LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long-term core cooling capability in the recirculation mode during the accident recovery period.

With the RCS temperature below 3500 F, one OPERABLE ECCS subsystem is acceptable without single failure consideration and with some valves out of normal injection lineup, on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements.

MILLSTONE - UNIT 3 B 3/4 5-1 Amendment No. 4,

LBDCRNo. 04-MP3-015 February 24, 2005

EMERGENCY CORE COOLING SYSTEMS BASES ECOS SUBSYSTEMS (Continued)

The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support charging pump operation. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off" and "Auto,"

remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g., Safety Injection Signal).

Placing the remote control switch fora Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off" position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions.

The Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the safety analyses are met and that subsystem OPERABILITY is maintained. Surveillance Requirements for throttle valve position stops and flow balance testing provide assurance that proper ECCS flows will be maintained in the event of a LOCA. Maintenance ofproper flow resistance and pressure drop in the piping system to each injection point is necessary to: (1) prevent total pump flow from exceeding runout conditions when the system is in its minimum resistance configuration, (2) provide the proper flow split between injection points in accordance with the assumptions used in the ECCS-LOCA analyses, and (3) provide an acceptable level of total ECCS flow to all injection points equal to or above that assumed in the ECCS-LOCA analyses.

Surveillance Requirement 4.5.2b.1 requires verifying that the ECCS piping is full of water. The ECCS pumps are normally in a standby, nonoperating mode, with the exception of the operating centrifugal charging pump(s). As such, the ECCS flow path piping has the potential to develop voids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to

__the RS full of water ensures that the system will perform properly when required to inject into the RCS.Thiswill-also prevent water hammerpump-cavitation,-and pumping of-noncondensible -- -

gases (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.

This Surveillance Requirement is met by:

VENTING ECCS pump casings and the accessible discharge piping high points including the ECCS pump suction crossover piping (i.e., downstream of valves 3RSS*MV8837A/B and 3RSS*MV8838A/B to safety injection and charging pump suction).

MILLSTONE - UNIT 3 B 3/45-2 Amendment No. 4GI, 44-, 4i&;,

LBDCR No. 04-MP3-015 February24,2005 EMERGENCY CORE COOLING SYSTEMS BASES ECCS SUBSYSTEMS (Continued) 0 VENTING of the nonoperating centrifugal charging pumps at the suction line test connection. The nonoperating centrifugal charging pumps do not have casing vent connections and VENTING the suction pipe will assure that the pump casing does not contain voids and pockets of entrained gases.

• using an external water level detection method for the water filled portions of the RSS piping upstream of valves 3RSS*MV8837A/B and 3RSS*MV8838A[B. When deemed necessary by an external water level detection method, filling and venting to reestablish the acceptable water levels may be performed after entering LCO ACTION statement 3.62.2 since VENTING without isolation of the affected train would result in a breach of the.contaimnent pressure boundary.

The following ECCS subsections are exempt from this Surveillance:

• the operating centrifugal charging pump(s) and associated piping - as an operating pump is self VENTING and cannot develop voids and pockets of entrained gases.

• the RSS pumps, since this equipment is partially dewatered during plant operation.

• the RSS heat exchangers, since this equipment is laid-up dry during plant operation.

• the RSS piping that is not maintained filled with water during plant operation.

Surveillance Requirement 45.2.C.2 requires that the visual inspection of the containment be performed at least once daily if the containment has been entered that day and when the final containment entry is made. This will reduce the number of unnecessary inspections and also reduce personnel exposure.

The Emergency Core Cooling System (ECCS) has several piping cross connection points for use during the post-LOCA recirculation phase of operation. These cross-connection points allow the Recirculation Spray System (RSS) to supply water fromr the containment sump to the safety injection and charging pumps. The RSS has the capability to supply both Train A and B safety injection pumps and both Train A and B charging pumps. Operator action is required to position valves to establish flow from the containment sump through the RSS subsystems to the safety injection and charging pumps since the valves are not automatically repositioned. The quarterly stroke testing (Technical Specification 4.0.5) of the ECCIRSS recirculation flowpath valves discussed below will not result in subsystem inoperability (except due to other equipment manipulations to support valve testing) since these valves are manually aligned in accordance with the Emergency Operating Procedures (EOPs) to establish the recirculation flowpaths. It is expected the valves will be returned to the normal pre-test position following termination of the surveillance testing in response to the accident. Failure to restore any valve to the normal pre-test position will be indicated to the Control Room MILLSTONE - UNIT 3 B 3/4 5-2a Amendment No. 4-IO, 44I, 4i-,

L`BDCR No. 04-MP3-015 February 24, 2005 EMERGENCY CORE COOLTNG SYSTEMS BASES

• EGCS SUBSYSTEMS (Continued)

Operators when the ESF status panels are checked, as directed by the EOPs. The EOPs direct the Control Room Operators to check the ESF status panels early in the event to ensure proper equipment alignment. Sufficient time before the recirculation flowpath is required is expected to be available for operator action to position any valves that have not been restored to the pretest position, including local manual valve operation. Even if the valves are not restored to the pre-test position, sufficient capability will remain to meet ECCS post-LOCA recirculation requirements.

As a result, stroke testing of the ECCS recirculation valves discussed below will not result in a

• loss of system independence orredundancy, and both ECMS subsystems will remain OPERABLE.

When performing the quarterly stroke test of3SIH*MV8923A, the control switch for safety injection pump 3SIH*PIA is placed in the pull-to-lock position to prevent an automatic pump start with the suction valve closed. With the control switch for 3SIH*PlA in pull-to-lock, the Train A ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a.,

applies. This ACTION statement is sufficient to administratively control the plant configuration {

with the automatic start of 3SIH*PIA defeated to allow stroke testing of3SIH*MV8923A. In addition, the EOPs and the ESF status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train B) is fully finctional, as is a significant portion of the Train A subsystem. During the recirculation phase, the Train A RS S subsystem can supply water from the containment sump to the Train A and B charging pumps, and the Train B RSS subsystem can supply water from the containment sump to the B safety injection pump.

When performing the quarterly stroke test of3SIH*MV8923B, the control switch for safety injection pump 3SIH*PIB is placed in the pull-to-lock position to prevent an automatic pump start with the suction valve closed. With the control switch for 3SIH*P1B in pull-to-lock, the Train B ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a.,

applies. This ACTION statement is sufficient to administratively control the plant configuration with the automatic start of 3SIH*PIB defeated to allow stroke testing of 3SIH*MV8923B. In addition, the EOPs and the ESF status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS orRSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional

• equipment failure need be postulated). During the injection MILLSTONE - UNIT 3 B 3/4 5-2b Amendment No. 4004, 44, 4-5,

• LBDCR No. 04-MP3-015 February 24, 2005 EMERGENCY CORE COOIRNG SYSTEMS BASES ECCS Subsystems: AuxiliaryBuilding RPCCW Ventilation Area Temperature Maintenance:

In MODES 1, 2, 3 and 4, two trains of 4 heaters each, powered from class IE power supplies, are required to support charging pump OPERABILITY during cold weather conditions.

These heaters are required whenever outside temperature is less than or equal to 171P.

When outside air temperature is below 170F, if both trains of heaters in the RPCCW Ventilation Area are available to maintain at least 650F in the Charging Pump and Reactor Component Cooling WaterPump areas of the Auxiliary Building, both charging pumps are OPERABLE forMODES 1, 2 and 3.

When outside air temperature is below 170F, if one train ofheaters in the RPCCW Ventilation Area is available to maintain at least 320F in the Charging Pump and Reactor Component Cooling Water Pump areas of the Auxiliary Building, the operating charging pump is OPERABLE, for MODE 4.

With less than 4 OPERABLE heaters in eithertrain, the corresponding train of charging is inoperable. This condition will require entry into the applicable ACTION statement for LCOs 3.5.2 and 3.5.3.

LCO 3.5.2 ACTION statement Wb", and LCO 3.5.3 ACTION statement "c" address special reporting requirements in response to ECCS actuation with water injection to the RCS.

The special report completion isnot a requirement for logging out of the ACTION statements that require the reports.

314.5.4 REFUELING WATER STORAGE TANK The OPERABILITY of the refueling water storage tank (RWSI) as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ensure that: (1) sufficient water is available within containment to permit recirculation cooling flow to the core, and (2) the reactor will remain subcritical in the cold condition following a large break (LB)

LOCA, assuming mixing of the RWST, RCS, ECCS water, and other sources of water that may eventually reside in the sump, with all control rods assumed to be out. These assumptions are consistent with the LOCA analyses.

The contained water volume limit includes an allowance for water not usable because of tank discharge line location orotherphysical characteristics.

The limits on contained water volume and boron concentration of the RWST also ensure a pH value of between 7.0 and 7.5 for the solution recirculated within containment after a LOCA. This pH band minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components.

The maximurriminimilm solution temperatures for the RWST in MODES 1,2,3 and 4 are based on analysis assumptions.

MILLSTONE -UNIT 3 B 3/45-2d Amendment No. 490, I4-7, 4i,

LBDCR 03-MP3-005 December 18,2003 3/4.6 CONTAINMENT SYSTEMS BASES 314.6.1 PRIMARY CONTAINMENT 3/4.6.1.1 CONTATNMENT TNTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with the leakage rate limitation, will limit the SITE BOUNDARY radiation doses to within the dose guidelines of 10 CFR Part 100 during accident conditions and the control room operators dose to within the guidelines of GDC 19.

Primary CONTAINMENT INTEGRITY is required in MODES I through 4. This requires an OPERABLE containment automatic isolation valve system. In MODES 1, 2 and 3 this is satisfied by the automatic containment isolation signals generated by high containment pressure, low pressurizer pressure and low steamline pressure. In MODE 4 the automatic containment isolation signals generated by high containment pressure, low pressurizer pressure and low stearniline pressure are not required to be OPERABLE. Automatic actuation of the containment isolation system in MODE 4 is not required because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating engineered safety features components. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. Since the manual actuation pushbuttons portion of the containment isolation system is required to be OPERABLE in MODE 4, the plant operators can use the manual pushbuttons to rapidly postion all automatic containment isolation valves to the required accident position. Therefore, the containment isolation actuation pushbuttons satisfy the requirement for an OPERABLE containment automatic isolation valve system in MODE 4.

3/4.6.1.2 CONTAINMENJT LEAKAGE The limitations on containment leakage rates, as specified in the Containment Leakage Rate Testing Program, ensure that the total containment leakage volume will not exceed the value assumed in the safety analyses at the peak accident pressure, Pa. As an added conservatism, the measured overall integrated leakage rate is furtherlimited to less than 0.75 La during performance of the periodic test to account for possible degradation of the containment leakage barriers between leakage tests.

The Limiting Condition for Operation defines the limitations on containment leakage.

The leakage rates are verified by surveillance testing as specified in the Containment Leakage Rate Testing Program, in accordance with the requirements of Appendix J. Although the LCO specifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such an exact value for pressure. Consequently, the surveillance testing is performed at a pressure greater than or equal to Pa to account for test instrument uncertainties and stabilization changes. This conservative test pressure ensures that the measured leakage rates MILLSTONE - UNIT 3 B 3/4 61 Amendment No. @9, B9, 4-H, 444, 26, I

LBDCR No. 04-MP3-015 February 24,2005 CONTAINMENT SYSTEMS BASES 314.6.3 CONTAINMENT ISOLATION VALVES The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment and is consistent with the requirements of General Design Criteria 54 through 57 of Appendix A to 10 CFR Part 50. Containment isolation within the time limits specified for these isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA. FSAR Table 6.2-65 lists all containment isolation valves. The addition ordeletion of anycontainmentisolationvalve shall be made in accordance with Section 50.59 of IOCFR50 and approved by the committee(s) as described in the QAP Topical Report.

For the pur poses of meeting this LCO, the safety function of the containment isolation valves is to shut within the time limits assumed in the accident analyses. As long as the valves can shut within the time limits assumed in the accident analyses, the valves are OPERABLE. Where the valve position indication does not affect the operation of the valve, the indication is not required for valve OPERABILITY under this LCO. Position indication for containment isolation valves is covered by Technical Specification 6.8.4.e., Accident Monitoring Instrumentation.

Failed position indication on these valves must be restored "as soon as practicable" as required by Technical Specification 6.8.4.e.3. Maintaining the valves OPERABLE, when position indication fails, facilitates troubleshooting and correction of the failure, allowing the indication to be restored "as soon as practicable."

With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration.

If the containment isolation valve on a closed system becomes inoperable, the remaining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.

However, actions must still be taken to meet Technical Specification ACTION 3.6.3.d and the valve, not normally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the AmON atement Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance.

Closed sstem isolation valves applicable to Technical Specification ACTION 3.6.3.d are included in FSAR Table 6.2-65, and are the isolation valves for those penetrations credited as General Design Criteria 57. The specified time (i.e., 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />) of Technical Specification ACTION 3.6.3.d is reasonable, considering the relative stability of the closec system (hence, reliability) to act as a penetration isolation-boundary and the relative importance of supporting containment OPERABILTIT during MODES 1,2,3 and 4. In the event the affected penetration is isolated in accordance with 3.6.3.d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.l.1.a). This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The frequency of once per 31 days in this surveillance for verifying that each affected penetration flow path is isolated is appropriate considering the valves are operated under administrative controls and the probability of their misalignment is low.

MILLSTONE - UNIT 3 B 3/4 6-3 Amendment No. ;8,63, 442, 2-6,

LBDCRNo. 04-MP3-015 February 24, 2005 CONTAINMENT SYSTEMS BASES For the purposes of meeting this LCO, neither the containment isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve OPERABILITY.

The opening of containment isolation valves on an intermittent basis under administrative controls includes the following considerations: (1)stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment.

The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened or closed. However, it is not necessary to log into any Technical Specification ACTION Statement for these valves, provided the appropriate administrative controls have been established.

Opening a closed containment isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the containment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. The determination of the appropriate administrative controls for containment isolation valves requires an evaluation of the expected environmental conditions. This evaluation must conclude environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of containment through the respective penetration.

When the Residual Heat Removal (RHR) System is placed in service in the plant cooldown mode of operation, the RHR suction isolation remotely operated valves 3RHS*MV8701A and 3RHS*MV8701B, and/or3RHS*MV8702A and 3RHS*MV8702B are opened. These valves are normally operated from the control room. They do not receive an automatic containment isolation closure signal, but are interlocked to prevent their opening if Reactor Coolant System (RCS) pressure is greater than approximately 412.5 psia. When any of these valves are opened, either one of the two required licensed (Reactor Operator) control room operators can be credited as the operator required for administrative control. It is not necessary to use a separate dedicated operator.

3/4.6.4 COMBUSTIBLE GASCONTROL Hydrogen Monitors are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion. Containment hydrogen concentration is also important in verifying the adequacy of mitigating actions. The requirement to perform a hydrogen sensor calibration at least every 92 days is based upon vendor recommendations to maintain sensor calibration. This calibration consists of a two point calibration, utilizing gas containing approximately one percent hydrogen gas for one of the calibration points, and gas containing approximately four percent hydrogen gas for the other calibration point.

MILLFSTONE -UNIT 3 B 314 6-3a Amendment No. A, 6A, 44I, -246,

LBDCR 03-MP3-005 December 18, 2003 CONTAINMENT SYSTEMS BASES 314,6.4 COMBUSTIBLE GAS CONTROL (Continued)

3. Calculate as found slip constant (A)

a. Pin = Pcontainment - APf b.

(scfm easure d- Acc~ura [L14 7 Tc + 460) 3550-([ ] p[i~ 52]

ArPpout x 14.7] - 14.7 1/2 x (147x Tc + 460 1/ 2 (L P';in "n 528 .1

4. Calculate expected postaccident flow rate using A calculated in Step 3.

a. Slip RPM

=A x (4.937)1/2 x 1.218

b. Actual Inlet CFM ACFM = .028 (3550 - Slip RPM)

c. Standard CFM scfm = ACFM 0.725

d. Postaccident scfm Minimum = scfm x 0.95

e. Acceptance Flow Rate Postaccident scfm minimum 2 41.52 scfm.

Table I Accuracy Range (Ref. 2) scfm (measured) Accuracy Range 30to<40 9.13 scfm 40 to < 50 6.98 scWm 50 to < 60 5.81 scWm 60 to < 90 5.17 scfm Table 2 Inlet Piping Loss (Ref. 1) scfm Measured APf (psi)

(Unadjusted) 30 .21 40 .31 50 .52 60 .73 70 .98 80 1.28 NELLSTONE - UNIT 3 B 3/4 6-3c Amendment No. 6, 442, 246,

LBDCR No. 04-MP3-015 February 24, 2005 CONTAINMENT SYSTEMS BASES 314.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)

FSAR Chapter 15, Section 15.6) is based upon a worst-case response time following an SI initiated at the limiting setpoint. One train of the SLCRS in conjunction with the Auxiliary Building Filter (AEF) system is capable of drawing a negative pressure (0.4 inches water gauge at the auxiliary building 24'6" elevation) within 120 seconds after a LOCA. This time includes diesel generator startup and sequencing time, system startup time, and time for the system to attain the required negative pressure after starting.

LQQ In the event of a DBA, one SLCRS is required to provide the minimum postulated iodine removal assumed in the safety analysis. Two trains of the SLCRS must be OPERABLE to ensure that at least one train will operate, assuming that the other train is disabled by a single-active failure. The SLCRS works in conjunction with the ABF system. Inoperability of one train of the ABF system also results in poperability of the corresponding train of the SLCRS. Therefore, wheneverLCO 3.7.9 is entered due to the ABF train A (B) being inoperable, LCO 3.6.6.1 must be entered due to the SLCRS train A (B) being inoperable.

When a SLCRS LCO is not met, it is not necessary to declare the secondary containment inoperable. However, in this event, it is necessary to determine that a loss of safety function does not exist. A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed.

Applicability In MODES 1, 2, 3, and 4, a DBA could lead to a fission product release to containment that leaks to the secondary containment. The large break LOCA, on which this system's design is based, is a full-power event. Less severe LOCAs and leakage still require the system to be OPERABLE throughout these MODES. The probability and severity of a LOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such an accident is low.

In MODES 5 and 6, the probability and consequences of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.

ACTIONS With one SLCRS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The OPERABLE train is capable of providing 100 percent of the iodine removal needs for a DBA. The 7-day Completion Time is based on consideration of such factors as the reliability of the OPERABLE redundant SLCRS train and the low probability of a DBA occurring during this period. The Completion Time is adequate to make most repairs. If the SLCRS cannot e restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not aply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and H( DE 5 within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the requiredplant conditions from full-power conditions in an orderly manner and without challenging plant systems.

MILLSTONE - UNIT 3 B 314 6-5 Amendment No. A, 4A6,

LBDCRNo. 04-MP3-015 February 24, 2005 CONTAINMENT SYSTEMS BASES 314.6.6.2 SECONDARY CONTAINMENT (continued)

In MODES 5 and 6, the probability'and consequences of a DBA are low due to the RCS temperature and pressure limitation in these MODES. Therefore, Secondary Containment is not required in MODES 5 and 6.

ACTIONS In the event Secondary Containment OPERABILITY is not maintained, Secondary Containment OPERABILITY must be restored within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. Twenty-four hours is a reasonable Completion Time considering the limited leakage design of containment and the low probability of a DBA occurring during this time period. Therefore, it is considered that there exists no loss of safety fiinction while in the ACTION Statement.

Inoperability of the Secondary Containment does notimake the SLCRS fans and filters inoperable. Therefore, while in this ACTION Statement solely due to inoperability of the Secondary Containment, the conditions and required ACTIONS associated with Specification 3.6.6.1 (i.e., Supplementary Leak Collection and Release System) are not required to be entered.

I If the Secondary Containment OPERABILITY cannot be restored to OPERABLE status within the required completion time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and to MODE 5 within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant systems.

Surveillance Requirements 4.6.6.2.1 Maintaining Secondary Containment OPERABILITY requires maintaining each door in each access opening in a closed position except when the access opening is being used for normal entry and exit. The normal time allowed for passage of equipment and personnel through each access opening at a time is defined as no more than 5 minutes. The access opening shall not be blocked open. During this time, it is not considered necessary to enter the ACTION statement. A 5-minute time is considered acceptable since the access opening can be quickly closed without special provisions and the probability of occurrence of a DBA concurrent with equipment and/or personnel transit time of 5 minutes is low.

The 31-day frequency for this surveillance is based on engineering judgment and is considered adequate in view of the other indications of access opening status that are available to the operator.

MILLSTONE - UNIT 3 B 3/4 6-8 Amendment No. A, 4A6,

LBDCR No. 04-MP3-015 February 24,2005 PLANT SYSTEMS BASES SAFETY VALVES (Continued) wS = Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steam generator at the highest MSSV opening pressure including tolerance and accumulation, as appropriate, in lb/sec. For example, if the maximum number of inoperable MSSVs on any one steam generator is one, then w8 should be a summation of the capacity of the OPERABLE MSSVs at the highest OPERABLE MSSV operating pressure, excluding the highest capacity MSSV. If the maximum number of inoperable MSSVs per steam generator is three, then we should be a summation of the capacity of the OPERABLE MSSVs at the highest OPERABLE MSSV operating pressure, excluding the three highest capacity MSSVs. The following plant specific safety valve flow rates were used:

SG Safety Main Steam System Valve Number Set Pressure (psia) Flow (ibm/hr per loop)

(Bank No.)___ ____

1 1200 893,160 2 1210 900,607 3 1220 908,055 4 1230 915,502 5 1240 922,950 3/4.7.1.2 AUXILIARY FEEDWATER SYSTEM The OPERABILITY of the Auxiliary Feedwater (AFW System ensures a makeup water supply to the steam generators (SGs) to support decay heat removal from the Reactor Coolant System (RCS) upon the loss of normal feewater supply, assuming the worst case single failure.

The System consists of two motor driven AF! pumps and one steam turbine driven AFW pump. Each motor driven AFW pump provides at least 50/%of the AFW flow capacity assumed in the accident analysis. After reactor shutdown, decay heat eventually decreases so that one motor driven AFW pump can provide sufficient SG makeup flow. The steam driven AFW pump has a rated capacity approximately double that of a motor driven AFW pump and is thus defined as a 100% capacity pump.

Given the worst case single failure, the AFW System is designed to mitigate the consequences of numerous design basis accidents, including Feedwater Line Break, Loss of Normal Feedwater, Steam Generator Tube Rupture, Main Steam Line Break, and Small Break Loss of Coolant Accident.

MILLSTONE - UNIT 3 B 3/4 7-2 Amendment No. 4I9, 4-39, 4-0,

LBDCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM ITNE ISOLATION VALVES (continued)

The accident analysis compares several different SLB events against different acceptance criteria.

The large SLB outside containment upstream of the MSIVs is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB upstream of the MSIV at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSrV to close.

The MSIVs serve only a safety function and remain open during POWVER OPERATION. These valves operate under the following situations:

a. An HELB inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSIVs isolates the break from the unaffected steam generators.

b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.

c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.

d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators. In addition to minimizing radiological releases, this enables the operator to maintain the pressure of the steam generator with the ruptured tube below the MSSV setpoints, a necessary step toward isolating the flow through the rupture.

e. The MSIVs are also utilized during other events, such as a feedwater line break. This event is less limiting so far as MSIV OPERABILITY is concerned.

iAILLSTONE - UNIT 3 B 3/47o4 Amendment No. 4-9,436,

LBDCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.6 STEAM GENERATOR ATMOSPHERIC RELIEF BYPASS LENES The OPERABILITY of the steam generator atmospheric relief bypass valve (SGARBV) lines provides a method to recover from a steam generator tube rupture (SGTR) event during which the operator is required to perform a limited cooldown to establish adequate subcooling as a necessary step to limit the primary to secondary break flow into the ruptured steam generator.

The time required to limit the primary to secondary break flow for an SGTR event is more critical than the time required to cooldown to RHR entry conditions. Because of these time constraints, these valves and associated flow paths must be OPERABLE from the control room. The number of SGARBVs required to be OPERABLE from the control room to satisfy the SGIR accident analysis requires consideration of single failure criteria. Four SGARBV are required to be OPERABLE to ensure the credited steam release pathways available to conduct a unit cooldown following a SG-RM For other design events, the SGARBVs provide a safety grade method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the steam bypass system or the steam generatoratrnospheric reliefvalves be unavailable. Prior to operatoraction to cooldown, the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below design limits.

Each SGARBV line consists of one SGARBV and an associated block valve (main steam atmospheric relief isolation valve, 3MSS*MOVI8AJB/C/D). These block valves are used in the event a steam generator atmospheric relief valve (SGARV) or SGARBV fails to close. Because of the electrical power relationship between the SGARBV and the block valves, ifa block valve is maintained closed, the SGARBV flow path is inoperable because of single failure consideration.

The bases for the required ACTIONS can be found in NUREG 1431, Rev. 1.

The LCO APPLICABILITY and ACTION statements uses the terms 'MODE 4 when steam generator is relied upon for heat removal" and "in MODE 4 without reliance upon steam generator for heat removal." This means that those steam generators which are credited for decay heat removal to comply with LCO 3.4.1.3 (Reactor Coolant System, HOT SHUTDOWN) shall have an OPERABLE SGARBV line. SeeBases Section 314.4.1 for more detail.

314.7.2 DELETED MILLSTONE - UNIT 3 B 3/47-7 Amendment No. 4136, 44, 44, 44,

LBDCR 3-22-02 March 14, 2002 PLANT SYSTEMS BASES 3/4.7.3 REACTOR PLANT COMPONENT COOLING WATER SYSTEM The OPERABILITY of the Reactor Plant Component Cooling Water System ensures that sufficient cooling capacity is available for continued operation ofsafety-related equipment during normal and accident conditions. The redundant cooling capacity ofthis system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support reactor plant component cooling water pump operation. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing I00% of the required flow. Each train has a two position, "Off' and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic Start signals (e.g., Safety Injection Signal).

• Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off"position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions.

3/4.7.4 SERVICE WATER SYSBEM The OPERABILITY of the Service Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

An OPERABLE service water loop requires one OPERABLE service waterpump and associated strainer. Two OPERABLE service water loops, with one OPERABLE service water pump and associated strainer per loop, will provide sufficient core (and containment) decay heat removal during a design basis accident coincident with a loss of offsite power and a single failure.

MILLSTONE - UNIT 3 B 314 7-7a Amendment No. i4,

LBDCRNo. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES ACIONSTATEMENI When the UHS temperature is above 750F, the ACTION Statement for the LCO requires that the UHS temperature be monitored for 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br />, and the plant be placed in at least HOT STANDBY within the next six hours and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br /> in the event the UHS temperature does not drop below 750F during the 12-hour monitoring period.

The 12-hour interval is based on operating experience related to trending of the parameter variations during the applicable MODES. During this period, the UHS temperature will be monitored on an increased frequency. If the trend shows improvement, and if the trend of the UHS temperature gives reasonable expectations that the temperature will decrease below 75OF during the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> monitoring period, the UHS temperature will be continued to be monitored during the remaining portion of the 12-hour period. However, if it becomes apparent that the UHS temperature will remain above 751Fthroughout the 12-hour monitoring period, conservative action regarding compliance with the ACTION Statement should be taken.

An evaluation was conducted to qualify the risk significance of various Chapter 15 initiating events and earthquakes during periods of elevated UHS temperature. It concluded that a seismic event was not credible for the time periods with elevated UHS temperature.

With respect to the service water loads, the limiting Condition HI and III Chapter 15 event initiators are those that add additional heat loads to the service water system. A loss of offisite power event is limiting because of the added loads due to the diesel generator and the residual heat removal heat exchanger. A steam generator tube rupture event is limiting because of the addition of the safety injection and diesel generator loads without isolation of the turbine plant component cooling water loads (no loss of offsite power or containment depressurization actuation signal). Although the risk significance of a Condition IV accident occurring during the period of elevated UHS temperature is considered to be negligibly small compared to that of Condition II and III events, aLoss of Coolant Accident with or without a LOP was also evaluated.

These scenarios have been evaluated with the additional consideration of a single failure. The evaluation investigated whether or not these events could be resolved with an elevated UHS temperature. It was determined that Millstone Unit No. 3 could recover from these events, even with an elevated temperature of 770F.

This evaluation provides the basis for the ACTION statement requirement to place the plant in HOT STANDBY within six hours and in COLD SHUTDOWN within the next 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />, ifthe UHS temperature goes above 770 F during the 12-hour monitoring period.

MILLSTONE - UNIT 3 B 3/47-9 Amendment No. 4136,

LBDCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES SURVEILLANCE REQUIRMEWS For the surveillance requirements, the UHS temperature is measured at the locations described in the LCO write-up provided in this section.

Surveillance Requirement 4.7.5.a verifies that the LTHS is capable of providing a 30-day cooling water supply to safety-related equipment without exceeding its design basis temperature. The 24-hour frequency is based on operating experience related to trending of the parameter variations during the applicable MODES. This surveillance requirement verifies that the average water temperature of the UHS is less than or equal to 750F.

Surveillance Requirement 4.7.5.b requires that the UHS temperature be monitored on an increased frequency whenever the UHS temperature is greater than 700 F during the applicable MODES. The intent of this Surveillance Requirement is to increase the awareness of plant personnel regarding UHS temperature trends above 700F. The frequency is based on operating experience related to trending of the parameter variations during the applicable MODES.

314.7.6 DELETED 314.7.7 CONTROL ROOM EMERGENCYVENTLATnON SYSTEM BACKGROUND The control room emergency ventilation system provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity. Additionally, the system provides temperature control for the control room during normal and post-accident operations.

The control room emergency ventilation system is comprised of the control room emergency air filtration system and a temperature control system.

The control room emergency air filtration system consists of two redundant systems that recirculate and filter the control room air. Each control room emergency air filtration system consists of a moisture separator, electric heater, prefilter, upstream high efficiency particulate air (HEPA) filter, charcoal adsorber, downstream HIEPA filter, and fan. Additionally, ductwork, valves or dampers, and instrumentation form part of the system.

Normal Operation A portion of the control room emergency ventilation system is required to operate during normal operations to ensure the temperature of the control room is maintained at or below 951F.

MILLSTONE - UNIT 3 B 3/4 7-1 0 Amendment No. 449, 4A6,444, p44,

LBDCR 05-MP3-003-April 1,2005 PLANT SYSTEMS BASES 314.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

BACKGROUND (Continued)

Post Accident Operation The control room emergency ventilation system is required to operate during post-accident operations to ensure the temperature of the control room is maintained and to ensure the control room will remain habitable during and following accident conditions.

The following sequence of events occurs upon receipt of a control building isolation (CBI) signal or a signal indicating high radiation in the air supply duct to the control room envelope.

1. The control room boundary is isolated to prevent outside air from entering the control room to prevent the operators from being exposed to the radiological conditions that may exist outside the control room. The analysis for a loss of coolant accident assumes that the highest releases occur in the first hour after a loss of coolant accident.

2. After 60 seconds, the control room envelope pressurizes to 1/8 inch water gauge by the control room emergency pressurization system. This action provides a continuous PURGE of the control room envelope and prevents inleakage from the outside environment. Technical Specification 3/4.7.8 provides the requirements for the control room envelope pressurization system.

3. Control room pressurization continues for the first hour.

4. After one hour, the control room emer$ency ventilation system will be placed in service in the filtered pressurization mode (outside air is diverted through the filters to the control room envelope to maintain a positive pressure). To run the control room emergency air filtration system in the filtered pressurization mode, the air supply line must be manually opened.

APPLICABLE SAFETY ANALYSIS The OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty ratm&for the equipment and instrumentation cooled by this system, and (2)the control room will remain habitable for operations personnel during and following all credible accident conditions. The OPERABILITY of this system in conjunction with control room design provisions isbased on limiting the radiation exposure to personnel occupying the control room. For all postulated designbasis accidents except a Fuel Handling Accident, the radiation exposure to personnel occupying the control room shall be 5 rem or less whole body, or its equivalent for the duration of the accident, consistent with the requirements of General Design Criterion 19 of Appendix "A,"

10 CF:R 50. For a Fuel Handling Accident, the radiation exposure to personnel occupying the control room shall be 5 rem TDE or less, consistent with the requirements of 10 CF 50.67.

This limitation is consistent withthe requirements of General Design Criterion 19 of Appendix A, 10 CFR Part S0.

MILLSTONE - UNIT 3 B 3/4 7-11 Amendment No. 4-i, 24-9,

LBDCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

LiITING CONDITION FOR OPERATION Two independent control room emergency air filtration systems are required to be OPERABLE to ensure that at least one is available in the event the other system is disabled.

A control room emergency air filtration system is OPERABLE when the associated:

a. Fan is OPERABLE;

b. HEPA filters and charcoal adsorbers are not excessively restricting flow and are capable of performing their filtration functions; and

c. moisture separator, heater, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

The integrity of the control room habitability boundary (i.e., walls, floors, ceilings, ductwork, and access doors) must be maintained such that the control building habitability zone can be maintained at its design positive pressure ifrequired to be aligned in the filtration pressurization mode. However, the LCO is modified by a footnote allowing the control room boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in constant communication with the control room. This individual will have a method to rapidly close the opening when a need for control room isolation is indicated.

APPLICABILiTY In MODES 1,2,3,4,5, and 6.

During fuel movement within containment or the spent fuel pool.

ACTIONS a., b., and c. of this specification are applicable at all times during plant operation in MODES 1,2,3, and 4. ACTIONS d. and e. are applicable in MODES 5 and 6, and whenever fuel is being moved within containment or the spent fuel pool. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged. Therefore, the movement of either new or irradiated fuel (assemblies or individual fuel rods) can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment or the storage pool.

MILLSTONE - UNIT 3 B 3/4 7-12 Amendment No. 436, M, 249,

LBDCRNo. 04-MPO-015 February 24,2005 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

ACTIONS MODES l. 2. 3. and 4

a. With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. In this condition, the remaining control room emergency air filtration system is adequate to perform the control room protection function. However, the overall reliability is reduced because a single failure in the OPERABLEtrain could result in a loss of the control room emergency air filtration system function. The 7-day completion time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability.

If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unit must be placed in at least HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. These completion times are reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems.

b. With both control room emergency air filtration systems inoperable, except due to an inoperable control room boundary, the movement of fuel within the spent fuel pool must be immediately suspended. At least one control room emergency air filtration system must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. These completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

c. With both control room emergency air filtration systems inoperable due to an inoperable control room boundary, the movement of fuel within the spent fuel pool must be immediately suspended. The control room boundary must be restored to OPERABLE status within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, or the unit must be inHOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

If the control room boundary is inoperable in MODES 1,2, 3, and 4, the control room emergency air filtration systems cannot perform their intended functions. Actions must be taken to restore an OPERABLE control room boundary within 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />. During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent ofGDC 19) should be utilized to protect control room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplanned measures should be MILLSTONE - UNIT 3 B 3/4 7-13 Amendment No. A-6, I0a, 24-9,

• LBDCRNo. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES 3f4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

ACTIONS (Continued) available to address these concerns for intentional and unintentional entry in to this condition. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed outage time is a typically reasonable time to diagnose, plan, and possibly repair, and test most problems with the control room boundary.

MODES 5 and 6. and fuel movement within containment or the spent fuel pool

d. With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. After 7 days, either initiate and maintain operation of the remaining OPERABLE control room emergency air filtration system in the recirculation mode or suspend the movement of fuel. Initiating and maintaining operation of the OPERABLE train in the recirculation mode ensures:

(i) OPERABILITY of the train will not be compromised by a failure of the automatic actuation logic; and (ii) active failures will be readily detected.

e. With both control room emergency air filtration systems inoperable, or with the train required by ACION 'd' not capable of being powered by an OPERABLE emergency power source, actions mustbe taken to suspend all operations involving the movement of fuel. This action places the unit in a condition that minimizes risk. This action does not preclude the movement of fuel to a safe position.

SURVEILLANCE REQUIREMENTS 477.a The control room environment should be checked periodically to ensure that the control room temperature control system is functioning properly. Verifying that the control room air temperature is less than or equal to 950F at least once per 12 hours0.5 days <br />0.0714 weeks <br />0.0164 months <br /> is sufficient. It is not necessary to cycle the control room ventilation chillers. The control room is manned during operations covered by the technical specifications. Typically, temperature aberrations will be readily apparent.

4.7.72b Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing the trains once every 31 days on a STAGGERED TEST BASIS provides an adequate check of this system. This surveillance requirement verifies a system flow rate of 1,120 cfmn 20%.

Additionally, the system is required to operate for at least 10 continuous hours with the heaters energized. These operations are sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters due to the humidity in the ambient air.

MILLSTONE - UNIT 3 B 3/47-13 a Amendment No. 436, 48, I, I49,

LBDCR 05-MP3-003 April 1,2005 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

SURVEILLANCE REUMENTS (Continued)

During the first hour, the control room pressurization system creates and maintains the positive pressure in the control room. This capability is verified by Surveillance Requirement 4.7.8.C, independent of Surveillance Requirement 4.7.7.e.2. A CBI signal will automatically align an operating filtration system into the recirculation mode of operation due to the isolation of the air supply line to the filter.

After the first hour of an event with the potential for a radiological release, the control room emergency ventilation system will be aligned in the filtered pressurization mode (outside air is diverted through the filters to the control room envelope to main.tain a positive pressure).

Alignment to the filtered pressurization mode requires manual operator action to open the air supply line.

4a.7.7.e.3 This surveillance verifies that the heaters can dissipate 9.4 4 I kW at 480V when tested in accordance with ANSI N510-1980. The frequency is at least once per 24 months. The heater kW measured must be corrected to its nameplate rating. Variations in system voltage can lead to measurements ofkW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.

4.7.7.f Following the complete or partial replacement of a HEPA filter bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfies the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N510-1980 fora DOP test aerosol while operating the system at a flow rate of 1,120 cfm A 20%.

MlLLSTONE -UNIT 3 3/4 7-16 Amendment No. 4-6, I, 26,

L3DCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

SURVEILLANCE REQUIREMENTS (Continued) 4.7.7.g Following the complete or partial replacement of a charcoal adsorber bank the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfied the in-place Penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N510-1910 for a havogenated hydrocarbon refrigerant test gas while operating the system at a flow of 1,120 cfm + 20%.

References:

(1) Nuclear Regulatory Guide 1.52, Revision 2 (2) MP3 UFSAR, Table 1.8-1, NRC Regulatory Guide 1.52 (3) NRC Generic Letter 91-04 (4) Condition Report (CR) NM3-99-0271 3/4.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM BACKGROUND The control room envelope pressurization system provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity.

The control room envelope pressurization system consists of two banks of air bottles with its associated piping, instrumentation, and controls. Each bank is cajable of providing the control room area with one-hour of air following any event with the potential for radioactive releases.

Control Room Envelope OPERABTLITY is satisfied while:

• Door 352 (C-49-1) is closed (East door)

• Door 351 (C-47-1) is closed, but IA, ATD/Missile Shield, is nmt closed (West doors)

Normal Operation During normal operations, the control room envelope pressurization system is required to be on standby.

Post Accident Operation The control room envelope pressurization system is required to operate-during post-accident operations to ensure the control room will remain habitable during and following accident conditions.

The sequence of events which occurs upon receipt of a control building isolation (CBI) signal or a signal indicating high radiation in the air supply duct to the control room envelope is described in Bases Section 3/4.7.7.

MILLSTONE - UNIT 3 B33/4 7-17 Amendment No. 4,

LBDCRNo. 04-MP3-015 February 24,2005 PLANT SYSTEMS BASES 314.7.8 CONTROL ROOM ENVELOPE PRESSURIZATION SYSTEM (Continued)

APPLICABLE SAFETY ANALYSIS The OPERABILITY of the control room envelope pressurization system ensures that:

(1) breathable air is supplied to the control room, instrumentation rack room, and computer room, and (2) a positive pressure is created and maintained within the control room envelope during control building isolation for the first hour following any event with the potential for radioactive releases. Each system is capable of providing an adequate air supply to the control room for one hour following an initiation of a control building isolation signal. After one hour, operation of the control room emergency ventilation system would be initiated.

LTMITING CONDITION FOR OPERATION Two independent control room envelope pressurization systems are required to be OPERABLE to ensure that at least one is available in the event the other system is disabled.

A control room envelope pressurization system is OPERABLE when the associated:

a. air storage bottles are OPERABLE; and

b. piping and valves are OPERABLE.

The integrity of the control room habitability boundary (i.e., walls, floors, ceilings, ductwQrk, and access doors) must be maintained. However, the LCO is modified by a footnote allowing the control room boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in constant communication with the control room. This individual will have a method to rapidly close'the opening when a need for control room isolation is indicated.

MILLSTONE - UNIT 3 B 3/4 7-18 Amendment No. 46, M, A4-9,

LBDCRNo. 04-MP3-015 February 24,2005 PLANT SYSTEMS BASES 314.7.8 CONTROL ROOM ENVELOPE PRESSURJZATION SYSTEM (Continued)

APPLICABILITY In MODES 1,2,3,4,5, and 6.

During fuel movement within containment or the spent fuel pool.

ACTIONS a., b., c., and d. of this specification are applicable at all times during plant operation in MODES 1, 2,3, and 4. -ACTIONS e. and f. are applicable in MODES 5 and 6, and whenever fuel is being moved within containment or the spent fuel pool. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel that is impacted upon is damaged. Therefore, the movement of either new or irradiated fuel (assemblies or individual fuel rods) can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment or the storage pool.

ACTIONS MODES 1, 2, 3, and 4

a. With one control room envelope pressurization system inoperable, action must be taken either to restore the inoperable system to an OPERABLE status within 7 days, or place the unit in HOT STANDBY within six hours and COLD SHUTDOWN within the next 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />.

The remaining control room envelope pressurization system is adequate to perform the control room protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room envelope pressurization system. The 7-day completion time is based on the low probability of a design basis accident occurring during this time period and the ability of the remaining train to provide the required capability.

The completion times for the unit to be placed in HOT STANDBY and COLD SHUTDOWN are reasonable. They are based on operating experience, and they permit the unit to be placed in the required conditions from full power conditions in an orderly manner and without challenging unit systems.

b. With both control room envelope pressurization systems inoperable, except due to an inoperable control room boundary or during performance of Surveillance Requirement 4.7.8.c, the movement of fuel within the spent fuel pool must be immediately suspended.

At least one control room envelope pressurization system must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, or the unit must be in HOT STANDBY within the next 6 hours0.25 days <br />0.0357 weeks <br />0.00822 months <br /> and in COLD SHUTDOWN within the following 30 hours1.25 days <br />0.179 weeks <br />0.0411 months <br />. These completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

MILLSTONE - UNIT 3 B 3/4 7-19 AmendmentNo. 46, M, 49,

LBDCR No. 04-MP3-015 February 24, 2005 PLANT SYSTEMS BASES LCO 3.7.9 ACTION statement:

With one Auxiliary Building Filter System inoperable, restoration to OPERABLE status within 7 days is required.

The 7 days restoration time requirement is based on the following: The risk contribution is less for an inoperable Auxiliary Building Filter System, than for the charging pump or reactor plant component cooling water (RPCCW) systems, which have a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> restoration time requirement. The Auxiliary Building Filter System is not a direct support system for the charging pumps orRPCCW pumps. Because the pump area isa common area, and as long as the other train of the Auxiliary Building Filter System remains OPERABLE, the 7 day restoration time limit is acceptable based on the low probability of a DBA occurring during the time period and the ability of the remaining train to provide the required capability. A concurrent failure of both trains would require entry into LCO 3.03 due to the loss of functional capability. The Auxiliary Building Filter System does support the Supplementary Leak Collection and Release System (SLCRS) and the LCO ACTION statement time of 7 days is consistent with that specified for SLCRS (See LCO 3.6.6.1).

Surveillance Requirement 4.7.9.c Surveillance requirement 4.7.9.c requires that after 720 hours30 days <br />4.286 weeks <br />0.986 months <br /> of operation a charcoal sample must be taken and the sample must be analyzed within 31 days after removal.

The 720 hours30 days <br />4.286 weeks <br />0.986 months <br /> of operation requirement originates from Regulatory Guide 1.52, Revision 2, March 1978, Table 2, Note "c", which states that 'Testing should be performed (1) initially, (2) at least once per 18 months thereafter for systems maintained in a standby status or after 720 hours30 days <br />4.286 weeks <br />0.986 months <br /> ofsystem operations, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system." This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits as well as providing trending data. The 720 hour0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> figure is an arbitrary number which is equivalent to a 30 day period. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normally in operation and sample canisters are typically removed due to the 18 month criteria.

3L4.7.10 SNJBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the Reactor Coolant System and all other safety-related systems is maintained during and following a seismic or other event initiating dynamic loads. For the purpose of declaring the affected system OPERABLE with the inoperable snubber(s), an engineering evaluation may be performed, in accordance with Section 50.59 of 10 CFR Part 50.

Snubbers are classified and grouped by design and manufacturer but not by size.

Snubbers of the same manufacturer but having different internal mechanisms are classified as different types. For example, mechanical snubbers utilizing the same design features of the 2-kip, 10-kip and 100-kip capacity MILLSTONE - UNIT 3 B 3/4 7-23a Amendment No. 84, 449946, 484,

LBDCR No. 04-MP3-015 February 24, 2005 314.8 ELECTRICAL POWER SYSTEMS BASES 3/4.8.1. 3/4.8.2 and 3/4.8.3 A.C. SOURCES. D.C. SOURCES. and ONSITE POWER DISTRIBUTION The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix A to 10 CFR Part 50.

LCO 3.8.1.1.a LCO 3.8.1.1.a requires two independent offsite power sources. With both the RSST and the NSST available, either power source may supply power to the vital busses to meet the intent of Technical Specification 3.8.1.1. The FSAR, and Regulatory Guide 1.32, 1.6, and 1.93 provide the basis for requirements concerning off-site power sources. The basic requirement is to have two independent offsite power sources. The requirement to have a fast transfer is rot specifically stated. An automatic fast transfer is required for plants without a generator output trip breaker, where power from the NSST is lost on a turbine trip. The surveillance requirement for transfer from the normal circuit to the alternate circuit is required for a transfer from the NSST to the RSST in the event of an electrical failure. There is no specific requirement to have an automatic transfer from the RSST to the NSST.

The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation.

The OPERABILITY of the power sources are consistent with the initial condition assumptions of the safety analyses and are based upon maintaining at least one redundant set of onsite A.C. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss-of-offsite power and single failure of the other onsite A.C.

source. The A.C. and D.C. source allowable out-of-service times are based in part on Regulatory Guide 1.93, "Availability of Electrical Power Sources," December 1974. Technical Specification 3.8.1.1 ACTION Statements b.2 and c.2 provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel generator does not exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1.1 2.a.5 does not have to be performed. If the cause of inoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement e. would be entered, and appropriate actions will be taken. Once the failure is corrected, the common cause failure no longer exists, and the required ACTION Statements (b., c., and e.) will be satisfied.

If it can not be determined that the cause of the inoperable diesel generator does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1 .2.a.5, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evaluation is no MILLSTONE-UNIT3 B 3/48-1 Amendment No. 4a2, a,

LBDCR No. 04-MP3-015 February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES longer under the time constraint imposed while in ACTION Statements b.2 or c.2.

The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to:

1. Preplanned preventative maintenance or testing; or

2. An inoperable support system with no potential common mode failure for the remaining diesel generator; or

3. An independently testable component with no potential common mode failure for the remaining diesel generator.

When one diesel generator is inoperable, there is an additional ACTION requirement (b.3 and c.3) to verify that all required systems, subsystems, trains, components and devices, that depend on the remaining OPERABLE diesel generator as a source of emergency power, are also OPERABLE, and that the steam-driven auxiliary feedwater pump is OPERABLE. This requirement is intended to provide assurance that a loss-of-offsite power event will not result in a complete loss of safety function of critical systems during the period one of the diesel generators is inoperable. The tern, verify, as used in this context means to administratively check by examining logs or other information to determine if certain components are out-of-service for maintenance or other reasons. It does not mean to perform the Surveillance Requirements needed to demonstrate the OPERABILITY of the component.

If one Millstone UnitNo. 3 diesel generator is inoperable in MODES 1 through 4, a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed outage time is provided by ACION Statement b.5 to allow restoration of the diesel generator, provided the requirements of ACTION Statements b.l, b.2, and b3 are met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 2 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 2 Technical Specification (2 diesel generators in MODES I through 4, and 1 diesel generator in MODES 5 and 6i and the Millstone Unit No. 3 SBO diesel generator is available.

The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 2 diesel generators and the Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 2 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator.

When using the 14 day allowed outage time provision and the Millstone Unit No. 2 diesel generator requirements and/orMillstone Unit No. 3 SBO diesel generator requirements are not met, 72 hours3 days <br />0.429 weeks <br />0.0986 months <br /> is allowed for restoration of the required Millstone Unit No. 2 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 2 diesel generators and/or Millstone Unit No. 3 SBO diesel generator are not restored within 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />, and one Millstone Unit No. 3 diesel generator is still inoperable, Millstone Unit No. 3 is required to shut down.

MILLSTONE - UNIT 3 B 3/4 8 1a Amendment No. 44A, 2A0,

LBDCR No. 04-MP3-015 February 24,2005 3/4.8 -ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 3 diesel generator will allow perfiormance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional Millstone Unit No. 3 requirements must be met:

1) The charging pump and charging pump cooling pump in operation shall be powered from the bus not associated with the out of service diesel generator. In addition, the spare charging pump will be available to replace an inservice charging pump if necessary.

2) The extended diesel generator outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.

3) The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within 30 days prior to allowing a Millstone Unit No. 3 EDG to be inoperable for greater than 72 hours3 days <br />0.429 weeks <br />0.0986 months <br />.

4) All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

5) A contingency plan shall be available (OP 3314J, Auxiliary Building Emergency Ventilation and Exhaust) to provide alternate room cooling to the charging and CCP pump area (24'6" Auxiliary Building) in the event of a failure of the ventilation system prior to commencing an extended diesel generator outage.

In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with the Configuration Risk Management Program, as required by 10 CFR 50.65(a)(4).

The OPERABILITY of the minimum specified A.C. and D.C. power sources and associated distribution systems during shutdown and REFUELING ensures that: (1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods, and (2) sufficient instrumentation and control capability is available for monitoring and maintaining the unit status.

The Surveillance Requirements for demonstrating the OPERABILITY of the diesel generators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection of Diesel Generator Set Capacity for Standby Power Supplies," March 10, 1971; 1.108, 'Teriodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," Revision 1,August 1977; and 1.137, "Fuel-Oil Systems for Standby Diesel Generators,"

Revision 1,October 1979.

LCO 3.8.1.1 ACTION statement b.3 and c.3 Required ACTION Statement b3 and c.3 requires that all systems, subsystems, trains, components, and devices that depend on the remaining OPERABLE diesel as a source of emergency power be verified OPERABLE.

MILLSTONE - UNIT 3 B 3/4 8-lb Amendment No. 44-2, M40,

LBDCR No. 04-MP3-009 December 9,2004 314.8 ELECTRJCAL POWER SYSTEMS BASES 3/4.8.1. 3/4.8.2. and 3/4.8.3 A.C. SOURCES. D.C. SOURCES. AND ONSITE POWER DISTRIBUTION Technical Specification 3.8.1.1.b.1 requires each of the diesel generator day tanks contain a minimum volume of 278 gallons. Technical Specification 3.8.1.2b.1 requires a minimum volume of 278 gallons be contained in the required diesel generator day tank. This capacity ensures that a minimum usable volume of 189 gallons is available. This volume permits operation of the diesel generators for approximately 27 minutes with the diesel generators loaded to the 2,000 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> rating of 5335 kw. Each diesel generator has two independent fiul oil transfer pumps. The shutoff level of each fuel oil transferpump provides forapproximately 60 minutes of diesel generator operation at the 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> rating. The pumps start at day tank levels to ensure the minimum level is maintained. The loss of the two redundant piumps would cause day tank level to drop below the minimum value.

Technical Specification 3.8.1.1.b.2 requires a minimum volume of 32,760 gallons be contained in each of the diesel generator's fuel storage systems. Technical Specification 3.8.1.2.b.2 requires a minimum volume of 32,760 gallons be contained in the required diesel generator's fuel storage system. This capacity ensures that a minimum usable volume (29,180 gallons) is available to permit operation of each of the diesel generators for approximately three days with the diesel generators loaded to the 2,000 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> rating of 5335 W. The ability to cross-tie the diesel generator fuel oil supply tanks ensures that one diesel generator may operate up to approximately six days.

Additional fuel oil can be supplied to the site within twenty-four hours after contacting a fuel oil supplier.

Surveillance Requirements 4.8.1(..2.a.6 (monthly) and 4.8.1.1 .2.b.2 (once per 184 days' and 4.8.1.1.2.i (18 months test)

The Surveillances 4.8.1.1.2.a.6 and 4.8.1.1.2b.2 verify that the diesel generators are capable of synchronizing with the offsite electrical system and loaded to greater than or equal to continuous rating of the machine. A minimum time of 60 minutes is required to stabilize engine temperatures, while MILLSTONE -UNIT3 B 314 8-1c Amendment No. 9, 4-i, 43, 494, 2244;

LBDCR No. 04-MP3-015 February 24, 2005 314.8 ELECTRICAL POWER SYSTEMS BASES minimizing the time that the diesel generator is connected to the offsite source. Surveillance Requirement 4.8.1.1.2j requires demonstration once per 18 months that the diesel generator can start and run continuously at full load capability for an interval of not less than 24 hours1 days <br />0.143 weeks <br />0.0329 months <br />, > 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br /> I of which are at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the diesel generator. The load band is provided to avoid routine overloading of the diesel generator. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The load band specified accounts for instrumentation I inaccuracies using plant computer and for the operational control capabilities and human factor characteristics. The note (*) acknowledges that momentary transient outside the load range shall not invalidate the test.

Surveillance Requirements 4.8.1.1 .2.a.5 (Monthly). 4.8.1.1.2.b.1 (Once per 184 DaYs).

4.8.1.1 .2.g.4.b (18 Month Teso. 4.8.1.1 .2.S.5 (18 Month Test) and 4.8.1.1 .2.g.6.b (18 Month Test)

Several diesel generator surveillance requirements specify that the emergency diesel generators are started from a standby condition. Standby conditions for a diesel generator means the diesel engine coolant and lubricating oil are being circulated and temperatures are maintained within design ranges. Design ranges for standby temperatures are greater than or equal to the low temperature alarm setpoints and less than or equal to the standby "keep-warm" heater shutoff temperatures for each respective sub-system.

Surveillance Requirement 4.8.1.1 .2j (18 Month Test!

The existing "standby condition" stipulation contained in specification 4.8.1.1.2.a.5 is superseded when performing the hot restart demonstration required by 4.8.1.1 .2j.

MILLSTONE - UNIT 3 B 3/4 8-ld Amendment No. 9,442,44, 4-94, 240,

LBDCR 04MP3 -002 3/4. REFUELING OPERATIONS March25,2004 BASES 314.9.1 BORON CONCENTRATION The limitations on reactivity conditions during REFUELING ensure that: (I) the reactor will remain subCritical during CORE ALTERATIONS, and (2) a uniform boron concentration is maintained for reactivity control in the watervolume having direct access to the reactorvessel. The value of 0.95 or less forKff includes a 1%Ak/k conservative allowance for uncertainties. Similarly, the boron concentration value specified in the CORE OPERATING LIMITS REPORT includes a conservative uncertainty allowance of 50 ppm boron. The boron concentration, specified in the CORE OPERATING MITS REPORT, provides for boron concentration measurement uncertainty between the spent fJel pool and the RWST. The locking closed of the required valves during refueling operations precludes the possibility of uncontrolled boron dilution of the filled portion of the RCS.

This action prevents flow to the RCS of unborated water by closing flow paths from sources of unborated water.

MODE ZERO shall be the Operational MODE where all fuel assemblies have been removed from containment to the Spent Fuel Pool. Technical Specification Table 1.2 defines MODE 6 as 'Tuel in the reactor vessel with the vessel head closure bolts less than fully tensioned or with the head removed." With no fuel in the vessel the definition for MODE 6 no longer applies. The transition from

• MODE 6 to MODE ZERO occurs when the last fuel assembly of a full core off load has been transferred to the Spent Fuel Pool and has cleared the transfer canal while in transit to a storage location. This will:

• Ensure Technical Specifications regarding sampling the transfer canal boron concentration are observed (4.9.1.1.2);

• Ensure that MODB 6 Technical Specification requirements are nol relaxed prematurely during fuel movement in containment.

314.9.1.2 BORON CONCENTRATION TN SPENT FUEL POOQL During normal Spent Fuel Pool operation, the spent fuel racks are capable of maintaining Klrf at less than or equal to 0.95 in an unborated water environment. This is accomplished in Region 1,2, and 3 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in some fuel storage regions, the limits on fuel burnup, fuel enrichment and minimum fuel decay time, and the use of blocking devices in certain fuel storage locations.

The boron requirementin the spent fuel pool specified in3.9.1.2 ensures that in the event of a fuel assemblyhandling accident involving either a single dropped or misplaced fuel assembly, the Xeff of the spent fuel storage racks will remain less than or equal to 0.95.

314.9.2 INSTRUMENTATON The OPERABILITY of the Source Range Neutron Flux Monitors ensures that redundant monitoring capability is available to detect changes in the reactivity condition of the core.

314.9.3 DECAY-TIME The minimum requirement forreactor.subcriticality priorto movement of irradiated fuel assemblies in the reactorvessel ensures thatsufficient timelhas elapsed to allowtheradioactive decay of the short-lived fission products. This decay time Is consistent with the assumptions used in the safety analyses.

MILLSTONE-UNIT 3 B 3/4 9-1 AmendmentNo. 4* 60,4&, 4&9,

LBDCR No. 04-MP3-015 February 24, 2005 BASES 314.9.8.2 LOW WATER LEVEL (continued!

An OPERABLE RHR loop consists of an RHRpump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. An operating RHR flow path should be capable ofdetermining the low end temperature. The flow path starts in one ofthe RCS hot legs and is returned to the RCS cold legs.

APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level <23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level 2 23 ft are located in LCO 3.9.8.1, "Residual Removal (RHR) AND Coolant Circulation-High Water Level."

ACfIONS

a. If less than the required number ofRHR loops are OPERABLE, actions shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation, or until > 23 ft of water level is established above the reactor vessel flange. When the water level is 2 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.8.1, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective action.

b. If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Reduced boron concentrations cannot occur by the addition of water with a low boron concentration than that contained in the RCS, because all of the unborated water sources are isolated.

If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RUR loop to operation. Since the unit is in ACTIONS 'a' and 'b' concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.

If no RHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br />. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.

The Completion Time of4 hours0.167 days <br />0.0238 weeks <br />0.00548 months <br /> is reasonable, based on the low probability of the coolant boiling in that time.

MILLSTONE - UNIT 3 B 3/4 9-6 Amendment No. 40;,