Text

Cycle Specific Technical Specification Bases Page Updates
	ML071640334
Person / Time
Site:	San Onofre
Issue date:	06/11/2007
From:	Scherer A; Southern California Edison Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML071640334 (161)
	v • d • e

ISOUTHERN CALIFORNIA A. Edward Scherer EDISON Manager of Nuclear Regulatory Affairs An EDISON INTERNATIONAL Company June 11, 2007 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C. 20555

SUBJECT:

Docket Nos. 50-361 and 50-362 Cycle Specific Technical Specification Bases Page Updates San Onofre Nuclear Generating Station, Units 2 and 3

Dear Sir or Madam:

Enclosed is the refueling cycle update to the San Onofre Nuclear Generating Station Units 2 and 3 Technical Specification (TS) Bases. As required by TS 5.4.4, changes to the TS Bases implemented without prior U.S. Nuclear Regulatory Commission (NRC) approval are provided to the NRC on a frequency consistent with 10 CFR 50.71(e).

Included in this update are all TS Bases pages that have been revised between June 16, 2005, and February 28, 2007. The pages are marked with change bars in the right hand margin to show where changes have been made.

Pages that are supplied without any change bars reflect text rollover from one page to the next as the result of additions or deletions.

If you have any questions on this subject, please call me or Ms. Linda T. Conklin at (949) 368-9443.

Sincerely, Enclosure cc: B. S. Mallett, Regional Administrator, NRC Region IV C. C. Osterholtz, NRC Senior Resident Inspector, SONGS Units 2 and 3 N. Kalyanam, NRC Project Manager, SONGS Units 2 and 3 P.O. Box 128 San Clemente, CA 92672 949-368-7501 A(Do I Fax 949-368-7575 pgie-

ENCLOSURE PART 1: SAN ONOFRE UNIT 2 REVISED BASES PAGES PART 2: SAN ONOFRE UNIT 3 REVISED BASES PAGES Bases Change Package Numbers B03-006 B03-009 B05-002 B05-005 B05-007 B05-009 B05-011 B06-001 B06-004 B06-005 B06-007

SAN ONOFRE UNIT 2 REVISED BASES PAGES Reactor Core SLs B 2.1.1 BASES APPLICABLE h. Local Power Density-High trip; SAFETY ANALYSES (continued) i. DNBR- Low trip;

j. Reactor Coolant Flow-Low trip; and

k. Steam Generator Safety Valves.

The SL represents a design requirement for establishing the protection system trip setpoint allowable values identified previously. LCO 3.2.1, "Linear Heat Rate (LHR)," and LCO 3.2.4, "Departure From Nucleate Boiling Ratio (DNBR),"

or the assumed initial conditions of the safety analyses (as indicated in the UFSAR, Ref. 2) provide more restrictive limits to ensure that the SLs are not exceeded.

SAFETY LIMITS SL 2.1.1.1 and SL 2.1.1.2 ensure that the minimum DNBR is not less than the safety analyses limit and that fuel centerline temperature remains below melting.

The minimum value of the DNBR during normal operation and design basis AOOs is limited to 1.31, based on a statistical combination of CE-I CHF correlation and engineering factor uncertainties, and is established as an SL. Additional factors such as rod bow and spacer grid size and placement will determine the limiting safety system settings required to ensure that the SL is maintained.

A steady state peak linear heat rate of 21 KW/ft has been established as the Limiting Safety System Setting to prevent fuel centerline melting during normal steady state operation. Following design basis anticipated operational occurrences, the transient linear heat rate may exceed 21 KW/ft provided the fuel centerline melt temperature is not exceeded.

The design melting point of new fuel with no burnable poison is 5080'F. The melting point is adjusted downward from this temperature depending on the amount of burnup and amount and type of burnable poison in the fuel. The 58°F per 10,000 MWD/MTU adjustment for burnup was accepted by the NRC in Topical Report CEN-386-P-A, Reference 3. Adjustments for burnable poisons are established based on NRC approved Topical Report CENPD-382-P-A, Reference 4.

(continued)

SAN ONOFRE--UNIT 2 B 2.0-3 Amendment No. 207 12/21/06

Reactor Core SLs B 2.1.1 BASES (continued)

SAFETY LIMIT The following violation responses are applicable to the VIOLATIONS reactor core SLs.

2.2.1 If SL 2.1.1.1 or SL 2.1.1.2 is violated, the requirement to go to MODE 3 places the unit in a MODE in which this SL is not applicable.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of bringing the unit to a MODE where this SL is not applicable and reduces the probability of fuel damage.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.

2. UFSAR, Section 15.0.3.2, "Initial Conditions."

3. CEN-386-P-A, "Verification of the Acceptability of a 1-Pin Burnup Limit of 60 MWD/MTU for Combustion Engineering 16x16 PWR Fuel," August 1992.

4. CENPD-382-P-A, "Methodology for Core Designs Containing Erbium Burnable Absorbers," August 1993.

(conti nued)

SAN ONOFRE--UNIT 2 B 2.0-4 Amendment No. 207 12/21/06

Reactor Core SLs B 2.1.1 BASES THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 2.0-5 Amendment No. 207 12/21/06 1

RCS Pressure SL B 2.1.2 BASES SAFETY LIMIT The following SL violation responses are applicable to the VIOLATIONS RCS pressure SLs.

2.2.2.1 If the RCS pressure SL is violated when the reactor is in MODE I or 2, the requirement is to restore compliance and be in MODE 3 within I hour.

With RCS pressure greater than the value specified in SL 2.1.2 in MODE 1 or 2, the pressure must be reduced to below this value. A pressure greater than the value specified in SL 2.1.2 exceeds 110% of the RCS design pressure and may challenge system integrity.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months provides the operator time to complete the necessary actions to reduce RCS pressure by terminating the cause of the pressure increase, removing mass or energy from the RCS, or a combination of these actions, and to establish MODE 3 conditions.

2.2.2.2 If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes.

Exceeding the RCS pressure SL in MODE 3, 4, or 5 is potentially more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. This action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.

(continued)

SAN ONOFRE--UNIT 2 B 2.0-8 Amendment No. 207 12/21/06

RCS Pressure SL B 2.1.2 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.

2. ASME, Boiler and Pressure Vessel Code,Section III, Article NB-7000.

3. ASME, Boiler and Pressure Vessel Code,Section XI, Article IWX-5000.

4. 10 CFR 100.

5. UFSAR, Section 7.2, "Reactor Protective Systems" SAN ONOFRE--UNIT 2 B 2.0-9 Amendment No. 207 12/21/06 1

LCO Applicability B 3.0 BASES (continued)

LCO 3.0.3 Voluntary entry into LCO 3.0.3 is permissible but requires (continued) prior approval (approval may be verbal) from either the Operations Manager, Station Manager or corporate officer with direct responsibility for the plant. The approval must subsequently be documented in written retrievable manner.

Inadvertent entry still allows for the one hour preparation period before Actions to change MODES must begin.

A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met.

b. A Condition exists for which the Required Actions have now been performed.

c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered-,,

and not from the time LCO 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , then the time allowed for reaching MODE 4 is the next 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3.

The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications (continued)

SAN ONOFRE--UNIT 2 B 3.0-4 Amendment No. 207 12/21/06 1

SDM-Tav, > 200°F B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) -Tav 9 > 200°F BASES BACKGROUND The reactivity control systems must be redundant and capable of holding the reactor core subcritical when shutdown under cold conditions, in accordance with GDC 26 (Ref. 1).

Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel. As such, SDM defines the Lk/k sub-critical that would be obtained immediately following the insertion of all full length control element assemblies (CEAs), assuming the single CEA of highest reactivity worth is fully withdrawn. The SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences assuming the highest reactivity worth CEA remains fully withdrawn. When the CEAs are all verified to be inserted, by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out.

The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable CEAs and soluble boric acid in the Reactor Coolant System (RCS). The CEA System provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the CEA of highest reactivity worth remains fully withdrawn.

The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes, and maintain the reactor subcritical under cold conditions.

During power operation, SDM control is ensured by operating with the shutdown CEAs fully withdrawn and the regulating CEAs within the limits of LCO 3.1.7, "Regulating Control Element Assembly (CEA) Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.

(conti nued)

SAN ONOFRE--UNIT 2 B 3.1-1 Amendment No. 7-,200 11/18/05 1

SDM- Tavg > 200°F B 3.1.1 BASES APPLICABLE The minimum required SDM is assumed as an initial condition SAFETY ANALYSES in the safety analyses. The safety analyses (Ref. 2) establish an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and AOOs, with the assumption of the highest worth CEA stuck out following a reactor trip. When the CEAs are all verified to be inserted, by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out.

LCO SDM is a core physics design condition that can be ensured through CEA positioning (regulating and shutdown CEAs) and through the soluble boron concentration.

APPLICABILITY In MODES 3 and 4, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses. In MODES I and 2, SDM is ensured by complying with LCO 3.1.6, "Shutdown Control Element Assembly (CEA) Insertion Limits," and LCO 3.1.7, "Regulating CEA Insertion Limits." In MODE 5, SDM is addressed by LCO 3.1.2, "SHUTDOWN MARGIN (SDM)- Tavg

< 200'F." In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration."

ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid makeup tanks or the refueling water storage tank.

The operator should borate with the best source available for the plant conditions.

(continued)

SAN ONOFRE--UNIT 2 B 3.1-2 Amendment No. 42-7-,200 11/18/05

SDM-Tavg > 200°F B 3.1.1 BASES (continued)

ACTIONS A.1 (continued)

(continued)

In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the maximum required boron concentration is high.

SURVEILLANCE SR 3.1.1.1 and SR 3.1.1.2 REQUIREMENTS SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:

a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.

SDM shall be verified to be within limits within I hour following the detection of inoperable CEA(s) and every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This surveillance Frequency allows sufficient time to assess core conditions while considering the reduced available negative reactivity due to inoperable CEAs.

During routine operations SDM is determined with a Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months based on the generally slow change in required boron concentration, and also allows sufficient time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.

(continued)

SAN ONOFRE--UNIT 2 B 3.1-3 Amendment No. 7-,200 11/18/05

SDM-Tavg > 200°F B 3.1.1 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. SONGS Units 2 and 3 UFSAR, Section 15.

SAN ONOFRE--UNIT 2 B 3.1-4 Amendment No. -+-2-7-,200 11/18/05 1

SDM- Tavg > 200°F B 3.1.1 THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.1-5 Amendment No. 7-,200 11/18/05 1

SDM-TavT > 200°F B 3.1.1 THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.1-6 Amendment No. 42-7--,200 11/18/05 I

SDM-Tavg < 200'F B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 SHUTDOWN MARGIN (SDM)-Tavg

200'F BASES BACKGROUND The reactivity control systems must be redundant and capable of holding the reactor core subcritical when shut down under cold conditions, in accordance with GDC 26 (Ref. 1).

Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel. As such, SDM defines the Ak/k sub-critical that would be obtained immediately following the insertion of all full length control element assemblies (CEAs), assuming the single CEA of highest reactivity worth is fully withdrawn. The SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences assuming the highest reactivity worth CEA remains fully withdrawn. When the CEAs are all verified to be inserted,-

by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out.

The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable CEAs and soluble boric acid in the Reactor Coolant System (RCS).

The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes, and maintain the reactor subcritical under cold conditions.

During power operation, SDM control is ensured by operating with the shutdown CEAs fully withdrawn and the regulating CEAs within the limits of LCO 3.1.7, "Regulating Control Element Assembly (CEA) Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.

(conti nued)

SAN ONOFRE--UNIT 2 B 3.1-7 Amendment No. 4-2-7--,200 11/18/05

SDM-Tavg

200'F B 3.1.2 BASES APPLICABLE The minimum required SDM is assumed as an initial condition SAFETY ANALYSES in safety analyses. The safety analyses (Ref. 2) establish an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and AOOs with the assumption of the highest worth CEA stuck out following a reactor trip. When the CEAs are all verified to be inserted, by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out. Specifically, for MODE 5, the primary safety analysis that relies on the SDM limits is the boron dilution analysis.

LCO The boron dilution (Ref. 3) accident initiated in MODE 5 is the most limiting analysis that establishes the SDM value of the LCO. For the boron dilution accident, if the LCO is violated, then the minimum required time assumed for.

operator action to terminate dilution may no longer be applicable.

SDM is a core physics design condition that can be ensured through CEA positioning (regulating and shutdown CEAs) and through soluble boron concentration.

APPLICABILITY In MODE 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.6, "Shutdown Control Element Assembly (CEA) Insertion Limits," and LCO 3.1.7 "Regulating CEA Insertion Limits." In MODES 3 and 4, the SDM requirements are given in LCO 3.1.1. "SHUTDOWN MARGIN (SDM) -Tavg > 200'F." In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration."

ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that (continued)

SAN ONOFRE--UNIT 2 B 3. 1-8 Amendment No. 2q-7-,200 11/18/05

SDM-Tg < 200'F B 3.1.2 BASES ACTIONS A.1 (continued)

(continued) boration will be continued until the SDM requirements are met. In determining the boration flow rate the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the boron concentration is high.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Because it is imperative to raise the boron concentration of the RCS as soon as possible, a source of water with a high boron concentration is required in the boric acid makeup tanks or the refueling water storage tank. The operator should borate with the best source available for the plant conditions.

SURVEILLANCE SR 3.1.2.1 REQUIREMENTS In MODE 5 the SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:

a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.

(continued)

SAN ONOFRE--UNIT 2 B 3. 1-9 Amendment No. 12-7--200 11/18/05 I

SDM-Tavg _ 200'F B 3.1.2 BASES (continued)

SURVEILLANCE SR 3.1.2.1 (continued)

REQUIREMENTS (continued) The reactivity effects of items c, d, e, and f above, are nominally constant, and are bound while the RCS boron concentration is maintained greater than the refueling boron concentration specified for MODE 6 and all CEAs inserted.

Therefore, adequate SDM is assured by determining at least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months that:

a. The core has not been critical since the refueling (e.g. factors c through f are unchanged).

b. The reactor coolant system boron concentration is greater than or equal to the refueling boron concentration required by TS 3.9.1.

c. All CEAs are inserted.

d. No more than one charging pump is functional, by verifying that power is removed from the remaining charging pumps, when the RCS is at less than full inventory (i.e., pressurizer level < 5%).

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration, and it allows sufficient time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. UFSAR, Section 15.

3. UFSAR, Section 15.4.1.4.

SAN ONOFRE--UNIT 2 B 3.1-10 Amendment No. 4-2-7--,200 11/18/05 1

SDM-Tvg < 200'F B 3.1.2 THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.1-11 Amendment No. +2-7-,200 11/18/05 I

SDM-Tavg

200'F B 3.1.2 THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.1-12 Amendment No. +2-7-,200 11/18/05 I

Reactivity Bal ance B 3.1.3 BASES APPLICABLE the assumptions used in the reload cycle design analysis or SAFETY ANALYSES the calculational models used to predict soluble boron (continued) requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted critical boron curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.

Following each reactor refueling cycle and before entering MODE 1, low power physics tests are conducted to validate the predicted design parameters used in the safety analysis.

During these tests the predicted reactor coolant critical boron concentration is compared with the measured critical boron concentration. If any significant difference exists.

between the measured and predicted critical boron concentrations, the bases for the disparity is determined and evaluated before proceeding into Mode 1.

The normalization of predicted RCS boron concentration to the measured value is to be performed prior to reaching 60 EFPD following startup from a refueling outage, with the CEAs in their normal positions for power operation. The normalization is performed near BOC, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.

The reactivity balance satisfies Criterion 2 of the NRC Policy Statement.

LCO Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the nuclear design methodology are larger than expected. A limit on the reactivity balance of

+/- 1% Ak/k has been established, based on engineering judgment. A +/-1% Ak/k deviation in reactivity from that predicted is larger than expected for normal operation, and should therefore be evaluated.

(continued)

SAN ONOFRE--UNIT 2 B 3.1-15 Amendment No. +/-2-I--200 11/18/05 I

Reactivity Balance B 3.1.3 BASES ACTIONS A.1 and A.2 (continued)

Completion Time of 7 days is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.

Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected.

If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is in, the calculation technique, then the calculational models:must be revised to provide more accurate predictions. If any of these results are demonstrated and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized, and power operation may continue. If operational restrictions or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.

The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.

B.1 If the core reactivity cannot be restored to within

+/-1% Ak/k, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If the SDM for MODE 3 is not met, then boration as required by TS 3.1.1.1 ACTION A.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

SAN ONOFRE--UNIT 2 B 3.1-17 Amendment No. + 2-7 T200 11/18/05

CEA Alignment B 3.1.5 BASES LCO Failure to meet the requirements of this LCO may produce (continued) unacceptable power peaking factors and LHRs, or unacceptable SDMs, all of which may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on CEA OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (e.g., trippability) and alignment of CEAs have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the CEAs are bottomed, and the reactor is shut down and not producing fission power. In the shutdown modes, the OPERABILITY of the shutdown and regulating CEAs has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration: of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)-Tayg

> 200'F," for SDM in MODES 3, 4, and 5, and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during refueling.

ACTIONS A.1. A.2.1. A.2.2. B.1. and B.2 A CEA may become misaligned, yet remain trippable. In-this condition, the CEA can still perform its required function of adding negative reactivity should a reactor trip be necessary.

If one or more regulating CEAs are misaligned by 7 inches but trippable, continued operation in MODES 1 and 2 may continue, provided within 15 minutes a power reduction is initiated in accordance with the COLR requirements, and within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months the misaligned CEA(s) is aligned within 7 inches of its group or the misaligned CEA's group is aligned within 7 inches of the misaligned CEA(s).

Xenon redistribution in the core starts to occur as soon as a CEA becomes misaligned. Initiating a THERMAL POWER reduction in accordance with the COLR ensures acceptable power distributions are maintained (Ref. 3). For small misalignments (< 7 inches) of a CEA, there is:

(continued)

SAN ONOFRE--UNIT 2 B 3.1-28 Amendment No. 127 May 2, 1997*

200 11/18/05

CEA Alignment B 3.1.5 BASES ACTIONS A.1, A.2.1, A.2.2, B.1, and B.2 (continued)

a. A small effect on the time dependent long term power distributions relative to those used in generating LCOs and limiting safety system settings (LSSS) setpoints;

b. A negligible effect on the available SDM; and

c. A small effect on the ejected CEA worth used in the accident analysis.

With a large CEA misalignment (2 7 inches), however, this misalignment would cause distortion of the core power distribution. This distortion may, in turn, have a significant effect on the time dependent, long term power distributions relative to those used in generating LCOs and LSSS setpoints.

The effects on the available SDM and the ejected CEA worth used in the accident analysis remain small.

Therefore, this condition is limited to the single CEA misalignment, while still allowing 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for recovery.

In both cases, a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time period is sufficient to:

a. Identify cause of a misaligned CEA;

b. Take appropriate corrective action to realign the CEAs; and

c. Minimize the effects of xenon redistribution.

The CEA must be returned to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or transition to MODE 3.

C.1, C.2.1, and C.2.2 Although a part length CEA has less of an effect on core flux than a full length CEA, a misaligned part length CEA will still result in xenon redistribution and affect core power distribution. Requiring realignment within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months minimizes these effects and ensures acceptable power distribution is maintained.

(continued)

SAN ONOFRE--UNIT 2 B 3. 1-29 Amendment No. 42-7-,-200 11/18/05 I

CEA Alignment B 3.1.5 BASES ACTIONS D. 1 (continued)

If a Required Action or associated Completion Time of Condition A, Condition B, or Condition C is not met, one regulating or shutdown CEA is untrippable, or more than one full length or part length CEA misaligned, the unit is required to be brought to MODE 3. By being brought to MODE 3, the unit is brought outside its MODE of applicability.

When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

If a CEA is untrippable, it is not available for reactiv~ity insertion during a reactor trip. With an untrippable CEA; (continued)

SAN ONOFRE--UNIT 2 B 3.1-30 Amendment No. +24-,200 11/18/05 I

Shutdown CEA Insertion Limits B 3.1.6 BASES (continued)

APPLICABLE The shutdown CEA insertion limits satisfy Criterion 2 of the SAFETY ANALYSES NRC Policy Statement.

(continued)

LCO The shutdown CEAs must be within their insertion limits any time the reactor is critical or approaching criticality.

This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.

APPLICABILITY The shutdown CEAs must be within their insertion limits, with the reactor in MODES I and 2. The Applicability in MODE 2 begins any time any regulating CEA is not fully inserted. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. In, MODE 3, 4, 5, or 6, the shutdown CEAs are fully inserted in the core and contribute to the SDM. Refer to LCO 3.1.1 and LCO 3.1.2, "SHUTDOWN MARGIN (SDM) -T 200'F," for SDM requirements in MODES 3, 4, and 5. LCO3.9.1, "Boron Concentration," ensures adequate SDM in MODE 6.

This LCO has been modified by a Note indicating the LCO requirement is suspended during SR 3.1.5.3, which verifies the freedom of the CEAs to move, and requires the shutdown CEAs to move below the LCO limits, which would normally violate the LCO.

ACTIONS A. 1 Prior to entering this Condition, the shutdown CEAs were fully withdrawn. If a shutdown CEA is then inserted into the core, its potential negative reactivity is added to the core as it is inserted.

If the CEA(s) is not restored to within limits within I hour then an additional 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed for restoring the CEA(s) to within limits. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months total Completion Time allows the operator adequate time to adjust the CEA(s) in an orderly manner and is consistent with the required Completion Times in LCO 3.1.5, "Control Element Assembly (CEA) Alignment."

(continued)

SAN ONOFRE--UNIT 2 B 3.1-37 Amendment No. 42-7-,200 11/18/05

Shutdown CEA Insertion Limits B 3.1.6 BASES (continued)

ACTIONS B.1 (continued)

When Required Action A.1 cannot be met or completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completi'on Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS Verification that the shutdown CEAs are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown CEAs will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. This SR ensures that the shutdown CEAs are withdrawn before the regulating CEAs are withdrawn duringa.

unit startup.

Since the shutdown CEAs are positioned manually by the control room operator, verification of shutdown CEA position at a Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate to ensure that the shutdown CEAs are within their insertion limits. Also, the Frequency takes into account other information available to the operator in the control room for the purpose of monitoring the status of the shutdown CEAs.

(continued)

SAN ONOFRE--UNIT 2 B 3. 1-38 Amendment No. +2-7-,200 11/18/05 1

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABLE Fuel cladding damage does not occur when the core is SAFETY ANALYSES operated outside these LCOs during normal operation.

(continued) However, fuel cladding damage could result, should an accident occur with simultaneous violation of one or more of these LCOs. Changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.

The SDM requirement is ensured by limiting the regulating and shutdown CEA insertion limits, so that the allowable inserted worth of the CEAs is such that sufficient reactivity is available in the CEAs to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth CEA remains fully withdrawn upon trip (Ref. 3).

The most limiting SDM requirements for Mode 1 and 2 conditions at BOC are determined by the requirements of; several transients, e.g., Loss of Flow, Seized Rotor, etc.

However, the most limiting SDM requirements for Modes I and 2 at EOC come from just one transient, Steam Line Break (SLB). The requirements of the SLB event at EOC for both the full power and no load conditions are significantly larger than those of any other event at that time in the cycle and, also, considerably larger than the most limiting requirements at BOC.

Although the most limiting SDM requirements at EOC are much larger than those at BOC, the available SDMs obtained via the scramming of the CEAs are also substantially larger due to the much lower boron concentration at EOC. To verify that adequate SDMs are available throughout the cycle to satisfy the changing requirements, calculations are performed at both BOC and EOC. It has been determined that calculations at these two times in the cycle are sufficient since the differences between available SDMs and the limiting SDM requirements are the smallest at these times in the cycle. The measurement of CEA bank worth performed as part of the Startup Testing Program demonstrates that the core has the expected shutdown capability. Consequently, adherence to LCOs 3.1.6 and 3.1.7 provides assurance that the available SDMs at any time in the cycle will exceed the limiting SDM requirements at that time in the cycle.

(continued)

SAN ONOFRE--UNIT 2 B 3.1-43 Amendment No. 7-,200 11/18/05

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABLE The regulating and shutdown CEA insertion limits ensure that SAFETY ANALYSES safety analyses assumptions for reactivity insertion rate, (continued) SDM, ejected CEA worth, and power distribution peaking factors are preserved (Ref. 3).

The regulating CEA insertion limits satisfy Criterion 2 of the NRC Policy Statement.

LCO The limits on regulating CEA sequence, and physical insertion, as defined in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected CEA worth is maintained, and ensuring adequate negative reactivity insertion on trip. The overlap between regulating banks provides more uniform rates of reactivity insertion and withdrawal. The overlap of the regulating groups may be increased; provided that the sequence of regulating group movement and the insertion limits are satisfied.

The power dependent insertion limit (PDIL) alarm circuit is required to be OPERABLE for notification that the CEAs are outside the required insertion limits. When the PDIL alarm circuit is inoperable, the verification of CEA positions is increased to ensure improper CEA alignment is identified before unacceptable flux distribution occurs.

(continued)

SAN ONOFRE--UNIT 2 B 3. 1-43a Amendment No. 42-7--,200 11/18/05

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABILITY The regulating CEA sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES 1 and 2. These limits must be maintained, since they preserve the assumed power distribution, ejected CEA worth and SDM assumptions. Applicability in MODES 3, 4, and 5 is not required, since neither the power distribution nor ejected CEA worth assumptions would be exceeded in these MODES. SDM is preserved in MODES 3, 4, and 5 by adjustments to the soluble boron concentration.

This LCO is modified by a Note indicating the LCO requirement is suspended during SR 3.1.5.3. This SR verifies the freedom of the CEAs to move, and requires the regulating CEAs to move below the LCO limits, which would normally violate the LCO.

ACTIONS A.1 and A.2 Operation beyond the transient insertion limit may result in a loss of SDM and excessive peaking factors. The transient insertion limit should not be violated during normal operation. However, violations may occur during transients when the operator is manually controlling the CEAs in response to changing plant conditions. When the regulating groups are inserted beyond the transient insertion limits, actions must be taken to either withdraw the regulating groups above the limits or to reduce THERMAL POWER to less than or equal to that allowed for the actual CEA insertion limit. Two hours provides a reasonable time to accomplish this, allowing the operator to deal with current plant conditions while limiting peaking factors to acceptable levels.

B.1 and B.2 If the CEAs are inserted between the long term steady state insertion limits and the transient insertion limits for (continued)

SAN ONOFRE--UNIT 2 B 3.1-44 Amendment No. 7-,200 11/18/05 1

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

ACTIONS C.1 (continued) borated water to enter the Reactor Coolant System from the chemical addition and makeup systems, and to cause the regulating CEAs to withdraw to the acceptable region. It is reasonable to continue operation for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after it is discovered that the 5 EFPD or 14 EFPD limit has been exceeded. This Completion Time is based on limiting the potential xenon redistribution, the low probability of an accident, and the steps required to complete the action.

D.1 and D.2 With the Core Operating Limit Supervisory System out of service, operation beyond the short term steady state insertion limits can result in peaking factors that could approach the DNB or local power density trip setpoints.

Eliminating this condition within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limits the magnitude of the peaking factors to acceptable levels (Ref. 8). Restoring the CEAs to within the limit or reducing THERMAL POWER to that fraction of RTP that is allowed by CEA group position, using the limits specified in the COLR, ensures acceptable peaking factors are maintained.

E.1 With the PDIL circuit inoperable, performing SR 3.1.7.1 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months thereafter ensures improper CEA alignments are identified before unacceptable flux distributions occur.

F.1 When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is (continued)

SAN ONOFRE--UNIT 2 B 3.1-46 Amendment No. 7-,200 11/18/05

Boration Systems - Shutdown B 3.1.10 B 3.1 REACTIVITY CONTROL SYSTEM B 3.1.10 Boration Systems - Shutdown BASES BACKGROUND The Chemical and Volume Control System (CVCS) functions to provide a means for reactivity control and maintain reactor coolant inventory, activity, and chemistry in accordance with GDC 26, 27, and 33 (Ref. 1, 2, and 3). The CVCS includes the letdown and boron injection subsystems. The boron injection subsystem is required to establish and maintain a safe shutdown condition for the reactor. The letdown portion of the CVCS is used for normal plant operation, however, it is not required for safety.

One OPERABLE boron injection flow path is required while operating in Modes 5 and 6. The required flow path may include either: 1) The Refueling Water Storage Tank (RWST)

(TO05 and/or T006) via a charging pump or High Pressure Safety Injection Pump, or; 2) A Boric Acid Makeup (BAMU)

Tank via the BAMU pump or gravity feed valve to a charging pump. AC electrical power is available from the OPERABLE power sources specified by TS 3.8.2.

APPLICABLE SAFETY ANALYSES The charging pumps inject concentrated boric acid into the RCS to provide negative reactivity control in MODES 5 and 6.

With the RCS below 200'F one injection system is acceptable without single failure considerations on the basis of the stable reactor condition and additional restrictions on CORE ALTERATIONS.

Boron dilution is conducted under strict procedural controls which specify limits on the rate and magnitude of any required change in boron concentration. Therefore, the probability of a sustained or erroneous dilution is very low. The high neutron flux alarm on the startup channel instrumentation will alert the operator of a boron dilution event. The operator will terminate the dilution before losing shutdown margin by either turning off the charging (continued)

SAN ONOFRE--UNIT 2 B 3.1-59 Amendment No. 2-7 08/2* 00--l/

200 11/18/05

DNBR B 3.2.4 BASES (continued)

APPLICABLE potential for fuel cladding damage exists because changes in SAFETY ANALYSES the power distribution can cause increased power peaking (continued) and correspondingly increased local LHRs.

DNBR satisfies Criterion 2 of the NRC Policy Statement.

LCO The power distribution LCO limits are based on correlations between power peaking and certain measured variables used as inputs to the LHR and DNBR operating limits. The power distribution LCO limits are provided in the COLR.

With the COLSS in service and one or both of the control element assembly calculators (CEACs) OPERABLE, the DNBR will be maintained by ensuring that the core power calculated by the COLSS is equal to or less than the permissible core power operating limit based on DNBR calculated by the COLSS.

In the event that the COLSS is in service but neither of the two CEACs is OPERABLE, the DNBR is maintained by ensuring that the core power calculated by the COLSS is equal to or less than a reduced value of the permissible core power operating limit calculated by the COLSS. In this condition, the calculated operating limit must be reduced by the allowance specified in the COLR.

In instances for which the COLSS is out of service and either one or both of the CEACs are OPERABLE, the DNBR is maintained by operating within the acceptable region specified in the COLR using any OPERABLE CPC channel.

Alternatively, when the COLSS is out of service and neither of the two CEACs is OPERABLE, the DNBR is maintained by operating within the acceptable region specified in the COLR using any OPERABLE CPC channel.

With the COLSS out of service, the limitation on DNBR as a function of the ASI represents a conservative envelope of operating conditions consistent with the analysis assumptions that have been analytically demonstrated adequate to maintain an acceptable minimum DNBR for all AOOs. Of these, the postulated loss of flow transient is the most limiting. Operation of the core with a DNBR at or above this limit ensures that an acceptable minimum DNBR is maintained in the event of a loss of flow transient.

(continued)

SAN ONOFRE--UNIT 2 B 3.2-30 Amendment No. +2-7-,200 11/18/05

ESFAS Instrumentation B 3.3.5 BASES (continued)

ACTIONS D.1 and D.2 (continued)

Function is in two-out-of-three logic in the bypassed input parameter, but with another channel failed, the ESFAS may be operating with a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected.

To correct the problem, the second channel is placed in trip. This places the ESFAS Function in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, ESFAS actuation will occur.

Action D.2 provides a limit of 7 days for operation with 2 inoperable channels. In the one-out-of-two configuration, a single channel failure can cause a spurious trip. For RAS and EFAS functions, a spurious trip can lead to undesireable consequences during certain Design Basis Events.

The 7 day time limit provides operational flexibility to perform a required CHANNEL FUNCTIONAL TEST on one channel (which is bypassed) while a second channel is inoperable (and is tripped).

The 7 day time limit also maintains acceptable core damage frequency as discussed in NSG 98-007, Time Limit for RAS or EFAS Channel in Trip (Reference 11).

E.1. E.2.1. and E.2.2 Condition C applies to one automatic bypass removal channel inoperable. The only automatic bypass removal on an ESFAS is on the Pressurizer Pressure-Low signal. This bypass removal is shared with the RPS Pressurizer Pressure-Low bypass removal.

If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status, the associated ESFAS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise, the affected ESFAS channel must be declared inoperable, as in Conditions A and B, and the bypass either removed or the bypass removal channel repaired. The Bases for the Required Actions and required Completion Times are consistent with Conditions A and B.

(continued)

SAN ONOFRE--UNIT 2 B 3.3-100 Amendment No. 197 07/19/05

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.3-152 Amendment No. 208 12/05/06 1

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.3-153 Amendment No. 208 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.3-154 Amendment No. 208 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.3-155 Amendment No. 208 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.3-156 Amendment No. 208 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 2 B 3.3-157 Amendment No. 208 12/05/06 I

PAM Instrumentation B 3.3.11 BASES (continued)

SURVEILLANCE SR 3.3.11.4 REQUIREMENTS A CHANNEL CALIBRATION is performed every 18 months. CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies the channel responds to the measured parameter within the necessary range and accuracy.

The Frequency is based upon operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

SR 3.3.11.5 A CHANNEL CALIBRATION is performed every 24 months. The Frequency is based upon operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 24 month calibration interval for the determination of the magnitude of equipment drift.

REFERENCES 1. SONGS Units 2 and 3 Regulatory Guide 1.97 Instrumentation Report #90010A.

2. Regulatory Guide 1.97, Revision 2.

3. NUREG-0737, Attachment 1.

4. UFSAR, Section 7.5.1.7.

SAN ONOFRE--UNIT 2 B 3.3-175 Amendment No. 127 03/06/06 1

RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

The PTLR contains P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature (Ref. 1).

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational.

guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.

10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the ASME Code,Section III, Appendix G (Ref. 3).

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 3.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-9 Amendment No. 42-7-,203

RCS P/T Limits B 3.4.3 BASES (continued)

ACTIONS C.1 and C.2 (continued)

The Completion Time of "prior to entering MODE 4" forces the evaluation prior to entering a MODE where temperature and pressure can be significantly increased. The evaluation for a mild violation is possible within several days, but more severe violations may require special, event specific stress analyses or inspections.

Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within the PTLR limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.

Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.

This SR is modified by a Note that requires this SR be performed only during RCS system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.

NOTE: Any change in RCS temperature of less than 10 degrees F in any one hour period during normal operation is not considered an RCS heatup/

cooldown. This type of transient is determined by ASME III Code Class 1 stress calculations to be an insignificant transient in the contribution to the component fatigue usage factor.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-15 Amendment No. 127 05/30/,&G 203

RCS P/T Limits B 3.4.3 BASES (continued)

SURVEI LLANCE SR 3.4.3.2 REQUIREMENTS (continued) This SR verifies that the reactor vessel material irradiation surveillance specimens will be removed and examined, to determine changes in material properties, as required by 10 CFR 50 Appendix H. The results of these examinations will be used to update the PTLR.

REFERENCES 1. CE NPSD-683-A, The Development of a RCS Pressure and Temperature Limits Report for the Removal of P-T Limits and LTOP Setpoints from the Technical Specifications.

2. 10 CFR 50, Appendix G.

3. ASME, Boiler and Pressure Vessel Code,Section III, Appendix G.

4. ASTM E185-73.

5. 10 CFR 50, Appendix H.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

7. UFSAR, Chapter 5.

SAN ONOFRE--UNIT 2 B 3.4-16 Amendment No. +2-7-,203 1

Pressurizer Heatup and Cooldown Limits B 3.4.3.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3.1 Pressurizer Heatup and Cooldown Limits.

BASES BACKGROUND All components in the Reactor Coolant System are designed to withstand the effects of cyclic loads due to system temperature and pressure changes. These cyclic loads are introduced by normal load transients, reactor trips, and startup and shutdown operations. The various categories of load cycles used for design purposes are provided in the UFSAR (Ref. 1). During startup and shutdown, the rates of temperature and pressure changes are limited so that the maximum specified heatup and cooldown rates are consistent with the design assumptions and satisfy the stress limits for cyclic operation.

During normal plant operations, primarily heatup and cooldown, some plant operating practices can induce pressurizer insurge and outsurge cycles which may effect the structural integrity of the pressurizer vessel. These insurge/outsurge cycles can introduce additional stress and fatigue loading to the lower region of the pressurizer.

Two components of the pressurizer are especially sensitive to thermal loading changes. They are the pressurizer spray line spray nozzle and the pressurizer surge line. Of particular concern is the potential for flow stratification I

in the spray line during operation involving fewer than four RCPs. The horizontal piping configuration at the top of the spray line has been modified with a one-piece gooseneck arrangement, to promote filling the spray line and to reduce thermal cycling fatigue.

During RCP heatup and cooldown, both RCP POO and P003 in the loop lA/lB (with the pressurizer) should be operated whenever possible to ensure that the spray line remains filled. If this is not possible, throttling the main spray valve to keep the line filled is recommended. Thermal fatigue analyses of both the spray nozzle and spray piping using similar transient loadings were re-performed to the 1980 edition of the ASME Code Section III.

(continued)

SAN-ONOFRE--UNIT 2 B 3.4-17 Amendment No. 197 07/19/05

Pressurizer Heatup and Cooldown Limits B 3.4.3.1 BASES (continued)

BACKGROUND In these analyses, the number of allowable thermal fatigue (continued) cycles approaches infinity at differential temperatures of 200'F or less. A small continuous flow is maintained through the spray lines, by two 3/4" needle valves, bypassing the mainspray control valves. The purpose of this flow is to to reduce thermal shock to the spray nozzle and I spray line when the spray control valves open. This limits the differential temperature to within the 200'F assumed in the Code stress reports. This consideration is enforced by requiring bypass flow to be within 85 0 F of RCL cold leg temperature (Ref. 3).

The Pressurizer Spray nozzle has been evaluated for susceptibility to permanent component deformation during overcooling events exceeding the thermal transient limits of Pressure/Temperature Limits. The evaluation was performed applying the "thermal ratcheting" criteria of ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7 (Ref.4). Limit curves to permanent deformation are published that give the maximum allowable temperature change as a function of transient duration and system pressure.

The pressurizer surge line nozzle has been evaluated for susceptibility to permanent component deformation during overcooling events exceeding the thermal transient limits of Pressure/Temperature Limits. The evaluation was performed applying the "thermal ratcheting" criteria of ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7.

Limit curves are published for the Pressurizer surge line nozzles that check for deformation due to the ratcheting and these should be utilized to evaluate component operability following an overcooling event, and prior to return to operation.

APPLICABLE The limitations imposed on the pressurizer heatup and SAFETY ANALYSES cooldown rates and spray water temperature differential are provided to assure that the pressurizer is operated within the design criteria assumed for the fatigue analysis performed in accordance with the ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7 requirements.

(continued)

SAN-ONOFRE--UNIT 2 B 3.4-18 Amendment No. 197 07/19/05

Pressurizer Heatup and Cooldown Limits B 3.4.3.1 BASES (continued)

ACTIONS C.1 and C.2 (continued)

If requirements of the LCO are not met at any time in other than MODES 1, 2, 3, or 4, the Required Action C.1 requires to immediately initiate action to restore parameter(s) to within limits specified in the Pressure/Temperature Limits.

Also, Required Action C.2 requires to perform engineering evaluation prior to entering MODE 4 to determine the effects of the out-of-limit condition on the structural integrity of the pressurizer.

CONDITION C is modified by a Note which requires to determine the pressurizer is acceptable for continued operation whenever the requirements of the LCO not met any time in other than MODES 1, 2, 3, or 4.

SURVEILLANCE SR 3.4.3.1.1 REQUIREMENTS To minimize the potential thermal stresses of the pressurizer during startup and shutdown, the rate of temperature changes should be monitored during startup and shutdown. The verification these rates are within limits specified in the Pressure/Temperature Limits should be made every 30 minutes. This FREQUENCY is based on operating, experience and reflects the importance of the possible effect of temperature changes rate during such Unit evolutions as startup and shutdown on pressurizer and its components integrity.

This SURVEILLANCE REQUIREMENT is modified by a Note which requires to perform this SR during pressurizer heatup and cooldown operations only.

SR 3.4.3.1.2 SR 3.4.3.1.2 requires to determine for use in the Pressure/Temperature Limits the spray water temperature differential for each cycle of auxiliary spray operation and for each cycle of main spray operation when the RCS cold leg temperature is < 500'F. The spray nozzle thermal transients for normal (4-RCP) and auxiliary spray operations are developed in the calculation package S-PEC-368, and are used as design input for the Pressurizer Class-1 stress report.

A maximum temperature differential of 200'F is assumed for normal spray operations. Of particular (continued)

SAN-ONOFRE--UNIT 2 B 3.4-20 Amendment No. 197 07/19/05 1

Pressurizer Heatup and Cooldown Limits B 3.4.3.1 BASES (continued)

SURVEILLANCE SR 3.4.3.1.2 (continued)

REQUIREMENTS concern is the potential for flow stratification in the pressurizer spray line during operations involving fewer than four RCPs. The horizontal piping configuration at the top of the spray line has been modified with a one-piece gooseneck arrangement, to promote filling the spray line and to reduce thermal cycling fatigue.

Pressurizer spray line temperature indication is provided by two RTDs relocated close to the top of the spray riser in order to better represent the actual spray temperature as it enters the pressurizer. Because of unexpectedly high ambient heat losses in the spray piping, the bypass valve was unable to hold the spray line to withinthe previously analyzed 40'F temperature step. Additional analysis in 1984 showed acceptable results for an 85 0 F transient. DOuring loss of offsite power the RCS is depressurized using auxiliary spray.

The auxiliary spray is safety grade and has power supplied, by the Class 1E 480V onsite power distribution system. A bypass line around the auxiliary spray valve allows depressurization using manual valve if the motor-operated auxiliary spray valve should fail. The design basis minimum value of continuous bypass flow, 3-6 gpm, includes consideration of maintaining the line full of water, in order to preclude a counter flow of steam vapor into the spray line.

REFERENCES 1. UFSAR, Section 3.9, "Mechanical Systems and Components."

2. Pressurizer, Instruction Manual, S023-919-68-01, April, 1977.

3. Design Basis Document, DBD-S023-360, "Reactor Coolant System."

4. ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7.

(continued)

SAN-ONOFRE--UNIT 2 B 3.4-21 Amendment No. 197 07/19/05 I

RCS Loops-MODES 1 and 2 B 3.4.4 BASES (continued)

APPLICABLE aspect for this LCO is the reactor coolant forced flow rate, SAFETY ANALYSES which is represented by the number of RCS loops in service.

(continued)

Both transient and steady state analyses have been performed to establish the effect of flow on DNB. The transient or accident analysis for the plant has been performed assuming four RCPs are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are of most importance to RCP operation are the four pump coastdown, single pump locked rotor, single pump (broken shaft or coastdown), and rod withdrawal events (Ref. 1).

RCS loops-MODES 1 and 2 satisfy Criterion 3 of the NRC Policy Statement.

LCO The purpose of this LCO is to require adequate forced flow for core heat removal. Flow is represented by having both:

RCS loops with both RCPs in each loop in operation for removal of heat by the two SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required to, be at rated power.

Each OPERABLE loop consists of two RCPs providing forced flow for heat transport to an SG that is OPERABLE. SG, and hence RCS loop, OPERABILITY with regard to SG water level is ensured by the Reactor Protection System (RPS) in MODES I and 2. A reactor trip places the plant in (continued)

SAN ONOFRE--UNIT 2 B 3.4-24 Amendment No. ,204

RCS Loops-MODE 3 B 3.4.5 BASES (continued)

LCO of requiring both SGs to be capable (> 50% wide range water (continued) level) of transferring heat from the reactor coolant at a controlled rate. Forced reactor coolant flow is the required way to transport heat, although natural circulation flow provides adequate removal. A minimum of one running RCP meets the LCO requirement for one loop in operation.

The Note permits a limited period of operation without RCPs.

All RCPs may be de-energized for

I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. This means that natural circulation has been established. When in natural circulation, a reduction in boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained is prohibited because an even concentration distribution throughout the RCS cannot be ensured. Core outlet temperature is to be maintained at least 10'F below the saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

In MODES 3, 4, and 5, it is sometimes necessary to stop all RCPs or shutdown cooling (SDC) pump forced circulation (e.g., to change operation from one SDC train to the other, to perform surveillance or startup testing, to perform the transition to and from SDC System cooling, or to avoid operation below the RCP minimum net positive suction head limit). The time period is acceptable because natural circulation is adequate for heat removal, or the reactor coolant temperature can be maintained subcooled and boron stratification affecting reactivity control is not expected.

An OPERABLE loop consists of at least one RCP providing forced flow for heat transport and an SG that is OPERABLE.

An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 3, the heat load is lower than at power; therefore, one RCS loop in operation is adequate for transport and heat removal. A second RCS loop is required to be OPERABLE but not in operation for redundant heat removal capability.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.6, "RCS Loops-MODE 4";

(conti nued)

SAN ONOFRE--UNIT 2 B 3.4-28 Amendment No. +7-5,204

RCS Loops-MODE 4 B 3.4.6 BASES (continued)

LCO prohibits boron dilution with coolant at boron (continued) concentrations less than required to assure the SDM of LCO 3.1.1 is maintained when forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained at least IO°F below saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. The response of the RCS without the RCPs or SDC pumps depends on the core decay heat load and the length of time that the pumps are stopped. As decay heat diminishes, the effects on RCS temperature and pressure diminish. Without cooling by forced flow, higher heat loads will cause the reactor coolant temperature and pressure to increase at a rate proportional to the decay heat load. Because pressure can increase, the applicable system pressure limits (pressure and temperature (P/T) limits or low temperature overpressure protection (LTOP) limits) must be observed and forced SDC flow or heat removal via the SGs must be re-established prior to reaching the pressure limit. The circumstances for stopping both RCPs or SDC pumps are to be limited to.

situations where:

a. Pressure and temperature increases can be maintained well within the allowable pressure (P/T limits and:

LTOP) and 10'F subcooling limits; or

b. An alternate heat removal path through the SGs is in operation.

Note 2 requires that either of the following two conditions be satisfied before an RCP may be started with any RCS cold leg temperature less than or equal to the LTOP enable temperature specified in the PTLR.

a. Pressurizer water volume is < 900 ft 3 ; or

b. Secondary side water temperature in each SG is < 10°0 F above each of the RCS cold leg temperatures.

Satisfying the above condition will preclude a large pressure surge in the RCS when the RCP is started.

An OPERABLE RCS loop consists of at least one OPERABLE RCP and an SG that is OPERABLE and has the minimum water level specified in SR 3.4.6.2.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-32 Amendment No. 2-0-,204

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO maintained subcooled, and boron stratification affecting (continued) reactivity control is not expected.

Note 2 allows one SDC train to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other SDC train is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable train during the only time when such testing is safe and possible.

Note 3 allows one RCS loop to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other RCS loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.

Note 4 requires that either of the following two conditions be satisfied before an RCP may be started:

a. Pressurizer water volume must be < 900 ft 3 ; or

b. Secondary side water temperature in each SG must be

< 10°0 F above each of the RCS cold leg temperatures.

Satisfying either of the above conditions will preclude..a low temperature overpressure event due to a thermal transient when the RCP is started.

Note 5 specifies that a containment spray (CS) pump may be used in place of a low pressure safety injection (LPSI) pump in either or both shutdown cooling trains to provide shutdown cooling (SDC) flow based on the calculated heat load of the core 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the reactor is sub-critical with the reactor coolant system (RCS) fully depressurized and vented in accordance with TS 3.4.12.

Note 6 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of SDC trains from operation when at least one RCP is in operation.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-38 Amendment No. +-2-4,175 07/15/05

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO An OPERABLE SDC loop consists of an OPERABLE SDC pump, a (continued) heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and the ability to determine the low end temperature. An associated OPERABLE safety related CCW train is required for an OPERABLE SDC loop. An OPERABLE CCW safety related train includes an OPERABLE full capacity pump, surge tank, heat exchanger, piping, valves and instrumentation. A CCW critical loop remains OPERABLE so long as the non-critical loop isolation valves can be closed automatically on CCW surge tank Io-Io level, or administrative controls are in place isolating the non-seismic portions of the non-critical loop. A CCW critical loop can remain OPERABLE without backup nitrogen if the non-critical loop is aligned to the other train or if the non-seismic portions of the non-critical loop are isolated under administrative controls.

SDC pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. An OPERABLE RCS, loop consists of at least one OPERABLE RCP and an OPERABLE-SG. An OPERABLE SG can perform as a heat sink when it has (continued)

SAN ONOFRE--UNIT 2 B 3.4-38a Amendment No. 7,175 04/03/06 1

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO an adequate water level and is OPERABLE.

(continued)

An OPERABLE RCS loop consists of at least one RCP providing forced flow for heat transport and an SG that is OPERABLE.

An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation to remove decay heat from the core and to provide proper boron mixing. One SDC train/RCS loop provides sufficient circulation for these purposes.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation-High Water Level" (MODE 6); andý'

LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 and A.2 If the required SDC train/RCS loop is inoperable and any SGs have secondary side water levels < 50% wide range, redundancy for heat removal is lost. Action must be initiated immediately to restore a second SDC train/RCS loop to OPERABLE status or to restore the water level in the required SGs. Either Required Action A.1 or Required Action A.2 will restore redundant decay heat removal paths.

The immediate Completion Times reflect the importance of maintaining the availability of two paths for decay heat removal.

B.1 and B.2 If no SDC train/RCS loop is in operation, except as permitted in Note 1, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.2 must be (continued)

SAN ONOFRE--UNIT 2 B 3.4-39 Amendment No. 5,204

RCS Loops-MODE 5, Loops Not Filled B 3.4.8 BASES (continued)

LCO An OPERABLE SDC loop consists of an OPERABLE SDC pump, a (continued) heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and the ability to determine the low end temperature. An associated OPERABLE safety related CCW train is required for an OPERABLE SDC loop. An OPERABLE CCW safety related train includes an OPERABLE full capacity pump, surge tank, heat exchanger, piping, valves and instrumentation. A CCW critical loop remains OPERABLE so long as the non-critical loop isolation valves can be closed automatically on CCW surge tank bo-Io level, or administrative controls are in place isolating the non-seismic portions of the non-critical loop. A CCW critical loop can remain OPERABLE without backup nitrogen if the non-critical loop is aligned to the other train or if the non-seismic portions of the non-critical loop are isolated under administrative controls.

APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the SDC System.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 If the required SDC train is inoperable, redundancy for heat removal is lost. Action must be initiated immediately to restore a second train to OPERABLE status. The Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

B.1 and B.2 If no SDC train is OPERABLE or in operation, except as provided in Note 1 or in Note 2, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.2 must be suspended. Action to restore one SDC train to OPERABLE status and operation must be initiated immediately. The required margin to criticality must not be reduced in this type of operation. Suspending the introduction into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.2 is required to assure continued safe (conti nued)

SAN ONOFRE--UNIT 2 B 3.4-44 Amendment No. +2-7-,175 04/03/06

LTOP System RCS Temperature < PTLR B 3.4.12.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12.1 Low Temperature Overpressure Protection (LTOP) System RCS Temperature < PTLR Limit BAS ES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1).

The reactor vessel is the limiting RCPB component for demonstrating such protection. LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the allowable combinations for operational pressure and temperature during cooldown, shutdown, and heatup to keep from violating the Reference 1 requirements during the LTOP MODES.

The reactor vessel material is less tough at low temperatures than at normal operating temperatures. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only during shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the P/T limits.

The design basis of the LTOP assumes unrestricted flow from two HPSI pumps and three charging pumps (full charging capacity) without letdown. Because there are three HPSI pumps and three charging pumps, the limitation on the number of HPSI pumps to be maintained OPERABLE during the specified MODES, along with isolating the Safety Injection Tanks, ensures that a mass addition to the RCS that exceeds the design basis assumptions of the LTOP will not occur. This limitation on the number of HPSI pumps that can provide (continued)

SAN ONOFRE--UNIT 2 B 3.4-55 Amendment No. I 247-,203

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

BACKGROUND makeup and injection to the RCS implements the guidance (continued) provided in Generic Letter 90-06.

With minimum coolant input capability, the ability to provide core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve and, if needed, until the HPSI pump is actuated by SI.

Shutdown Cooling System Relief Valve Requirements The Shutdown Cooling System relief valve has adequate relieving capability to protect the RCS from overpressurization when the transient is limited to e.ither (1) the start of an idle RCP with the secondary water temperature of the steam generator less than or equal to 100'F above the RCS cold leg temperatures or (2) inadvertent safety injection actuation with two HPSI pumps injecting into a water-solid RCS with full charging capacity and letdown isolated.

RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

The OPERABILITY of an RCS vent opening of greater than 5.6 square inches ensures that the RCS will be protected from pressure transients which could exceed the limits of Appendix G to 10 CFR Part 50 when one or more of the RCS cold legs is less than or equal to that specified in the PTLR. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-56 Amendment No. +2-77203

Reactor Core SLs B 2.1.1 BASES (continued)

SAFETY LIMIT The following violation responses are applicable to the VIOLATIONS reactor core SLs.

2.2.1 If SL 2.1.1.1 or SL 2.1.1.2 is violated, the requirement to go to MODE 3 places the unit in a MODE in which this SL is not applicable.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of bringing the unit to a MODE where this SL is not applicable and reduces the probability of fuel damage.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.

2. UFSAR, Section 15.0.3.2, "Initial Conditions."

3. CEN-386-P-A, "Verification of the Acceptability of a 1-Pin Burnup Limit of 60 MWD/MTU for Combustion Engineering 16x16 PWR Fuel," August 1992.

4. CENPD-382-P-A, "Methodology for Core Designs Containing Erbium Burnable Absorbers," August 1993.

(continued)

SAN ONOFRE--UNIT 3 B 2.0-4 Amendment No. 199 12/21/06

Reactor Core SLs B 2.1.1 BASES (continued)

THIS PAGE INTENTIONALLY LEFT BLANK I, SAN ONOFRE--UNIT 3 B 2.0-5 Amendment No. 199 12/21/06 I

RCS Pressure SL B 2.1.2 BASES (continued)

SAFETY LIMIT The following SL violation responses are applicable to the VIOLATIONS RCS pressure SLs.

2.2.2.1 If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, the requirement is to restore compliance and be in MODE 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

With RCS pressure greater than the value specified in SL 2.1.2 in MODE 1 or 2, the pressure must be reduced to below this value. A pressure greater than the value specified in SL 2.1.2 exceeds 110% of the RCS design pressure and may challenge system integrity.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months provides the operator time to complete the necessary actions to reduce RCS pressure by terminating the cause of the pressure increase, removing mass or energy from the RCS, or a combination of these actions, and to establish MODE 3 conditions.

2.2.2.2 If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes.

Exceeding the RCS pressure SL in MODE 3, 4, or 5 is potentially more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. This action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.

(continued)

SAN ONOFRE--UNIT 3 B 2.0-8 Amendment No. 199 12/21/06

RCS Pressure SL B 2.1.2 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.

2. ASME, Boiler and Pressure Vessel Code, Section III, Article NB-7000.

3. ASME, Boiler and Pressure Vessel Code, Section XI, Article IWX-5000.

4. 10 CFR 100.

5. UFSAR, Section 7.2, "Reactor Protective Systems" SAN ONOFRE--UNIT 3 B 2.0-9 Amendment No. 199 12/21/06 I

LCO Applicability B 3.0 BASES (continued)

LCO 3.0.3 Voluntary entry into LCO 3.0.3 is permissible but requires (continued) prior approval (approval may be verbal) from either the Operations Manager, Station Manager or corporate officer with direct responsibility for the plant. The approval must subsequently be documented in written retrievable manner.

Inadvertent entry still allows for the one hour preparation period before Actions to change MODES must begin.

A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met.

b. A Condition exists for which the Required Actions have now been performed.

c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , then the time allowed for reaching MODE 4 is the next 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3.

The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications (continued)

SAN ONOFRE--UNIT 3 B 3.0-4 Amendment No. 199 12/21/06 I

SDM-Tavg > 200°F B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) -Tavg > 200°F BASES BACKGROUND The reactivity control systems must be redundant and capable of holding the reactor core subcritical when shutdown under cold conditions, in accordance with GDC 26 (Ref. 1).

Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel. As such, SDM defines the Ak/k sub-critical that would be obtained immediately following the insertion of all full length control element assemblies (CEAs), assuming the single CEA of highest reactivity worth is fully withdrawn. The SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences assuming the highest reactivity worth CEA remains fully withdrawn. When the CEAs are all verified to be inserted",.

by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out.

The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable CEAs and soluble boric acid in the Reactor Coolant System (RCS). The CEA System provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage I

limits, assuming that the CEA of highest reactivity worth remains fully withdrawn.

The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes, and maintain the reactor subcritical under cold conditions.

During power operation, SDM control is ensured by operating with the shutdown CEAs fully withdrawn and the regulating CEAs within the limits of LCO 3.1.7, "Regulating Control Element Assembly (CEA) Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-1 Amendment No. 4-6.-,-191 11/18/05

SDM-Tavg > 200°F B 3.1.1 BASES (continued)

APPLICABLE The minimum required SDM is assumed as an initial condition SAFETY ANALYSES in the safety analyses. The safety analyses (Ref. 2) establish an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and I

AOOs, with the assumption of the highest worth CEA stuck out following a reactor trip. When the CEAs are all verified to be inserted, by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out.

LCO SDM is a core physics design condition that can be ensured I through CEA positioning (regulating and shutdown CEAs) and through the soluble boron concentration.

APPLICABILITY In MODES 3 and 4, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses. In MODES I and 2, SDM I is ensured by complying with LCO 3.1.6, "Shutdown Control Element Assembly (CEA) Insertion Limits," and LCO 3.1.7,.

"Regulating CEA Insertion Limits." In MODE 5, SDM is addressed by LCO 3.1.2, "SHUTDOWN MARGIN (SDM) -Tavg

< 200'F." In MODE 6, the shutdown reactivity requirements I are given in LCO 3.9.1, "Boron Concentration."

ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid makeup tanks or the refueling water storage tank.

The operator should borate with the best source available for the plant conditions.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-2 Amendment No. +-I-6-,191 11/18/05 1

SDM-Tavg > 200°F B 3.1.1 BASES (continued)

ACTIONS A.1 (continued)

(continued)

In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the maximum required boron concentration is high.

SURVEILLANCE SR 3.1.1.1 and SR 3.1.1.2 REQUIREMENTS SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:

a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;-

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.

SDM shall be verified to be within limits within I hour following the detection of inoperable CEA(s) and every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This surveillance Frequency allows sufficient time to assess core conditions while considering the reduced available negative reactivity due to inoperable CEAs.

During routine operations SDM is determined with a Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months based on the generally slow change in required boron concentration, and also allows sufficient time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-3 Amendment No. 4-1-6-,191 11/18/05

SDM-Tavg > 200OF B 3.1.1 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. SONGS Units 2 and 3 UFSAR, Section 15. II SAN ONOFRE--UNIT 3 B 3. 1-4 Amendment No. --6-,191 11/18/05 1

SDM-Tavg > 200OF B 3.1.1 THIS PAGE INTENTIONALLY LEFT BLANK I SAN ONOFRE--UNIT 3 B 3.1-5 Amendment No. 4-1-65-191 11/18/05' I

SDM-Tavg > 200 0 F B 3.1.1 THIS PAGE INTENTIONALLY LEFT BLANK I

SAN ONOFRE--UNIT 3 B 3.1-6 Amendment No. 1-i-6-j,191 11/18/05 I

SDM-Tavg _<200'F B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 SHUTDOWN MARGIN (SDM)- Tavg

200'F BASES BACKGROUND The reactivity control systems must be redundant and capable of holding the reactor core subcritical when shut down under cold conditions, in accordance with GDC 26 (Ref. 1).

Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel. As such, SDM defines the %

Ak/k sub-critical that would be obtained immediately following the insertion of all full length control element assemblies (CEAs), assuming the single CEA of highest reactivity worth is fully withdrawn. The SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences assuming the highest reactivity worth CEA remains fully.

withdrawn. When the CEAs are all verified to be inserted,'

by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out.

The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable CEAs and soluble boric acid in the Reactor Coolant System (RCS).

I The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes, and maintain the reactor subcritical under cold conditions.

During power operation, SDM control is ensured by operating with the shutdown CEAs fully withdrawn and the regulating CEAs within the limits of LCO 3.1.7, "Regulating Control Element Assembly (CEA) Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.

(continued)

SAN ONOFRE--UNIT 3 B 3. 1-7 Amendment No. 1-l-6-,191 11/18/05 I

SDM-Tavg < 200'F B 3.1.2 BASES (continued)

APPLICABLE The minimum required SDM is assumed as an initial condition SAFETY ANALYSES in safety analyses. The safety analyses (Ref. 2) establish I an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and AOOs with the assumption of the highest worth CEA stuck out following a reactor trip. When the CEAs are all verified to be inserted, by both open reactor trip breakers and the CEA position indications, it is not required to assume that the highest reactivity worth CEA is stuck out. Specifically, for MODE 5, the primary safety analysis that relies on the SDM limits is the boron dilution analysis.

LCO The boron dilution (Ref. 3) accident initiated in MODE 5 is the most limiting analysis that establishes the SDM value of the LCO. For the boron dilution accident, if the LCO is violated, then the minimum required time assumed for operator action to terminate dilution may no longer be applicable.

SDM is a core physics design condition that can be ensured through CEA positioning (regulating and shutdown CEAs) and through soluble boron concentration.

APPLICABILITY In MODE 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODES I and 2,. SDM is ensured by complying with LCO 3.1.6, "Shutdown Control Element Assembly (CEA) Insertion Limits," and LCO 3.1.7 "Regulating CEA Insertion Limits." In MODES 3 and 4, the SDM requirements are given in LCO 3.1.1, "SHUTDOWN MARGIN (SDM) -Tavg > 200 0 F." In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration."

ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that (continued)

SAN ONOFRE--UNIT 3 B 3. 1-8 Amendment No. I-6-,191 11/18/05 I

SDM- Tavg

200'F B 3.1.2 BASES (continued)

ACTIONS A.1 (continued)

(continued) boration will be continued until the SDM requirements are met. In determining the boration flow rate the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the boron concentration is high.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Because it is imperative to raise the boron concentration of the RCS as soon as possible, a source of water with a high boron concentration is required in the boric acid makeup tanks or the refueling water storage tank. The operator should borate with the best source available for the plant conditions.

SURVEILLANCE SR 3.1.2.1 REQUIREMENTS In MODE 5 the SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:

a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-9 Amendment No. 4-I-,-,191 11/18/05 I

SDM-Tavg

200'F B 3.1.2 BASES (continued)

SURVEILLANCE SR 3.1.2.1 (continued)

REQUIREMENTS The reactivity effects of items c, d, e, and f above, are nominally constant, and are bound while the RCS boron concentration is maintained greater than the refueling boron concentration specified for MODE 6 and all CEAs inserted.

Therefore, adequate SDM is assured by determining at least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months that:

a. The core has not been critical since the refueling (e.g. factors c through f are unchanged).

b. The reactor coolant system boron concentration is greater than or equal to the refueling boron concentration required by TS 3.9.1.

c. All CEAs are inserted.

d. No more than one charging pump is functional, by verifying that power is removed from the remainimngw*

charging pumps, when the RCS is at less than full inventory (i.e., pressurizer level < 5%).

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration, and it allows sufficient time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. UFSAR, Section 15.

3. UFSAR, Section 15.4.1.4. I SAN ONOFRE--UNIT 3 B 3.1-10 Amendment No. 4-+-6-191 11/18/05

SDM-Tavg _<200'F B 3.1.2 THIS PAGE INTENTIONALLY LEFT BLANK I SAN ONOFRE--UNIT 3 B 3.1-11 Amendment No. 4,-6--191 11/18/05 1

SDM-Tavo _<200'F B 3.1.2 THIS PAGE INTENTIONALLY LEFT BLANK I SAN ONOFRE--UNIT 3 B 3.1-12 Amendment No. +1-6-,191 11/18/05 1

Reactivity Bal ance B 3.1.3 BASES (continued)

APPLICABLE the assumptions used in the reload cycle design analysis or SAFETY ANALYSES the calculational models used to predict soluble boron (continued) requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted critical boron curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.

Following each reactor refueling cycle and before entering MODE 1, low power physics tests are conducted to validate the predicted design parameters used in the safety analysis.

During these tests the predicted reactor coolant critical boron concentration is compared with the measured critical boron concentration. If any significant difference exists between the measured and predicted critical boron I

concentrations, the bases for the disparity is determined and evaluated before proceeding into Mode 1.

The normalization of predicted RCS boron concentration to the measured value is to be performed prior to reaching, 60 EFPD following startup from a refueling outage, with the CEAs in their normal positions for power operation. The normalization is performed near BOC, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.

The reactivity balance satisfies Criterion 2 of the NRC Policy Statement.

LCO Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the nuclear design methodology are larger than expected. A limit on the reactivity balance of

+/- 1% Ak/k has been established, based on engineering judgment. A +/-1% Ak/k deviation in reactivity from that predicted is larger than expected for normal operation, and should therefore be evaluated.

(conti nued)

SAN ONOFRE--UNIT 3 B 3.1-15 Amendment No. +4-6-,191 11/18/05 1

Reactivity Balance B 3.1.3 BASES (continued)

ACTIONS A.1 and A.2 (continued)

Completion Time of 7 days is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.

Following'evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected.

If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is inthe calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated and it is concluded tvhatý the--,

reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized, and power operation may continue. If operational restrictions or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.

The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.

B.1 If the core reactivity cannot be restored to within

+/-1% Ak/k, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If the SDM for MODE 3 is not met, then boration as required by TS 3.1.1.1 ACTION A.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-17 Amendment No. --1-6-,191 11/18/05

CEA Alignment B 3.1.5 BASES (continued)

LCO Failure to meet the requirements of this LCO may produce (continued) unacceptable power peaking factors and LHRs, or unacceptable SDMs, all of which may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on CEA OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (e.g., trippability) and alignment of CEAs have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the CEAs are bottomed, and the reactor is shut down and not producing fission power. In the shutdown modes, the OPERABILITY of the shutdown and regulating CEAs has the.

potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)- Tavg

> 200 0 F," for SDM in MODES 3, 4, and 5, and LCO 3.9.1.,

"Boron Concentration," for boron concentration requi-rements during refueling.

ACTIONS A.1. A.2.1. A.2.2. B.1. and B.2 A CEA may become misaligned, yet remain trippable. In this condition, the CEA can still perform its required function of adding negative reactivity should a reactor trip be_

necessary.

If one or more regulating CEAs are misaligned by 7 inches but trippable, continued operation in MODES 1 and 2 may continue, provided within 15 minutes a power reduction is initiated in accordance with the COLR requirements, and within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months the misaligned CEA(s) is aligned within 7 inches of its group or the misaligned CEA's group is aligned within 7 inches of the misaligned CEA(s).

Xenon redistribution in the core starts to occur as soon as a CEA becomes misaligned. Initiating a THERMAL POWER reduction in accordance with the COLR ensures acceptable power distributions are maintained (Ref. 3). For small misalignments (< 7 inches) of a CEA, there is:

(continued)

SAN ONOFRE--UNIT 3 B 3.1-28 Amendment No. 116 May 2, 1997, 191 11/18/05

CEA Alignment B 3.1.5 BASES (continued)

ACTIONS A.1. A.2.1. A.2.2, B.1, and B.2 (continued)

a. A small effect on the time dependent long term power distributions relative to those used in generating LCOs and limiting safety system settings (LSSS) setpoints;

b. A negligible effect on the available SDM; and

c. A small effect on the ejected CEA worth used in the accident analysis.

With a large CEA misalignment (Ž 7 inches), however, this misalignment would cause distortion of the core power distribution. This distortion may, in turn, have a significant effect on the time dependent, long term power distributions relative to those used in generating LCOs and LSSS setpoints.

The effects on the available SDM and the ejected CEA worth used in the accident analysis remain small.

Therefore, this condition is limited to the single CEA misalignment, while still allowing 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for recovery.

In both cases, a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time period is sufficient to:

a. Identify cause of a misaligned CEA;

b. Take appropriate corrective action to realign the CEAs; and

c. Minimize the effects of xenon redistribution.

The CEA must be returned to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or transition to MODE 3.

C.I. C.2.1. and C.2.2 Although a part length CEA has less of an effect on core flux than a full length CEA, a misaligned part length CEA will still result in xenon redistribution and affect core power distribution. Requiring realignment within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months minimizes these effects and ensures acceptable power distribution is maintained.

(continued)

SAN ONOFRE--UNIT 3 B 3. 1-29 Amendment No. 6-,191 11/18/05 I

CEA Alignment B 3.1.5 BASES (continued)

ACTIONS D.1 (continued)

If a Required Action or associated Completion Time of Condition A, Condition B, or Condition C is not met, one regulating or shutdown CEA is untrippable, or more than one full length or part length CEA misaligned, the unit is required to be brought to MODE 3. By being brought to MODE 3, the unit is brought outside its MODE of applicability.

When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

If a CEA is untrippable, it is not available for reactivity insertion during a reactor trip. With an untrippable CEA, (continued)

SAN ONOFRE--UNIT 3 B 3. 1-30 Amendment No. 1--65-191 11/18/05 1

Shutdown CEA Insertion Limits B 3.1.6 BASES (continued)

APPLICABLE The shutdown CEA insertion limits satisfy Criterion 2 of the SAFETY ANALYSES NRC Policy Statement.

(continued)

LCO The shutdown CEAs must be within their insertion limits any time the reactor is critical or approaching criticality.

This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.

APPLICABILITY The shutdown CEAs must be within their insertion limits, with the reactor in MODES I and 2. The Applicability in MODE 2 begins any time any regulating CEA is not fully inserted. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. In I MODE 3, 4, 5, or 6, the shutdown CEAs are fully inserted in the core and contribute to the SDM. Refer to LCO 3.1.1 and LCO 3.1.2, "SHUTDOWN MARGIN (SDM)- Tav < 200F,'" for SDM requirements in MODES 3, 4, and 5. LO 3.9.1, "Boron Concentration," ensures adequate SDM in MODE 6.

This LCO has been modified by a Note indicating the LCO requirement is suspended during SR 3.1.5.3, which verifies the freedom of the CEAs to move, and requires the shutdown CEAs to move below the LCO limits, which would normally violate the LCO.

ACTIONS A. 1 I Prior to entering this Condition, the shutdown CEAs were fully withdrawn. If a shutdown CEA is then inserted into the core, its potential negative reactivity is added to the core as it is inserted.

II If the CEA(s) is not restored to within limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months then an additional 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed for restoring the CEA(s) to within limits. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months total Completion Time allows the operator adequate time to adjust the CEA(s) in an orderly manner and is consistent with the required Completion Times in LCO 3.1.5, "Control Element Assembly (CEA) Alignment."

(conti nued)

SAN ONOFRE--UNIT 3 B 3.1-37 Amendment No. -I+/---,191 11/18/05 1

Shutdown CEA Insertion Limits B 3.1.6 BASES (continued)

ACTIONS B.1 (continued)

When Required Action A.1 cannot be met or completed within the required Completion Time, a controlled shutdown should I

be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS Verification that the shutdown CEAs are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown CEAs will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. This SR ensures that the shutdown CEAs are withdrawn before the regulating CEAs are withdrawn during a unit startup.

Since the shutdown CEAs are positioned manually by the control room operator, verification of shutdown CEA position at a Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate to ensure that the shutdown CEAs are within their insertion limits. Also, the Frequency takes into account other information available to the operator in the control room for the purpose of monitoring the status of the shutdown CEAs.

(continued)

SAN ONOFRE--UNIT 3 B 3. 1-38 Amendment No. +1-1-6,191 11/18/05

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABLE Fuel cladding damage does not occur when the core is SAFETY ANALYSES operated outside these LCOs during normal operation.

(continued) However, fuel cladding damage could result, should an accident occur with simultaneous violation of one or more of these LCOs. Changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.

The SDM requirement is ensured by limiting the regulating and shutdown CEA insertion limits, so that the allowable inserted worth of the CEAs is such that sufficient reactivity is available in the CEAs to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth CEA remains fully withdrawn upon trip (Ref. 3).

The most limiting SDM requirements for Mode I and 2 conditions at BOC are determined by the requirements of several transients, e.g., Loss of Flow, Seized Rotor, etc.

However, the most limiting SDM requirements for Modes 1 and 2 at EOC come from just one transient, Steam Line Break (SLB). The requirements of the SLB event at EOC for both the full power and no load conditions are significantly larger than those of any other event at that time in the cycle and, also, considerably larger than the most limiting requirements at BOC.

Although the most limiting SDM requirements at EOC are much larger than those at BOC, the available SDMs obtained via the scramming of the CEAs are also substantially larger due to the much lower boron concentration at EOC. To verify that adequate SDMs are available throughout the cycle to satisfy the changing requirements, calculations are performed at both BOC and EOC. It has been determined that calculations at these two times in the cycle are sufficient since the differences between available SDMs and the limiting SDM requirements are the smallest at these times in the cycle. The measurement of CEA bank worth performed as part of the Startup Testing Program demonstrates that the core has the expected shutdown capability. Consequently, adherence to LCOs 3.1.6 and 3.1.7 provides assurance that the available SDMs at any time in the cycle will exceed the limiting SDM requirements at that time in the cycle.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-43 Amendment No. -+-6-,191 11/18/05 1

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABLE The regulating and shutdown CEA insertion limits ensure that SAFETY ANALYSES safety analyses assumptions for reactivity insertion rate, (continued) SDM, ejected CEA worth, and power distribution peaking factors are preserved (Ref. 3).

The regulating CEA insertion limits satisfy Criterion 2 of the NRC Policy Statement.

LCO The limits on regulating CEA sequence, and physical insertion, as defined in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected CEA worth is maintained, and ensuring adequate negative reactivity insertion on trip. The overlap between regulating banks provides more uniform rates of reactivity insertion and withdrawal. The overlap of the regulating groups may be increased; provided that the sequence of regulating group movement and the insertion limits are satisfied.

The power dependent insertion limit (PDIL) alarm circuit is required to be OPERABLE for notification that the CEAs are outside the required insertion limits. When the PDIL alarm circuit is inoperable, the verification of CEA positions is increased to ensure improper CEA alignment is identified before unacceptable flux distribution occurs.

(continued)

SAN ONOFRE--UNIT 3 B 3. 1-43a Amendment No. 11--6-,191 11/18/05

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABILITY The regulating CEA sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES 1 and 2. These limits must be maintained, since they preserve the assumed power distribution, ejected CEA worth and SDM assumptions. Applicability in MODES 3, 4, and 5 is not required, since neither the power distribution nor ejected CEA worth assumptions would be exceeded in these MODES. SDM is preserved in MODES 3, 4, and 5 by adjustments to the soluble boron concentration.

This LCO is modified by a Note indicating the LCO requirement is suspended during SR 3.1.5.3. This SR verifies the freedom of the CEAs to move, and requires the regulating CEAs to move below the LCO limits, which would normally violate the LCO.

ACTIONS A.1 and A.2 Operation beyond the transient insertion limit may result in a loss of SDM and excessive peaking factors. The transient insertion limit should not be violated during normal operation. However, violations may occur during transients when the operator is manually controlling the CEAs in response to changing plant conditions. When the regulating groups are inserted beyond the transient insertion limits, actions must be taken to either withdraw the regulating groups above the limits or to reduce THERMAL POWER to less than or equal to that allowed for the actual CEA insertion limit. Two hours provides a reasonable time to accomplish this, allowing the operator to deal with current plant conditions while limiting peaking factors to acceptable levels.

B.1 and B.2 If the CEAs are inserted between the long term steady state insertion limits and the transient insertion limits for (continued)

SAN ONOFRE--UNIT 3 B 3.1-44 Amendment No. +-1-6-,191 11/18/05

Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

ACTIONS C.1 (continued) borated water to enter the Reactor Coolant System from the chemical addition and makeup systems, and to cause the regulating CEAs to withdraw to the acceptable region. It is reasonable to continue operation for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after it is discovered that the 5 EFPD or 14 EFPD limit has been exceeded. This Completion Time is based on limiting the potential xenon redistribution, the low probability of an accident, and the steps required to complete the action.

D.1 and D.2 With the Core Operating Limit Supervisory System out of service, operation beyond the short term steady state insertion limits can result in peaking factors that could approach the DNB or local power density trip setpoints.

Eliminating this condition within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limits the magnitude of the peaking factors to acceptable levels (Ref. 8). Restoring the CEAs to within the limit or reducing THERMAL POWER to that fraction of RTP that is-allowed by CEA group position, using the limits specified in the COLR, ensures acceptable peaking factors are maintained.

E.1 With the PDIL circuit inoperable, performing SR 3.1.7.1 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months thereafter ensures improper CEA alignments are identified before unacceptable flux distributions occur.

F.1 When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is (continued)

SAN ONOFRE--UNIT 3 B 3.1-46 Amendment No. 1-1-6-,191 11/18/05

Boration Systems - Shutdown B 3.1.10 B 3.1 REACTIVITY CONTROL SYSTEM B 3.1.10 Boration Systems - Shutdown BASES BACKGROUND The Chemical and Volume Control System (CVCS) functions to provide a means for reactivity control and maintain reactor coolant inventory, activity, and chemistry in accordance with GDC 26, 27, and 33 (Ref. 1, 2, and 3). The CVCS includes the letdown and boron injection subsystems. The boron injection subsystem is required to establish and maintain a safe shutdown condition for the reactor. The letdown portion of the CVCS is used for normal plant operation, however, it is not required for safety.

One OPERABLE boron injection flow path is required while operating in Modes 5 and 6. The required flow path may include either: 1) The Refueling Water Storage Tank (RWST)

(TO05 and/or T006) via a charging pump or High Pressure Safety Injection Pump, or; 2) A Boric Acid Makeup (BAMU)

Tank via the BAMU pump or gravity feed valve to a charging pump. AC electrical power is available from the OPERABLE power sources specified by TS 3.8.2.

APPLICABLE SAFETY ANALYSES The charging pumps inject concentrated boric acid into the RCS to provide negative reactivity control in MODES 5 and 6.

With the RCS below 200'F one injection system is acceptable without single failure considerations on the basis of the stable reactor condition and additionai restrictions on CORE ALTERATIONS.

Boron dilution is conducted under strict procedural controls which specify limits on the rate and magnitude of any required change in boron concentration. Therefore, the probability of a sustained or erroneous dilution is very low. The high neutron flux alarm on the startup channel instrumentation will alert the operator of a boron dilution event. The operator will terminate the dilution before losing shutdown margin by either turning off the charging (continued)

SAN ONOFRE--UNIT 3 B 3.1-59 Amendment No. 11* o08/21/0J0--

191 11/18/05

DNBR B 3.2.4 BASES (continued)

APPLICABLE potential for fuel cladding damage exists because changes in SAFETY ANALYSES the power distribution can cause increased power peaking (continued) and correspondingly increased local LHRs.

DNBR satisfies Criterion 2 of the NRC Policy Statement.

LCO The power distribution LCO limits are based on correlations between power peaking and certain measured variables used as inputs to the LHR and DNBR operating limits. The power distribution LCO limits are provided in the COLR.

With the COLSS in service and one or both of the control element assembly calculators (CEACs) OPERABLE, the DNBR will be maintained by ensuring that the core power calculated by the COLSS is equal to or less than the permissible core power operating limit based on DNBR calculated by the COLSS.

In the event that the COLSS is in service but neither of the two CEACs is OPERABLE, the DNBR is maintained by ensuring that the core power calculated by the COLSS is equal to or less than a reduced value of the permissible core power operating limit calculated by the COLSS. In this condition, the calculated operating limit must be reduced by the allowance specified in the COLR.

In instances for which the COLSS is out of service and either one or both of the CEACs are OPERABLE, the DNBR is maintained by operating within the acceptable region specified in the COLR using any OPERABLE CPC channel.

Alternatively, when the COLSS is out of service and neither of the two CEACs is OPERABLE, the DNBR is maintained by operating within the acceptable region specified in the COLR using any OPERABLE CPC channel.

With the COLSS out of service, the limitation on DNBR as a function of the ASI represents a conservative envelope of operating conditions consistent with the analysis assumptions that have been analytically demonstrated adequate to maintain an acceptable minimum DNBR for all AOOs. Of these, the postulated loss of flow transient is the most limiting. Operation of the core with a DNBR at or above this limit ensures that an acceptable minimum DNBR is maintained in the event of a loss of flow transient.

(continued)

SAN ONOFRE--UNIT 3 B. 3.2-30 Amendment No. +-1-6,-191 11/18/05 I

ESFAS Instrumentation B 3.3.5 BASES (continued)

ACTIONS D.1 and D.2 (continued)

Function is in two-out-of-three logic in the bypassed input parameter, but with another channel failed, the ESFAS may be operating with a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected.

To correct the problem, the second channel is placed in trip. This places the ESFAS Function in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, ESFAS actuation will occur.

Action D.2 provides a limit of 7 days for operation with 2 inoperable channels. In the one-out-of-two configuration, a single channel failure can cause a spurious trip. For RAS and EFAS functions, a spurious trip can lead to undesireable consequences during certain Design Basis Events.

The 7 day time limit provides operational flexibility to perform a required CHANNEL FUNCTIONAL TEST on one channel (which is bypassed) while a second channel is inoperable (and is tripped).

The 7 day time limit also maintains acceptable core damage frequency as discussed in NSG 98-007, Time Limit for RAS or EFAS Channel in Trip (Reference 11).

E.1, E.2.1, and E.2.2 Condition C applies to one automatic bypass removal channel inoperable. The only automatic bypass removal on an ESFAS is on the Pressurizer Pressure-Low signal. This bypass removal is shared with the RPS Pressurizer Pressure-Low bypass removal.

If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status, the associated ESFAS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise, the affected ESFAS channel must be declared inoperable, as in Conditions A and B, and the bypass either removed or the bypass removal channel repaired. The Bases for the Required Actions and required Completion Times are consistent with Conditions A and B.

(continued)

SAN ONOFRE--UNIT 3 B 3.3-100 Amendment No. 188 07/19/05

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.3-152 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.3-153 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.3-154 Amendment No. 200 12/05/06 1

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.3-155 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.3-156 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.3-157 Amendment No. 200 12/05/06 I

PAM Instrumentation B 3.3.11 BASES (continued)

SURVEI LLANCE SR 3.3.11.4 REQUIREMENTS A CHANNEL CALIBRATION is performed every 18 months. CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies the channel responds to the measured parameter within the necessary range and accuracy.

The Frequency is based upon operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

SR 3.3.11.5 A CHANNEL CALIBRATION is performed every 24 months. The Frequency is based upon operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 24 month calibration interval for the determination of the magnitude of equipment drift.

REFERENCES 1. SONGS Units 2 and 3 Regulatory Guide 1.97 Instrumentation Report #90010A. I

2. Regulatory Guide 1.97, Revision 2.

3. NUREG-0737, Attachment 1.

4. UFSAR, Section 7.5.1.7.

SAN ONOFRE--UNIT 3 B 3.3-175 Amendment No. 116 03/06/06

RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

The PTLR contains P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature (Ref. 1).

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.

10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the ASME Code,Section III, Appendix G (Ref. 3).

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 3.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-9 Amendment No. +-1-6-,195 I

RCS P/T Limits B 3.4.3 BASES (continued)

ACTIONS C.1 and C.2 (continued)

The Completion Time of "prior to entering MODE 4" forces the evaluation prior to entering a MODE where temperature and pressure can be significantly increased. The evaluation for a mild violation is possible within several days, but more severe violations may require special, event specific stress analyses or inspections.

Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within the PTLR limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.

Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.

This SR is modified by a Note that requires this SR be performed only during RCS system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.

NOTE: Any change in RCS temperature of less than 10 degrees F in any one hour period during normal operation is not considered an RCS heatup/

cooldown. This type of transient is determined by ASME III Code Class 1 stress calculations to be an insignificant transient in the contribution to the component fatigue usage factor.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-15 Amendment No. 116 n/n30/n195 I

RCS P/T Limits B 3.4.3 BASES (continued)

SURVEILLANCE SR 3.4.3.2 REQUIREMENTS (continued) This SR verifies that the reactor vessel material irradiation surveillance specimens will be removed and examined, to determine changes in material properties, as required by 10 CFR 50 Appendix H. The results of these examinations will be used to update the PTLR.

REFERENCES 1. CE NPSD-683-A, The Development of a RCS Pressure and Temperature Limits Report for the Removal of P-T Limits and LTOP Setpoints from the Technical Specifications.

2. 10 CFR 50, Appendix G.

3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.

4. ASTM E185-73.

5. 10 CFR 50, Appendix H.

6. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.

7. UFSAR, Chapter 5.

SAN ONOFRE--UNIT 3 B 3.4-16 Amendment No. +-+-6-,195

Pressurizer Heatup and Cooldown Limits B 3.4.3.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3.1 Pressurizer Heatup and Cooldown Limits.

BASES BACKGROUND All components in the Reactor Coolant System are designed to withstand the effects of cyclic loads due to system temperature and pressure changes. These cyclic loads are introduced by normal load transients, reactor trips, and startup and shutdown operations. The various categories of load cycles used for design purposes are provided in the UFSAR (Ref. 1). During startup and shutdown, the rates of temperature and pressure changes are limited so that the maximum specified heatup and cooldown rates are consistent with the design assumptions and satisfy the stress limits for cyclic operation.

During normal plant operations, primarily heatup and cooldown, some plant operating practices can induce pressurizer insurge and outsurge cycles which may effect the structural integrity of the pressurizer vessel. These insurge/outsurge cycles can introduce additional stress and fatigue loading to the lower region of the pressurizer.

Two components of the pressurizer are especially sensitive to thermal loading changes. They are the pressurizer spray line spray nozzle and the pressurizer surge line. Of I particular concern is the potential for flow stratification in the spray line during operation involving fewer than four RCPs. The horizontal piping configuration at the top of the spray line has been modified with a one-piece gooseneck arrangement, to promote filling the spray line and to reduce thermal cycling fatigue.

During RCP heatup and cooldown, both RCP PO01 and P003 in the loop lA/1B (with the pressurizer) should be operated whenever possible to ensure that the spray line remains filled. If this is not possible, throttling the main spray valve to keep the line filled is recommended. Thermal fatigue analyses of both the spray nozzle and spray piping using similar transient loadings were re-performed to the 1980 edition of the ASME Code Section III.

(continued)

SAN-ONOFRE--UNIT 3 B 3.4-17 Amendment No. 188 07/19/05 I

Pressurizer Heatup/Cooldown B 3.4.3.1 BASES (continued)

BACKGROUND In these analyses, the number of allowable thermal fatigue (continued) cycles approaches infinity at differential temperatures of 200'F or less. A small continuous flow is maintained through the spray lines, by two 3/4" needle valves, bypassing the mainspray control valves. The purpose of this flow is to reduce thermal shock to the spray nozzle and I spray line when the spray control valves open. This limits the differential temperature to within the 200'F assumed in the Code stress reports. This consideration is enforced by requiring bypass flow to be within 85°F of RCL cold leg temperature (Ref. 3).

The Pressurizer Spray nozzle has been evaluated for susceptibility to permanent component deformation during overcooling events exceeding the thermal transient limits of Pressure/Temperature Limits. The evaluation was performed applying the "thermal ratcheting" criteria of ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7 (Ref.4). Limit curves to permanent deformation are published that give the maximum allowable temperature change as a function of transient duration and system pressure.

The pressurizer surge line nozzle has been evaluated for susceptibility to permanent component deformation during overcooling events exceeding the thermal transient limits of Pressure/Temperature Limits. The evaluation was performed applying the "thermal ratcheting" criteria of ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7.

Limit curves are published for the Pressurizer surge line nozzles that check for deformation due to the ratcheting and these should be utilized to evaluate component operability following an overcooling event, and prior to return to operation.

APPLICABLE The limitations imposed on the pressurizer heatup and SAFETY ANALYSES cooldown rates and spray water temperature differential are provided to assure that the pressurizer is operated within the design criteria assumed for the fatigue analysis performed in accordance with the ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7 requirements.

(conti nued)

SAN-ONOFRE--UNIT 3 B 3.4-18 Amendment No. 188 07/19/05 1

Pressurizer Heatup/Cooldown B 3.4.3.1 BASES (continued)

ACTIONS C.1 and C.2 (continued)

If requirements of the LCO are not met at any time in other than MODES 1, 2, 3, or 4, the Required Action C.1 requires to immediately initiate action to restore parameter(s) to within limits specified in the Pressure/Temperature Limits.

Also, Required Action C.2 requires to perform engineering evaluation prior to entering MODE 4 to determine the effects of the out-of-limit condition on the structural integrity of the pressurizer.

CONDITION C is modified by a Note which requires to determine the pressurizer is acceptable for continued operation whenever the requirements of the LCO not met any time in other than MODES 1, 2, 3, or 4.

SURVEILLANCE SR 3.4.3.1.1 REQUIREMENTS To minimize the potential thermal stresses of the pressurizer during startup and shutdown, the rate of temperature changes should be monitored during startup and shutdown. The verification these rates are within limits specified in the Pressure/Temperature Limits should be made every 30 minutes. This FREQUENCY is based on operating experience and reflects the importance of the possible effect of temperature changes rate during such Unit evolutions as startup and shutdown on pressurizer and its components integrity.

This SURVEILLANCE REQUIREMENT is modified by a Note which requires to perform this SR during pressurizer heatup and cooldown operations only.

SR 3.4.3.1.2 SR 3.4.3.1.2 requires to determine for use in the Pressure/Temperature Limits the spray water temperature differential for each cycle of auxiliary spray operation and for each cycle of main spray operation when the RCS cold leg temperature is < 500'F. The spray nozzle thermal transients for normal (4-RCP) and auxiliary spray operations are developed in the calculation package S-PEC-368, and are used as design input for the Pressurizer Class-1 stress report.

A maximum temperature differential of 200'F is assumed for normal spray operations. Of particular (continued)

SAN-ONOFRE--UNIT 3 B 3.4-20 Amendment No. 188 07/19/05 1

Pressurizer Heatup/Cooldown B 3.4.3.1 BASES (continued)

SURVEILLANCE SR 3.4.3.1.2 (continued)

REQUIREMENTS concern is the potential for flow stratification in the pressurizer spray line during operations involving fewer than four RCPs. The horizontal piping configuration at the top of the spray line has been modified with a one-piece gooseneck arrangement, to promote filling the spray line and to reduce thermal cycling fatigue.

Pressurizer spray line temperature indication is provided by two RTDs relocated close to the top of the spray riser in order to better represent the actual spray temperature as it enters the pressurizer. Because of unexpectedly high ambient heat losses in the spray piping, the bypass valve was unable to hold the spray line to withinthe previously analyzed 40°F temperature step. Additional analysis in 1984 showed acceptable results for an 85 0 F transient. DOuring loss of offsite power the RCS is depressurized using auxiliary spray.

The auxiliary spray is safety grade and has power supplied by the Class 1E 480V onsite power distribution system. A bypass line around the auxiliary spray valve allows depressurization using manual valve if the motor-operated auxiliary spray valve should fail. The design basis minimum value of continuous bypass flow, 3-6 gpm, includes consideration of maintaining the line full of water, in order to preclude a counter flow of steam vapor into the spray line.

REFERENCES 1. UFSAR, Section 3.9, "Mechanical Systems and Components."

2. Pressurizer, Instruction Manual, S023-919-68-01, April, 1977.

3. Design Basis Document, DBD-S023-360, "Reactor Coolant System."

4. ASME Code Section III, articles NB-3653.1, NB-3653.2, and NB-3653.7.

(continued)

SAN-ONOFRE--UNIT 3 B 3.4-21 Amendment No. 188 07/19/05 1

RCS Loops-MODES I and 2 B 3.4.4 BASES (continued)

APPLICABLE aspect for this LCO is the reactor coolant forced flow rate, SAFETY ANALYSES which is represented by the number of RCS loops in service.

(continued)

Both transient and steady state analyses have been performed to establish the effect of flow on DNB. The transient or accident analysis for the plant has been performed assuming four RCPs are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are of most importance to RCP operation are the four pump coastdown, single pump locked rotor, single pump (broken shaft or coastdown), and rod withdrawal events (Ref. 1).

RCS loops-MODES 1 and 2 satisfy Criterion 3 of the NRC Policy Statement.

LCO The purpose of this LCO is to require adequate forced flow for core heat removal. Flow is represented by having both RCS loops with both RCPs in each loop in operation for removal of heat by the two SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required to be at rated power.

Each OPERABLE loop consists of two RCPs providing forced flow for heat transport to an SG that is OPERABLE. SG, and hence RCS loop, OPERABILITY with regard to SG water level is ensured by the Reactor Protection System (RPS) in MODES 1 and 2. A reactor trip places the plant in (continued)

SAN ONOFRE--UNIT 3 B 3.4-24 Amendment No. 41--6,196

RCS Loops-MODE 3 B 3.4.5 BASES (continued)

LCO of requiring both SGs to be capable (> 50% wide range water (continued) level) of transferring heat from the reactor coolant at a controlled rate. Forced reactor coolant flow is the required way to transport heat, although natural circulation flow provides adequate removal. A minimum of one running RCP meets the LCO requirement for one loop in operation.

The Note permits a limited period of operation without RCPs.

All RCPs may be de-energized for

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. This means that natural circulation has been established. When in natural circulation, a reduction in boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained is prohibited because an even concentration distribution throughout the RCS cannot be ensured. Core outlet temperature is to be maintained at least 10'F below the saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

In MODES 3, 4, and 5, it is sometimes necessary to stop all RCPs or shutdown cooling (SDC) pump forced circulation (e.g., to change operation from one SDC train to the other, to perform surveillance or startup testing, to perform the transition to and from SDC System cooling, or to avoid operation below the RCP minimum net positive suction head limit). The time period is acceptable because natural circulation is adequate for heat removal, or the reactor coolant temperature can be maintained subcooled and boron stratification affecting reactivity control is not expected.

An OPERABLE loop consists of at least one RCP providing forced flow for heat transport and an SG that is OPERABLE.

An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 3, the heat load is lower than at power; therefore, one RCS loop in operation is adequate for transport and heat removal. A second RCS loop is required to be OPERABLE but not in operation for redundant heat removal capability.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.6, "RCS Loops-MODE 4";

(conti nued)

SAN ONOFRE--UNIT 3 B 3.4-28 Amendment No. 116,166,196

RCS Loops-MODE 4 B 3.4.6 BASES (continued)

LCO prohibits boron dilution with coolant at boron (continued) concentrations less than required to assure the SDM of LCO 3.1.1 is maintained an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained at least 1O0 F below saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. The response of the RCS without the RCPs or SDC pumps depends on the core decay heat load and the length of time that the pumps are stopped. As decay heat diminishes, the effects on RCS temperature and pressure diminish. Without cooling by forced flow, higher heat loads will cause the reactor coolant temperature and pressure to increase at a rate proportional to the decay heat load. Because pressure can increase, the applicable system pressure limits (pressure and temperature (P/T) limits or low temperature overpressure protection (LTOP) limits) must be observed and forced SDC flow or heat removal via the SGs must be re-established prior to reaching the pressure limit. The circumstances for stopping both RCPs or SDC pumps are to be limited to situations where:

a. Pressure and temperature increases can be maintained well within the allowable pressure (P/T limits and LTOP) and 10OF subcooling limits; or

b. An alternate heat removal path through the SGs is in operation.

Note 2 requires that either of the following two conditions be satisfied before an RCP may be started with any RCS cold leg temperature less than or equal to the LTOP enable temperature specified in the PTLR.

a. Pressurizer water volume is < 900 ft 3 ; or

b. Secondary side water temperature in each SG is < 100°F above each of the RCS cold leg temperatures.

Satisfying the above condition will preclude a large pressure surge in the RCS when the RCP is started.

An OPERABLE RCS loop consists of at least one OPERABLE RCP and an SG that is OPERABLE and has the minimum water level specified in SR 3.4.6.2.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-32 Amendment No. 116,166,195,196 I

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO maintained subcooled, and boron stratification affecting (continued) reactivity control is not expected.

Note 2 allows one SDC train to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other SDC train is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable train during the only time when such testing is safe and possible.

Note 3 allows one RCS loop to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other RCS loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.

Note 4 requires that either of the following two conditions be satisfied before an RCP may be started:

a. Pressurizer water volume must be < 900 ft 3 ; or

b. Secondary side water temperature in each SG must be

< 100'F above each of the RCS cold leg temperatures.

Satisfying either of the above conditions will preclude a low temperature overpressure event due to a thermal transient when the RCP is started.

Note 5 specifies that a containment spray (CS) pump may be used in place of a low pressure safety injection (LPSI) pump in either or both shutdown cooling trains to provide shutdown cooling (SDC) flow based on the calculated heat load of the core 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the reactor is sub-critical with the reactor coolant system (RCS) fully depressurized and vented in accordance with TS 3.4.12.

Note 6 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of SDC trains from operation when at least one RCP is in operation.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-38 Amendment No. +-+6,166 07/15/05

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO An OPERABLE SDC loop consists of an OPERABLE SDC pump, a (continued) heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and the ability to determine the low end temperature. An associated OPERABLE safety related CCW train is required for an OPERABLE SDC loop. An OPERABLE CCW safety related train includes an OPERABLE full capacity pump, surge tank, heat exchanger, piping, valves and instrumentation. A CCW critical loop remains OPERABLE so long as the non-critical loop isolation valves can be closed automatically on CCW surge tank Io-Io level, or administrative controls are in place isolating the non-seismic portions of the non-critical loop. A CCW critical loop can remain OPERABLE without backup nitrogen if the non-critical loop is aligned to the other train or if the non-seismic portions of the non-critical loop are isolated under administrative controls.

SDC pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. An OPERABLE RCS loop consists of at least one OPERABLE RCP and an OPERABLE SG. An OPERABLE SG can perform as a heat sink when it has (continued)

SAN ONOFRE--UNIT 3 B 3.4-38a Amendment No. -146,166 04/03/06 1

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES (continued)

LCO an adequate water level and is OPERABLE.

(continued)

An OPERABLE RCS loop consists of at least one RCP providing forced flow for heat transport and an SG that is OPERABLE.

An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation to remove decay heat from the core and to provide proper boron mixing. One SDC train/RCS loop provides sufficient circulation for these purposes.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 and A.2 If the required SDC train/RCS loop is inoperable and any SGs have secondary side water levels < 50% wide range, redundancy for heat removal is lost. Action must be initiated immediately to restore a second SDC train/RCS loop to OPERABLE status or to restore the water level in the required SGs. Either Required Action A.1 or Required Action A.2 will restore redundant decay heat removal paths.

The immediate Completion Times reflect the importance of maintaining the availability of two paths for decay heat removal.

B.1 and B.2 If no SDC train/RCS loop is in operation, except as permitted in Note 1, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.2 must be (continued)

SAN ONOFRE--UNIT 3 B 3.4-39 Amendment No. 116,166,196 1

RCS Loops-MODE 5, Loops Not Filled B 3.4.8 BASES (continued)

LCO An OPERABLE SDC loop consists of an OPERABLE SDC pump, a (continued) heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and the ability to determine the low end temperature. An associated OPERABLE safety related CCW train is required for an OPERABLE SDC loop An OPERABLE CCW safety related train includes an OPERABLE'full capacity pump, surge tank, heat exchanger, piping, valves and instrumentation. A CCW critical loop remains OPERABLE so long as the non-critical loop isolation valves can be closed automatically on CCW surge tank Io-Io level, or administrative controls are in place isolating the non-seismic portions of the non-critical loop. A CCW critical loop can remain OPERABLE without backup nitrogen if the non-critical loop is aligned to the other train or if the non-seismic portions of the non-critical loop are isolated under administrative controls.

APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the SDC System.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation -High Water Level" (MODE 6); and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A. 1 If the required SDC train is inoperable, redundancy for heat removal is lost. Action must be initiated immediately to restore a second train to OPERABLE status. The Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

B.1 and B.2 If no SDC train is OPERABLE or in operation, except as provided in Note 1 or in Note 2, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.2 must be suspended. Action to restore one SDC train to OPERABLE status and operation must be initiated immediately. The required margin to criticality must not be reduced in this type of operation. Suspending the introduction into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.2 is required to assure continued safe (continued)

SAN ONOFRE--UNIT 3 B 3.4-44 Amendment No. +-1-6,166 04/03/06 1

LTOP System RCS Temperature < PTLR B 3.4.12.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12.1 Low Temperature Overpressure Protection (LTOP) System RCS Temperature

PTLR BAS ES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1).

The reactor vessel is the limiting RCPB component for demonstrating such protection. LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the allowable combinations for operational pressure and temperature during cooldown, shutdown, and heatup to keep from violating the Reference 1 requirements during the LTOP MODES.

The reactor vessel material is less tough at low temperatures than at normal operating temperatures. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only during shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the P/T limits.

The design basis of the LTOP assumes unrestricted flow from two HPSI pumps and three charging pumps (full charging capacity) without letdown. Because there are three HPSI pumps and three charging pumps, the limitation on the number of HPSI pumps to be maintained OPERABLE during the specified MODES, along with isolating the Safety Injection Tanks, ensures that a mass addition to the RCS that exceeds the design basis assumptions of the LTOP will not occur. This limitation on the number of HPSI pumps that can provide (continued)

SAN ONOFRE--UNIT 3 B 3.4-55 Amendment No. ++6--I-195 1

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

BACKGROUND makeup and injection to the RCS implements the guidance (continued) provided in Generic Letter 90-06.

With minimum coolant input capability, the ability to provide core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve and, if needed, until the HPSI pump is actuated by SI.

Shutdown Cooling System Relief Valve Requirements The Shutdown Cooling System relief valve has adequate relieving capability to protect the RCS from overpressurization when the transient is limited to either (1) the start of an idle RCP with the secondary water temperature of the steam generator less than or equal to IO0F above the RCS cold leg temperatures or (2) inadvertent safety injection actuation with two HPSI pumps injecting into a water-solid RCS with full charging capacity and letdown isolated.

RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

The OPERABILITY of an RCS vent opening of greater than 5.6 square inches ensures that the RCS will be protected from pressure transients which could exceed the limits of Appendix G to 10 CFR Part 50 when one or more of the RCS cold legs is less than or equal to that specified in the PTLR. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-56 Amendment No. ++-6-,195 I

LTOP System RCS Temperature _<PTLR B 3.4.12.1 BASES (continued)

APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel SAFETY ANALYSES is adequately protected against exceeding the Reference 1 P/T limits during shutdown. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown with RCS cold leg temperature greater than that specified in the PTLR.

In the event that no safety valves are OPERABLE and for RCS cold leg temperature less than or equal to that specified in the PTLR, the operating shutdown cooling relief valve, connected to the RCS, provides overpressure relief capability and will prevent RCS overpressurization. When the RCS is depressurized, an RCS vent to atmosphere sized 5.6 inches or greater may be used as an alternative to the SDCS Relief Valve.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System will be re-evaluated to ensure its functional requirements can still be satisfied using the relief valve method or the depressurized and vented RCS condition.

Reference 3 contains the acceptance limits that satisfy the LTOP requirements. Any change to the RCS must be evaluated against these analyses to determine the impact of the change on the LTOP acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:

Mass Inout Tvoe Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

Heat Input Type Transients

a. Inadvertent actuation of pressurizer heaters;

b. Loss of shutdown cooling (SDC); or (continued)

SAN ONOFRE--UNIT 3 B 3.4-57 Amendment No. 4-1-6-,195 I

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

APPLICABLE Heat Input Type Transients (continued)

SAFETY ANALYSES

c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle:

a. No more than two HPSI pumps OPERABLE.

b. Deactivating the SIT discharge isolation valves in their closed positions when SIT pressure equals or exceeds the maximum RCS pressure for existing RCS cold leg temperature allowed by the Pressure/Temperature Limits.

Shutdown Cooling System Relief Valve Performance One SDCS Relief Valve isolation valve pair is capable of mitigating an LTOP event that is bounded by the limiting SDCS pressure transients. When one or both SDCS Relief Valve isolation valve(s) in one isolation valve pair becomes INOPERABLE, the other OPERABLE SDCS Relief Valve isolation valve pair is placed in a power-lock open condition to preclude a single failure which might cause undesired mechanical motion of one or both of the OPERABLE SDCS Relief Valve isolation valve(s) in a single isolation valve pair and result in loss of system function. This power-lock open condition of the OPERABLE SDCS Relief Valve isolation valve pair is consistent with the guidance provided in Branch Technical Position ICSB 18 (PSB), "Application of the Single Failure Criterion to Manually-Controlled Electrically-Operated Valves."

RCS Vent Performance The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.

The RCS vent is passive and is not subject to active failure.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-58 Amendment No. 4-i-6--195 I

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

LCO This LCO is required to ensure that the LTOP System is (continued) OPERABLE. The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE.

Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference I limits as a result of an operational transient.

To limit the coolant input capability, the LCO requires at most two HPSI pumps capable of injecting into the RCS and the SITS isolated or depressurized to less than the Pressure/Temperature Limits. LCO 3.5.3, "ECCS-Shutdown,"

defines the pump OPERABILITY requirements. LCO 3.3.2, "Engineered Safety Feature Activation System (ESFAS)

Instrumentation," defines SI actuation OPERABILITY for the LTOP MODE 4 small break LOCA, as discussed in the previous section.

The elements of the LCO that provide overpressure mitigation through pressure relief are:

a. The Shutdown Cooling System Relief Valve; or

b. The depressurized RCS and an RCS vent.

The SDCS is OPERABLE for LTOP when both trains of isolation valves are open, its lift setpoint is set at 406 +/- 10 psig or less and testing has proven its ability to open at that setpoint. An RCS vent is OPERABLE when open with an area Ž 5.6 square inches.

Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

APPLICABILITY This LCO is applicable in MODE 4 when the temperature of any RCS cold leg is less than or equal to the LTOP enable temperature specified in the PTLR, in MODE 5, and in MODE 6 when the reactor vessel head is on. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above the LTOP enable temperatures specified in the PTLR. When the reactor vessel head is off, overpressurization cannot occur.

(conti nued)

SAN ONOFRE--UNIT 3 B 3.4-59 Amendment No. 4I-6--195 1

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

LCO LCO 3.4.3 provides the operational P/T limits for all MODES.

(continued) LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above the enable temperatures specified in the PTLR.

APPLICABILITY Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

The Applicability is modified by a Note stating that SIT isolation or depressurization to less than the Pressure/

Temperature Limits only required when the SIT pressure is greater than or equal to the RCS pressure for the existing temperature, as allowed by the P/T limit in the PTLR. This Note permits the SIT discharge valve surveillance performed only under these pressure and temperature conditions.

ACTIONS A.1 With more than two HPSI pumps capable of injecting into the RCS, overpressurization is possible.

The immediate Completion Time to initiate actions to restore restricted coolant input capability to the RCS reflects the importance of maintaining overpressure protection of the RCS.

B.1 When the SIT pressure is greater than or equal to the maximum RCS pressure for the existing cold leg temperature allowed in the PTLR, an unisolated SIT requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

(continued)

SAN ONOFRE--UNIT 3 B 3.4-60 Amendment No. 1-6-,195 1

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

ACTIONS B.1 (continued)

By isolating the SIT(s), the RCS is protected against the SIT tanks pressurizing the RCS in excess of the LTOP limits.

The Completion Time is based on operating experience that this activity can be accomplished in this time period and on engineering evaluation indicating that an event requiring LTOP is not likely in the allowed time.

C.1 If the Required Action and associated Completion Time of condition B is not met, the affected SIT(s) must be depressurized to less than the maximum RCS pressure for the existing cold leg temperature allowed in the PTLR within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

By depressurizing the SIT(s) below the LTOP limit stated in.

the PTLR the RCS is protected against the SIT(s) pressurizing the RCS in excess of the LTOP limits.

The Completion Time is based on operating experience that this activity can be accomplished in this time period and on engineering evaluation indicating that an event requiring LTOP is not likely in the allowed time.

D.1 and D.2 The 24-hour Allowable Outage Time (AOT) for a single channel SDCS Relief Valve isolation valve(s) increases the availability of the LTOP system to mitigate low temperature overpressure transients especially during MODES 5 and 6 when the potential for these transients are highest (RCS temperatures between 80'F and 190'F and the RCS is water-solid). The 24-hour AOT implements the guidance provided in Generic Letter 90-06 (Ref. 6).

E.1 If the SDCS Relief Valve is inoperable, or if a Required Action and the associated Completion Time of Condition A, (continued)

SAN ONOFRE--UNIT 3 B 3.4-61 Amendment No. -I-I-6-,195 1

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

ACTIONS E.1 (continued)

C, or D are not met, or if the LTOP System is inoperable for any reason other than Condition A, C or D, the RCS must be depressurized and a vent established within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The vent must be sized at least 5.6 square inches to ensure the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action protects the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to depressurize and vent the RCS is based on the time required to place the plant in this condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

SURVEILLANCE SR 3.4.12.1.1 and SR 3.4.12.1.2 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, not more than two HPSI pumps are verified OPERABLE. The other pump is secured by verifying that its motor circuit breaker is not racked-in, or its discharge valve is locked closed and power is removed. Additionally, the SIT discharge isolation valves are verified closed and deactivated or SIT(s) are depressurized to less than the values in the PTLR.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval considers operating practice to regularly assess potential degradation and to verify operation within the safety analysis.

SR 3.4.12.1.3 SR 3.4.12.1.3 requires verifying that the RCS vent is open 2 5.6 square inches is proven OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for a vent valve that is unlocked open; and (continued)

SAN ONOFRE--UNIT 3 B 3.4-62 Amendment No. 116 May 2, 1997,195

LTOP System RCS Temperature

PTLR B 3.4.12.1 BASES (continued)

SURVEILLANCE SR 3.4.12.1.3 (continued)

REQUIREMENTS

b. Once every 31 days for a valve that is locked, sealed, or otherwise secured open and once every 31 days for open flanged RCS penetrations.

The passive vent arrangement must only be open to be OPERABLE. This Surveillance need only be performed if the vent is being used to satisfy the requirements of this LCO.

The Frequencies consider operating experience with mispositioning of unlocked and locked vent valves, respectively.

SR 3.4.12.1.4 and SR 3.4.12.1.5 When one or both SDCS Relief Valve isolation valve(s) in one isolation valve pair becomes inoperable, the other OPERABLE SDCS Relief Valve isolation valve pair is verified in a power-lock open condition every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to preclude a single failure which might cause undesired mechanical motion of one or both of the OPERABLE SDCS Relief Valve isolation valve(s) in a single isolation valve pair and result in loss of system function.

This surveillance requirement, SR 3.4.12.1.4, is modified by two notes. Note 1 requires to perform this SR when the SDCS Relief Valve isolation valve pair is inoperable. Note 2 specifies that the power lock-open requirement is satisfied either with the AC breakers open for valve pair 3HV9337 and 3HV9339 or the regulating transformer output breakers open for valve pair 3HV9377 and 3HV9378, whichever valve pair is OPERABLE.

When both pairs of SDCS Relief Valve isolation valves are OPERABLE and the SDCS Relief Valve is used for overpressure protection, the isolation valves are verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

SR 3.4.12.1.6 The SDCS Relief Valve Setpoint is verified periodically in accordance with the Inservice Testing Program.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-63 Amendment No. 116 03/30//9n9-,195 1

LTOP System RCS Temperature < PTLR B 3.4.12.1 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix G.

2. Generic Letter 88-11.

3. UFSAR, Section 15.

4. 10 CFR 50.46.

5. 10 CFR 50, Appendix K.

6. Generic Letter 90-06.

SAN ONOFRE--UNIT 3 B 3.4-64 Amendment No. +-+-6-,195 I

LTOP System RCS Temperature > P.TLR B 3.4.12.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12.2 Low Temperature Overpressure Protection (LTOP) System RCS Temperature > PTLR Limit BAS ES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1).

The reactor vessel is the limiting RCPB component for demonstrating such protection. LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the allowable combinations for operational pressure and temperature during cooldown, shutdown, and heatup to keep from violating the Reference I requirements during the LTOP MODES.

The reactor vessel material is less tough at low temperatures than at normal operating temperatures. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only during shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the P/T limits.

In MODE 4 when the temperature of any RCS cold leg is greater than the enable temperatures specified in the PTLR the LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked.

The LTOP System consists of the Shutdown Cooling System Relief Valve with both pairs of SDCS Relief Valve isolation valves open, or a minimum of one pressurizer code safety valve OPERABLE.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-65 Amendment No. +-+-6-,195 I

LTOP System RCS Temperature > PTLR B 3.4.12.2 BASES (continued)

BACKGROUND Shutdown Coolinq System Relief Valve Reauirements (continued)

The Shutdown Cooling System relief valve has adequate relieving capability to protect the RCS from overpressurization when the transient is limited to the start of an idle RCP with the secondary water temperature of the steam generator less than or equal to 100°F above the RCS cold leg temperatures.

Pressurizer Code Safety Valve Reauirements The pressurizer code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 4.6 x 10' lbs per hour of saturated steam at the valve setpoint plus 3% accumulation. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown with RCS cold leg temperature greater than that specified in the PTLR.

APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel SAFETY ANALYSES is adequately protected against exceeding the Reference I P/T limits during shutdown. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown with RCS cold leg temperature greater than that specified in the PTLR. In the event that no safety valves are OPERABLE and for RCS cold leg temperature less than or equal to that specified in the PTLR, the operating shutdown cooling relief valve, connected to the RCS, provides overpressure relief capability and will prevent RCS overpressurization. When the RCS is depressurized, an RCS vent to atmosphere sized 5.6 inches or greater may be used as an alternative to the SDCS Relief Valve.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System will be re-evaluated to ensure its functional requirements can still (continued)

SAN ONOFRE--UNIT 3 B 3.4-66 Amendment No. -I-1-6-,195 1

LTOP System RCS Temperature > !PTLR B 3.4.12.2 BASES (continued)

APPLICABLE be satisfied using the relief valve method or the SAFETY ANALYSES depressurized and vented RCS condition.

(continued)

Reference 3 contains the acceptance limits that satisfy the LTOP requirements. Any change to the RCS must be evaluated against these analyses to determine the impact of the change on the LTOP acceptance limits.

Shutdown Cooling System Relief Valve Performance One SDCS Relief Valve isolation valve pair is capable of mitigating an LTOP event that is bounded by the limiting SDCS pressure transients. When one or both SDCS Relief Valve isolation valve(s) in one isolation valve pair becomes INOPERABLE, the other OPERABLE SDCS Relief Valve isolation valve pair is placed in a power-lock open condition to preclude a single failure which might cause undesired mechanical motion of one or both of the OPERABLE SDCS Relief Valve isolation valve(s) in a single isolation valve pair and result in loss of system function. This power-lock open condition of the OPERABLE SDCS Relief Valve isolation valve pair is consistent with the guidance provided in Branch Technical Position ICSB 18 (PSB), "Application of the Single Failure Criterion to Manually-Controlled Electrically-Operated Valves."

LCO This LCO is required to ensure that the LTOP System is OPERABLE. The LTOP System is OPERABLE when the minimum pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference I limits as a result of an operational transient.

The elements of the LCO that provide overpressure mitigation through pressure relief are:

a. The Shutdown Cooling System Relief Valve; or

b. A minimum of one pressurizer code safety valve.

The SDCS is OPERABLE for LTOP when both trains of isolation valves are open, its lift setpoint is set at 406 +/- 10 psig or less and testing has proven its ability to open at that setpoint. A pressurizer code safety valve is OPERABLE when (continued)

SAN ONOFRE--UNIT 3 B 3.4-67 Amendment No. 1+-6-,195 I

LTOP System RCS Temperature > PTLR B 3.4.12.2 BASES (continued)

LCO its lift setting is 2500 psia +/- 1% and testing has proven (continued) its ability to open at that setpoint.

Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

APPLICABILITY This LCO is applicable in MODE 4 when the temperature of all RCS cold legs are above the enable temperatures specified in the PTLR. When the temperature of any RCS cold leg is equal to or below the enable temperatures specified in the PTLR the Shutdown Cooling System Relief valve is used for overpressure protection or if the RCS is also depressurized, then an RCS vent to atmosphere sized 5.6 inches or greater can be used for overpressure protection. When the reactor vessel head is off, overpressurization cannot occur.

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3.

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

ACTIONS A.1 With no pressurizer code safety valves OPERABLE and the SDCS Relief Valve INOPERABLE overpressurization is possible.

The 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time to be in MODE 5 and vented through a greater than or equal to 5.6 inch vent reflects the importance of maintaining overpressure protection of the RCS.

B.1 and B.2 The 24-hour Allowable Outage Time (AOT) for a single channel SDCS Relief Valve isolation valve(s) increases the (continued)

SAN ONOFRE--UNIT 3 B 3.4-68 Amendment No. 6-,195 I

LTOP System RCS Temperature > PTLR B 3.4.12.2 BASES (continued)

ACTIONS B.1 and B.2 (continued) availability of the LTOP system to mitigate low temperature overpressure transients during MODE 4.

The 24-hour AOT implements the guidance provided in Generic Letter 90-06.

SURVEILLANCE SR 3.4.12.2.1 REQUIREMENTS When the SDCS Relief Valve is being used for overpressure protection, then at least once per 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months both pairs of SDCS Relief Valve isolation valves are verified open to preclude a single failure condition that might occur if only one pair of isolation valves are open.

SR 3.4.12.2.2 The SDCS Relief Valve Setpoint is verified periodically in accordance with the Inservice Testing Program.

REFERENCES 1. 10 CFR 50, Appendix G.

2. Generic Letter 88-11.

3. UFSAR, Section 15.

4. 10 CFR 50.46.

5. 10 CFR 50, Appendix K.

6. Generic Letter 90-06.

SAN ONOFRE--UNIT 3 B 3.4-69 Amendment No. +1-1-6-195 I

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses SAFETY ANALYSES do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from each steam generator (SG) is 0.5 gallons per minute or increases to 0.5 gallons per minute as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.

Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR).

The leakage contaminates the secondary fluid.

The UFSAR (Ref. 3) analysis for SGTR assumes the contaminated secondary fluid reaching each SG is released via the safety valves, and by the atmospheric dump valve used to perform the plant cooldown to shutdown cooling entry.

The SLB is more limiting for site radiation releases. The safety analysis for the SLB accident assumes 0.5 gpm of primary to secondary LEAKAGE to each steam generator as an initial condition. The dose consequences resulting from the II SLB accident are within the limits defined in 10 CFR 100.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the RCPB. With the exception of LEAKAGE past a mechanical nozzle seal assembly, LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-71 Amendment No. 1-1-6,196 1

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

LCO b. Unidentified LEAKAGE (conti nued)

One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of identified LEAKAGE and is well within the capability of the RCS makeup system. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).

Violation of this LCO could result in continued degradation of a component or system.

LCO 3.4.14, "RCS Pressure Isolation Valve (PIV)

Leakage," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leaktight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.

d. Primary to Secondary LEAKAGE through Any One SG The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 4). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-72 Amendment No. i-1-6,196

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

ACTIONS A.1 Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.

B.1 and B.2 If any pressure boundary LEAKAGE exists or primary to secondary LEAKAGE is not within limit, or if unidentified or identified LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.

SURVEILLANCE SR 3.4.13.1 REQUIREMENTS Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection.

Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-73 Amendment No. 4-1-6,196 I

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

SURVEILLANCE SR 3.4.13.1 (continued)

REQUIREMENTS The RCS water inventory balance must be performed with the reactor at steady state operating conditions. The Surveillance is modified by two NOTES. Note 1 states that this SR is not required to be performed in MODES 3 and 4, until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of steady state operation have elapsed.

Steady state operation is required to perform a proper water inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met when steady state is established. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. These leakage detectionrsystems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."

Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because primary to secondary LEAKAGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. A Note under the Frequency column states that this SR is required to be performed during steady state operation.

If a transient evolution is occurring 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from the last water inventory balance, then a water inventory balance shall be performed within 120 hours0.00139 days 0.0333 hours 1.984127e-4 weeks 4.566e-5 months of the last water inventory balance.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-74 Amendment No. +-+6,196 I

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

SURVEILLANCE SR 3.4.13.2 REQUIREMENTS (continued) This SR verifies that primary to secondary LEAKAGE is less or equal to 150 gallons per day through any one SG.

Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.17, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.

The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

The Surveillance Frequency of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 5).

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45, May 1973.

3. UFSAR, Section 15.

4. NEI 97-06, "Steam Generator Program Guidelines."

5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."

SAN ONOFRE--UNIT 3 B 3.4-75 Amendment No. 4-1-6,196 1

SG Tube Integrity

'B3.4.17 B.3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.17 Steam Generator (SG) Tube Integrity BASES BACKGROUND Steam Generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers. The SG tubes have a number of important safety functions. Steam Generator tubes are an integral part of the Reactor Coolant Pressure Boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, "RCS Loops -

MODES 1 and 2," LCO 3.4.5, "RCS Loops - MODE 3," LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled."

SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.

Steam Generator tubing is subject to a variety of degradation mechanisms. Steam Generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation.

Specification 5.5.2.11, "Steam Generator (SG) Program,"

requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.2.11, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.2.11. Meeting (continued)

SAN ONOFRE--UNIT 3 B 3.4-93 Amendment No. 196

SG Tube Integrity B 3.4.17 BASES (continued)

BACKGROUND the SG performance criteria provides reasonable assurance of (continued) maintaining tube integrity at normal and accident conditions.

The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).

APPLICABLE The Steam Generator Tube Rupture (SGTR) accident is SAFETY the limiting design basis event for SG tubes and avoiding ANALYSES an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to 0.5 gallons per minute (720 gallons per day) to each SG, plus the leakage rate associated with a double-ended rupture of a single tube.

The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture). In these analyses, the steam discharge to the atmosphere is based on a primary to secondary LEAKAGE from each SG of 0.5 gallons per minute or is assumed to increase to 0.5 gallons per minute as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.16, "RCS Specific Activity,"

limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref.2),

10 CFR 100 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).

Steam Generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the repair criteria be plugged or repaired in accordance with the Steam Generator Program.

During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is repaired or removed from service by plugging. If a tube was determined to satisfy the repair criteria but was not plugged or repaired, the tube may still have tube integrity.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-94 Amendment No. 196

SG Tube Integrity B 3.4.17 BASES (continued)

LCO In the context of this Specification, a SG tube is defined (continued) as the entire length of the tube, including the tube wall and any repairs made to it, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.

A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 5.5.2.11, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.

There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.

The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation". Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero". The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification (continued)

SAN ONOFRE--UNIT 3 B 3.4-95 Amendment No. 196

SG Tube Integrity B 3.4.17 BASES (continued)

LCO of axial thermal loads as primary or secondary loads will be (continued) evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.

Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code,Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification this includes safety factors and applicable design basis loads based on ASME Code,Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).

The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 0.5 gpm from each SG or 1 gpm total for both SGs. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.

The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational LEAKAGE," and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day.

This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.

APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1,2,3 or 4.

RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1,2,3 and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-96 Amendment No. 196

SG Tube Integrity B 3.4.17 BASES (continued)

ACTIONS The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube.

This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube.

Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.

Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube repair criteria but were not plugged or repaired in accordance with the Steam Generator Program as required by SR 3.4.17.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam Generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG repair criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged or repaired has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, Condition B applies.

A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.

If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged or repaired prior to entering MODE 4 following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-97 Amendment No. 196 I

SG Tube Integrity B 3.4.17 BASES (continued)

ACTIONS B.1 and B.2 (continued)

If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.17.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.

During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.

The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube repair criteria.

Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-98 Amendment No. 196

SG Tube Integrity B 3.4.17 BASES (continued)

SURVEILLANCE SR 3.4.17.1 (continued)

REQUIREMENTS The Steam Generator Program defines the Frequency of SR 3.4.17.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.2.11 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections.

SR 3.4.17.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is repaired or removed from service by plugging. The tube repair criteria delineated in Specification 5.5.2.11 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube repair criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.

Steam Generator tube repairs are only performed using approved repair methods as described in the Steam Generator Program.

The frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the repair criteria are plugged or repaired prior to subjecting the SG tubes to significant primary to secondary pressure differential.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-99 Amendment No. 196

SG Tube Integrity B 3.4.17 BASES (continued)

REFERENCES 1. NEI 97-06, "Steam Generator Program Guidelines."

2. 10 CFR 50 Appendix A, GDC 19.

3. 10 CFR 100.

4. ASME Boiler and Pressure Vessel Code,Section III, Subsection NB.

5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.

6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines".

SAN ONOFRE--UNIT 3 B 3.4-100 Amendment No. 196 1

SITs B 3.5.1 BASES (continued)

ACTIONS B.1 (continued) condition be established for the specific case, where "One accumulator [SIT] is inoperable due to the inoperability of water level and pressure channels," in which the completion time to restore the accumulator to operable status will be 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . While technically inoperable, the accumulator would be available to fulfill its safety function during this time and, thus, this change would have a negligible increase in risk."

C.1 If one SIT is inoperable, for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA as is assumed in Appendix K to 10CFR50.

Reference 7 provides series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status.

Reference 7 discusses a best-estimate analysis that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one Low Pressure Safety Injection (LPSI) pump or the operation of one High Pressure Safety Injection (HPSI) pump and a single SIT.

Reference 7 also discusses a plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to shorter recovery periods.

D.1 and D.2 If the SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 715 psia (continued)

SAN ONOFREý-UNIT 3 B 3.5-8 Amendment No. 188 07/19/05

SITs B 3.5.1 BASES (continued)

REFERENCES 1. IEEE Standard 279-1971.

2. UFSAR, Section 6.3.

3. 10 CFR 50.46.

4. UFSAR, Chapter 15.

5. NUREG-1366, December 1992.

6. NRC Generic Letter 93-05, "Line-Item Technical Specification Improvements to Reduce Surveillance Requirements for Testing During Power Operations,"

September 27, 1993.

7. CE NPSD-994, "CEOG Joint Application Report for Safety Injection Tank AOT/STI Extension," April 1995.

SAN ONOFRE--UNIT 3 B 3.5-10a Amendment No. 188 07/19/05 I

ECCS- Operating B 3.5.2 BASES (continued)

ACTIONS A.1 and B.1 (continued)

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of each of Condition A and Condition B is to maintain a combination of OPERABLE equipment such that 100% of the ECCS flow equivalent to 100% of a single OPERABLE train remains available. This allows increased flexibility in plant operations when components in opposite trains are inoperable.

Each of Condition A and Condition B includes a combination of OPERABLE equipment such that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train remains available.

Condition A addresses the specific condition where the only affected ECCS subsystem is a single LPSI subtrain. The availability of a least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is implicit in the definition of Condition A.

If LCO 3.5.2 requirements are not met due only to the existence of Condition A, then the inoperable LPSI subtrain components must be returned to OPERABLE status within 7 days of discovery of Condition A. This 7-day Completion Time is based on the findings of the deterministic and probabilistic analysis that are discussed in Reference 6. Seven days is a reasonable amount of time to perform many corrective and preventative maintenance items on the affected LPSI subtrain. Reference 6 concluded that the overall risk impact of this Completion Time was either risk-beneficial or risk-neutral.

(continued)

SAN ONOFRE--UNIT 3 B 3.5-16 Amendment No. 188 07/19/05 1

Containment Isolation Valves B 3.6.3 BASES (continued)

SURVEILLANCE SR 3.6.3.1 REQUIREMENTS Each 42 inch containment purge valve is required to be verified sealed closed at 31 day intervals. This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertent or spurious pening of a containment purge valve. Detailed analysis of the purge valves failed to conclusively demonstrate their ability to close during a LOCA in time to limit offsite doses. Therefore, these valves are required to be in the sealed closed position during MODES 1, 2, 3, and 4. A containment purge valve that is sealed closed must have motive power to the valve operator removed. This can be accomplished by de-energizing the source of electric power or by removing the air supply to the valve operator. In this application, the term "sealed" has no connotation of leak tightness. The Frequency is a result of an NRC initiative, Generic Issue B-24 (Ref. 3), related to containment purge valve use during unit operations. This SR is not required to be met while in Condition D of this LCO.

This is reasonable since the penetration flow path would be isolated.

SR 3.6.3.2 This SR ensures that the minipurge valves are closed as required or, if open, open for an allowable reason. The SR is not required to be met when the purge valves are open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The minipurge valves are capable ofclosing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.3.

SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification, that those valves outside containment and capable of being mispositioned are in the correct position.

(continued)

SAN ONOFRE--UNIT 3 B 3.6-23 Amendment No. 1-1-- --1/24/n 192 12/12/05

Containment Isolation Valves B 3.6.3 BASES (continued)

SURVEILLANCE SR 3.6.3.3 (continued)

REQUIREMENTS Since verification of valve position for valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. Valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these valves were verified to be in the correct position upon locking, sealing, or securing.

The first Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons.

Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small. The second note specifies that SR 3.0.4 is not applicable.

SR 3.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. For valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate, since these valves and flanges are operated under administrative controls and the probability of their misalignment is low.

Valves that are open under administrative controls are not required to meet the SR during the time that they are open.

This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these valves were verified to be in the correct position upon locking, sealing, or securing.

The first Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by (continued)

SAN ONOFRE--UNIT 3 B 3.6-24 Amendment No. 1.- n31--0389Onn 192 12/12/05

Containment Isolation Valves B 3.6.3 BASES (continued)

SURVEILLANCE SR 3.6.3.4 (continued)

REQUIREMENTS administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these valves, once they have been verified to be in their proper position, is small The second note specifies that SR 3.0.4 is not applicable.

(continued)

SAN ONOFRE--UNIT 3 B 3.6-24a Amendment No. 192 12/12/05 1

Containment Spray and Cooling Systems B 3.6.6.1 BASES (continued)

LCO During a DBA, a minimum of two containment cooling trains or two containment spray trains, or one of each, is required to maintain the containment peak pressure and temperature below the design limits (Ref. 2). Additionally, one containment spray train is also required to remove iodine from the containment atmosphere and maintain concentrations below those assumed in the safety analysis. To ensure that these requirements are met, two containment spray trains and two containment cooling units must be OPERABLE. Therefore, in the event of an accident, the minimum requirements are met, assuming that the worst case single active failure occurs.

Each Containment Spray System includes a spray pump, spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an ESF actuation signal and automatically transferring suction to the containment sump.

Each Containment Cooling System includes demisters, cooling coils, dampers, fans, instruments, and controls to ensure an OPERABLE flow path.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature, requiring the operation of the containment spray trains and containment cooling trains.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray and Containment Cooling systems are not required to be OPERABLE in MODES 5 and 6.

ACTIONS A.1 With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE spray and cooling trains are adequate to perform the iodine removal and containment cooling functions.

(continued)

SAN ONOFRE--UNIT 3 B 3.6-37 Amendment No. 188 07/19/05 1

Containment Spray and Cooling Systems B 3.6.6.1 BASES (continued)

ACTIONS A.1 (continued)

The 7-day Completion Time is based on the findings of the deterministic and probabilistic analysis that was reviewed and approved in Reference 3. Seven days is a reasonable amount of time to perform many corrective and preventive maintenance items on the affected Containment Spray Train.

The 14 day portion of the Completion Time is based upon engineering judgement. It takes into account the low probability of coincident entry into two conditions in this Specification coupled with the low probability of an accident occurring during this time. Refer to Section 1.3, "Completion Times," for a more detailed discussion of the purpose of the "from discovery of failure to meet the LCO" portion of the Completion Time.

B.1 and B.2 If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 4 allows additional time for the restoration of the containment spray train and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.

C.1 With one required containment cooling train inoperable, the inoperable containment cooling train must be restored to OPERABLE status within 7 days. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 7 day Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System and the low probability of a DBA occurring during this period.

(continued)

SAN ONOFRE--UNIT 3 B 3.6-38 Amendment No. 188 07/19/05 1

CCW System B 3.7.7

BASES (continued)

APPLICABLE BNS system OPERABILITY ensures that both CCW surge tanks SAFETY ANALYSES will be pressurized for at least seven days following a (continued) Design Basis Event without bottle changeout. In MODES 1-4 the BNS system is required to be OPERABLE whenever the associated train of CCW is required to be OPERABLE. (Note:

For BNS requirements in MODES 5 and 6, see B 3.4.7 RCS Loops-MODE 5, Loops Filled, B 3.4.8 RCS Loops-MODE 5, Loops Not Filled, B 3.9.4 Shutdown Cooling (SDC) and Coolant Circulation-High Water Level, or B 3.9.5 Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level.) The BNS system surveillance requirements provide adequate assurance that BNS system OPERABILITY will be maintained.

The CCW System satisfies Criterion 3 of the NRC Policy Statement.

LCO The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two CCW trains must be OPERABLE.

At least one CCW train will operate assuming the worst single active failure occurs coincident with the loss of offsite power.

A CCW train is considered OPERABLE when the following:

a. The associated pump and surge tank are OPERABLE; and

b. The associated piping, valves, heat exchanger and instrumentation and controls required to perform the safety related function are OPERABLE.

The isolation of CCW from other components or systems not required for safety may render those components or systems inoperable, but does not affect the OPERABILITY of the CCW System.

CCW non-critical loop isolation valves 3HV-6212, 3HV-6213, 3HV-6218 and 3HV-6219 are required to prevent loss of CCW inventory in an event in which the non-critical loop fails.

These valves are air operated. Because they are essential in isolation the Safety Related CCW loads from the non-qualified non-critical loop these valves are supplied with safety related air accumulators as well as normal air supply. If the required air accumulator's pressure falls to 70 psig it is impossible to assure that the required (continued)

SAN ONOFRE--UNIT 3 B 3.7-41 Amendment No. 116 04/03/06 I

ECW System B 3.7.10 BASES (continued)

BACKGROUND If while implementing LCO 3.7.10 Action A for an inoperable (continued) ECW train, the opposite ECW train for the affected Unit(s) becomes inoperable, enter LCO 3.0.3 on the applicable Unit(s).

TS 3.7.10 allows 14 days for restoring operability of one ECWS train. The 14 day AOT is based on a probabilistic risk assessment that was done in accordance with the guidance of Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk Informed Decisionmaking: Technical Specifications."

The 14 day AOT is implemented in the three-tiered approach.

First, the risk of the 14 day AOT is acceptable based on the single AOT risk. Second, administrative controls must be established to ensure that planned maintenance on the normal chilled water system does not coincide with planned maintenance on the ECW system. Third, risk-significant configurations are identified and managed appropriately per the Maintenance Rule (a)(4). Allowing only one 14 day clock even in the case of multiple single train component failures is conservative. This approach prohibits exceeding the-intent of the LCO, which is to ensure an ECWS train remains out of service for no more than 14 days, regardless of circumstances.

LCO 3.7.10 allows only one ECW train to be inoperable.

Therefore, with both trains inoperable, a LCO 3.0.3 entry is required.

An emergency chiller is considered OPERABLE when it is or can be aligned to either Unit's operating or standby OPERABLE Component Cooling Water (CCW) critical loop, provided that the OPERABLE CCW critical loop can be placed in operation within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after a design basis event is detected in the Control Room. (Reference 2) Thus, an emergency chiller, under normal circumstances, remains OPERABLE during a transfer operation between OPERABLE CCW critical loops completed in less than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

Likewise, an emergency chiller is considered OPERABLE when it is aligned to either Unit's energized 4 kV bus. Under normal circumstances, the emergency chiller remains OPERABLE during a transfer operation between 4 kV buses, provided the transfer operation is completed in less than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

Room Coolers OPERABILITY, General If one or more required individual room coolers for a Unit are inoperable and the backup cooling listed in Table 1 for the affected room(s) is also inoperable, OR if the temperature in the affected room(s) increases above its design temperature, declare the safety related equipment in the cooled room(s) inoperable and enter the LCO action (continued)

SAN ONOFRE--UNIT 3 B 3.7-50 Amendment No. 188 07/19/05 1

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.7-63 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.7-64 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.7-65 Amendment No. 200 12/05/06 1

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.7-66 Amendment No. 200 12/05/06 I

THIS PAGE INTENTIONALLY LEFT BLANK SAN ONOFRE--UNIT 3 B 3.7-67 Amendment No. 200 12/05/06 I

AC Sources- Operating B 3.8.1 BASES (continued)

ACTIONS A.2 (continued)

As in Required Action A.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.

B.1 To ensure a highly reliable power source remains when one of the required DGs is inoperable, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform,"

a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. This includes motor driven auxiliary feedwater pumps. Single train systems, such as turbine driven auxiliary feedwater pumps, are not included. Redundant required feature failures consist of inoperable features associated with a train, redundant to the train that has an inoperable DG.

(continued)

SAN ONOFRE--UNIT 3 B 3.8-7 Amendment 188 07/19/05 I

AC Sources -Operating B 3.8.1 BASES (continued)

ACTIONS B.4 (continued)

"time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

C.1 and C.2 Required Action C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Regulatory Guide 1.93 (Ref. 6) for two inoperable required offsite circuits. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance is based upon the assumption that two complete safety trains are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption is not the case and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are powered from redundant AC safety trains. This includes motor driven auxiliary feedwater pumps. Single train turbine driven auxiliary pumps, are not included in the list.

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable; and

b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits inoperable) and a required feature becomes inoperable, this Completion Time begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed (continued)

SAN ONOFRE--UNIT 3 B 3.8-10 Amendment 188 07/19/05 1

Distribution Systems -Operating B 3.8.9 Table B 3.8.9-1 (page 1 of 1)

AC and DC Electrical Power Distribution Systems TYPE VOLTAGE TRAIN A TRAIN B AC safety 4160 V ESF Bus A04 ESF Bus A06 buses 480 V Load Center B04 Load Center B06 TRAIN A TRAIN C TRAIN B TRAIN D Bus DI Bus D3 Bus D2 Bus D4 DC buses(3) 125 V from from from from battery battery battery battery B007 and B009 and B008 and B010 and charger charger charger charger BOO1 B003 B002 B004 TRAIN A TRAIN C TRAIN B TRAIN D AC vital Bus YO1 Bus Y03 Bus Y02 Bus Y04 buses 120 V from from from from inverter inverter inverter inverter YO01 Y003 Y002 Y004 connected connected connected connected to bus DI to bus D3 to bus D2 to bus D4 NOTES: (1) Each train of the AC, DC, and AC vital bus electrical power distribution systems is a subsystem.

(2) If a support system (e.g., charger or inverter) is declared inoperable and it has its own LCO, entry into LCO 3.8.9 is not required. Only entry into its LCO is required.

(3) An OPERABLE Class 1E battery bank BOOX may replace any battery B007 through B010 to allow battery maintenance (including replacement) activities.

I SAN ONOFRE--UNIT 3 B 3.8-83 Amendment No. 116 01/11/07

SDC and Coolant Circulation-High Water Level B 3.9.4 BASES (continued)

APPLICABLE If the reactor coolant temperature is not maintained below SAFETY ANALYSES 200'F, boiling of the reactor coolant could result. This could lead to inadequate cooling of the reactor fuel due to a resulting loss of coolant in the reactor vessel.

Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity, and because of the possible addition of water to the reactor vessel with a lower boron concentration than is required to keep the reactor subcritical. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is a fission product barrier. One loop of the SDC System is required to be operational in MODE 6, with the water level Ž 20 ft above the top of the reactor vessel flange, to prevent this challenge. The LCO does permit de-energizing of the SDC pump for short durations under the condition that the boron concentration is not diluted. This conditional de-energizing of the SDC pump does not result in a challenge to the fission product barrier.

SDC and Coolant Circulation-High Water Level satisfies Criterion 3 of the NRC Policy Statement.

LCO Only one SDC loop is required for decay heat removal in MODE 6, with water level Ž 20 ft above the top of the reactor vessel flange. Only one SDC loop is required because the volume of water above the reactor vessel flange provides backup decay heat removal capability. At least one SDC loop must be in operation to provide:

a. Removal of decay heat;

b. Mixing of borated coolant to minimize the possibility of a criticality; and

c. Indication of reactor coolant temperature.

(conti nued)

SAN ONOFRE--UNIT 3 B 3.9-17 Amendment No. 116 07/15/05

SDC and Coolant Circulation-High Water Level B 3.9.4 BASES (continued)

LCO An OPERABLE SDC loop consists of an OPERABLE SDC pump, a (continued) heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and the ability to determine the low end temperature. The flow path starts in one of the RCS hot legs and returns to the RCS cold legs. An associated OPERABLE safety related CCW train is required for an OPERABLE SDC loop. An OPERABLE CCW safety related train includes an OPERABLE full capacity pump, surge tank, heat exchanger, piping, valves and instrumentation. A CCW critical loop remains OPERABLE so long as the non-critical loop isolation valves can be closed automatically on CCW surge tank lo-lo level, or administrative controls are in place isolating the non-seismic portions of the non-critical loop. A CCW critical loop can remain OPERABLE without backup nitrogen if the non-critical loop is aligned to the other train or if the non-seismic portions of the non-critical loop are isolated under administrative controls.

(continued)

SAN ONOFRE--UNIT 3 B 3.9-17a Amendment No. 116 04/03/06 1

SDC and Coolant Circulation-High Water Level B 3.9.4 BASES (continued)

LCO The LCO is modified by two Notes. With the upper guide (continued) structure removed from the reactor vessel Note 1 allows the required operating SDC loop to be removed from service for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in each 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, provided that:

a. The maximum RCS temperature is maintained

140'F.

b. No operations are permitted that would dilute the RCS boron concentration to less than that required to meet the minimum required boron concentration of LCO 3.9.1.

c. The capability to close the containment penetrations with direct access to the outside temperature within the calculated time to boil is maintained.

d. The reactor cavity water level is maintained Ž 20 feet above the top of the reactor pressure vessel flange, or, for core alterations, Ž 23 feet above the top of the reactor pressure vessel flange.

This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, RCS to SDC isolation valve testing, and inservice testing of LPSI system components. During this 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period, decay heat is removed by natural convection to the large mass of water in the refueling canal.

Note 2 allows Operations to use a containment spray pump in place of a low pressure safety injection pump to provide shutdown cooling flow.

APPLICABILITY One SDC loop must be in operation in MODE 6, with the water level Ž 20 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the SDC System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). SDC loop requirements in MODE 6, with the water level < 20 ft above the top of the reactor vessel flange, are located in LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level."

ACTIONS SDC loop requirements are met by having one SDC loop OPERABLE and in operation, except as permitted in the Note to the LCO.

(continued)

SAN ONOFRE--UNIT 3 B 3.9-18 Amendment No. 1-I6,166 07/15/05 I

SDC and Coolant Circulation-Low Water Level B 3.9.5 BASES (continued)

APPLICABLE If the reactor coolant temperature is not maintained below SAFETY ANALYSES 200'F, boiling of the reactor coolant could result. This could lead to inadequate cooling of the reactor fuel due to the resulting loss of coolant in the reactor vessel.

Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity, and because of the possible addition of water to the reactor vessel with a lower boron concentration than is required to keep the reactor subcritical. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two loops of the SDC System are required to be OPERABLE, and one loop is required to be in operation in MODE 6, with the water level < 20 ft above the top of the reactor vessel flange, to prevent this challenge.

With the reactor vessel head removed and 12 feet of water above the reactor vessel flange and all the specified requirements met, a heat sink is available for core cooling and a method is available to restore the reactor cavity level to 20 feet above the reactor vessel flange.

Therefore, in the event of a failure of the operating shutdown cooling loop, adequate time is provided to initiate emergency procedures to cool the core.

SDC and Coolant Circulation-Low Water Level satisfies Criterion 3 of the NRC Policy Statement.

LCO In MODE 6, with the water level < 20 ft above the top of the reactor vessel flange, both SDC loops must be OPERABLE.

Additionally, one loop of the SDC System must be in operation in order to provide:

a. Removal of decay heat;

b. Mixing of borated coolant to minimize the possibility of a criticality; and

c. Indication of reactor coolant temperature.

An OPERABLE SDC loop consists of an OPERABLE SDC pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and the ability to determine the low end temperature. The flow path starts in one of the RCS hot legs and returns to the RCS cold legs. An (conti nued)

SAN ONOFRE--UNIT 3 B 3.9-22 Amendment No. 116 07/15/05

SDC and Coolant Circulation-Low Water Level B 3.9.5 BASES (continued)

LCO associated OPERABLE safety related CCW train is required for (continued) an OPERABLE SDC loop. An OPERABLE CCW safety related train includes an OPERABLE full capacity pump, surge tank, heat exchanger, piping, valves and instrumentation. A CCW critical loop remains OPERABLE so long as the non-critical loop isolation valves can be closed automatically on CCW surge tank Io-Io level, or administrative controls are in place isolating the non-seismic portions of the non-critical oop. A CCW critical loop can remain OPERABLE without backup nitrogen if the non-critical loop is aligned to the other train or if the non-seismic portions of the non-critical loop are isolated under administrative controls.

This LCO is modified by the Note that allows Operations to use a containment spray pump in place of a low pressure safety injection pump to provide shutdown cooling flow.

or

1) The reactor has been shutdown for at least 6 days.

2) The water level above the reactor vessel flange is 12 feet or greater.

3) The associated loop of Salt Water Cooling (SWC) is OPERABLE and operating.

4) The associated Component Cooling Water (CCW) pump and the CCW swing pump are OPERABLE, and the associated CCW loop is OPERABLE and operating.

5) The Shutdown Cooling system is operating using the containment spray pump, and the associated high pressure safety injection pump and the low pressure safety injection pump are OPERABLE and at ambient temperature, available for injection from the RWST.

6) The RWST contains the volume of water required to raise the level to 20 feet above the reactor vessel flange.

7) The associated Emergency Diesel Generator is Operable.

8) The water temrerature of the SDC system is maintained less than 120 F.

APPLICABILITY Two SDC loops are required to be OPERABLE, and one SDC loop must be in operation in MODE 6, with the water level < 20 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the SDC System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System. MODE 6 requirements, with a water level Ž 20 ft above the reactor vessel flange, are covered in LCO 3.9.4, "Shutdown Cooling and Coolant Circulation-High Water Level."

(conti nued)

SAN ONOFRE--UNIT 3 B 3.9-23 Amendment No. 116 04/03/06

ML071640334

Text

SUBJECT:

Dear Sir or Madam:

Navigation menu

Search