Text

Appendix a to Operating License Number DPR-28
	ML092110065
Person / Time
Site:	Vermont Yankee File:NorthStar Vermont Yankee icon.png
Issue date:	07/31/2002
From:	; Office of Nuclear Reactor Regulation
To:	;
	Kuntz R, NRR/DLR, 415-2733
Shared Package
ML092110048	List: ML092110050; ML092110054; ML092110065; ML092110071; NRC-2011-0067, Federal Register Notice Vermont Yankee Nuclear Power Station Renewed License;
References
	Download: ML092110065 (270)
	v • d • e

APPENDIX A TO OPERATING LICENSE DPR-28 TECHNICAL SPECIFICATIONS AND BASES FOR VERMONT YANKEE NUCLEAR POWER STATION VERNON. VERMONT ENTERGY NUCLEAR OPERATIONS. INC.

AND ENTERGY NUCLEAR VERMONT YANKEE. LLC DOCKET NO. 50-271 Reissued by Change Nos. 13,15, and 17 Dated 1/17174, 1128/74, and 4/10/74 Amendment No. 208 JUL S I 2o

VYNPS TABLE OF CONTENTS Page No.

1.0 DEFINITIONS . 1 LIMITING SAFETY SAFETY LIMITS SYSTEM SETTING 1.1 FUEL CLADDING INTEGRITy . 6 2.1 1.2 REACTOR COOLANT SySTEM . 18 2.2 LIMITING CONDITIONS OF OPERATION Page l'10. SURVEILLANCE 3.0 LIMITING CONDITIONS OF OPERATION and SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ... 19a 4. C BASES 19c 3.1 REACTOR PROTECTION SYSTEM . 20 4.1 BASES 29 3.2 PROTECTIVE INSTRUMENT SySTEMS . 34 4.2 A. Emergency Core Cooling System............. 34 A B. Primary Containment Isolation. ... .... ..... "43 B C. Reactor Building Ventilation Isolation and Standby Gas Treatment System Ini tia tion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 C D. (Deleted)................................. 54 o E. Control Rod Block Actuation............... 54 E F. Mechanical Vacuum Pump Isolation Instrumentation 58 F G. Post-Accident Monitoring Instrumentation.. 60 G H. (Deleted)................................. 64 H I. Recirculation Pump Trip Instrumentation. . . . . . . . . . . . . . . . . . . . . . . . . . . 64 I J. (Deleted) 64 J K. Degraded Grid Protective System.. 68" K L. Reactor Core Isolation Cooling System Actuation ":......... 72 L BASES 75 3.3 CONTROL ROD SYSTEM . 81 4.3 A. Reactivity Limitations.................... 81 A B. Control Rods.............................. 82 B C. Scram Insertion Times..................... 85 C D. Control Rod Accumulators , 87 D E. Reactivity Anomalies...................... 8B E F. Scram Discharge Volume Vent and Drain Valves 88 F Amendment No .4-3-, .frl., ~, %, 1-64, -3:-9-3-, ~, ff4, ft.+/-., ~,244 -i

VYNPS TABLE OF CONTENTS (Continued)

LIMITING CONDITIONS OF OPERATION 3.4 REACTOR STANDBY LIQUID CONTROL SYSTEM ........ . 92 4.4 A. Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 92 A B. Operation with Inoperable Components ..... . 93 B C. Standby Liquid Control System Tank-Borated Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 C BASES 97 3.5 CORE AND CONTAIN~ENT COOLING SySTEMS ......... . 99 4. ,5 A. Core Spray and Low Pressure Coolant Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . '. .... . 99 A B. Containment Spray Cooling Capability ..... . 102 B C. Residual Heat Removal (RHR) Service Water System . . . . . . . . . . . . . . . . . . . . . . . . . ; ... . 103 C D. Station Service Water and Alternate Cooling Tower Systems ...........*......... 104 D E. High Pressure Coolant Injection (HPCI)

System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 E F. Automatic Depressurization System .... _ ... . 106 F G. Reactor Core Isolation Cooling System (RCIC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 G H. Minimum Core and Containment Cooling System Availability . . . . . . . . . . . . . . . . . . . . . . . 108 H I. Maintenance of Filled Discharge Pipe ..... . 109 I BASES 110 3.6 REACTOR COOLANT SySTEM . . . . . . . . . . . . . . . . . . . . . . . . 115 4.6 A. Pressure and Temperature Limitations .... ,. 115 A B. Coolant Chemistry . . . . . . . . . . . . . . . . . . . . . . . . . 116 B C. Coolant Leakage . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 ... C D. Safety and Relief Valves ................ .. 120 D E. Structural Integrity and Operability Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 E F. Jet Pumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 F G. Single Loop Operation . . . . . . . . . . . . . . . . . . . . . 122 H. Recirculation System . . . . . . . . . . . . . . . . . . . . . . 126 I. Deleted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 I J. Thermal Hydraulic Stability .............. . 134 J BASES 138 3.7 STATION CONTAINMENT SYSTEMS .................. . 146 4.7 A. Primary Containment. . . . . . . . . . . . . . . . . . . . . . . 146 A B. Standby Gas Treatment System ............. . 152 B C. Secondary Containment System ............. . 155 C D. Primary Containment Isolation Valves ..... . 158 D E. Reactor Building Automatic Ventilation System Isolation Valves (RBAVSIVs) ....... . 1S8a E BASES 163 Amendment No. ~, !H, ~, %, -+/--9-3, ~, ?H-4 245 -ii

VYNPS TABLE OF CONTENTS (Continued)

LIMITING CONDITIONS OF OPERATION Page No. SURVEILLANCE 3.8 RADIOACTIVE EFFLUENTS ......................... 172 ... 4.8 A. Deleted ....... ........................... 172 ... A B. Deleted ....... ........................... 172 ... B C. Deleted ....... ........................... 172 ... C D. Liquid Holdup Tanks ..... ................. 172 ... D E. Deleted ...... ............................ 173 ... E F. Deleted ...... ........................... 173 ... F G. Deleted ...... ........................... 173 ... G H. Deleted ...... ........................... 173 ... H I. Deleted ...... ........................... 173 ... I J. Explosive Gas Mixture .... ............... 173 ... J K. Steam Jet Air Ejector (SJAE) .... ........ 174 ... K L. Deleted ...... ........................... 174 ... L M. Deleted ...... ........................... 174 ... M N. Deleted ...... ........................... 174 ... N BASES 175 3.9 Deleted ................ 190 3.10 AUXILIARY ELECTRICAL POWER SYSTEMS ............ 211 ... 4.10 A. Normal Operation .......................... 211 ... A B. Operation with Inoperable Components ...... 215 ... B C. Diesel Fuel ............................... 218 ... C BASES 220 3.11 REACTOR FUEL ASSEMBLIES .......................

224 4.11 A. Average Planar Linear Heat Generation Rate (APLHGR) .................................. 224 ... A B. Linear Heat Generation Rate (LHGR) ........ 225 ... B C. Minimum Critical Power Ratio(MCPR) ........ 226 ... C BASES 227 Amendment No. 44, -6 Ago H9w Gil, 214 -iii-

VYNPS TABLE OF CONTENTS (Continued)

LIMITING CONDITIONS OF OPERATION Page No. SURVEILLANCE 3.12 REFUELING AND SPENT FUEL HANDLING... ....... ... 229 4.12 A. Refueling Interlocks...................... 229 A B. Core Monitoring *.***..*...*..*****.*...... 230 B C. Fuel Storage Pool Water Level.......... .*. 231 C D. Control Rod and Control Rod Drive Maintenance. . * . * . * . * . * . . * . . * * . * . * * . * . . . . *

232 D E. Extended Core Maintenance................. 233 E F. Fuel Movement............................. 235 F G. Deleted................................... 235 G H. Spent Fuel Pool Water Temperature... ...... 236 H BASES 237 3.13 Deleted....................................... 240 5.0 DESIGN FEATURES............................... 253 6.0 ADMINISTRATIVE* CONTROLS. * * . * * . * * * * * * * * . * * * * * .

255 6.1 RESPONSIBILITY ..*........ : . . . . . . . . . . . . . . . . . . . . 255 6.2 ORGANIZATION. . . . * . * . . . * . * * . * . . * . * . . . . . . . * . . * . . 255 6.3 ACTION TO BE TAKEN IF A SAFETY LIMIT IS EXCEEDED..... .....*... . . . . . . . . . . . . . . . . . . . . . . . . 257 6.4 PROCEDURES ..*.*.*.*...*..*............**.*..*. 257 6.5 HIGH RADIATION AREA ........*..*.........*..*.* 257 6.6 REPORTING REQUIREMENTS .*..**..***.**..*....**. 258 6.7 PROGRAMS AND MANUALS . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Amendment No. ~, 3-, +, -B-3, %, ~, +/-%, 1H4 245 iv

VYNPS 1.0 DEFINITIONS 1.0 DEFINITIONS The succeeding frequently used terms are explicitly defined so that a uniform interpretation of the specifications may be achieved.

A. Reportable Occurrence - The equivalent of a reportable event which shall be any of the conditions specified in Section 50.73 to 10CFR Part 50.

B. Alteration of the Reactor Core - The act of moving any component affecting reactivity within the reactor vessel in the region above the core support plate, below the upper grid and within the shroud. Normal movement of control rods or neutron detectors, or the replacement of neutron detectors is not defined as a core alteration.

C. Hot Standby - Hot standby means operation with the reactor critical and

'the main steam line isolation valves closed.

D. Immediate - Immediate means that the required action will be initiated as soon as practicable considering the safe operation of the unit and the importance of the required action.

E. Instrument Calibration - An instrument calibration means the adjustment of an instrument signal output so that it corresponds, within acceptable range and accuracy, to a known value(s) of the parameter which the instrument monitors. Calibration shall encompass the entire instrument including actuation, alarm, or trip. Response time as specified is not part of the routine instrument calibration but will be checked once per operating cycle.

F. Instrument Check - An instrument check is qualitative determination of acceptable operability by observation of instrument behavior during operation. This determination shall include, where possible, comparison of the instrument with other independent instruments measuring the same variable.

G. Instrument Functional Test - An instrument functional test shall be:

1. Analog channels - the injection of a signal into the channel as close to the sensor as practicable to verify operability including alarm and/or trip functions.

2. Bistable channels - the injection of a signal into the sensor to verify the operability including alarm and/or trip functions.

H. Logic System Functional Test - A logic system functional test shall be a test of all logic components required for operability of a logic circuit, from as close to the sensor as practicable up to, but not including, the actuated device, to verify operability. The logic system functional test may be performed by means of any series of sequential, overlapping, or total system steps so that the entire logic system is tested.

Amendment No. 7, GE, 95, !aq, C68, 216 1

VYNPS 1.0 DEFINITIONS I. Minimum Critical Power Ratio - The minimum critical power ratio is defined as the ratio of that power in a fuel assembly which is calculated to cause some point in that assembly to experience boiling transition as calculated by application of the appropriate NRC-approved critical power correlation to the actual assembly operating power.

J. Mode - The reactor mode is that which is established by the mode-selector-switch.

K. Operable - A system, subsystem, train, component or device shall be operable or have operability when it is capable of performing its specified function(s). Implicit in this definition shall be the assumption that all necessary attendant instrumentation, controls, normal or emergency electrical power sources, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsystem, train, component or device to perform its function(s) are also capable of performing their related support function(s).

L. Operating - Operating means that a system or component is performing its intended functions in its required manner.

M. Operating Cycle - Interval between the end of one refueling outage and the end of the next subsequent refueling outage.

N. Primary Containment Integrity - Primary containment integrity means that the drywell and pressure suppression chamber are intact and all of the following conditions are satisfied:

1. All manual containment isolation valves on lines connecting to the reactor coolant system or containment, which are not required to be open during accident conditions, are closed. Such valves may be opened intermittently under administrative controls.

2. At least one door in each airlock is closed and sealed.

3. All automatic containment isolation valves are operable or deactivated in the isolated position.

4. All blind flanges and manways are closed.

0. Protective Instrumentation Definitions

1. Instrument Channel - An instrument channel means an arrangement of a sensor and auxiliary equipment required to generate and transmit to a trip system a single trip signal related to the plant parameter monitored by that instrument channel.

2. Trip System - A trip system means an arrangement of instrument channel trip signals and auxiliary equipment required to initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip signals related to one Amendment No. 642, on, A},4-G, z.&m, 213 2

VYNPS 1.0 DEFINITIONS or more plant parameters in order to initiate trip system action.

Initiation of protective action may require the tripping of a single trip system or the coincident tripping of two trip systems.

3. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a channel or system level.

4. Protective Function - A system protective action which results from the protective action of the channels monitoring a particular plant condition.

P. Rated Neutron Flux - Rated neutron flux is the neutron flux that corresponds to a steady state power level of 1912 thermal megawatts.

Q. Rated Thermal Power - Rated thermal power means a steady state power level of 1912 thermal megawatts.

R. Reactor Power Operation - Reactor power operation is any operation with the mode switch in the "Startup/Hot Standby" or "Run" position with the reactor critical and above 1% rated thermal power.

1. Startup/Hot Standby Mode - In this mode the low turbine condenser vacuum trip is bypassed when condenser vacuum is less than 12 inches Hg and both turbine stop valves and bypass valves are closed; the low pressure and the 10 percent closure main steamline isolation valve closure trips are bypassed; the reactor protection system is energized with IRM neutron monitoring system trips and control rod withdrawal interlocks in service and APRM neutron monitoring system operable.

2. Run Mode - In this mode the reactor system pressure is equal to or greater than 800 psig and the reactor protection system is energized with APRM protection and RBM interlocks in service.

S. Reactor Vessel Pressure - Unless otherwise indicated, reactor vessel pressures listed in the TechnLcal Specifications are those measured by the reactor vessel steam space detector.

T. Refueling Outage - Refueling outage is the period of time between the shutdown of the unit prior to a refueling and the startup of the plant subsequent to that refueling. For the purpose of designating frequency of testing and surveillance, a refueling outage shall mean a regularly scheduled refueling outage; however, where such outages occur within 8 months of the completion of the previous refueling outage, the required surveillance testing need not be performed until the next regularly scheduled outage.

U. Deleted Amendment No. g4, 84, 6&, 4-68, 497, 2:29 3

VYNPS 1.0 DEFINITIONS V. Shutdown - The reactor is in a shutdown condition when the reactor mode switch is in the shutdown mode position and no core alterations are being performed. When the mode switch is placed in the shutdown position a reactor scram is initiated, power to the control rod drives is removed, and the reactor protection system trip systems are de-energized.

1. Hot Shutdown means conditions as above with reactor coolant temperature greater that 212 0F.

2. Cold Shutdown means conditions as above with reactor coolant temperature equal to or less than 212'F.

3. Shutdown means conditions as above such that the effective multiplication factor (Keff) of the core shall be less than 0.99.

W. Deleted X. Transition Boiling - Transition boiling means the boiling regime between nucleate and film boiling. Transition boiling is the regime in which both nucleate and film boiling occur intermittently with neither type being completely stable.

Y. Surveillance Frequency - Relocated to Specifications 4.0.2 and 4.0.3.

Amendment No. 44, 4-2-4, 4-6-, 4--n, 497, G4, 221 4

VYNPS 1.0 DEFINITIONS Z. Surveillance Interval - Relocated to Specification 4.0.1.

AA. Deleted BB. SourceCheck" The qualitative assessment of channel response when the channel sensor is exposed to a radioactive source.

CC. Dose Equivalent I-13l - The dose equivalent I-131 shall be that concentration of I-13l (microcurie/gram) which alone would produce the same dose as the quantity and isotopic mixture of I-131, I-132, I-133, 1-134 and I-135 actually present. The dose.conversion factors used for this calculation shall be those listed in Federal Guidance Report (FGR) 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," 1988; FGR 12, "External Exposure to Radionuclides In Air, Water, and Soil," 1993; or NRC Regulatory Guide 1.109, "Revision I, October 1977.

DD. Deleted EE. Deleted FF. Deleted GG. Deleted HH. Deleted II. Deleted JJ. Deleted KK. Deleted LL. Deleted MM. Deleted NN. Core Operating Limits Report - The Core Operating Limits Report is the unit~specific document that provides core operating limits for the current operating reload cycle. These cycle-specific core operating limits shall be determined for each reload cycle in accordance with Specification 6.6.C.

Plant operation within these operating limits is addressed in individual specifications.

00. Reactor Protection System (RPS) Response Time - RPS Response Time shall be the time from the opening of the sensor contact up to and including the.

opening of the scram solenoid relay.

" Amendment No. H, ~, 43, -+Q., ~, ~, H-6-r +/-M, -+/--6S, ~, 8-3-, -+/--9-J., ~, ~, 5 236

VYNPS 1.1 SAFETY LIMIT 2.1 LIMITING SAFETY SYSTEM SETTING 1.I" FUEL CLADDING INTEGRITY 2.1 FUEL CLADDING INTEGRITY Applicability: Applicability:

Applies to the interrelated Applies to trip setting of the variable associated with fuel instruments and devices which are thermal behavior. provided to prevent the nuclear system safety limits from being exceeded.

Objective: Objective:

To establish limits be'Low which the To define the level of the process integrity of the fuel cladding is variable at which automatic preserved. protective action is initiated.

Specification: Specification:

A. Bundle Safety Limit (Reactor A. Trip Settings Pressure >800 psia and Core Flow

>10% of Rated) The limiting safety system trip settings shall be as When the reactor pressure is specified below:

>800 psia and the core flow is greater than 10% of rated: 1. Neutron Flux Trip Settings

1. A Minimum Critical Power Ratio a. APRM Flux Scram (MCPR) of less than 1.09 (1.10 Allowable Value for Single Loop Operation) (Run Mode) shall constitute violation of the Fuel Cladding Integrity When the mode switch Safety Limit (FCISL) . is in the RUN position, the APRM flux scram Allowable Value shall be:

Two loop operation:

S~ 0.33W+ 50.45% for 0% < W ~ 30.9%

S~ 1.07W+ 27.23% for 30.9% < W ~ 66.7%

S~ 0.55W+ 62.34% for 66.7% < W :5 99.0%

With a maximum of 117.0% power for W >

99.0%

Single loop operation:

S~ 0.33W+ 48.00% for 0% < W s 39.i%

S~ 1.07W+ 19.01% for 39.1% <.W s 61. 7%

S~ 0.55W+ 51.22% for 61.7% < W s 119.4%

With a maximum of 117.0% power for W >

119.4%

where:

S setting in percent of rated thermal power (1912 MWt)

Amendment No. ~, 4+, ~, %, -!f4, .~, ~, ~, H-6-,'.;H-+, ~, ~,243 6

VYNPS 1.1 SAFETY LIMIT 2.1 LIMITING SAFETY SYSTEM SETTING B. Core Thermal Power Limit W = percent rated two loop (Reactor Pressure *800 psia drive flow where 100%

or Core Flow *10% of Rated) rated drive flow is that flow equivalent When the reactor pressure is to 48 x 106 lbs/hr core

800 psia or core flow *10% flow of rated, the core thermal I power shall not exceed 23% of In the event of operation at rated thermal power. > 23% Rated Thermal Power the I C. Power Transient APRM gain shall be equal to or greater than 1.0.

To ensure that the safety limit established in Specification 1.lA and l.lB is not exceeded, each required scram shall be initiated by its expected scram signal. The safety limit shall be assumed to be exceeded when scram is accomplished by means other than the expected scram signal.

D. Whenever the reactor is shutdown with irradiated fuel in the reactor vessel, the water level shall not be less than 12 inches above the top of the enriched fuel when it is seated in the core.

Amendment No. A4, 49, -4, is, 64, i4, 94, A44, 18-4, 21A 229 7

VYNPS 1.1 SAFETY LIMIT 2.1 LIMITING SAFETY SYSTEM SETTING For no combination of loop recirculation flow rate. and core thermal power shall the APRM flux scram trip setting be allowed to exceed 120%*

of rated thermal power.

b. Flux Scram Trip Setting (Refuel or Startup!

Hot Standby Mode)

In accordance with Table 3.1.1, when the reactor mode switch is in the REFUEL position or the STARTUP/HOT STANDBY position, average power range monitor "(APRM) scram shall be set down to less than or equal to 15% of rated neutron flux. The IRM flux scram setting shall be set at less than or equal to 120/125 of full scale.

B. Deleted

c. Reactor low water level scram setting shall be at least 127 inches above the top of the enriched fuel.

Amendment No. -+/--&, ~, ~, ~, ~, ~, i!-+/-4, 236 8

1.1 SAFETY LIMIT 2.1 L.:MITING SAFETY S'.STEM SETTING Amendment No. 4-E-, 444, 64-, 4-, , 9 G, .4, 44-s, a-8-8, 211 9 AVG 2 7 n2O

VYNPS 1.1 SAFETY LIMIT 2.1 LIMITING SAFETY SYSTEM SETTING D. Reactor low-low water level Emergency Core Cooling System (ECCS) initiation shall be

~ 82.5 inches above the top of . I the enriched fuel.

E. When operating at > 25% uf Rated Thermal Power, turbine stop valve scram shall be ~ 10% valve closure from full open.

F. When operating at > 25% of Rated Thermal Power, turbine control valve fast closure.

Scram shall be actuation of the turbine control valve fast closure relay.

G. Main stearn line isolation valve closure scram shall be ~ 10%

valve closure from full open.

H. Main stearn line low pressure initiation of main stearn line isolation valve closure shall be ~ 800 psig.

Amendment No. 8-" My +/--H, ~, 236 10

VYNPS Amendment No. a1-G, .4, 187, 211, 219 11

VYNPS BASES:

1.1 FUEL CLADDING INTEGRITY A. Refer to General Electric Company Licensing Topical Report, "General Electric Standard Application for Reactor Fuel," NEDE-24011-P-A (most recent revision).

The fuel cladding integrity Safety Limit (SL) is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur. Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. However, the uncertainties in monitoring the core operating state and in the procedures used to calculate the critical power result in an uncertainty in the value of the critical power. Therefore, the fuel cladding integrity SL is defined as the critical power ratio in the limiting fuel assembly for which more than 99.9% of the fuel rods in the core are expected to avoid boiling transition, considering the power distribution within the core and all uncertainties.

The MCPR SL is determined using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved General Electric Critical Power correlations.

The MCPR fuel cladding integrity SL is increased for single loop operation in order to account for increased core flow measurement and TIP reading uncertainties.

B. Core Thermal Power Limit (Reactor Pressure < 800 psia or Core Flow

<10% of Rated)

The General Electric critical power correlation (also known as the GEXL critical power correlation) is applicable for operation at pressures greater than or equal to 800 psia and core flows greater than or equal to 10% of rated flow. For operation at lower pressures or core flows, the following basis is used:

At power levels at or below the low pressure, low flow (low power) thermal limit, the minimum core flow occurs for natural circulation, and as the power to flow ratio in natural circulation increases with increasing power, the maximum and most limiting power to flow ratio occurs for natural circulation at the low power thermal limit. This condition is therefore also the condition with the minimum margin to critical power. Analysis of the natural circulation flow rate at the low power thermal limit has shown that the core average mass flux is 0.3-0.4 Mlb/hr-ft2 and the corresponding core pressure drop is 5-6 psi. For these conditions, full scale ATLAS test data have shown a critical power of 4-5 MWt. Analysis has also shown that a maximum radial peaking factor of 2 is expected at the low power thermal limit condition. Since the low power thermal limit basis corresponds to a maximum average bundle power of 1.2 MWt or less, fuel bundles with radial peaking factor as high as 3 will have margin to critical power. This bounds any radial peaking, and therefore the low power thermal limit is conservative. An average bundle power of 1.2 MWt occurs at 23% rated thermal power. Thus, a limit of 23% rated thermal power for operation with reactor pressure less than or equal to 800 psia is conservative.

Amendment No. 18, 39, 47, 94, 150, 229 12

VYNPS BASES: 1.1 (Cont'd)

With no reactor coolant recirculation loops in operation, the plant must be brought to a condition in which the LCO does not apply. Operation of at least one reactor coolant recirculation loop provides core flow greater than natural circulation, so the margin to a critical power condition is significantly greater than this bounding example for all normal operating conditions with power less than the low power thermal limit. Therefore, a low power thermal limit of 23% rated thermal power is conservative.

Additionally, a core thermal power limit of 23% rated thermal power ensures consistency with the threshold for requiring thermal limit monitoring (i.e.,

average planar linear heat generation rate, linear heat generation rate, and minimum critical power ratio). This assures that for those power levels where thermal limit monitoring is required, the General Electric critical power correlation is applicable.

C. Power Transient Plant safety analyses have shown that the scrams caused by exceeding any safety setting will assure that the Safety Limit of Specification 1.1.1A or 1.1.1B will not be exceeded. Scram times are checked periodically to assure the insertion times are adequate. The thermal power transient resulting when a scram is accomplished other than by the expected scram signal (e.g., scram from neutron flux following closure of the main turbine stop valves) does not necessarily cause fuel damage. However, for this specification a Safety Limit violation will be assumed when a scram is only accomplished by means of a backup feature of the plant design. The concept of not approaching a Safety Limit provided scram signals are operable is supported by the extensive plant safety analysis.

The computer provided with Vermont Yankee has a sequence annunciation program which will indicate the sequence in which events such as scram, APRM trip initiation, pressure scram initiation, etc. occur.

This program also indicates when the scram setpoint is cleared. This will provide information on how long a scram condition exists and thus provide some measure of the energy added during a transient.

D. Reactor Water Level (Shutdown Condition)

During periods when the reactor is shutdown, consideration must also be given to water level requirements due to the effect of decay heat.

If reactor water level should drop below the top of the enriched fuel during this time, the ability to cool the core is reduced. This reduction in core cooling capability could lead to elevated cladding temperatures and clad perforation. The core can be cooled sufficiently should the water level be reduced to two-thirds the core height. Establishment of the safety limit at 12 inches above the top of the enriched fuel provides adequate margin. This level will be continuously monitored.

Amendment No. 18, 68, 150, 229 13

VYNPS BASES:

2.1 FUEL CLADDING INTEGRITY A. Trip Settings The bases for individual trip settings of Section 2.1 are discussed in the Bases for Specifications 3.1.A, 3.2.A and 3.2.B.

Amendment No. 18, 25, 39, 47, 61, 94, 116, 146, 219, 229, 236 14

VYNPS THIS PAGE INTENTIONALLY LEFT BLANK Amendment No. 18, 78, 84, 94, 229, 236 15

VYNPS THIS PAGE INTENTIONALLY LEFT BLANK Amendment No. 18, 25, 47, 61, 94, 187, 211, 236 16

VYNPS THIS PAGE INTENTIONALLY LEFT BLANK Amendment No. 18, 25, 84, 164, 173, 187, BVY 00-51, 229, 236 17

VYNPS 1.2 SAFETY LIMIT 2.2 LIMITING SAFETY SYSTEM SETTING

- 1.2 REACTOR COOLANT SYSTEM 2.2 REACTOR COOLANT SYSTEM Applicability: Applicability:

Applies to limits on reactor Applies to trip settings for coolant system pressure. controlling reactor system pressure.

Objective: Objective:

To establish a limit below which To provide for protective action the integrity of the reactor in the event that the principal coolant system is not threatened process variable approaches a due to an overpressure safety limit.

condition.

Specification: Specification:

The reactor coolant system pressure shall not exceed 1335 psig at any time when irradiated fuel is present in the reactor vessel.

A. Reactor coolant high pressure scram shall be less than or equal to 1055 psig.

B. Primary system relief and safety valve settings shall be as specified in Table 2.2.1.

TABLE 2.2.1 Primary System Relief and Safety Valve Settings Lif t Number and Type l Setting of Valve(s) Setting________

1 safety relief valve 1080 psig 2 safety relief valves 1090 psig 1 safety relief valve 1100 psig 3 safety valves 1240 psig I Note:

(1) As-left setpoint tolerance +/-1E.

As-found setpoint tolerance

+/-3t.

Amendment No. 44,4S4, 219 18

VYNPS BASES:

1.2 REACTOR COOLANT SYSTEM The reactor coolant system is an important barrier in the prevention of uncontrolled release of fission products. It is essential that the integrity of this system be protected by establishing a pressure limit to be observed for all operating conditions and whenever there is irradiated fuel in the reactor vessel.

The pressure safety limit of 1335 psig as measured by the vessel steam space pressure indicator is equivalent to 1375 psig at the lowest elevation of the reactor coolant system. The 1375 psig value is derived from the design pressures of the reactor pressure vessel, and the coolant system piping. The design pressure is 1250 psig at 575°F for both the reactor pressure vessel and the recirculation system piping. The pressure safety limit was chosen as the lower of the pressure transients permitted by the applicable design codes: ASME Boiler and Pressure Vessel Code, Section III-A for the pressure vessel, ASME Boiler and Pressure Vessel Code Section III-C for the recirculation pump casing, and USASI B31.1 Code for the reactor coolant system piping. The ASME Boiler and Pressure Vessel Code permits pressure transients up to 10% over design pressure (110% x 1250 = 1375 psig), and the USASI Code permits pressure transients up to 20% over the design pressure (120% x 1148 = 1378 psig).

The safety valves are sized to prevent exceeding the pressure vessel code limit for the worst-case isolation (pressurization) event (MSIV closure) assuming indirect (nuclear system high pressure) scram.

2.2 REACTOR COOLANT SYSTEM The settings on the reactor high pressure scram, reactor coolant system relief and safety valves, have been established to assure never reaching the reactor coolant system pressure safety limit as well as assuring the system pressure does not exceed the range of the fuel cladding integrity safety limit. In addition to preventing power operation above 1055 psig, the pressure scram backs up the APRM neutron flux scram for steam line isolation type transients. (See FSAR Section 14.5 and Supplement 2 to Proposed Change No. 14, November 12, 1973.)

Amendment No. 18, BVY 01-52 19

VYNPS 3.0 LIMITING CONDITIONS FOR 4.0 SURVEILLANCE REQUIREMENT (SR)

OPERATION APPLICABILITY APPLICABILITY 3.0.1 RESERVED SR 4.0.1 3.0.2 RESERVED SRs shall be met during the modes or other specified 3.0.3 RESERVED conditions in the Applicability for individual LCOs, unless 3.0.4 RESERVED otherwise stated in the SR.

Failure to meet a Surveillance, 3.0.5 RESERVED whether such failure is experienced during the 3.0.6 RESERVED performance of the Surveillance or between performances of the 3.0.7 RESERVED Surveillance, shall be failure to meet the LCO. Failure to 3.0.8 Inoperability of Snubbers perform a Surveillance within the specified frequency shall When one or more required be failure to meet the LCO snubbers are unable to perform except as provided in SR 4.0.3.

their associated support Surveillances do not have to be function(s), any affected performed on inoperable supported LCO(s) are not equipment or variables outside required to be declared not met solely for this reason if specified limits.

risk is assessed and managed, SR 4.0.2 and:

Unless otherwise stated in

a. the snubbers not able to these specifications, periodic perform their associated surveillance tests, checks, support function(s) are associated with only one train calibrations, and examinations or subsystem supported system shall be performed within the or are associated with a specified surveillance single train or subsystem intervals. These intervals may be adjusted plus 25%. The supported system and are able operating cycle interval is to perform their associated considered to be 18 months and support function within 72 the tolerance stated above is hours;or applicable.

b. the snubbers not able to SR 4.0.3 perform their associated support function(s) are associated with more than one If it is discovered that a train or subsystem of a surveillance was not performed multiple train or subsystem within its specified frequency, declaring applicable Limiting supported system and are able to perform their associated Conditions for Operation (LCOs) support function within 12 not met may be delayed, from the time of discovery, up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

hours or up to the limit of the At the end of the specified specified frequency, whichever period the required snubbers is greater. This delay period is permitted to allow must be able to perform their associated support function(s) performance of the or the affected supported surveillance. A risk evaluation system LCO(s) shall be shall be performed for any declared not met. .Surveillance delayed greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and the risk impact shall be managed.

Amendment No. 2-, 230 M 19a

VYNPS 3.0 LIMITING CONDITIONS FOR 4.0 SURVEILLANCE REQUIREMENT (SR)

OPERATION APPLICABILITY APPLICABILITY SR 4.0.3 (Continued)

If the surveillance is not performed within the delay period, applicable LCOs must immediately be declared not met, and applicable LCOs must be entered.

When the surveillance is performed within the delay period and the surveillance is not met (i.e., acceptance criteria are not satisfied),

applicable LCOs must immediately be declared not met, and applicable LCOs must be entered.

Amendment No. 221 19b

VYNPS BASES:

TS 3.0 Limiting Conditions for Operation Applicability LCO 3.0.8 Bases LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not being capable of performing their associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control. The snubber requirements do not meet the criteria in 10CFR50.36(c)(2)(ii), and as such, are appropriate for control by the licensee.

If the allowed time expires and the snubbers(s) are unable to perform their associated support function(s), the affected supported system's LCO(s) must be declared not met and the conditions and required actions entered.

LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the snubber(s) before declaring the supported system inoperable. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.

LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to restore the snubber(s) before declaring the supported system inoperable. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function.

LCO 3.0.8 requires that risk be assessed and managed. Industry and NRC guidance on the implementation of 10CFR50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function.

Amendment No. 221, BVY 07-043 19c

VYNPS TS 4.0 Surveillance Requirement (SR) Applicability SR 4.0.1 Bases SR 4.0.1 establishes the requirement that SRs must be met during the modes or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified frequency, in accordance with SR 4.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when either:

a. The systems or components are known to be inoperable, although still meeting the SRs or

b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a mode or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified.

Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given mode or other specified condition.

Surveillances do not have to be performed on inoperable equipment because the LCOs define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 4.0.2, prior to returning equipment to OPERABLE status.

Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 4.0.2. Post maintenance testing may not be possible in the current SR 4.0.1 mode or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a mode or other specified condition where other necessary post maintenance tests can be completed.

An example of this process is:

a. High pressure coolant injection (HPCI) maintenance during shutdown that requires system functional tests at a specified pressure.

Provided other appropriate testing is satisfactorily completed, startup can proceed with HPCI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.

Amendment No. 221, BVY 07-043 19d

VYNPS SR 4.0.2 Bases SR 4.0.2 permits a 25% extension of the interval specified in the Frequency.

This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that results from performing the surveillance at its specified frequency. This is based on the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 4.0.2 are those Surveillances for which the 25%

extension of the interval specified in the frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. An example of where SR 4.0.2 does not apply is in the Primary Containment Leakage Rate Testing Program. This program establishes testing requirements and frequencies in accordance with the requirements of regulations. The TS cannot in and of themselves extend a test interval specified in the regulations.

The provisions of SR 4.0.2 are not intended to be used repeatedly merely as an operational convenience to extend surveillance intervals (other than those consistent with refueling intervals).

SR 4.0.3 Bases SR 4.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a surveillance has not been completed within the specified frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified frequency, whichever is greater, applies from the point in time that it is discovered that the surveillance has not been performed in accordance with SR 4.0.2, and not at the time that the specified Frequency was not met.

This delay period provides adequate time to complete surveillances that have been missed. This delay period permits the completion of a surveillance before complying with action statements or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the surveillance, the safety significance of the delay in completing the required surveillance, and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the requirements. When a surveillance with a frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering Run Mode after each fuel loading, or in accordance with 10CFR50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 4.0.3 allows for the full delay period of up to the specified frequency to perform the surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. SR 4.0.3 provides a time limit for, and allowances for the performance of, surveillances that become applicable as a consequence of Mode changes imposed by Action Statements.

Amendment No. 221, BVY 07-043 19e

VYNPS SR 4.0.3 Bases (Continued)

Failure to comply with specified surveillance frequencies is expected to be an infrequent occurrence. Use of the delay period established by SR 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend surveillance intervals. While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified frequency is provided to perform the missed surveillance, it is expected that the missed surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the surveillance as well as any plant configuration changes required or shutting the plant down to perform the surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed surveillances will be placed in the licensees Corrective Action Program.

If a surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the completion times of the Action Statements for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the completion times of the Action Statements for the applicable LCO Conditions begin immediately upon the failure of the surveillance.

Completion of the surveillance within the delay period allowed by this Specification, or within the completion time of the ACTIONS, restores compliance with SR 4.0.1.

Amendment No. 221, BVY 07-043 19f

VYNPS 3.1 LIMITING CONDITIONS FOR 4.1 SURVEILLANCE REQUIREMENTS OPERATION 3.1 REACTOR PROTECTION SYSTEM (RPS) 4.1 REACTOR PROTECTION SYSTEM (RPS)

Applicability: Applicability:

Applies to the operability of Applies to the surveillance of plant instrumentation and the plant instrumentation and control systems required for control systems required for reactor safety. reactor safety.

Objective:

To specify the limits imposed on plant operation by those instrument and control systems required for reactor safety.

Specification: Specification:

A. The RPS instrumentation for A.1 RPS instrumentation shall each Trip Function in Table be checked, functionally 3.1.1 shall be operable in tested and calibrated as accordance with Table 3.1.1. indicated in Table ~.l.1.

When an RPS channel is placed in an inoperable status solely for the performance of required surveillances, entry into associated Limiting Conditions for Operation and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains RPS trip capabili ty.

2. Exercise -each automatic scram contactor once every week using the RPS channel test switches or by performing a Functional Test of any automatic RPS Trip Function.

3. Verify RPS Response Time is S 50 milliseconds for each automatic RPS Trip Function once every Operating Cycle.

Amendment No. 1-, ~, -l-&&, ~, ~, 236 20

VYNPS 3.1 LIMITING CONDITIONS FOR 4.1 SURVEILLANCE REQUIREMENTS OPERATION

4. Perform a Logic System Functional Test of RPS instrumentation Trip Functions once every Operating Cycle.

Amendment No.-1-64 , 236 20a

VYNPS Table 3.1.1 (page 1 of 3)

Reactor Protection System Instrumentation ACTIONS WHEN REQUIRED REQUIRED ACTIONS APPLICABLE MODES CHANNELS CHANNELS REFERENCED OR OTHER SPECIFIED' 'PER TRIP ARE FROM ACTION TRIP TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE NOTE 1 SETTING

1. Reactor Mode RUN, STARTUP/HOl 1 Note 1 Note 2.a NA Switch in STANDBY, Refuel a)

Shutdown Refuel (b) 1 Note 1 Note 2.d NA

2. Manual Scram RUN, STARTUP/HOl 1 Note 1 Note 2,. a NA STANDBY, Refuel a)

Refuel (b) 1 Note 1 Note 2.d NA

3. Intermediate Range Monitors (IRMs)

a. High Flux 'STARTUp/HOT 2 Note 1 Note 2.a ~ 120/125 STANDBY, Refuel (a)

Refuel (b) 2 Note 1 Note 2.d ~ 120/125

b. Inop STARTUP 1 HOT 2 Note 1 Note 2.a NA STANDBY, Refuel (a)

Refuel (b) 2' Note 1 Note 2.d NA (a) With reactor coolant temperature> 2l2°F.

(b) With reactor coolant temperature ~ 212°F and any control rod withdrawn from,a core cell containing one or more fuel assemblies.

Amendment No. ~, 236 21

VYNPS Table 3.1.1 (page 2 of 3)

Reactor Protection System Instrumentation ACTIONS W~EN REQUIRED REQUIRED ACTIONS APPLICABLE MODES . CHANNELS CHANNELS REFERENCED OR OTHER SPECIFIED PER TRIP ARE FROM ACTION TRIP TRIP FUNCTION CONDITIONS S"(STEM INOPERABLE .'NOTE 1 SETTING

4. Average Power.

Range Monitors (APRMs)

a. High Flux RUN 2 Note 1 Note 2.b (c)

(Flow Bias)

b. High Flux STARTUP/HOT 2 Note 1 Note 2.a ~ 15%

(Reduced) STANDBY, Refuel (al

c. Inop RUN, STARTUP/HOT 2 Note 1 Note 2.a NA STANDBY, Refuel a)

(a) With reactor coolant temperature> 212°F.

(c) Two loop operation:

S~ 0.331'1+ 50.45% for 0% < 1'1 ~ 30.9%

S~ 1.071'1+ 27.23% for 30.9% < 1'1 ~ 66.7%

S~ 0.551'1+ 62.34% for 66.7% < 1'1 ~ 99.0%

With a maximum of 117.0% power for W > 99.0%

Sinq1e loop operation:

S~ 0.331'1+ 48.00% for 0% < 1'1 ~ 39.1%

S~ 1.07W+ 19.01% for 39.1% < 1'1 ~ 61.7%

S~ 0.551'1+ 51.22% for 61.7% < 1'1 ~ 119.4%

With a maximum of 117.0% power for 1'1 > 119.4%

Amendment No. -l-64, 236 21a

VYNPS Table 3.1.1 (page 3 of 3)

Reactor Protection System Instrumentation ACTIONS WHEN REQUIRED REQUIRED ACTIONS APPLICABLE MODES CHANNELS CHANNELS REFERENCED OR OTHER SPECIFIED PER TRIP ARE FROM ACTION TRIP TR1P FUNCTION CONDITIONS SYSTEM . INOPERABLE NOTE 1 SETTING

5. High Reactor RUN, STARTUP/HOr 2 Note 1 Note 2.a SlOSS Pressure STANDBY,. Refuel a) psig

6. High Drywei1 RUN, STARTUP/HOr 2 Note 1 Note 2.a S 2.5 Pressure STANDBY, Refuel a) psig'

7. Reactor Low Water RUN, STARTUP/HOr 2 Note 1 Note 2.a ::? 127.0 Level STANDBY, Refuel a) inches

8. Scram Discharge RUN, STARTUP/HOr 2 per Note 1 Note 2.a .S 21. 0 Volume High Level STANDBY, Refuel a) volume gallons Refuel (b) 2 per Note 1 Note 2.d S 21.0 volume gallons

9. Main Steam Line RUN 8 Note 1 'Note 2.b ~ 10%

Isolation Valve valve

. Closure closure

10. Turbine Control .> 25% RATED 2 Note 1 Note 2.c (d)

Valve Fast THERMAL POWER Closure

11. Turbine Stop > 25% RATED '4 Note 1 Note 2.c .~ 10%

Valve Closure THERMAL POWER valve closure (a) With reactor coolant temperature> 212°F.

(b) With reactor coolant temperature S 212°F and any control rod* withdrawn from a core cell containing one or more fuel assemblies.

(d) Channel signals for the turbine control valve fast closure trip shall be derived from the same event or events which cause the control valve fast closure.

Amendment No. ~', 236 22

VYNPS Table 3.1.1 ACTION Notes

1. With one or more required Reactor Protection System channels inoperable, take all of the applicable Actions in.Notes 1.a, 1.b, and 1.c below.

a. With one or more Trip Functions with one or more required channels inoperable:

1) Place an inoperable channel for each Trip Function in trip within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; or

2) Place "the associated trip system in trip within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

b. With one or more Trip Functions with one or more required channels inoperable in both trip systems:

1) Place an inoperable channel in one trip system in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; or

2) Place one trip system in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

c. With one or more Trip Functions with Reactor Protection System trip capability not maintained:

1) Restore Reactor Protection System trip capability within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

If *any applicable *Action and associated completion time of Notes l.a, 1.b, or 1.c is not met, take the applicable Action of Note 2 below referenced in Table 3.1.1 for the channel.

2. a. Place the reactor in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

b. Place the reactor in STARTUP/HOT STANDBY within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

c. Reduce reactor power to < 25% Rated Thermal Power within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

d. Immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

Amendment No. ~, 236 23

VYNPS Table 4.1.1 (page lof 3)

Reactor Protection System.Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

1. Reactor Mode NA Each Refueling Outage NA Switch in Shutdown

2. Manual Scram NA Every 3 Months* NA

3. Intermediate Range Monitors (IRMs)

a. High Flux* Once/Day, Within 31 Days Before entering Once/Operating*

(a) STARTUP/HOT STANDBY (b) and Cycle (b), Ie)

Every 31 Days During STARTUP/HOT STANDBY, Every 31 Days During Refueling

b. Inop NA Within 31 Days Before. entering NA STARTUP/HOT STANDBY (b) and Every 31 Days During STARTUP/HOT STANDBY, Every 31 Days During'Refueling

4. Average Power Range Monitors

. (APRMs)

a. High Flux NA Every 3 Months Every 7 Days for (Flow Output Signal by Bias) Heat Balance ldl Every 3 Months (e)

Each Refueling Outage for Flow Bias, Every 2000 MWD/T Average Core Exposure for LPRMs using TIP System (a) IRM and Source Range Monitor channels shall be determined to overlap during each startup after entering. STARTUP/HOT STANDBY MODE and IRM and APRM channels shall be determined to overlap during each controlled shutdown, if not performed in the previous 7 days.

(b) Not required to be completed when entering STARTUP/HOT STANDBY MODE from RUN MODE until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering STARTUP/HOT STANDBY MODE.

(c) Neutron detectors are excluded.

(d) Not required to b~ completed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor power is ~ 23%

Rated Thermal Power.

(e) Trip unit calibration only.

Amendment No ~, .. 236 2'4

VYNPS Table 4.1.1 (page 2 of 3)

Reactor Protection System Instrumentation Tests and Frequen?ies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

4. APRMs (continued)

b. High Flux (a) Within 7 Days Before entering Within 7 Days Before (Reduced) STARTUP/HOT STANDBY (b) and enterinq STARTUP/HOT Every 7 Days During STANDBY !b). (cl. (e) and STARTUP/HOT STANDBY, Every 7 Days During Every 7 Days During Refueling STARTUP/

HOT STANDBY (c). (e)

Every 7 Days During Refueling(cl, (e)

c. Inop NA Every 3 Months NA

5. High Reactor Once/Day Every 3 Months Every 3 Months (e)

Pressure Once/Operating Cycle

6. High Drywell NA Every 3 Months Every 3 Months(e)

Pressure Once/Operating Cycle

7. Reactor Low Once/Day *Every 3 Months Every 3 Months Ie)

Water Level Once/Operating Cycle

8. Scram NA Every 3 Months Every 3 Months~)

Discharge Once/Operating Cycle Volume High Level

9. Main Steam NA Every 3 Months Each Refueling Line. Outage Isolation Valve Closure IO.Turbine . NA Every 3* Months Every 3 Months Control Valve Fast Clos~re

a. First NA Every 6 Months Every 6 Months and Stage prior to entering Turbine STARTUP/HOT STANDBY Pressure for plant startup Permissive after Ref~eling (a) IRM and Source Range Moni~or channels shall be determined to overlap during each startup after entering STARTUP/HOT STANDBY MODE and IRM and APRM channels shall be determined to overlap during each controlled shutdo~n, if not performed in the previous 7 days.

(b) Not required to be completed when entering STARTUP/HOT STANDBY MODE from RUN MODE until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering STARTUP/HOT STANDBY MODE.

(c) Neutron detectors are excluded.

(e). Trip unit calibration only.

Amendment No. ~, 236 25

VYNPS Table 4.1.1 !page 3 of 3)

Reactor Protection System Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION 1l.Turbine Stop NA Every 3 Months Each Refueling Valve Closure Outage

a. First NA Every 6 Months Every 6 Months and Stage prior to entering Turbine STARTUP/HOT Pressure STANDBY for plant Permissive startup after Refueling Amendment No. -H4, 236 26

VYNPS This page intentionally left blank Amendment No. 236 27

VYNPS This page intentionally left blank

(

Amendment No. 236 28

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM BACKGROUND The Reactor Protection System (RPS) initiates a reactor scram when one or more monitored parameters exceed their specified limits, to preserve the integrity of the fuel cladding and the reactor coolant pressure boundary (RCPB) and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.

The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance. The LSSS are defined in this Specification as the Allowable Values, which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs) during Design Basis Accidents (DBAs)and transients.

The RPS, as described in the UFSAR, Section 7.2 (Ref. 1), includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve (TCV) fast closure, turbine stop valve (TSV) position, drywell pressure, and scram discharge volume (SDV) water level, as well as reactor mode switch in shutdown position and manual scram signals.

There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal and the manual scram signal). Most channels include instrumentation that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic.

The RPS is comprised of two independent trip systems (A and B) with three logic channels in each trip system (logic channels A1, A2, and A3; B1, B2, and B3) as shown in Reference 1 figures. Logic channels A1, A2, B1, and B2 contain automatic logic for which the above monitored parameters each have at least one input to each of these logic channels. The outputs of the logic channels in a trip system are combined in a one-out-of-two logic so that either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as a one-out-of-two taken twice logic. In addition to the automatic logic channels, logic channels A3 and B3 (one logic channel per trip system) are manual scram channels. Both must be deenergized in order to initiate the manual trip function. Each trip system can be reset by use of a reset switch.

If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 10 second delay on reset ensures that the scram function will be completed.

Amendment No. 236 29

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM BACKGROUND (continued)

One scram pilot valve with two scram valves are located in the hydraulic control unit for each control rod drive (CRD). Each scram pilot valve has two solenoids with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.

The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The actions of the RPS are assumed in the safety analyses of References 1, 2, and 3. The RPS initiates a reactor scram when monitored parameter values exceed the trip values, specified by the setpoint methodology and listed in Table 3.1.1 to preserve the integrity of the fuel cladding, the RCPB, and the containment by minimizing the energy that must be absorbed following a LOCA.

RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Trip Functions not specifically credited in the accident analysis are retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

The operability of the RPS is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.1.1. Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.1.1. As a result, for most Trip Functions, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. Since the APRM flow biased flux scram Trip Setting is an Allowable Value, it is only considered inoperable if its actual trip setpoint is not within the Trip Setting specified in Table 3.1.1 The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time, where applicable.

Amendment No. 236 30

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The operability of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.

The individual Trip Functions are required to be operable in the MODES or other specified conditions indicated in Table 3.1.1, which may require an RPS trip to mitigate the consequences of a design basis accident or transient. To ensure a reliable scram function, a combination of Trip Functions is required in each MODE to provide primary and diverse initiation signals.

The RPS is required to be operable in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, and in Refuel with reactor coolant temperature < 212°F and any control rod withdrawn from a core cell containing one or more fuel assemblies. Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and, therefore, are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required Shutdown Margin and refuel position one-rod-out interlock ensure that no event requiring RPS will occur. During normal operation in HOT SHUTDOWN and COLD SHUTDOWN, all control rods are fully inserted and the Reactor Mode Switch Shutdown Position control rod withdrawal block does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be operable.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Mode Switch in Shutdown The Reactor Mode Switch in Shutdown Trip Function provides signals, via the manual scram logic channels, to two RPS logic channels, which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Trip Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

The reactor mode switch is a single switch with two channels, each of which provides input into one of the manual RPS logic channels (A3 and B3). The reactor mode switch is capable of scramming the reactor if the mode switch is placed in the shutdown position.

There is no Trip Setting for this Trip Function, since the channels are mechanically actuated based solely on reactor mode switch position.

Two channels of Reactor Mode Switch in Shutdown, with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be operable. The Reactor Mode Switch in Shutdown Trip Function is required to be Amendment No. 236 31

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) operable in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, and in Refuel with reactor coolant temperature < 212°F and any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

2. Manual Scram The Manual Scram push button channels provide signals to the manual scram logic channels (A3 and B3), which are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

There is one Manual Scram push button channel for each RPS trip system. In order to cause a scram it is necessary for each trip system to be actuated.

There is no Trip Setting for this Trip Function since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of Manual Scram with one channel in trip channel A3 and one channel in trip channel B3 are available and required to be operable in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, and in Refuel with reactor coolant temperature < 212°F and any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

3.a. Intermediate Range Monitor High Flux The IRMs monitor neutron flux levels from the upper range of the source range monitor (SRM) to the lower range of the average power range monitors (APRMs).

The IRMs are capable of generating trip signals that can be used to prevent fuel damage resulting from abnormal operating transients in the intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal. The IRMs provide diverse protection from the rod worth minimizer (RWM), which monitors and controls the movement of control rods at low power. The RWM prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion. The IRMs provide mitigation of the neutron flux excursion. To demonstrate the capability of the IRM System to mitigate control rod withdrawal events, a generic analysis has been performed (Ref. 3) to evaluate the consequences of control rod withdrawal events during startup.

This analysis, which assumes that one IRM channel in each trip system Amendment No. 236 32

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) is bypassed, demonstrates that the IRMs provide protection against local control rod withdrawal errors and results in peak fuel enthalpy below the 170 cal/gm fuel failure threshold criterion (Ref. 4).

The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.

The IRM System is divided into two groups of IRM channels, with three IRM channels inputting to each trip system. The analysis of Reference 3 assumes that one channel in each trip system is bypassed. Therefore, four channels with two channels in each trip system are required for IRM operability to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.

The analysis of Reference 3 has adequate conservatism to permit the IRM Trip Setting of 120 divisions of a 125 division scale.

The Intermediate Range Monitor High Flux Trip Function must be operable during STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F when control rods may be withdrawn and the potential for criticality exists. In Refuel with reactor coolant temperature < 212°F, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions. In RUN, the APRM System, the RWM, and the Rod Block Monitor provide protection against control rod withdrawal error events and the IRMs are not required.

3.b. Intermediate Range Monitor Inop This trip signal provides assurance that a minimum number of IRMs are operable. Anytime an IRM mode switch is moved to any position other than "Operate," whenever the detector voltage drops below a preset level, or when a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed. Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal.

This Trip Function was not specifically credited in the accident analysis but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

Four channels of Intermediate Range Monitor Inop with two channels in each trip system are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

Amendment No. 236 33

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Since this Trip Function is not assumed in the safety analysis, there is no Trip Setting for this Trip Function.

This Trip Function is required to be operable when the Intermediate Range Monitor High Flux Trip Function is required.

4.a. Average Power Range Monitor High Flux (Flow Bias)

The Average Power Range Monitor (APRM) channels receive input from the Local Power Range Monitors (LPRMs) within the reactor core, which provide indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide continuous indication of average reactor power from a few percent to greater than Rated Thermal Power. The Average Power Range Monitor High Flux (Flow Bias) Trip Function monitors neutron flux relative to the reactor coolant flow. The trip level is varied as a function of recirculation drive flow (i.e., at lower core flows, the setpoint is reduced proportional to the reduction in power experienced as core flow is reduced with a fixed control rod pattern) and is clamped at an upper limit.

The relationship between recirculation drive flow and reactor core flow is non-linear at low core flows. Due to stability concerns, separate APRM flow biased scram trip setting equations are provided for low core flows. The flow bias portion of the Average Power Range Monitor High Flux (Flow Bias) Trip Function is not specifically credited in the accident or transient analyses, but is included to provide protection against transients where Thermal Power increases slowly and to provide protection against power oscillations which may result from reactor thermal hydraulic instabilities. However, the clamp portion of the Average Power Range Monitor High Flux (Flow Bias) Trip Function is assumed to terminate the main steam isolation valve closure event and along with the safety/relief valves (S/RVs) limits the RPV pressure to less than the ASME Code limits. The control rod drop accident (CRDA) analysis also takes credit for the clamp portion of this Trip Function to terminate the CRDA.

The APRM System is divided into two groups of channels with three APRM channels inputting into each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Four channels of Average Power Range Monitor High Flux (Flow Bias) with two channels in each trip system arranged in a one-out-of-two logic are required to be operable to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 13 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the levels at which the LPRMs are located, except that channels A, C, D and F may lose all APRM inputs from the companion APRM cabinet plus one additional LPRM input and still be considered operable. The LPRMs, themselves, do not provide a scram signal. Each APRM channel receives one total drive flow signal representative of total core flow. The total drive flow signals are generated by two flow converters, one Amendment No. 236 33a

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) of which supplies signals to the trip system A APRMs, while the other supplies signals to the trip system B APRMs. Each flow converter signal is provided by summing up a flow signal from the two recirculation loops. Each required Average Power Range Monitor High Flux (Flow Bias) channel requires an input from one operable flow converter (e.g., if a converter unit is inoperable, the associated Average Power Range Monitor High Flux (Flow Bias) channels must be considered inoperable). An APRM flow converter is considered inoperable whenever it cannot deliver a flow signal less than or equal to actual recirculation flow conditions for all steady state and transient reactor conditions while in RUN.

The APRM flow biased flux scram Trip Setting is an Allowable Value, which is the limiting value that the trip setpoint may have when tested periodically, beyond which appropriate action shall be taken. For Vermont Yankee, the periodic testing is defined as the calibration. The actual scram trip is conservatively set in relation to the Allowable Value to ensure operability between periodic testing. The Trip Setting is derived from the Analytical Limit assumed in the CRDA analyses. W is percent of rated two loop drive flow where 100% rated drive flow is that flow equivalent to 48 X 106 lbs/hr core flow.

The Average Power Range Monitor High Flux (Flow Bias) Trip Function is required to be operable in RUN where there is a possibility of generating excessive Thermal Power and potentially exceeding the SL applicable to high pressure and core flow conditions (SL 1.1.A) and where there is the possibility of neutronic/thermal hydraulic instability. During STARTUP/HOT STANDBY and Refuel, other IRM and APRM Trip Functions provide protection for fuel cladding integrity. Although the Average Power Range Monitor High Flux (Flow Bias) Trip Function is assumed in the CRDA analysis, which is applicable in STARTUP/HOT STANDBY, the Average Power Range Monitor High Flux (Reduced)

Trip Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection. Therefore, the Average Power Range Monitor High Flux (Flow Bias) Trip Function is not required in STARTUP/HOT STANDBY.

4.b. Average Power Range Monitor High Flux (Reduced)

The APRM channels receive input signals from the LPRMs within the reactor core, which provide an indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than Rated Thermal Power. For operation at low power (i.e., STARTUP/HOT STANDBY), the Average Power Range Monitor High Flux (Reduced) Trip Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor High Flux (Reduced) Trip Function will provide a secondary scram to the Intermediate Range Monitor High Flux Trip Function because of the relative setpoints. With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor High Flux (Reduced) Trip Amendment No. 236 33b

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Function will provide the primary trip signal for a core-wide increase in power.

No specific safety analyses take direct credit for the Average Power Range Monitor High Flux (Reduced) Trip Function. However, the Average Power Range Monitor High Flux (Reduced) Trip Function indirectly ensures that before the reactor mode switch is placed in the run position, reactor power does not exceed 23% RTP (SL 1.1.B) when operating at low reactor pressure and low core flow. Therefore, it indirectly prevents fuel damage during significant reactivity increases with reactor power < 23% Rated Thermal Power.

The APRM System is divided into two groups of channels with three APRM channel inputs to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Four channels of Average Power Range Monitor High Flux (Reduced) with two channels in each trip system are required to be operable to ensure that no single failure will preclude a scram from this Trip Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 13 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the levels at which the LPRMs are located, except that channels A, C, D and F may lose all APRM inputs from the companion APRM cabinet plus one additional LPRM input and still be considered operable. The LPRMs, themselves, do not provide a scram signal.

The Trip Setting is based on preventing significant increases in power when reactor power is < 23% Rated Thermal Power.

The Average Power Range Monitor High Flux (Reduced) Trip Function must be operable during STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F when control rods may be withdrawn since the potential for criticality exists. In RUN, the Average Power Range Monitor High Flux (Flow Bias) Trip Functions provide protection against reactivity transients and the RWM and Rod Block Monitor protect against control rod withdrawal error events.

4.c. Average Power Range Monitor Inop This signal provides assurance that a minimum number of APRMs are operable.

Anytime an APRM mode switch is moved to any position other than "Operate," an APRM module is unplugged, or the APRM has too few LPRM inputs (< 13 for channels B and E; < 9 for channels A, C, D and F), an inoperative trip signal will be received by the RPS, unless the APRM is bypassed. Since only one APRM in each trip system may be bypassed, only one APRM in each trip system may be inoperable without resulting in an RPS trip signal. This Trip Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.

Amendment No. 236 33c

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Four channels of Average Power Range Monitor Inop with two channels in each trip system are required to be operable to ensure that no single failure will preclude a scram from this Trip Function on a valid signal.

There is no Trip Setting for this Trip Function.

This Trip Function is required to be operable in the MODES where the APRM Trip Functions are required.

5. High Reactor Pressure An increase in RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and Thermal Power transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB. The High Reactor Pressure Trip Function initiates a scram for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power. For the overpressurization protection analyses of Reference 5, reactor scram (the analyses conservatively assume scram from the APRM High Flux (Flow Bias) signal, not the High Reactor Pressure signal), along with the S/RVs, limits the peak RPV pressure to less than the ASME Section III Code limits.

High reactor pressure signals are initiated from four pressure transmitters that sense reactor pressure. The High Reactor Pressure Trip Setting is chosen to provide a sufficient margin to the ASME Section III Code limits during the event.

Four channels of High Reactor Pressure Trip Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal. The Function is required to be operable in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F since the Reactor Coolant System (RCS) is pressurized and the potential for pressure increase exists.

6. High Drywell Pressure High pressure in the drywell could indicate a break in the RCPB. A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell. The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the requirements of 10 CFR 50.46 are met.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Trip Setting was selected to be as low as possible and indicative of a LOCA inside primary containment.

Amendment No. 236 33d

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Four channels of High Drywell Pressure, with two channels in each trip system arranged in a one-out-of-two logic, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal. The Trip Function is required in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, where considerable energy exists in the RCS, resulting in the limiting transients and accidents.

7. Reactor Low Water Level Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, a reactor scram is initiated at low water level to substantially reduce the heat generated in the fuel from fission. The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS), ensures that requirements of 10 CFR 50.46 are met.

Reactor Low Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Reactor Low Water Level Trip Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal.

The Reactor Low Water Level Trip Setting is selected to ensure that during normal operation spurious scrams are avoided and that enough water is available above the top of enriched fuel to account for evaporative losses and displacements of coolant following the most severe abnormal operational transient involving a reactor water level decrease. The Trip Setting is referenced from top of enriched fuel. The top of enriched fuel has been designated as 0 inches and provides a common reference point for all reactor vessel water level instrumentation.

The Trip Function is required in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F where considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at low water levels provide sufficient protection for level transients in all other MODES.

Amendment No. 236 33e

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

8. Scram Discharge Volume High Level The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram. Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered.

Therefore, a reactor scram is initiated while the remaining free volume is still sufficient to accommodate the water from a full core scram. No credit is taken for a scram initiated from these Trip Functions for any of the design basis accidents or transients analyzed in the UFSAR. However, they are retained to ensure the RPS remains operable.

There are four level transmitters and trip units associated with each instrument volume. Four trip units (two for each instrument volume) are provided for each RPS trip system. On a per instrument volume basis, these trip units are arranged in pairs so that no single event will prevent a scram from this Trip Function on a valid signal.

The Trip Setting is chosen low enough to ensure that there is sufficient volume in the SDVs to accommodate the water from a full scram.

Eight channels of the Scram Discharge Volume High Level Trip Function, with two channels per volume in each trip system, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal. These Trip Functions are required in RUN, STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, and in Refuel with reactor coolant temperature < 212°F and any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.

At all other times, this Trip Function may be bypassed.

9. Main Steamline Isolation Valve Closure Main steamline isolation valve (MSIV) closure results in loss of the main turbine and the condenser as a heat sink for the nuclear steam supply system and indicates a need to shut down the reactor to reduce heat generation.

Therefore, a reactor scram is initiated on a Main Steamline Isolation Valve Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient. However, for the overpressurization protection analyses of Reference 5, the Average Power Range Monitor High Flux (Flow Bias) Trip Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis.

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the requirements of 10 CFR 50.46 are met.

Amendment No. 236 33f

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

MSIV closure signals are initiated from position switches located on each of the eight MSIVs. Each MSIV has two position switches; one switch inputs to RPS trip system A while the other switch inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steamline Isolation Valve Closure channels, each consisting of one position switch. The logic for the Main Steam Isolation Valve Closure Trip Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines must close in order for a scram to occur. In addition, certain combinations of valves closed in two lines will result in a half-scram.

The Main Steam Isolation Valve Closure Trip Setting is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.

Sixteen channels of the Main Steam Isolation Valve Closure Trip Function, with eight channels in each trip system, are required to be operable to ensure that no single instrument failure will preclude the scram from this Trip Function on a valid signal. This Trip Function is only required in RUN since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close. In STARTUP/HOT STANDBY and Refuel with reactor coolant temperature > 212°F, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection.

10. Turbine Control Valve Fast Closure Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure Trip Function is the primary scram signal for the generator load rejection event analyzed in Reference 6. For this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL (SL 1.1.A) is not exceeded.

Turbine Control Valve Fast Closure signals are initiated by the four pressure switches that sense acceleration relay oil pressure. Each pressure switch provides a signal to a separate RPS logic channel. This Trip Function must be enabled at Thermal Power > 25% Rated Thermal Power. This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Trip Function.

The Turbine Control Valve Fast Closure Trip Setting is selected to detect imminent TCV fast closure.

Amendment No. 236 33g

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Four channels of Turbine Control Valve Fast Closure with two channels in each trip system arranged in a one-out-of-two logic are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal. This Trip Function is required, consistent with the analysis assumptions, whenever Thermal Power is > 25% Rated Thermal Power.

This Trip Function is not required when Thermal Power is < 25% Rated Thermal Power, since the High Reactor Pressure and the Average Power Range Monitor High Flux (Flow Bias) Trip Functions are adequate to maintain the necessary safety margins.

11. Turbine Stop Valve Closure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop Valve Closure Trip Function is the primary scram signal for the turbine trip event analyzed in Reference 7. For this event, the reactor scram reduces the amount of energy required to be absorbed and ensures that the MCPR SL (SL 1.1.A) is not exceeded.

Turbine Stop Valve Closure signals are initiated from limit switches located on each of the four TSVs. Each TSV has one limit switch with two contacts; one contact inputs to RPS trip system A; the other contact inputs to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop Valve Closure channels, each consisting of one limit switch contact. The logic for the Turbine Stop Valve Closure Trip Function is such that three or more TSVs must be closed to produce a scram. In addition, certain combinations of two valves closed will result in a half-scram. This Function must be enabled at Thermal Power > 25% Rated Thermal Power. This is accomplished automatically by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Trip Function.

The Turbine Stop Valve Closure Trip Setting is selected to be high enough to detect imminent TSV closure, thereby reducing the severity of the subsequent pressure transient.

Eight channels of Turbine Stop Valve Closure, with four channels in each trip system, are required to be operable to ensure that no single instrument failure will preclude a scram from this Trip Function on a valid signal if any three TSVs should close. This Trip Function is required, consistent with analysis assumptions, whenever Thermal Power is > 25% Rated Thermal Power.

This Trip Function is not required when Thermal Power is < 25% Rated Thermal Power since the High Reactor Pressure and the Average Power Range Monitor High Flux (Flow Bias) Trip Functions are adequate to maintain the necessary safety margins.

Amendment No. 236 33h

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM ACTIONS Table 3.1.1 ACTION Notes 1.a.1) and 1.a.2)

Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref. 8) to permit restoration of any inoperable channel to operable status. However, this out of service time is only acceptable provided the associated Trip Function's inoperable channels are in only one trip system and the Trip Function still maintains RPS trip capability (refer to Bases for Table 3.1.1 ACTION Notes 1.b.1), 1.b.2), and 1.c.1)). If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Table 3.1.1 ACTION Note 1.a.1) or 1.a.2). Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram), the applicable action of Table 3.1.1 ACTION Note 2 must be taken.

Table 3.1.1 ACTION Notes 1.b.1) and 1.b.2)

Table 3.1.1 ACTION Notes 1.b.1) and 1.b.2) apply when, for any one or more Trip Functions, at least one required channel is inoperable in each trip system. In this condition, provided at least one channel per trip system is operable, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.

Table 3.1.1 ACTION Notes 1.b.1) and 1.b.2) limit the time the RPS scram logic, for any Trip Function, would not accommodate single failure in both trip systems (e.g., one-out-of-one and one-out-of-one arrangement for a typical four channel Trip Function). The reduced reliability of this logic arrangement was not evaluated in Reference 8 for the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time.

Within the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the associated Trip Function will have all required channels operable or in trip (or any combination) in one trip system.

This is accomplished by either placing all inoperable channels in trip or tripping the trip system.

Completing one of these Actions (either Table 3.1.1 ACTION Note 1.b.1) or 1.b.2)) restores RPS to a reliability level equivalent to that evaluated in Reference 8, which justified a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowable out of service time as presented in Table 3.1.1 ACTION Note 1.a.1) and 1.a.2). The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels if the two inoperable channels are in the same Trip Function while the four inoperable channels are all in Amendment No. 236 33i

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM ACTIONS (continued) different Trip Functions). The decision of which trip system is in the more degraded state should be based on prudent judgment and take into account current plant conditions (i.e., what Mode the plant is in). If this action would result in a scram, it is permissible to place the other trip system or its inoperable channels in trip.

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Trip Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram, the applicable actions of Table 3.1.1 ACTION Note 2 must be taken.

Table 3.1.1 ACTION Note 1.c.1)

Table 3.1.1 ACTION Note 1.c.1) is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Trip Function result in the Trip Function not maintaining RPS trip capability. A Trip Function is considered to be maintaining RPS trip capability when sufficient channels are operable or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Trip Function on a valid signal. For the typical Trip Function with one-out-of-two taken twice logic and the IRM and APRM Functions, this would require both trip systems to have one channel operable or in trip (or the associated trip system in trip). For Trip Function 1 (Reactor Mode Switch in Shutdown) and Trip Function 2 (Manual Scram), this would require both trip systems to have one channel, each operable or in trip (or the associated trip system in trip). For Trip Function 8 (Scram Discharge Volume High Level), this would require both trip systems to have one channel per instrument volume operable or in trip (or the associated trip system in trip).

For Trip Function 9 (Main Steamline Isolation Valve Closure), this would require both trip systems to have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems) operable or in trip (or the associated trip system in trip).

For Trip Function 11 (Turbine Stop Valve Closure), this would require both trip systems to have three channels, each operable or in trip (or the associated trip system in trip).

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Amendment No. 236 33j

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM ACTIONS (continued)

Table 3.1.1 ACTION Notes 2.a, 2.b, 2.c and 2.d If any applicable Action and associated completion time of Table 3.1.1 ACTION Note 1.a, 1.b, or 1.c are not met, the applicable Actions of Table 3.1.1 ACTION Note 2 and referenced in Table 3.1.1 (as identified for each Trip Function in the Table 3.1.1 ACTIONS REFERENCED FROM ACTION NOTE 1 column) must be immediately entered and taken. The applicable Action specified in Table 3.1.1 is Trip Function and Mode or other specified condition dependent.

For Table 3.1.1 ACTION Note 2.a, 2.b, or 2.c, if the applicable channel(s) is not restored to operable status or placed in trip (or the associated trip system placed in trip) within the allowed completion time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply.

The allowed completion times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.

For Table 3.1.1 ACTION Note 2.d, if the applicable channel(s) is not restored to operable status or placed in trip (or the associated trip system placed in trip) within the allowed completion time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.1.A.1 As indicated in Surveillance Requirement 4.1.A.1, RPS instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.1.1.

Table 4.1.1 identifies, for each RPS Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.1.A.1 also indicates that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Trip Function maintains RPS trip capability.

Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability Amendment No. 236 33k

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued) analysis (Ref. 8) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RPS will trip when necessary.

Surveillance Requirement 4.1.A.2, Automatic Scram Contactor Functional Test There are four pairs of RPS automatic scram contactors with each pair associated with an RPS scram test switch. Each pair of scram contactors is associated with an automatic scram logic channel (A1, A2, B1, and B2). Using the RPS channel test switches, the automatic scram contactors can be exercised without the necessity of using a scram function trip. However, a Functional Test of any automatic RPS Trip Function may be used to satisfy the requirement to exercise the RPS automatic scram contactors. Surveillance Frequency extensions for RPS Functions, described in Reference 8, are allowed provided the automatic scram contactors are exercised weekly. This Surveillance may be accomplished by placing the associated RPS scram test switch in the trip position, which will deenergize a pair of RPS automatic scram contactors thereby tripping the associated RPS logic channel.

The RPS scram test switches were not specifically credited in the accident analysis. However, because the Manual Scram Trip Functions at the Vermont Yankee Nuclear Power Station (VYNPS) were not configured the same as the generic model in Reference 8, the RPS scram test switches were evaluated and it was concluded that the Frequency extensions for RPS Trip Functions are not affected by the difference in RPS configuration since each automatic RPS channel has a test switch which is functionally the same as the manual scram switches in the generic model. As such, exercising each automatic scram contactor is required to be performed every 7 days. The Frequency of 7 days is based on the reliability analysis of Reference 8 as modified by the VYNPS design specific RPS evaluation.

Surveillance Requirement 4.1.A.3, RPS Response Time Test This Surveillance Requirement ensures that the individual channel response times are less than or equal to 50 milliseconds. This test may be performed in one measurement or in overlapping segments, with verification that all required components are tested. The Once every Operating Cycle Frequency is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

Amendment No. 236 33l

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued)

Surveillance Requirement 4.1.A.4 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel.

The testing required by the Control Rod System Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function.

The Frequency of "once every Operating Cycle" is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.1.1, Check Performance of an Instrument Check once per day for Trip Functions 3.a, 5, and 7, ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Footnote (a) of Table 4.1.1 provides requirements to verify overlap for Trip Functions 3.a and 4.b to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status.

The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a neutron flux region without adequate indication. This is required prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs. The overlap between IRMs and APRMs is of concern when reducing power into the IRM range. On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained. Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that the transition between RUN and STARTUP/HOT STANDBY can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, Amendment No. 236 33m

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued) prior to withdrawing the SRMs from the fully inserted position, IRMs are above mid-scale on range 1 before SRMs have reached the upscale rod block. As noted, IRM/APRM overlap is only required to be met during entry into STARTUP/HOT STANDBY from RUN. That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in STARTUP/HOT STANDBY). If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap),

the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable. Only those appropriate channels that are required in the current MODE or condition should be declared inoperable. A Frequency of 7 days is reasonable based on engineering judgment and the reliability of the IRMs and APRMs.

Table 4.1.1, Functional Test A Functional Test is performed on each required channel to ensure that the channel will perform the intended function. For Trip Function 1, this Surveillance is performed by placing the reactor mode switch in the shutdown position. For Trip Functions 2, 3.a, 3.b, 5, 6, 7, 8, 9, 10, 10.a, 11, and 11.a, this Surveillance verifies the trip of the required channel. For Trip Functions 4.a, 4.b, and 4.c, this Surveillance verifies the trip of the required output relay. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

For Trip Functions 3.a, 3.b, and 4.b, as noted (Table 4.1.1 Footnote (b)), the Functional Test is not required to be completed when entering STARTUP/HOT STANDBY from RUN, since testing of the STARTUP/HOT STANDBY required IRM and APRM Trip Functions cannot be performed in RUN without utilizing jumpers, lifted leads, or movable links. This allows entry into STARTUP/HOT STANDBY if the required Frequency is not met. In this event, the Surveillance must be completed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering STARTUP/HOT STANDBY from RUN. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance.

For Trip Function 4.b, a Frequency of 7 days provides an acceptable level of system average unavailability over the Frequency interval.

For Trip Functions 3.a and 3.b, the Frequency of 31 days is based on the safety assessment described in Reference 9.

For Trip Functions 2, 4.a, 4.c, 5, 6, 7, 8, 9, 10, and 11, the Frequency of Every 3 Months is based on the reliability analysis of Reference 8.

For Trip Functions 10.a and 11.a, the Frequency of Every 6 Months is based in engineering judgment and reliability of the components.

Amendment No. 236 33n

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued)

For Trip Function 1, The Frequency of Each Refueling Outage is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.1.1, Calibration For Trip Function 4.a, to ensure that the APRMs are accurately indicating the true core average power, the APRMs are adjusted to conform to the reactor power calculated from a heat balance. The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between performances of APRM adjustments (per heat balance). Footnote (d) to Table 4.1.1 requires this heat balance Surveillance to be performed only at 23% Rated Thermal Power because it is difficult to accurately maintain APRM indication of core Thermal Power consistent with a heat balance when < 23% Rated Thermal Power. At low power levels, a high degree of accuracy is unnecessary because of the large, inherent margin to thermal limits (MCPR and APLHGR). At 23% Rated Thermal Power, the Surveillance is required to have been satisfactorily performed within the last 7 days.

Footnote (d) is provided which allows an increase in Thermal Power above 23%

if the 7 day Frequency is not met. In this event, the Surveillance must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 23% Rated Thermal Power.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance.

For Trip Function 4.a, LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP) System. This establishes the relative local flux profile for appropriate representative input to the APRM System. The 2000 mega-watt days per short ton (MWD/T)

Frequency is based on operating experience with LPRM sensitivity changes, and that the resulting nodal power uncertainty, combined with other uncertainties, remains less than the total uncertainty (i.e., 8.7%) allowed by the GETAB safety limit analysis.

For Trip Functions 3.a, 4.a, 4.b, 5, 6, 7, 8, 9, 10, 10.a, 11, and 11.a, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The Instrument Calibration for Functions 9 and 11 should consist of a physical inspection and actuation of the associated position switches.

The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

Amendment No. 236 33o

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM SURVEILLANCE REQUIREMENTS (continued)

For Trip Functions 4.a, 5, 6, 7, and 8, a calibration of the trip units is required (Footnote (e)) once every 3 months. Calibration of the trip units provides a check of the actual setpoints. Trip function 4.b receives trip unit calibration (Footnote(e)) on a 7 Day Frequency during Refueling, before entering STARTUP/HOT STANDBY, and during STARTUP/HOT STANDBY. For Trip Functions 4.b,5,6,7, and 8, the channel must be declared inoperable if the trip setpoint is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures. The calibration of Trip Function 4.a, the APRM High Flux Flow Bias Scram, trip units provides a check of the actual trip setpoints. If the trip setting is found to be less conservative than accounted for in the appropriate setpoint calculation, but is not beyond the Allowable Value specified in Table 3.1.1, the channel performance is still within the requirements of the plant safety analysis.

However, if the trip setting is found to be less conservative than the Allowable Value specified in Table 3.1.1, the channel should be declared inoperable. Under these conditions, the setpoint should be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint calculation. The Frequency of every 3 months is based on the reliability analysis of Reference 8 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

Footnote (b) to Table 4.1.1 is provided to require the APRM and IRM Surveillances to be completed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering STARTUP/HOT STANDBY from RUN. Testing of the STARTUP/HOT STANDBY APRM and IRM Trip Functions cannot be performed in RUN without utilizing jumpers, lifted leads, or movable links. This Footnote allows entry into STARTUP/HOT STANDBY from RUN if the associated Frequency is not met. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance. Footnote (c) to Table 4.1.1 states that neutron detectors are excluded from Instrument Calibration because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Changes in LPRM neutron detector sensitivity are compensated for by performing the 7 day heat balance calibration and the 2000 MWD/T LPRM calibration against the TIP System.

Amendment No. 236 33p

VYNPS BASES: 3.1.A/4.1.A REACTOR PROTECTION SYSTEM REFERENCES

1. UFSAR, Section 7.2.

2. UFSAR, Chapter 14.

3. NEDO-23842, Continuous Control Rod Withdrawal in the Startup Range, April 18, 1978.

4. UFSAR, Section 14.5.3.

5. UFSAR, Section 14.5.1.3.1

6. UFSAR, Section 14.5.1.1.

7. UFSAR, Section 14.5.1.2.

8. NEDC-30851-P-A, Technical Specification Improvement Analyses for BWR Reactor Protection System, March 1988.

9. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment No. 225 to Facility Operating License No. DPR-28, Entergy Nuclear Vermont Yankee, LLC and Entergy Nuclear Operations Inc., Vermont Yankee Nuclear Power Station, Docket No. 50-271, dated July 7, 2005.

Amendment No. 236 33q

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION 3.2 PROTECTIVE INSTRUMENT SYSTEMS 4.2 PROTECTIVE INSTRUMENT SYSTEMS Applicability: Applicability:

Applies to the operational status Applies to the Surveillance*

of the plant instrumentation requirements of the systems which initiate and instrumentation systems which control a protective function. initiate and control a protective function.

Objective: Objective:

To assure the operability of To verify the operability of protective instrumentation protective instrumentation systems. systems.

Specification: Specification :.

A. Emergency Core Cooling System A. Emergency Core Cooling System (ECCS) (ECCS)

The ECCS instrumentation for 1. ECCS instrumentation shall each Trip Function in Table be checked, functionally 3.2.1 shall be operable in tested and calibr~ted as accordance with Table 3.2.1. indicated in Table 4.2.1.

When an ECCS instrumentation channel is placed in an inoperable status solely for performance of required surveillances, entry into associated Limiting Conditions for Operation and required Actions may be delayed as follows: (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Function 3.d; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Functions other than 3.d provided the associated Trip Function or redundant Trip Function maintains ECCS initiation capability.

2. Perform a Logic System Functional Test of ECCS instrumentation Trip Functions once every Operating Cycle.

Amendment No.~, 236 34

VYNPS Table 3.2.1 (page 1 of 4)

Emergency Core Cooling System Instrumentation ACTIONS WHEN REQUIRED REQUIRED APPLICABLE MODES OR CHANNELS CHANNELS OTHER SPECIFIED PER TRIP ARE TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE TRIP SETTING

1. Core Spray Sy,stem

a. High Drywell RUN, STARTUP/HOT 2 Note 1 :s; 2.5 psig Pressure STANDBY, HOT SHUTDOWN, Refuel (a). Ie)

b. Low:-Low RUN, STARTUP/HOT 2 Note 1 ~ 82.5 inches Reactor STANDBY, HOT SHUTDOWN, Vessel Water Refuella). (b), (e)

Level

c. Low Reactor RUN, STARTUP/HOT 1 Note 2 ~ 300 psig and Pressure STANDBY, HOT SHUTDOWN, :s; 350 psig (Initiation) Refuel (ai, (b)

d. Low Reactor RUN, STARTUP/HOT 2 Note 2 ~ 300 psig and Pressure STANDBY, HOT SHUTDOWN, :S;*350 psig (System Ready Refuel (e), (bl and Valve Permissive)

e. Pump Start RUN, STARTUP/HOT 1 Note 2 ~ 8 seconds and Time Delay STANDBY, HOT SHUTDOWN, :s; 10 seconds Refuel fa). (b)

f. Pump RUN, STARTUP/HOT 2 Note 8 ~ 100 psig Discharge STANDBY (c) , HOT per Pressure SHUTDOWN (c) , Refuel (c) pump

g. Auxiliary RUN, STARTUP/HOT 1 Note 2 NA Power Monitor STANDBY, HOT SHUTDOWN, Refuel (a). Ib)

h. Pump Bus RUN, STARTUP/HOT 1 Note 2 NA Power Monitor STANDBY, HOT SHUTDOWN, Refuel (a). (b)

(a) With reactor coolant temperature> 212 OF.

(b) When associated ECCS subsystem is required to be oper-able per specification 3.5.

(c) With reactor steam pressure> 150 psig.

(e) Required to initiate the emergency diesel generators when core spray is required to be operable per specification 3.5.

Amendment No. +64, 236 35

VYNPS Table 3.2.1 (page 2 of 4)

Emergency Core Cooling System Instrumentation ACTIONS WHEN REQUIRED REQUIRED APPLICABLE MODES OR CHANNELS CHANNELS OTHER SPECIFIED PER TRIP ARE TRIP FUNCTION. CONDITIONS SYSTEM INOPERABLE TRIP SETTING

2. Low Pressure Coolant Injection (LPCI)

System

a. Low Reactor RUN, STARTUP/HOT 1 Note 2 ~ 300 psig and

pressure STANDBY, HOT SHUTDOWN, 5 350 psig (Initiation) Refuel (a) , Ib)

b. High Drywell RUN, STARTUP/HOT 2 Note 1 S; 2.5 psig Pressure STANDBY, HOT SHUTDOWN, (Initiation) Refuel (a)

c. Low-Low RUN, STARTUP/HOT 2 Note 1 ~ 82.5 inches Reactor STANDBY, HOT SHUTDOWN, Vessel Water Refuel (a), (b)

Level

d. Reactor RUN, STARTUP/HOT 1 Note 3 ~ 2/3 core Vessel Shroud STANDBY, HOT SHUTDOWN, height Level Refuel (a)

e. LPCI Band C RUN, STARTUP/HOT 1 Note 2 ~ 3 seconds and Pump Start STANDBY, HOT SHUTDOWN, S 5 seconds Time Delay Refuel (a), (b)

f. RHR Pump RUN, STARTUP/HOT 2 per Note 8* ~ 100 psig Discharge STANDBY Ic) , HOT pump Pressure SHUTDOWN Ic) , Refuel lc )

g. High Drywell RUN, STARTUP/HOT 2 Note 3 S 2.5 psig Pressure STANDBY, HOT SHUTDOWN, (Containment Refuel (S)

Spray Permissive)

h. Low Reactor RUN, STARTUP/HOT 2 Note 2 ~ 300 psig and Pressure STANDBY, HOT SHUTDOWN, S; 350 psig (System Ready Refuel (a), (b) and Valve Permissive)

(a) With reactor coolant temperature> 212 of.

(b) When associated ECCS subsystem.is required to be operable per specification 3.5.

(c) With reactor steam pressure> 150 psig.

Amendment No. ~, 236 36

VYNPS Table 3.2.1 (page 3 of 4)

Emergency Core Cooling System Instrumentation ACTIONS WHEN REQUIRED REQUIRED APPLICABLE MODES OR CHANNELS CHANNELS OTHER SPECIFIED PER TRIP ARE TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE TRIP SETTING

2. LPCI System (Continued)

i. Auxiliary RUN, STARTUP/HOT 1 Note 2 NA Power Monitor STANDBY, HOT SHUTDOWN, Refuel (aI, (bl j .. Pump Bus RUN, STARTUP/HOT 1 Note 2 NA Power Monitor STANDBY, HOT SHUTDOWN, Refuel lal , Ib'

3. High Pressure Coolant Injection (HPCI)

System

a. Low-Low RUN, STARTUP/HOT 2 Note 4 ~ 82.5 inches Reactor STANDBY (cl , HOT Vessel* Water SHUTDOWN lcl , Refuel (c)

Level

b. Low RUN, STARTUP/HOT 2 Notes Condensate STANDBY lc) , HOT 5,9;10 Storage Tank SHUTDOWN (c, , Refuel lc )

Water Level

c. High Drywell RUN, STARTUP/HOT 2 Note 4 S 2.5 psig Pressure STANDBy 1c ), HOT SHUTDOWN(cl, Refuel lcl

d. High Reactor RUN, STARTUP/HOT 2 Note 6. S 177 inches Vessel Water STANDBY lc) , HOT Level SHUTDOWN lc ), Refuel lc )

(a) With reactor coolant temperature> 212 of.

(b) When associated ECCS subsystem is required to be operable per specification 3.5.

(c) With reactor steam pressure> 150 psig.

(d) Percent of instrument span.

Amendment No.-+/--64, 236 37

VYNPS Table 3.2.1 (page 4 of 4)

Emergency Core Cooling System Instrumentation ACTIONS WHEN REQUIRED REQUIRED APPLICABLE MODES OR CHANNELS CHANNELS OTHER SPECIFIED PER TRIP ARE TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE TRIP SETTING

4. Automatic Depressurization

.System (ADS)

a. Low-Low RUN, STARTUP/HOT 2 Note 7 ~ 82.5 inches Reactor* STANDBY (C), HOT Vessel Water SHUTDOWN(Cl, Refuel (e)

Level

b. High Drywell, RUN, STARTUP/HOT 2 Note 7 ~ 2.5 psig .

Pressure STANDBY (e), HOT SHUTDOWN ,e) , Refuel (e)

c. Time Delay RUN, STARTUP/HOT 1 Note 8 ~ 120 seconds STANDBY (C), HOT SHUTDOWN (e) , Refuel (e)

d. Sustained RUN, STARTUP/HOT 2 Note 8 ~ 8 minutes Low-Low STANDBY (e), HOT Reactor SHUTDOWN(e), Refuel 'e)

Vessel Water Level Time Delay (c) With ~eactor steam pressure> 150 psig.

Amendment No. ~, 236 38

VYNPS Table 3.2.1 ACTION Notes

1. With one or more channels inoperable for ECCS instrumentation Trip Functions l.a, l.b, 2.b and 2.c:

a. Declare the associated systems inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of initiation capability for feature(s) in both divisions; and

b. Place any inoperable channel in trip within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable Action and associated completion time of Note l.a or l.b is not met, immediately declare associated systems inoperable.

2. With one or more channels inoperable for ECeS'instrumentation Trip Functions Lc, Ld, Le~ Lg, Lh, 2.a" 2.e, 2.h, 2.1 and 2.j:

a. Declare the associated systems inoperable within l'hour from discovery of loss of initiation capability for feature(s) in both divisions; and

b. Restore any inoperable channel to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable Action and associated completion time of Note 2.a or 2.b is not met,' immediately declare associated systems inoperable.

3. With one or more channels inoperable for ECCS instrumentation Trip Functions 2.d and 2.g:

a. For Trip Function 2.g only, declare the associated system inoperable within, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of LPCI initiation capability; and

b. For Trip Function 2.g, place any inoperable channel in trip within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. For Trip Function 2.d restore any inoperable channel to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable Action ,and associated completion time of Note 3.a, 3.b or 3.c is not 'met, immediately declare associated' systems inoperable.

4. With one or more channels inoperable for ECCS instrumentation Trip Functions 3.a and 3.c:

a. Declare the HPCI System inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of HPCI System initiation capability; and

b. Place any inoperable channel in trip within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable Action and associated completion time of Note 4.a or 4.b is not met, immediately declare HPCI System inoperable.

5. With one or more channels inoperable for ECCS instrumentation Trip Function 3.b:

a. Declare the. HPCI System inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery' of loss of HPCI initiation capability when HPCI System suction is aligned to the Condensate Sto~age Tank; and

b. Place any inoperable channel in trip or align HPCI System suction to the suppression pool within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable Action and associated completion time of Note 5.a or 5.b is not met, immediately declare the HPCI System inoperable.

Amendment No. ~, 236 ,39

VYNPS Table 3.2.1 ACTION Notes (Continued)

6. With one or more channels inoperable for ECCS instrumentation Trip Function 3.d:

a. Restore any inoperable channel to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If the Action and associated completion time of Note 6.a is"not met, immediately declare the HPCI System inoperable.

7. With one or more channels inoperable for ECCS instrumentation Trip Functions 4.a and 4.b:

a. Declare ADS inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems; and

b. Place any inoperable channel in trip within 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of the inoperable channel concurrent with HPCI" System or RCIC System inoperable, and

c. Place any inoperable channel in trip within 8 days.

If any applicable Action and associated completion time of Note 7.a, 7.b or 7.c is not met, immediately declare ADS inoperable.

8. With one or more channels inoperable for ECCS instrumentation Trip Functions l.f, 2.f, 4.c and 4.d:

a. Declare ADS inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of ADS initiation capability in both trip systems; and

b. Restore any inoperable channel to operable status within 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of the inoperable channel concurrent with HPCI System or RCIC System inoperable, and

c. Restore any inoperable channel to operable status within 8 days.

If any applicable Action and associated completion time of Note 8.a, 8.b or 8.c is not met, immediately declare ADS inoperable.

9. If the as-found channel setpoint *is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

10. The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Nominal Trip Setpoint at the completion of the surveillance; otherwise, the channel shall be declared inoperable.

setpoints more conservative than the Limiting Trip Setpoint are acceptable provided that as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures to confirm channel performance.

The methodologies used to determine the as-found and the as-left tolerances are specified in the Vermont Yankee Setpoint Program Manual.

Amendment No. ~, 236 40

VYNPS Table 4.2.1 (page 1 of 2)

Emergency Core Cooling System Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

1. Core Spray System

a. High Drywell Once/Day Every 3 Months Every 3 Months la)

Pressure r Once/Operating Cycle

b. Low-Low Reactor Once/Day Every 3 Months Every 3 Months la)

Vessel Water Level Once/Operating Cycle

c. Low Reactor Pressure NA Every 3 Months* Every 3 Months la)

(Initiation) Once/Operating Cycle

d. Low Reactor Pressure NA Every 3 Months Every 3 Months la)

(System Ready and Once/Operating Cycle Valve Permissive)

e. Pump Start Time NA NA Once/Operating Cycle Delay

f. Pump Discharge NA Every 3 Months Every 3 Months Pressure

g. Auxiliary Power Once/Day Every 3 Months NA Monitor h.* Pump Bus Power Once/Day Every 3 Months NA Monitor

2. Low Pressure Coolant Injection (LPCI) System J

a. Low Reactor Pressure NA Every 3 Months Every 3 Months la)

(Initiation) Once/Operating Cycle

b. High Drywell Once/Day Every 3 Months Every 3 Months la)

Pressure Once/Operating Cycle (Initiation)

c. Low-Low Reactor** Once/Day Every 3 Months Every 3 Months la)

Vessel Water Level Once/Operating Cycle

d. Reactor Vessel NA Every 3 Months Every 3 Months lal Shroud Level Once/Operating Cycle

e. LPCI Band C Pump NA NA Once/Operating Cycle Start Time Delay

f. RHR.Pump Discharge NA Every 3 Months Every 3 Months Pressure

g. High Drywell NA Every 3 Months Every 3 Months la)

Pressure Once/Operating Cycle (Containment Spray Permissive)

(a) Trip unit calibration only.

Amendment No. ~, 236 41

VYNPS Table 4.2.1 (page 2 of ?)

Emergency Core Cooling System Instrumentation Tests and Frequencies TRIP FUNCTION 'CHECK FUNCTIONAL TEST CALIBRATION

2. LPCI System (Continued)

h. Low Reactor Pressure NA Every 3 Months Every 3 Months (a)

(System Ready and Once/Operating Cycle Valve Permissive)

i. Auxiliary Power Once/Day Every 3 Months NA Monitor

j. Pump Bus Power Once/Day Every 3 Months NA Monitor

3. High Pressure Coolant Injection (HPCI) System

a. Low-Low Reactor Once/Day Every 3 Months Every 3 Months (a)

Vessel Water Level Once/Operating Cycle

b. Low Condensate NA Every 3 Months Every 3 Montp,s, Storage Tank Water Level

c. High Drywell Once/Day Every 3 Months Every 3 Months la)

Pressure Once/Operating Cycle

d. High' Reactor Vessel NA Every 3 Months Every 3 Months~)

Water Level Onc~/Operating Cycle

4. Automatic Depressurization System (ADS)

a. Low-Low Reactor Once/Day Every 3 Months Ev!'!ry 3' Months (a)

Vessel Water Level Once}Operating Cycle

b. High Drywell Once/Day Every 3 Months Every '3 Months la)

Pressure Once/Operating 'Cycle

c. Time Delay NA NA Once/Operating Cycle

d. Sustained Low-Low NA NA Once/Operating Cycle Reactor Vessel Water Level Time Delay (a) Trip unit calibration only.

Amendment No. -l-64 236 42

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION 3.2 PROTECTIVE INSTRUMENT SYSTEMS 4.2 PROTECTIVE INSTRUMENT SYSTEMS B. Primary Containment Isolation B. Primary Containment Isolation The primary containment 1. The primary containment isolation instrumentation for isolation instrumentation

,each Trip Function in Table shall be checked, 3.2.Z shall be operable in functionally tested and accordance ,with Table 3.2.2. calibrated as indicated in Table 4.2.2.

When a primary containment isolation channel, and/or the affected primary containment isolation valve, is placed in an inoperable status solely for performance of required instrumentation surveillances, entry into associated Limiting Conditions for Operation and required Actions may be delayed'for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains isolation capabili ty.

2. Perform a Logic System Functional Test of Primary Containment isolation instrumentation Trip Functions once every Operating Cycle.

Amendment No. ~" 236 43

VYNPS Table 3.2.2 (page 1 of 3)

Primary Containment Isolation Instrumentation ACTIONS WHEN ACTIONS APPLICABLE MODES REQUIRED REQUIRED REFERENCED OR OTHER CHANNELS CHANNELS FROM SPECIFIED PER TRIP ARE ACTION TRIP TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE NOTE 1 SETTING

1. Main Steam Line Isolation a.Low-Low Reactor RUN, STARTUP/HOT 2 Note 1 Note 2.a ~ 82.5 Vessel Water STANDBY, HOT inches Level SHUTDOWN', Refuel (a) b.High Main Steam RUN, STARTUP/HOT 8 Note 1 Note 2.a s; 196 OF for Line Area STANDBY, HOT channels

'Temperature SHUTDOWN, Refuel (a) monitoring outside steam tu'nne1 and S; 200 OF for channels monitoring inside steam tunnel c'. High Main Steam RUN, STARTUP/HOT 2 per Note 1 Note 2.a s; 140% of.

Line Flow STANDBY, HOT main rated flow SHUTDOWN, Refuel 1a ) steam line d.Low Main Steam RUN 2 Note 1 Note 2.e ~ 800 psig Line Pressure e.High Main Steam STARTUP/HOT 2 Note 1 Note 2.a s; 40% of Line Flow - Not STANDBY, HOT rated flow in RUN SHUTDOWN, Refuel (a)

f. Condenser, Low. RUN, STARTUP/HOT 2 Note 1 Note 2.a s; 12 inches Vacuum STANDBY Ibl, HOT Hg absolute SHUTDOWN (b) ,

Refuel (al * (b)

2. Primary Containment Isolation a.Low Reactor RUN, STARTUP/HOT 2 Note 1 Note 2.b ~ 127.0 Vessel Water STANDBY, HOT inches Level SHUTDOWN, Refuel (a)

b. High Drywell RUN, STARTUP/HOT 2 Note 1 Note 2.b s; 2.5 psig Pressure STANDBY, HOT SHUTDOWN, Refuel (al (a) With reactor coolant temperature> 212 OF.

(b) With any turbine stop valve or turbine bypass valve not closed.

Amendment No. ~, 236 44

VYNPS Table 3.2.2 (page 2 of 3)

Primary Containment Isolation Instrumentation ACTIONS WHEN ACTIONS APPLICABLE MODES REQUIRED REQUIRED REFERENCED OR OTHER CHANNELS CHANNELS FROM SPECIFIED PER TRIP ARE ACTION TRIP TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE NOTE 1 SETTING

3. High Pressure Coolant Injection (HPCI) System Isolation a.High Steam Line RUN, STARTUP/HOT 6 Note 1 Note 2.d Space STANDBY, HOT Temperature SHUTDOWN, Refuel (0) b.High Steam Line RUN, STARTUP/HOT 1 Note 1 Note 2.d s; 195 dip (Steam Line STANDBY, HOT inches of Break) SHUTDOWN, Refuel (al water c.Low Steam RUN, STARTUP/HOT 4 Note .1 Note 2.d ~ 70 psig Supply Pressure STANDBY, HOT SHUTDOWN, Refuel (0) d.High Main Steam RUN, STARTUP/HOT 2 Note 1 Note 2.d Line Tunnel STANDBY, HOT Temperature SHUTDOWN, Refuel (al e.High Main Stea~ RUN, STARTUP/HOT 1 Note 1 Note 2.d s; 35 Line Tunnel STANDBY, HOT minutes Temperature Time SHUTDOWN, Refuel (0)

Delay

4. Reactor Core Isolation Cooling (RCIC) System Isolation a.High Main Steam RUN, STARTUP/HOT 2 Note 1 Note 2.d Line Tunnel STANDBY, HOT Temperature SHUTDOWN, Refuel (0) b.High Main Steam RUN, STARTUP/HOT 1 Note '1 Note 2.d s; 35 Line Tunnel STANDBY, HOT minutes Temperature Time SHUTDOWN, Refuel (0)

Delay c.High Steam Line RUN, STARTUP/HOT 6 Note 1 Note 2.d Space STANDBY, HOT Temperature SHUTDOWN, Refuel (0)

(a) With reactor cool~nt temperature> 212 of.

Amendment No. ~, 236 45

VYNPS Table 3.2.2 (page 3 of 3)

Primary Containment Isolation Instrumentation ACTIONS WHEN ACTIONS APPLICABLE MODES REQUIRED REQUIRED REFERENCED

'OR OTHER CHANNELS CHANNELS FROM SPECIFIED PER TRIP ARE ACTION TRIP TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE NOTE 1 SETTING

4. RCIC System Isolation ' ,

(Continued) d.High Steam Line RUN, STARTUP/HOT 1 Note 1 Note 2.d :s; 195 dIp (Steam Line STANDBY, HOT inches of Break) SHUTDOWN, Refuel (a) water e.High Steam Line RUN, STARTUP/HOT 1 Note 1 Note 2.d ~ 3 seconds, dIp Time Delay STANDBY, HOT and' SHUTDOWN, Refuel (a' :s; 7'seconds f.Low Steam RUN, STARTUP/HOT 4 Note 1 Note 2'.d ~ 50 psig Supply Pressure STANDBY, HOT SHUTDOWN, Refuel (a)

5. Residual Heat Removal Shutdown Cooling Isolation a.High Reactor RUN, STARTUP/HOT 1 Note 1 Note 2.d :s; 150 psig Pressure STANDBY, HOT SHUTDOWN, Refuel (a' (a) With reactor coolant temperature> 212 OF.

Amendment No. -H4, 236 46

VYNPS '

Table 3.2.2 ACTION Notes

1. With one or more required Primary Containment Isolation Instrumentation channels inoperable, ,take all of the 'applicable Actions in Notes 1.a and l.b below.

a. With one or more Trip Functions with one or more required channels' inoperable:

1) For Trip Functions 2.a and 2.b, place any inoperable channel in trip within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; and

2) For Trip Functions 3.e, 4.b, and 4'.e, restore any inoperable channel to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; and

3) For all other Trip Functions, place any inoperable channel in trip within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one or more Trip Functions with isolation capability not maintained:

1) Restore isolation capability within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Penetration flow' paths, isolated as a result of complying with the above Actions, may be unisolated intermittently under administrative controls.

If any applicable and associated completion time of Note l.a or l.b is not met, take the appli~able Actions of Note 2 below and referenced in Table 3.2.2 for the channel.

2'. a. Isolate the associated Main Steam Line within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (penetration flow paths may be unisolated intermittently under administrative control); or Place the reactor in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 'and place the reactor in COLD SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

b. Place the reactor in COLD SHUTDOWN within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c.Place the reactor in STARTUP/HOT STANDBY within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

d. Isolate the affected penetration flow path within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and comply with specificati9ns 3.5 and 3.7 (penetration flow paths may be unisolated intermittently under administrative control).

Amendment No.~ 236 47

VYNPS Table 4.2.2 (page 1 of 2)

Primary Contalnment Isolation Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

1. Main Steam Line

Isolation

a. Low-Low Reactor Once/Day Every 3 Months Every 3 Months (a)

Vessel Water Level Once/Operating Cycle

b. High Main Steam Line NA Every 3 Months Each Refueling Outage Area Temperature

c. High Main Steam Line Once/Day Every 3 Months Every.3 Months (a)

Flow Once/Operating Cycle

d. Low Main Steam Line NA Every 3 Months Every 3 Months Pressure

e. High Main Steam Line Once/Day Every 3 Months Every 3* Months (a)

Flow - Not in RUN Once/Operating Cycle

f. Condenser Low Vacuum NA Every 3 Months Every 3 Months

2. Primary Containment Isolation

a. Low Reactor Vessel NA Every 3 Months Every 3 Months (a)

Water Level Once/Operating Cycle

b. High Drywell Once/Day Every 3 Months Every 3 Months (a)

Pressure Once/Operating Cycle

3. High Pressure Coolant Injection (HPCI) System Isolation

a. High Steam Line NA Every 3 Months Each Refueling Outage Space Temperature

b. High Steam Line dip NA Every 3 Months Every 3 Months (Steam Line Break)

c. Low Steam Supply NA Every 3 Months Every 3 Months Pressure

d. High Main Steam Line NA Every 3 Months Each Refueling Outage Tunnel Temperature

e. High Main Steam Line NA NA Once/Operating Cycle Tunnel Temperature Time Delay (a) Trip unit calibration only.

AInendment No. -+/--64., 2"36 48

VYNPS Table 4.2.2 (page 2 of 2)

~rimary Containment Isolation Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

4. Reactor Core Isolation Cooling (RCIC) System Isolation

a. High Main Steam Line NA Every 3 Months Each Refueling Outage Tunnel Temperature

b. High Main Steam Line NA . NA Once/Operating Cycle Tunnel Temperature Time Delay

c. High Steam Line NA Every 3 Months Each Refueling Outage Space Temperature

d. High Steam Line dip NA Every 3 Months Every 3 Months (Steam Line Break)

e. High Steam Line dip NA Every 3 Months . Every 3 Months (Steam Line Break)'

Time Delay

f. Low Steam Supply NA Every 3 Months Every 3 Months Pressure

5. Residual Heat Removal Shutdown Cooling Isolation

a. High Reactor NA Every 3 Months Every 3 Months Pressure Amendment No. ~, 236 49

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION 3.2 PROTECTIVE INSTRUMENT SYSTEMS 4.2 PROTECTIVE INSTRUMENT SYSTEMS C. Reactor Building Ventilation C. Reactor Building Ventilation Isolation and Standby Gas Isolation and Standby Gas Treatment System Initiation Treatment System Initiation The reactor building 1. The reactor building ventilation isolation and ventilation isolation and Standby Gas Treatment System Standby Gas Treatment initiation instrumentation System initiation for each Trip Function in instrumentation shall be Table 3.2.3 shall be operable checked, functionally in accordance with tested and calibrated as

Table 3.2.3. indicated in Table 4.2.3.

When a channel is placed in an inoperable status solely for performance of required instrumentation surveillances, entry* into the associated Limiting Conditions for Operation and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains reactor building ventilation isolation capability'and Standby Gas Treatment System initiation.

capability.

2. Perform a Logic System Functional Test of reactor building venti~ation isolation and Standby Gas rreatment

'System initiation instrumentation Trip Functions once every Operating Cycle.

Amendment No. ~, 236. 50

VYNPS Table 3.2.3 (page 1 of 1)

Reactor Building Ventilation Isolation and Standby Gas Treatment System Initiation Instrumentation ACTIONS WHEN REQUIRED REQUIRED APPLICABLE MODES OR CHANNELS CHANNELS OTHER SPECIFIED PER TRIP ARE TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE TRIP SETTING

l. Low Reactor RUN, STARTUP/HOT 2 Note 1 ~127.0 inches Vessel Water STANDBY, HOT SHUTDOWN, Level Refuel la). (b)

2. High Drywell RUN, STARTUP/HOT 2 Note 1 ~ 2.5 psig Pressure STANDBY, HOT SHUTDOWN, Refuel 1al

3. High Reactor RUN, STARTUP/HOT 1 Note 1 ~14 mR/hr Building STANDBY, HOT SHUTDOWN, Ventilation Refuel la). (bl, (e). (d)

Radiation

4. High Refueling RUN, STARTUP/HOT 1 Note 1 ~ 100 mR/hr Floor Zone STANDBY, HOT SHUTDOWN, Radiation Refuel (a); (b), (e), (d)

(a) With reactor coolant temperature> 212 OF.

(b) During operations with potential for draining the reactor vessel.

(c) During movement of irradiated fuel assemblies or fuel cask in secondary containment.

(d) During Alteration of the Reactor Core.

Amendment No. ~, 236 51

VYNPS Table 3.2.3 ACTION Note

1. With one or more required Reactor Building Ventilation Isolation and Standby Gas Treatment System Initiation Instrumentation channels inoperable, take all of the applicable Actions in Notes 1.a and 1.b below.

a. With one or more Trip Functions with one or more required channels inoperabl'e:

1) For Trip Functions 1 and 2, place any inoperable channel in trip within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; and

2) For Trip Functions 3 and 4, place any inoperable .channel in trip within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one or more'Trip Functibns with isolation or initiation papabi1ity not maintained:

1) Restore isolation and initiation capability within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

If any applicable Action and associated completion time of Note l.a or 1.b is not met, isolate the Reactor Building Ventilation System and place the Standby Gas Treatment System in operation within I hour.

Amendment' No. ~, 236 52

VYNPS Table 4.2.3 (page 1 of 1)'

Reactor Building Ventilation Isolation and Standby Gas Treatment System Initiation Instrumentation Tests.and.Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

1. Low Reactor Vessel NA Every 3 Months Every 3 1"1onths (s)

Water Level Once/Operating Cycle

2. High Drywell Pressure NA Every 3 Months Every 3 Months (s)

Once/Operating Cycle

3. High Reactor Building Once/Day Every 3 Months Every 3 Months Ventilation Radiation

4. High Refueling Floor Once/Day Every 3 Months Every 3 Months Zone Radiation During Refueling (a) Trip unit calibration only.

Amendment No.-+/--64 , 236 53

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS D. Deleted. D. Deleted.

E. Control Rod Block Actuation E. Control Rod Block Actuation The control ~od block 1. The control ~od block instrumentation for each instrumentation shall be Trip Function in Table functionally tested and 3.2.5 shall be operable in calibrated as indicated accordance with Table in Table 4.2.5.

3.2.5.

When a Rod Block Monitor channel is placed in an inoperable status solely for performance of required surveillances, entry into associated Limiting Conditions for Operation and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains control rod block initiation capability.

2. Perform a Logic System Functional Test of Control Rod Block Actuation instrumentation Trip Functions once every Operating Cycle.

Amendment No. , 64, 3-6 246 54

VYNPS Table 3.2.5 (page 1 of 1)

Control Rod Block Instrumentation ACTIONS WHEN APPLICABLE REQUIRED REQUIRED MODES OR OTHER CHANNELS CHANNELS SPECIFIED PER TRIP ARE lI'RIP SETTING TRIP FUNCTION CONDITIONS FUNCTION INOPERABLE

l. Rod Block Monitor

a. Upscale (Flow Bias) > 30% RATED 2 Note 1 SO. 66 (W) +N THERMAL POWER with a maximum as defined in the COLR 1b )

b. Downscale > 30% RATED 2 Note 1 ~ 2/125 full THERMAL POWER scale

c. Inop > 30% RATED 2 Note 1 NA THERMAL POWER

2. Reactor Mode Switch - (a) 2 Note 2 NA Shutdown Position (a) When reactor mode switch is in the shutdown position.

(b) Trip Setting S 0.66 (W-6W)+N for single loop operation.

Amendment No. ~, 236 55

VYNPS Table 3.2.5. ACTION Notes 1 .. With one or two RBM channels inoperable, take all of the applicable Actions in Notes l.a and l.b below.

a. If one RBM channei is inoperable, restore the inoperable channel to*

operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. If the required Action and associated completion time of Note l.a above is not met~ or if two RBM channels are inoperable, place one RBM channel in trip within the *next hour.

2. With one or more Reactor Mode Switch - Shutdown Position channels inoperable, immediately suspend control rod withdrawal and immediately

.initiate actions to fully insert all insertable control rods in core cells containing one or more fuel assemblies.

Amendment No. ~, 236 56

VYNPS Table 4.2.5 (page 1 of 1)

Control Rod Block Instrumentation Tests and .Frequencies TRIP FUNCTION FUNCTIONAL TEST CALIBRATION

1. Rod Block Monitor (RBM)

a. Upscale (Flow Bias) Every 3 Months Every 3 Months (b). (e)

b. Downscale Every 3 Months Every 3 Months(~

c. Inop Every 3 Months NA

2. Reactor Mode Switch Every Refueling NA Shutdown Position Outage 1al (a) Required to be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is placed in the shutdown position.

(b) Neutron detectors are excluded.

(c) Includes calibration of the RBM Reference Downscale function (Le., RBM upscale function is not bypassed when >30% Rated Thermal Power).

Amendment No. -+/--64, 236 57

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION F. Mechanical Vacuum Pump F. Mechanical Vacuum Pump Isolation Instrumentation Isolation Instrumentation

1. When the reactor is in the 1. The High Main Steam Line RUN or STARTUP/HOT STANDBY Radiation Trip Function Mode and the mechanical for mecpanical vacuum pump vacuum pump is in service, isolation shall be 4 channels of the High checked, functionally Main Steam Line Radiation tested and calibrated as Trip Function for indicated in Surveillance mechanical vacuum pump Requirements 4.2.F.1.a, b, isolation shall be c, d and e.

operable.

When a channel is placed in an inoperable status solely for performance of required surveillances, entry into associated Limiting Conditions for Operation and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains mechanical vacuum pump isolation capability.

a. Perform an Instrument Check once each day.

b. Perform an Instrument Functional Test once every 3 months.

c. Perform an Instrument Calibration, except for radiation detectors, using a current source once every 3 months.

The Trip Setting shall be < 3.0 X background at rated thermal power.

d. Perform an Instrument Calibration using a' radiation source once each Refueling Outage.

e. Perform a Logic System Functional Test, including mechanical vacuum pump isolation valve, once every Operating Cycle.

Amendment No. -+/--64, ~, 236 58

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION

2. If Specification 3.2.F.l is not met, take all.of the applicable Actions in Specifications 3.2.F.2.a and 2.b below.

a. With one or more channels inoperable:

1) Restore any inoperable channel to operable status within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; or

2) Place'any inoperable channel or associated trip system in the trip condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (not applicable if the inoperable channel is the result of an inoperable mechanical vacuum pump isolation valve) .

b. If the required Action and associated completion time of Specification 3.2.F.2.a above is not met~ or if mechanical vacuum pump isolation capability is not maintained:

1) Isolate the mechanical vacuum pump within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; or

2) Isolate the main steam lines within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; or

3) Place the reactor in the SHUTDOWN Mode within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Amendment No.l-#, ~, 236 59

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION G. Post-Accident Monitoring G. Post-Accident Monitoring Instrumentation Instrumentation The post-accident monitoring 1. The post-accident instrumentation for each monitoring instrumentation Function in Table 3.2.6 shall shall be checked and be operable in accordance with Table 3.2.6. calibrated in accordance with Table 4.2.6.

When a channel is placed in an inoperable status solely for performance of required surveillances, entry into associated Limiting Conditions for J*

Operatlon

and requlre d Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Amendment No. %, -+/--64, 236 60

VYNPS Table 3.2.6 (page 1 of 1)

Post-Accident Monitoring Instrumentation.

REQUIRED ACTIONS WHEN CHANNELS REQUIRED APPLICABLE MODES OR OTHER PER CHANNELS ARE FUNCTION SPECIFIED CONDITIONS FUNCTION INOPERABLE

l. Drywell Atmospheric RUN, STARTUP/HOT STANDBY 2 Note 1 Temperature

2. Drywe11 Pressure RUN, STARTUP/HOT STANDBY 2 Note 1

3. Torus Pressure RUN, STARTUP/HOT STANDBY 2 Note 1

4. Torus Water Level RUN, STARTUP/HOT STANDBY *2 Note 1

5. Torus Water RUN, STARTUP/HOT STANDBY 2 Note 1 Temperature

6. Reactor Pressure RUN, STARTUP/HOT STANDBY 2 Note 1

7. Reactor Vessel Water RUN, STARTUP/HOT STANDBY 2 Note 1 Level

8. Torus Air Temperature RUN, STARTUP/HOT STANDBY 2 Note 1

9. Containment High RUN, STARTUP/HOT STANDBY 2 Note 2 Range Radiation Monitor Amendment No. ~, ~, 236 61

VYNPS Table 3.2.6 ACTION Notes

1. With, one or more Post-Accident Monitoring instrumentation channels, for Functions other than Function 9, inoperable, take ail of the applicabl~

Actions in Notes l.a and l.b below.

a. With one or more Functions with one channel inoperable:

1) Restore channel to operable status within 30 days; or

2) Prepare and submit a special report to the Commission within the next 14 days, outlining the Action taken, the cause of the inoperability, and the plans and schedule for restoring the channel to operable status.'

b. With one or more Function~ with two channels inoperable:

1) Restore one required channel to operable status with~n 7 days; or

2) Place the, reactor in HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

2. With one or more Post - Accident Monitoring instrumentation Function 9 channels inoperable, take all of the applicable Actions in Notes 2.a and 2.b below.

a. With one channel inoperable:

1) Restore channel to operable status within 30 days; or

2) Prepare and submit a special report to the Commission within the next 14 days, outlining the Action taken, the cause of the inoperabi+ity, and the plans and schedule for restoring the channel to operable status. '

b. With two channels inoperable:

1) Restore one channel to operable status within 7 days; or

2) Prepare and submit a special report to the Commission within the next 14 days, outlining the Action taken, the cause of the inoperability, and the plans and schedule for res~oring the channels to operable status.

Amendment No. -%0, ~, 236 62

VYNPS .

Table 4.2.6 (page 1 of 1)

Post-Accident Monitoring Instrumentation Tests and Frequencies FUNCTION CHECK CALIBRATION

1. Drywell Atmospheric Once/Day Every 6 Months Temperature

2. Drywell Pressure Once/Day Once/Operating Cycle

3. Torus Pressure Once/Day Once/Operating Cycle

4. Torus Water Level Once/Day Once/Operating Cycle

5. Torus Water Once/Day Every 6 Months Temperature

6. Reactor Pressure Once/Day Once/Operating

'Cycle

7. Reactor Vessel Water Once/Day Once/Operating Level Cycle

8. Torus Air Temperature Once/Day Every 6 Months

9. Containment High Once/Day Once/Operating Range Radiation Cycle Monitor Amendment No. %, ~, 236 63

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION*

H. Deleted. H. Deleted.

I. Recirculation Pump Trip L Recirculation Pump Trip Instrumentation Instrumentation The recirculation pump trip 1. The recirculation pump instrumentation for each Trip trip instrumentation *shall Function in Table 3.2.7 shall be checked, functionally be operable in accordance tested and calibrated in with Table 3.2.7. accordance with Table 4.2.7.

When a channel is placed in an inoperable status solely. for performance of required surveillances, entry into associated Limiting Conditions for Operations and required Actions may be delayed for up to .6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains recirculation pump trip capability.

2. Perform a Logic System Functional Test, including recirculation pump trip breaker actuation, of recirculation pump.trip instrumentation Trip Functions once every Operating Cycle.

J. Deleted. J. Deleted Amendment No. .§.eo, .§.eo, ~, ~, 236 64

VYNPS Table" 3.2.7 (page 1 of +)

Recirculation Pump Trip Instrumentation ACTIONS WHEN APPLICABLE REQUIRED REQUIRED MODES OR OTHER CHANNELS CHANNELS SPECIFIED PER TRIP ARE TRIP SETTING TRIP FUNCTION CONDITIONS SYSTEM INOPERABLE

l. Low-Low Reactor Vessel RUN 2 Note 1 ~ 82.5 inches Water Level

2. Time Delay RUN 2 Note 1 :;; 10 seconds

3. High Reactor Pressure RUN 2 Note 1 :;; 1150 psig Amendment No. ~, +64-, 236 65

VYNPS Table 3.2.7 ACTION Notes

1. With one or more recirculation pump trip instrumentation channels inoperable, take all of the applicable Actions in Notes l.a, l.b and I.c below.

a. With one or more Trip Functions with one or more channels inoperable:

1) Restore any inoperable channel to operable status within 14 days; or

2) Place any inoperable channel in trip within 14 days (not'applicable for Trip Function, 2 cha'nnels and not applicable if the inoperable channel is the result of an inoperable recirculation pump trip breaker) .

b. With Trip Functions 1 and 2 with recirculation pump trip capability ~ot maintained or with Trip Function 3 with recirculation pump trip capability not maintained:

1) Restore recirculation pump trip capability within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

c. With Trip Functions 1, 2 and 3 with recirculation pump trip capability not maintained:

1) Restore recirculation pump trip capability for all but one Trip Function within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

If any applicable Action and associated completion time of Note 1.a, 1.b or 1.c is not met, immediately take the applicable Action of Note 2.a or 2.b.

2. a. Remove affected recirculation pump from service within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; or

b. Place the plant in STARTUP/HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Amendment No. ~, 64, 236 66

VYNPS Table 4.2.7 (page 1 of 1)

Recirculation Pump Trip Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

1. Low-Low Reactor Vessel Once/Day Every 3 Months Every 3 Months (a)

Water Level Once/Operating Cycle

2. Time Delay NA NA Every 3 Months

3. High Reactor Pressure Once/Day Every 3 Months Every 3 Months (a) once/Operating Cycle .

(a) Trip unit calibration only.

Amendment No. 58-, -i-64, 236 67

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION K. Degraded Grid Protective K. Degraded Grid Protective S:i stem S:i stem The emergency bus The emergency bus undervoltage instrumentation undervoltage instrumentation for each Trip Function in shall be functionally tested Table 3.2.8 shall be operabie and calibrated in accordance in accordance with Table with Table 4.2.8.

3.2.8.

Amendment No. ~, ~,. 236 68

VYNPS Table 3.2.8 (page 1 of 1)

Degraded Grid Protective System Instrumentation ACTIONS WHEN' APPLICABLE REQUIRED MODES OR OTHER REQUIRED CHANNELS SPECIFIED CHANNELS ARE TRIP SETTING TRIP FUNCTION CONDITIONS PER'-BUS INOPERABLE l . Degraded Bus Voltage a,. Voltage Trip (b) (a) 2 Note'l '~ 3660 volts and S 3740 volts

b. Time Delay 'Trip (b) (a) 1 Note 2 ~ 9 seconds and S 11 *seconds

c. Voltage Alarm (c) (a) 2 Note 3 ~ 3660'volts and

~ 3740 volts

d. Alarm Time Delay (c) (a) 1 Note 3 ~9 seconds and S 11 seconds (a) When. the associated diesel generator is required to be operable per specifications 3.5, 3.7 and 3.10.

(b) LOCA condition.

(c) Non-LOCA condition.

Amendment No. %, '}-64, 236 69

VYNPS Table 3.2.8 ACTION Notes

1. With one or more r~quired Degraded Bus Voltage - Voltage Trip Function channels inoperable:

a. Place any inoperable channel in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

If the Action and associated completion time of Note 1.a are not met, immediately declare the associated diesel generator inoperable.

2. With one or more required Degraded Bus Voltage - Time Delay Trip Function channels inoperable:

a. Restore any inoperable channel to operable status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

If the Action and associated completion time of Note 2.a are not met, immediately declare the associated diesel generator inoperable.

3. With one or more required Degraded Bus Voltage - Voltage Alarm and/or Alarm Time Delay Trip Function channels inoperable, take all of the applicable Actions in Notes 3.a and 3.b:

a. With one or more buses with alarm capability not maintained, restore alarm capability within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ; and

b. Restore any inoperable channel to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If the Action and associated completion time of Note 3.a or 3.b are not met, immediately initiate increased voltage monitoring of the associated 4.16kV emergency busIes) to twice per shift.

Amendment No. ~, ~, 236 70

VYNPS Table 4.2.8 (page 1. of 1)

Degraded Grid Protective System Instrumentation Tests and Frequencies .

TRIP FUNCTION FUNCTIONAL TEST CALIBRATION

1. Degraded Bus Voltage

a. Voltage Trip (a) Once/Operating Cycle

b. Time Delay Trip (a) Once/Operating Cycle

c. Voltage Alarm (a) Once/Operating Cycle

d. Alarm Time Delay (a) Once/Operating Cycle (a). Separate Functional Tests are not required for this Trip Function. Trip Function operability is demonstrated during Trip Function Calibration and integrated ECCS tests performed once per Operating Cycle.

Amendment No. -%, ~, 236 71

VYNPS 3.2 LIMITING CONDITIONS FOR 4.2 SURVEILLANCE REQUIREMENTS OPERATION L. Reactor Core Isolation L. Reactor Core Isolation Cooling (RCIC) System Cooling (RCIC) System Actuation Actuation The RCIC System 1. The RCIC System instrumentation for each Trip.. instrumentation shall be Function in Table 3.2.9 shall checked, functionally be operable in accordance tested and calibrated as with Table 3.2.9. indicated in Table 4.2.9.

When a channel is placed in an inoperable status solely for performance of required surveillances, entry into associated Limiting Conditions for Operation and required Actions may be delayed as follows: (a) for u~ to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Function 3; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Functions 1 and 2 provided the associated Trip Function maintains RCIC initiation capability.

2. Perform a Logic System Functional Test of RCIC System instrumentation Trip Functions once every Operating Cycle.

An\endment No. -+/--H, ~, 23"6 72

VYNPS Table 3.2.9 (page 1 of 1)

Reactor Core Isolation Cooling System Instrumentation ACTIONS WHEN REQUIRED REQUIRED APPLICABLE MODES OR CHANNELS CHANNELS OTHER SPECIFIED PER ARE TRIP FUNCTION CONDITIONS FUNCTION INOPERABLE TRIP SETTING

l. Low-Low Reactor RUN, STARTUP/HOT 4 Note 1 ~ 82.5 inches Vessel water STANDBY (a) , HOT Level SHUTDOWN (a) , Refuel (a)

2. Low Condensate RUN, STARTUP/HOT 2 Note 2 ~ 3. SH lb )

Storage Tank STANDBY (a) , HOT water Level SHUTDOWN (a) , Refuel (a)

3. High Reactor RUN, STARTUP/HOT 2 Note 3 ~ 177.0 inches

. Vessel Water* STANDBY (a) , HOT Level SHUTDOWN (a) , Refuel (a)

(a) with reactor stearn pressure> 150 psig.

(b) Percent of instrument span.

Amendment No. -H-+/--, -+/--64, 236 73

VYNPS Table 3.2.9 ACTION Notes

1. With one or more RCIC System instrumentation Trip Function 1 channels inoperable:

a. Declare the RCIC System inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability; and

b. Place any inoperable'channel in trip within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable 'Action and associated completion time of Note 1.a or 1.b is not met, immediately declare the RCIC System inoperable.

2. With one or more RCIC System instrumentation Trip Function 2 channeis inoperable:

a. Declare the RCIC System inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiatio~ capability when RCIC System suction is aligned to the Condehsate Storage Tank; and

b. Place ariy inoperable channel in trip or align RCIC System suction to the suppression.p091 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If any applicable Action and associated completion time of Note 2.a or 2.b is not met, immediatel.y declare the RCIC System inoperable.

3. With one or more RCIC System instrumentation Trip Function 3 channels inoperable:

a. Restore any inoperable channel to operable status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If the Action and associated completion time of Note 3.a is not met, immediately declare the RCIC System inoperable.

Amendment No. -H+, ~ , 236 74

VYNPS Table 4.2.9 (page 1 of 1)

Reactor Core Isolation COOling System Instrumentation Tests and Frequencies TRIP FUNCTION CHECK FUNCTIONAL TEST CALIBRATION

l. Low-Low Reactor Vessel Once/Day Every 3 Months Every 3 Months (a)

Water Level Once/Operating Cycle

2. Low Condensate Storage NA Every 3 Months Every 3 Months (a)

Tank Water Level Once/Operating Cycle

3. High Reactor 'Vessel NA Every 3 Months Every 3 Months (a)

Water Level Once/Operating Cycle (a) Trip unit calibration only.

Amendment No. -H:-+/--, ~, 236 74a

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the ECCS to ensure that the fuel is adequately cooled in the event of a design basis accident or transient.

For most abnormal operational transients and Design Basis Accidents (DBAs), a wide range of dependent and independent parameters are monitored.

The ECCS instrumentation actuates core spray (CS), the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, high pressure coolant injection (HPCI), Automatic Depressurization System (ADS),

and the diesel generators (DGs). The equipment involved with each of these systems is described in Bases 3.5, Core and Containment Cooling Systems, and in Bases 3.10, Auxiliary Electrical Power Systems."

Core Spray System The CS System consists of two subsystems (A and B). Subsystem A is identical in function to subsystem B. Automatic initiation occurs for conditions of Low - Low Reactor Vessel Water Level and Low Reactor Pressure (Initiation) or High Drywell Pressure. The Low - Low Reactor Vessel Water Level and High Drywell Pressure diverse variables are each monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) for each Trip Function. The Low Reactor Pressure (Initiation) signals are initiated from two pressure transmitters that sense reactor pressure. Each pressure transmitter provides an input to both CS trip systems with the contacts arranged in a one-out-of-two logic.

Upon receipt of an initiation signal, if normal AC power is available, both CS pumps start. If an initiation signal is received when normal AC power is not available, the CS pumps are started approximately 9 seconds after power is available to limit the loading of the AC power sources.

The CS test line isolation valve, which is also a primary containment isolation valve (PCIV), is closed on a CS initiation signal to allow full system flow assumed in the accident analyses and maintain primary containment isolated in the event CS is not operating.

The CS System also monitors the pressure in the reactor to ensure that, before the injection valves open, the reactor pressure has fallen to a value below the CS System's maximum design pressure. The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

The status of the normal and emergency AC power supplies necessary for pump operation is also monitored. This ensures that load sequencing occurs Amendment No. 236 75

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued) if normal AC power is not available. These parameters are monitored by relays (Auxiliary Power Monitors and Pump Bus Power Monitors) whose outputs are arranged in a one-out-of-one logic and a one-out-of-two logic, respectively.

Low Pressure Coolant Injection System The LPCI is an operating mode of the Residual Heat Removal (RHR) System, with two LPCI subsystems (A and B). Subsystem A is identical in function to subsystem B. Automatic initiation occurs for conditions of Low - Low Reactor Vessel Water Level concurrent with Low Reactor Pressure (Initiation) or High Drywell Pressure (Initiation). Each of these diverse variables, except Low Reactor Pressure (Initiation) is monitored by four redundant transmitters, which, in turn, are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) for each Trip Function. The High Drywell Pressure signals are also used for the containment spray permissive.

The Low Reactor Pressure (Initiation) signals are initiated from two pressure transmitters that sense reactor pressure. Each of these pressure transmitters provides an input to both low pressure ECCS logic trains with the contacts arranged in one-out-of-two logic. Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset.

Upon receipt of an initiation signal, if normal AC power is available, the LPCI pumps are started with no time delay. If normal AC power is not available, LPCI pumps A and D start immediately once power is available and LPCI pumps B and C are started approximately 4 seconds after power is available to limit the loading of the AC standby power sources.

The RHR containment cooling return line valves, torus spray isolation valves, and drywell spray isolation valves (which are also PCIVs) are also closed on a LPCI initiation signal to allow the full system flow assumed in the accident analyses and maintain primary containment isolated in the event LPCI is not operating.

The LPCI System monitors the pressure in the reactor to ensure that, before an injection valve opens, the reactor pressure has fallen to a value below the LPCI System's maximum design pressure. The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Additionally, instruments (i.e., reactor water level and reactor pressure) are provided to close the recirculation loop pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines. The variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Amendment No. 236 75a

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued)

Low reactor water level in the shroud is detected by two additional instruments. When level is greater that the trip setting of the LPCI Reactor Vessel Shroud Level Trip Function, LPCI may no longer be required, therefore, other modes of RHR (e.g., suppression pool cooling) are allowed. Manual overrides for the isolations, when water level is below the associated trip setting, are provided.

The status of the normal and emergency AC power supplies necessary for pump operation is also monitored. This ensures that load sequencing occurs if normal AC power is not available. These parameters are monitored by relays (Auxiliary Power Monitors and Pump Bus Power Monitors) whose outputs are arranged in a one-out-of-one logic and a one-out-of-two logic, respectively.

High Pressure Coolant Injection System Automatic initiation of the HPCI System occurs for conditions of Low - Low Reactor Vessel Water Level or High Drywell Pressure. Each of these variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Trip Function.

The HPCI test line isolation valves are closed upon receipt of a HPCI initiation signal to allow the full system flow assumed in the accident analysis.

The HPCI System also monitors the water level in the condensate storage tank (CST). Reactor grade water in the CST is the normal source. Upon receipt of a HPCI initiation signal, the CST suction valve is automatically signaled to open. If the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open. When the suppression pool suction valves start to open, the CST suction valve automatically closes. Two level transmitters are used to detect low water level in the CST. Either transmitter can cause the suppression pool suction valves to open and the CST suction valve to close.

The HPCI System provides makeup water to the reactor until the reactor vessel water level reaches the High Reactor Vessel Water Level trip, at which time the HPCI turbine trips, which causes the turbine's stop valve to close. This variable is monitored by two transmitters, which are, in turn, connected to two trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a two-out-of-two logic to provide high reliability of the HPCI System. The HPCI System automatically restarts if a Low - Low Reactor Vessel Water Level signal is subsequently received.

Amendment No. 236 75b

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued)

Automatic Depressurization System Automatic initiation of the ADS occurs when signals indicating Low - Low Reactor Vessel Water Level; High Drywell Pressure, or sustained Low - Low Reactor Vessel Water Level; and CS or RHR (LPCI Mode) High Pump Discharge Pressure are all present and the ADS Time Delay has timed out. There are two transmitters for Low - Low Reactor Vessel Water Level and High Drywell Pressure in each of the two ADS trip system logics. Each of these transmitters connects to a trip unit, which then drives a relay whose contacts form the initiation logic.

Each ADS trip system logic includes a time delay between satisfying the initiation logic and the actuation of the ADS valves. The ADS Time Delay setpoint chosen is long enough that the HPCI System has sufficient operating time to recover to a level above Low - Low Reactor Vessel Water Level, yet not so long that the LPCI and CS Systems are unable to adequately cool the fuel if the HPCI System fails to maintain that level. An alarm in the control room is annunciated when either of the timers is timing. Resetting the ADS initiation signals resets the ADS Time Delay.

The ADS also monitors the discharge pressures of the four LPCI pumps and the two CS pumps. Each ADS trip system includes two discharge pressure permissive switches from one CS pump and from each LPCI pump. The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. Any one of the six low pressure pumps is sufficient to permit automatic depressurization.

The ADS logic in each trip system logic is arranged in two strings. Each string has a contact from each of the following variables: Low - Low Reactor Vessel Water Level; High Drywell Pressure; and Sustained Low - Low Reactor Vessel Water Level Time Delay. All required contacts in both logic strings must close, the ADS Time Delay must time out, and a CS or LPCI pump discharge pressure signal must be present to initiate an ADS trip system logic. Either the A or B trip system logic will cause all the ADS relief valves to open.

Once the High Drywell Pressure signal, Sustained Low - Low Reactor Vessel Water Level Time Delay, or the ADS initiation signal is present, the trip system logic is sealed in until manually reset.

Manual inhibit switches are provided in the control room for the ADS; however, their function is not required for ADS operability (provided ADS is not inhibited when required to be operable).

Amendment No. 236 75c

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

BACKGROUND (continued)

Diesel Generators Automatic initiation of the DGs occurs for conditions of Low - Low Reactor Vessel Water Level or High Drywell Pressure. Each of these diverse variables is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the four trip units are connected to relays whose contacts are connected to a one-out-of-two taken twice logic to initiate all DGs. The DGs receive their initiation signals from the CS System initiation logic. The DGs can also be started manually from the control room and locally from the associated DG room. Upon receipt of a loss of coolant accident (LOCA) initiation signal, each DG is automatically started, is ready to load within 13 seconds, and will run in standby conditions (rated voltage and frequency, with the DG output breaker open).

The DGs will only energize their respective 4.16 kV emergency buses if a loss of offsite power occurs or if a degraded voltage occurs concurrent with an accident signal.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The actions of the ECCS are explicitly assumed in the safety analyses of References 1 and 2. The ECCS is initiated to preserve the integrity of the fuel cladding by ensuring the requirements of 10 CFR 50.46 are met.

ECCS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Trip Functions are retained for other reasons and are described below in the individual Trip Functions discussion.

The operability of the ECCS instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.2.1. Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.1.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

In general, the individual Trip Functions are required to be operable in the Modes or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis transient or accident.

Table 3.2.1 Footnotes (a), (b), and (c) specifically indicate other conditions when certain ECCS Instrumentation Trip Functions are required to be operable. To ensure reliable ECCS and DG function, a combination of Trip Functions is required to provide primary and secondary initiation signals.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Trip Function by Trip Function basis.

Amendment No. 236 75d

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.b. High Drywell Pressure High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the High Drywell Pressure Trip Function in order to minimize the possibility of fuel damage. The High Drywell Pressure Trip Function, along with the Low - Low Reactor Vessel Water Level Trip Function is directly assumed in the analysis of the recirculation line break (Ref. 1).

The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the requirements of 10 CFR 50.46 are met.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Trip Setting was selected to be indicative of a LOCA inside primary containment.

The High Drywell Pressure Trip Function is required to be operable when the ECCS or DG is required to be operable in conjunction with times when the primary containment is required to be operable. Thus, four channels of the CS and LPCI High Drywell Pressure Trip Functions are required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN and Refuel (with reactor coolant temperature > 212°F) to ensure that no single instrument failure can preclude ECCS and DG initiation. In other Modes or conditions, the High Drywell Pressure Trip Function is not required, since there is insufficient energy in the reactor to pressurize the primary containment to High Drywell Pressure setpoint.

1.b, 2.c. Low - Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. The low pressure ECCS and associated DGs are initiated at Low - Low Reactor Vessel Water Level to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The Low - Low Reactor Vessel Water Level is one of the Trip Functions assumed to be operable and capable of initiating the ECCS and associated DGs during the accidents analyzed in References 1 and 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

Low - Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Amendment No. 236 75e

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Low - Low Reactor Vessel Water Level Trip Setting is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling. The Trip Setting is referenced from the top of enriched fuel.

Four channels of Low - Low Reactor Vessel Water Level Trip Function are only required to be operable when the ECCS or DG(s) are required to be operable to ensure that no single instrument failure can preclude ECCS and DG initiation.

1.c, 2.a. Low Reactor Pressure (Initiation)

Low reactor pressure signals, in conjunction with low RPV level, indicate that the capability to cool the fuel may be threatened. The low pressure ECCS are initiated upon simultaneous receipt of a low reactor pressure and a low-low reactor vessel water level signal to ensure that the core spray and flooding functions are available to prevent and minimize fuel damage. The Low Reactor Pressure (Initiation) is one of the Trip Functions assumed to be operable and capable of permitting initiation of the ECCS during the accidents analyzed in References 1 and 2. In addition, the Low Reactor Pressure (Initiation) Trip Function is directly assumed in the analysis of the recirculation line break (Ref. 1). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

The Low Reactor Pressure (Initiation) signals are initiated from two pressure transmitters that sense the reactor pressure. Each transmitter provides an input to both low pressure ECCS logic trains, such that failure of one transmitter will cause a loss of redundancy but will not result in a loss of automatic low pressure ECCS pump start capability.

The Trip Setting is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough such that the ECCS injection will ensure the requirements of 10 CFR 50.46 are met.

Two channels per trip system of Low Reactor Pressure (Initiation) Trip Function are only required to be operable when the ECCS or DG(s) are required to be operable to ensure that no single instrument failure can preclude ECCS and DG initiation.

1.d, 2.h. Low Reactor Pressure (System Ready and Valve Permissive)

Low reactor pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. These low reactor pressure signals are also used as permissives for recirculation pump discharge valve closure and recirculation pump discharge bypass valve closure. This ensures that the LPCI subsystems inject into the proper RPV location assumed in the safety Amendment No. 236 75f

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) analysis. Low Reactor Pressure (System Ready and Valve Permissive) is one of the Trip Functions assumed to be operable and capable of permitting initiation and injection of the ECCS and capable of closing the recirculation pump discharge valve(s) and recirculation pump discharge bypass valve(s) during the accidents and transients analyzed in References 1 and 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met. The Low Reactor Pressure (System Ready and Valve Permissive) Trip Function is directly assumed in the analysis of the recirculation line break (Ref. 1).

The Low Reactor Pressure (System Ready and Valve Permissive) signals are initiated from four pressure transmitters that sense the reactor pressure.

The Trip Setting is chosen to be low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough such that the ECCS injection will ensure the requirements of 10 CFR 50.46 are met and to ensure that the recirculation pump discharge valves and recirculation pump discharge bypass valves close prior to commencement of LPCI injection flow into the core, as assumed in the safety analysis.

Four channels of the Low Reactor Pressure (System Ready and Valve Permissive)

Trip Function are only required to be operable when the ECCS or DG(s) are required to be operable to ensure that no single instrument failure can preclude proper ECCS initiation and injection.

1.e, 2.e. CS and LPCI B and C Pump Start Time Delay The purpose of these time delays is to stagger the start of the CS and RHR (LPCI) B and C pumps on the associated Division 1 and Division 2 buses, thus limiting the starting transients on the 4.16 kV emergency buses. These Trip Functions are necessary when power is being supplied from the standby power sources. The Core Spray Pump Start Time Delay and the LPCI B and C Pump Start Time Delay Trip Functions are assumed to be operable in the accident and transient analyses requiring ECCS initiation. That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are two Core Spray Pump Start Time Delay relays, one for each trip system. Each time delay relay is dedicated to a single pump start logic, such that a single failure of a Core Spray Pump Start Time Delay relay will not result in failure of more than one CS pump. In this condition, one of the two CS pumps will remain operable; thus, single failure criterion is satisfied.

There are two LPCI B and C Pump Start Time Delay relays, one for each trip system. Each time delay relay is dedicated to a single pump start logic, such that a single failure of a LPCI B or C Pump Start Time Delay relay will not result in failure of more than one of the two associated LPCI pumps. In this condition, one of the two associated LPCI pumps will remain operable; thus, single failure criterion is satisfied.

Amendment No. 236 75g

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Trip Settings for the Core Spray and LPCI Pump B and C Pump Start Time Delays are chosen to be long enough so that most of the starting transient of the previously started pump is complete before starting a subsequent pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded.

Each channel of the Core Spray and LPCI B and C Pump Start Time Delay Trip Functions is required to be operable when the associated CS and LPCI subsystems are required to be operable.

1.f, 2.f. CS and RHR Pump Discharge Pressure The Pump Discharge Pressure signals from the CS and RHR pumps are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel.

Pump Discharge Pressure is one of the Trip Functions assumed to be operable and capable of permitting ADS initiation during the events analyzed in Reference 1 with an assumed HPCI failure. For these events, the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions. This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

Pump discharge pressure signals are initiated from twelve pressure switches, two on the discharge side of each of the six low pressure ECCS pumps. In order to generate an ADS permissive in one trip system logic, it is necessary that only one pump (one of the two channels for the pump) indicate the high discharge pressure condition. The Pump Discharge Pressure Trip Setting is less than the pump discharge pressure when the pump is operating at all flow ranges and high enough to avoid any condition that results in a discharge pressure permissive when the CS and LPCI pumps are aligned for injection and the pumps are not running. The actual operating point of this function is not assumed in any transient or accident analysis.

Twelve channels of Core Spray and RHR Pump Discharge Pressure Trip Functions are only required to be operable when the ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation. Two CS channels associated with CS pump A and four LPCI channels associated with RHR pumps A and C are required for trip system logic A. Two CS channels associated with CS pump B and four LPCI channels associated with RHR pumps B and D are required for trip system logic B. However, each channel output is also electrically cross-connected such that each channel provides one logic contact in each ADS trip system logic.

Amendment No. 236 75h

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 1.g, 2.i. CS and LPCI Auxiliary Power Monitors The function of the CS and LPCI Auxiliary Power Monitors is to monitor emergency bus status and to implement load sequencing if the normal AC power supply is not available. The CS and LPCI Auxiliary Power Monitors are assumed to be operable in the accident and transient analyses requiring ECCS initiation. That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are a total of two CS and LPCI Auxiliary Power Monitors, one dedicated to CS A and LPCI subsystem A, and one dedicated to CS B and LPCI subsystem B.

There are no Trip Settings specified for these Trip Functions, since they are logic relays that cannot be adjusted.

Each channel of the CS and LPCI Auxiliary Power Monitors is only required to be operable when the associated CS and LPCI subsystems are required to be operable to ensure that no single instrument failure can preclude proper DG load sequencing and subsequent low pressure ECCS initiation as assumed in the safety analyses.

1.h, 2.j. CS and LPCI Pump Bus Power Monitors The function of the CS and LPCI Pump Bus Power Monitors is to monitor emergency bus status and to delay implementation of load sequencing until the associated emergency bus is powered, assuming a loss of the normal AC power supply. Alternately, assuming no loss of normal AC power supply, these monitors will prevent the CS and LPCI pump motor breakers from closing until the respective bus is energized. The CS and LPCI Pump Bus Power Monitors are assumed to be operable in the accident and transient analyses requiring ECCS initiation. That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are a total of four CS and LPCI Pump Bus Power Monitors, two dedicated to CS A and LPCI subsystem A, and two dedicated to CS B and LPCI subsystem B.

There are no Trip Settings specified for these Trip Functions, since they are logic relays that cannot be adjusted.

One of the two channels per Trip System of the CS and LPCI Pump Bus Power Monitors are only required to be operable when the associated CS and LPCI subsystems are required to be operable to ensure that no single instrument failure can preclude proper DG load sequencing and subsequent low pressure ECCS initiation as assumed in the safety analyses.

Amendment No. 236 75i

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 2.d. Reactor Vessel Shroud Level The Reactor Vessel Shroud Level Trip Function is provided as a permissive to allow the RHR System to be manually aligned from the LPCI mode to the suppression pool cooling/spray or drywell spray modes. The permissive ensures that water level in the vessel is at least two thirds core height before the manual transfer is allowed. This ensures that LPCI is available to prevent or minimize fuel damage. This Trip Function may be overridden during accident conditions as allowed by plant procedures. The Reactor Vessel Shroud Level Trip Function is implicitly assumed in the analysis of the recirculation line break (Ref. 1) since the analysis assumes that no LPCI flow diversion occurs when reactor water level is below the Reactor Vessel Shroud Level.

Reactor Vessel Shroud Level signals are initiated from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Shroud Level Trip Setting is chosen to allow the low pressure core flooding systems to activate and provide adequate cooling before allowing a manual transfer.

Two channels of the Reactor Vessel Shroud Level Trip Function are only required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN and Refuel (with reactor coolant temperature > 212°F). In other Modes or conditions, the specified initiation time of the LPCI subsystems is not assumed, and other administrative controls are adequate to control the valves that this Trip Function isolates (since the systems that the valves are opened for are not required to be operable in these other Modes or conditions and are normally not used).

2.g. LPCI High Drywell Pressure (Containment Spray Permissive)

The High Drywell Pressure (Containment Spray Permissive) Trip Function is provided as a permissive to allow the RHR System to be manually aligned from the LPCI mode to the suppression pool cooling/spray or drywell spray modes.

The permissive prevents the operator from inadvertently initiating containment spray, when it is not required to reduce drywell pressure, during a LOCA.

This ensures that LPCI is available to prevent or minimize fuel damage. The High Drywell Pressure (Containment Spray Permissive) Trip Function is implicitly assumed in the analysis of the recirculation line break (Ref. 1) since the analysis assumes that LPCI flow is available when required.

Amendment No. 236 75j

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Trip Setting was selected to be indicative of a LOCA inside primary containment.

The High Drywell Pressure (Containment Spray Permissive) Trip Function is required to be operable when LPCI is required to be operable in conjunction with times when the primary containment is required to be operable. Thus, four channels of the High Drywell Pressure (Containment Spray Permissive)

Trip Function are required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN and Refuel (with reactor coolant temperature > °F) to ensure that no single instrument failure can preclude LPCI initiation or cause inadvertent flow diversion. In other Modes or conditions, the specified initiation time of the LPCI subsystems is not assumed, and other administrative controls are adequate to control the valves that this Trip Function isolates (since the systems that the valves are opened for are not required to be operable in these other Modes or conditions and are normally not used).

HPCI System 3.a. Low - Low Reactor Vessel Water Level Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the HPCI System is initiated at Low - Low Reactor Vessel Water Level to maintain level above the top of the active fuel. The Low -

Low Reactor Vessel Water Level is one of the Trip Functions assumed to be operable and capable of initiating HPCI during the accidents and transients analyzed in References 1 and 2.

Low - Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Low - Low Reactor Vessel Water Level Trip Setting is high enough above the top of enriched fuel to start HPCI in time to prevent fuel uncovering for small breaks, but far enough below normal levels that spurious HPCI startups are avoided. The Trip Setting is referenced from the top of enriched fuel.

Four channels of Low - Low Reactor Vessel Water Level Trip Function are required to be operable only when HPCI is required to be operable to ensure that no single instrument failure can preclude HPCI initiation.

Amendment No. 236 75k

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 3.b Low Condensate Storage Tank Level Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valves between HPCI and the CST are open and, upon receiving a HPCI initiation signal, water for HPCI injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open. When the suppression pool suction valves both start to open, the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCI pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must both start to open before the CST suction valve automatically closes. The Trip Function is implicitly assumed in the accident and transient analyses (which take credit for HPCI) since the analyses assume that the HPCI suction source is the suppression pool.

The Low Condensate Storage Tank Level signal is initiated from two level transmitters. The logic is arranged such that either level transmitter can cause the suppression pool suction valves to open and the CST suction valve to close. The Low Condensate Storage Tank Level Trip Function Trip Setting is high enough to ensure adequate pump suction head while water is being taken from the CST. The Trip Setting is presented in terms of percent instrument span.

Two channels of the Low Condensate Storage Tank Level Trip Function are required to be operable only when HPCI is required to be operable to ensure that no single instrument failure can preclude HPCI swap to suppression pool source.

3.c. High Drywell Pressure High pressure in the drywell could indicate a break in the RCPB. The HPCI System is initiated upon receipt of the High Drywell Pressure Trip Function in order to minimize the possibility of fuel damage. The High Drywell Pressure Trip Function associated with HPCI is not assumed in accident or transient analyses. It is retained since it is a potentially significant contributor to risk.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Trip Setting was selected to be as low as possible to be indicative of a LOCA inside primary containment.

Four channels of the High Drywell Pressure Trip Function are required to be operable when HPCI is required to be operable to ensure that no single instrument failure can preclude HPCI initiation.

Amendment No. 236 75l

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 3.d. High Reactor Vessel Water Level High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the High Reactor Vessel Water Level signals are used to trip the HPCI turbine to prevent overflow into the main steam lines (MSLs) to preclude an unanalyzed event.

High Reactor Vessel Water Level signals for HPCI are initiated from two level transmitters from the narrow range water level measurement instrumentation.

Both High Reactor Vessel Water Level signals are required in order to close the HPCI turbine stop valve. This ensures that no single instrument failure can preclude HPCI initiation. The High Reactor Vessel Water Level Trip Setting is high enough to avoid interfering with HPCI System operation during reactor water level recovery resulting from low reactor water level events and low enough to prevent flow from the HPCI System from overflowing into the MSLs. The Trip Setting is referenced from the top of enriched fuel.

Two channels of the High Reactor Vessel Water Level Trip Function are required to be operable only when HPCI is required to be operable.

Automatic Depressurization System (ADS) 4.a. Low - Low Reactor Vessel Water Level Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for initiation from this Trip Function. The Low - Low Reactor Vessel Water Level is one of the Trip Functions assumed to be operable and capable of initiating the ADS during the accident analyzed in Reference 1. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

Low - Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Low - Low Reactor Vessel Water Level Trip Function are required to be operable only when ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system logic A, while the other two channels input to ADS trip system logic B.

The Low - Low Reactor Vessel Water Level Trip Setting is chosen to allow time for the low pressure core flooding systems to initiate and provide adequate cooling. The Trip Setting is referenced from the top of enriched fuel.

Amendment No. 236 75m

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 4.b High Drywell Pressure High pressure in the drywell could indicate a break in the RCPB. Therefore, ADS receives signals necessary for initiation from this Trip Function in order to minimize the possibility of fuel damage. The High Drywell Pressure Trip Function is assumed to be operable and capable of initiating the ADS during accidents analyzed in Reference 1. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the requirements of 10 CFR 50.46 are met.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Trip Setting was selected to be as low as possible to be indicative of a LOCA inside primary containment. Four channels of High Drywell Pressure Trip Function are required to be operable only when ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system logic A, while the other two channels input to ADS trip system logic B.

4.c. Time Delay The purpose of the ADS Time Delay is to delay depressurization of the reactor vessel to allow the HPCI System time to restore and maintain reactor vessel water level. Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited. By delaying initiation of the ADS function, the operator is given the chance to monitor the success or failure of the HPCI System to maintain water level, and then to decide whether or not to allow ADS to initiate or to inhibit initiation. The ADS Time Delay Trip Function is assumed to be operable for the accident analyses of Reference 1 that require ECCS initiation and assume failure of the HPCI System.

There are two ADS Time Delay relays, one in each of the two ADS trip system logics. The Trip Setting for the ADS Time Delay is chosen to be long enough to allow HPCI to start and avoid an inadvertent blowdown yet short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Two channels of the ADS Time Delay Trip Function are only required to be operable when the ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation. One channel inputs to ADS trip system logic A, while the other channel inputs to ADS trip system logic B.

Amendment No. 236 75n

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 4.d. Sustained Low - Low Reactor Vessel Water Level Time Delay One of the signals received for ADS initiation is High Drywell Pressure.

However, if the event requiring ADS occurs outside the drywell (e.g., main steam line break outside containment), a high drywell pressure signal may never be present. Therefore, the Sustained Low - Low Reactor Vessel Water Level Time Delay Trip Function is used to bypass the High Drywell Pressure Trip Function after a certain time period has elapsed. The instrumentation is retained in the TS because ADS is part of the primary success path for mitigation of a DBA.

There are four Sustained Low - Low Reactor Vessel Water Level Time Delay relays, two in each of the two ADS trip system logics. The Trip Setting for the Sustained Low - Low Reactor Vessel Water Level Time Delay is chosen to ensure that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.

Four channels of the Sustained Low - Low Reactor Vessel Water Level Time Delay Trip Function are only required to be operable when the ADS is required to be operable to ensure that no single instrument failure can preclude ADS initiation.

ACTIONS Table 3.2.1 ACTION Note 1 Table 3.2.1 ACTION Note 1.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in redundant automatic initiation capability being lost for the feature(s). Table 3.2.1 ACTION Note 1.a features would be those that are initiated by Trip Function 1.a, 1.b, 2.b, and 2.c (e.g., low pressure ECCS).

Redundant automatic initiation capability is lost if (a) two Trip Function 1.a channels are inoperable and untripped in the same trip system, (b) two Trip Function 1.b channels are inoperable and untripped in the same trip system, (c) two Trip Function 2.b channels are inoperable and untripped in the same system, or (d) two Trip Function 2.c channels are inoperable and untripped in the same trip system. Each inoperable channel would only require the affected portion of the associated system of low pressure ECCS and DGs to be declared inoperable. However, since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and untripped, and the completion times of Table 3.2.1 ACTION Note 1.a started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS and DGs being concurrently declared inoperable.

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 1.b is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared Amendment No. 236 75o

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 1.a, the completion time only begins upon discovery of a loss of initiation capability for feature(s) in both divisions (i.e., that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Trip Function as described in the paragraph above).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to operable status. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 1.b. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), the associated systems must be declared inoperable. With any applicable Action and associated completion time not met, the associated subsystem(s) may be incapable of performing the intended function, and the supported subsystem(s) associated with inoperable untripped channels must be declared inoperable immediately.

Table 3.2.1 ACTION Note 2 Table 3.2.1 ACTION Note 2.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in automatic initiation capability being lost for the feature(s). Table 3.2.1 ACTION Note 2.a features would be those that are initiated by Trip Functions 1.c, 1.d, 1.e, 1.g, 1.h, 2.a, 2.e, 2.h, 2.i, and 2.j (i.e., low pressure ECCS). Automatic initiation capability is lost if either (a) two Trip Function 1.c channels are inoperable, (b) two Trip Function 1.d channels are inoperable in the same trip system, (c) one Trip Function 1.e channel is inoperable in each trip system, (d) one Trip Function 1.g channel is inoperable in each trip system, (e) two Trip Function 1.h channels inoperable in each trip system, (f) two Trip Function 2.a channels are inoperable, (g) one Trip Function 2.e channel inoperable in each trip system, (h) two Trip Function 2.h channels inoperable in the same trip system, (i) one Trip Function 2.i channel inoperable in each trip system or (j) two Trip Function 2.j channels inoperable in each trip system. Each inoperable channel would only require the affected portion of the associated system of low pressure Amendment No. 236 75p

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued)

ECCS to be declared inoperable. However, since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and untripped, and the completion times of Table 3.2.1 ACTION Note 2.a started concurrently for the channels in both subsystems, this results in the affected portions in the associated low pressure ECCS being concurrently declared inoperable. For Functions 1.e and 2.e, the affected portions are the associated low pressure ECCS pumps.

In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 2.b is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 2.a, the Completion Time only begins upon discovery of a loss of initiation capability for feature(s) in both divisions (i.e., that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Trip Function as described in the paragraph above). The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to operable status. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the associated systems must be declared inoperable. With any applicable Action and associated completion time not met, the associated subsystem(s) may be incapable of performing the intended function, and the supported subsystem(s) associated with inoperable channels must be declared inoperable immediately.

The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

Table 3.2.1 ACTION Note 3 Table 3.2.1 ACTION Note 3.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in redundant automatic initiation capability being lost for the feature(s).

Table 3.2.1 ACTION Note 3.a features would be those that are initiated by Trip Functions 2.d and 2.g (i.e., LPCI). Redundant automatic initiation capability is lost if one Trip Function 2.d channel is inoperable in each trip system or if two Trip Function 2.g channels are inoperable in the same trip system.

Each inoperable channel would only require the affected portion of the associated LPCI subsystem to be declared inoperable. However, since channels in both associated LPCI subsystems are inoperable and untripped, and the completion times of Table 3.2.1 ACTION Note 3.a started concurrently for the Amendment No. 236 75q

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) channels in both subsystems, this results in the affected portions in the associated LPCI subsystems being concurrently declared inoperable. Table 3.2.1 ACTION Note 3.a is not applicable to Trip Function 2.d, since this Trip Function provides backup to administrative controls ensuring that operators do not divert LPCI flow from injecting into the core when needed. Thus, a total loss of Trip Function 2.d capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed, since the LPCI subsystems remain capable of performing their intended function.

In the situation of loss of redundant automatic initiation capability for Trip Function 2.g, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 3.b is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 3.a, the Completion Time only begins upon discovery of a loss of LPCI initiation capability due to inoperable, untripped channels within the Trip Function 2.g as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.3) to permit restoration of any inoperable channel to operable status. If an inoperable channel for Trip Function 2.d cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 3.b. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accomodate a single failure, and allow operation to continue.

If an inoperable channel for Trip Function 2.g cannot be restored to operable status within the allowable out of service time, the associated systems must be declared inoperable. With any applicable Action and associated completion time not met, the associated subsystem(s) may be incapable of performing the intended function, and the supported subsystem(s) associated with the inoperable channels must be declared inoperable immediately.

Table 3.2.1 ACTION Note 4 Table 3.2.1 ACTION Note 4.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in redundant automatic initiation capability being lost for the feature(s). The Table 3.2.1 ACTION Note 4.a feature would be HPCI.

Redundant automatic initiation capability is lost if two Trip Function 3.a or two Trip Function 3.c channels are inoperable and untripped in the same trip system logic.

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 4.b is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared Amendment No. 236 75r

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Table 3.2.1 ACTION Note completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 4.a, the completion time only begins upon discovery of a loss of HPCI initiation capability due to inoperable, untripped channels within the same Trip Function as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to operable status. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 4.b. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), the HPCI System must be declared inoperable. With any applicable Action and associated completion time not met, the HPCI System may be incapable of performing the intended function, and the HPCI System must be declared inoperable immediately.

Table 3.2.1 ACTION Note 5 Table 3.2.1 ACTION Note 5.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in a complete loss of automatic component initiation capability for the HPCI System. Automatic component initiation capability is lost if two Trip Function 3.b channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.1 ACTION Note 5.b is not appropriate and the HPCI System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of HPCI initiation capability. Table 3.2.1 ACTION Note 5.a is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Trip Function is already performed.

The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 5.a, the completion time only begins upon discovery that the HPCI System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Trip Function as described in the paragraph Amendment No. 236 75s

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to operable status. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition or the suction source must be aligned to the suppression pool per Table 3.2.1 ACTION Note 5.b. Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool). Performance of either of the two actions of Table 3.2.1 ACTION Note 5.b will allow operation to continue. If Table 3.2.1 ACTION Note 5.b is performed, measures should be taken to ensure that the HPCI System piping remains filled with water. Alternately, if it is not desired to perform Table 3.2.1 ACTION NOTE 5.b (e.g., as in the case where shifting the suction source could drain down the HPCI suction piping), the HPCI System must be declared inoperable. With any applicable Action and associated completion time not met, the HPCI System may be incapable of performing the intended function, and the HPCI System must be declared inoperable immediately.

Table 3.2.1 ACTION Note 6 For Trip Function 3.d, the loss of one or more channels results in a loss of the function (two-out-of-two logic). This loss was considered during the development of Reference 3 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed to permit restoration of the inoperable channel to operable status by Table 3.2.1 ACTION Note 6.a. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the HPCI System must be declared inoperable. With any applicable Action and associated completion time not met, the HPCI System may be incapable of performing the intended function, and the HPCI System must be declared inoperable immediately. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

Table 3.2.1 ACTION Note 7 Table 3.2.1 ACTION Note 7.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in redundant automatic initiation capability being lost for the ADS. Redundant automatic initiation capability is lost if either (a) one or more Trip Function 4.a channels are inoperable and untripped in each trip system logic, or (b) one or more Trip Function 4.b channels are inoperable and untripped in each trip system.

Amendment No. 236 75t

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued)

In this situation (loss of automatic initiation capability), the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Table 3.2.1 ACTION Note 7.b or 7.c, respectively, is not appropriate and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 7.a, the completion time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within the same Trip Function as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to operable status if both HPCI and RCIC are operable (Table 3.2.1 ACTION Note 7.c). If either HPCI or RCIC is inoperable, the time is shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months (Table 3.2.1 ACTION Note 7.b). If the status of HPCI or RCIC changes such that the completion time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable, untripped channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the completion time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the 8 day allowable out of service time begins upon discovery of the inoperable, untripped channel. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.1 ACTION Note 7.b or 7.c, as applicable. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), the ADS must be declared inoperable. With any applicable Action and associated completion time not met, the ADS may be incapable of performing the intended function, and the ADS must be declared inoperable immediately.

Table 3.2.1 ACTION Note 8 Table 3.2.1 ACTION Note 8.a is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Trip Function result in redundant automatic initiation capability being lost for the ADS.

Redundant automatic initiation capability is lost if either (a) one Trip Function 4.c channel is inoperable in each trip system logic (i.e., 2 channels are inoperable), (b) one or more Trip Function 4.d channels are inoperable in each trip system logic, or (c) all Trip Function 1.f and 2.f channels are inoperable.

Amendment No. 236 75u

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued)

In this situation (loss of automatic initiation capability), the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Table 3.2.1 ACTION Note 8.b or 8.c, respectively, is not appropriate and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.1 ACTION Note 8.a, the completion time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within the same Trip Function as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to operable status if both HPCI and RCIC are operable (Table 3.2.1 ACTION Note 8.c). If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months (Table 3.2.1 ACTION Note 8.b). If the status of HPCI or RCIC changes such that the completion time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the completion time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the 8 day allowable out of service time begins upon discovery of the inoperable channel. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the ADS must be declared inoperable. With any applicable Action and associated completion time not met, the ADS may be incapable of performing the intended function, and the ADS must be declared inoperable immediately. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

Table 3.2.1 ACTION Notes 9 and 10 The Emergency Core Cooling System Instrumentation, High Pressure Coolant Injection, Low Condensate Storage Tank Water Level function is modified by Notes 9 and 10 as identified in Table 3.2.1. Note 9 requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The ability to reset the setpoint represents continued confidence that the channel can perform its intended safety function. The performance of this channel will be evaluated under the Corrective Action Program. This will ensure required review and documentation of the condition for continued operability. Note 10 requires that the as-left setting for the channel be returned to within the as-left tolerance of the Nominal Trip Setpoint. Where a setpoint more conservative that the Limiting Trip Setpoint is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left Amendment No. 236 75v

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

ACTIONS (continued) channel setting cannot be returned to a setting within the as-left tolerance of the Nominal Trip Setpoint, then the channel shall be declared inoperable.

The methodologies for calculating the Normal Trip Setpoint and the as-left and the as-found tolerances are located in the Vermont Yankee Setpoint Program Manual which is included by reference in the UFSAR. This ensures changes are evaluated under 10CFR50.59.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.A.1 As indicated in Surveillance Requirement 4.2.A.1, ECCS instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.1.

Table 4.2.1 identifies, for each ECCS Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.A.1 also indicates that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months as follows: (a) for Trip Function 3.d; and (b) for Trip Functions other than 3.d provided the associated Trip Function or redundant Trip Function maintains initiation capability. Upon completion of the surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary.

Surveillance Requirement 4.2.A.2 The Logic System Functional Test demonstrates the operability of the required initiation logic for a specific channel. The simulated automatic actuation testing required by the ECCS Technical Specifications and Diesel Generator Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function. For the ADS Trip Functions, this Logic System Functional Test requirement does not include solenoids of the ADS valves.

However, a simulated automatic actuation, which opens all pilot valves of the ADS valves, shall be performed such that each trip system logic can be verified independent of its redundant counterpart. In addition, for the ADS Trip Functions, the Logic System Functional Test will include verification of operation of all automatic initiation inhibit switches by monitoring relay contact movement. Verification that the ADS manual inhibit switches prevent opening all ADS valves will be accomplished in conjunction with Surveillance Requirement 4.5.F.1. The Frequency of once every Operating Cycle is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Amendment No. 236 75w

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.1, Check Performance of an Instrument Check once per day for Trip Functions 1.a, 1.b, 1.g, 1.h, 2.b, 2.c, 2.i, 2.j, 3.a, 3.c, 4.a, and 4.b, ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare.

The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.1, Functional Test For Trip Functions 1.a, 1.b, 1.c, 1.d, 1.f, 1.g, 1.h, 2.a, 2.b, 2.c, 2.d, 2.f, 2.g, 2.h, 2.i, 2.j, 3.a, 3.b, 3.c, 3.d, 4.a, and 4.b, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of Every 3 Months is based on the reliability analysis of Reference 3.

Table 4.2.1, Calibration For Trip Functions 1.a, 1.b, 1.c, 1.d, 1.e, 1.f, 2.a, 2.b, 2.c, 2.d, 2.e, 2.f, 2.g, 2.h, 3.a, 3.b, 3.c, 3.d, 4.a, 4.b, 4.c, and 4.d, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For Trip Functions 1.a, 1.b, 1.c, 1.d, 2.a, 2.b, 2.c, 2.d, 2.g, 2.h, 3.a, 3.c, 3.d, 4.a, and 4.b, a calibration of the trip units is required (Footnote (a)) once every 3 months. Calibration of the trip units provides a check of the actual setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found Amendment No. 236 75x

VYNPS BASES: 3.2.A/4.2.A EMERGENCY CORE COOLING SYSTEM (ECCS)

SURVEILLANCE REQUIREMENTS (continued) tolerances specified in plant procedures. The Frequency of every 3 months is based on the reliability analysis of Reference 3 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. UFSAR, Section 6.5.

2. UFSAR, Chapter 14.

3. NEDC-30936-P-A, BWR Owners' Group Technical Specification Improvement Methodology (With Demonstration for BWR ECCS Actuation Instrumentation),

Parts 1 and 2, December 1988.

Amendment No. 236 75y

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs). The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL) flow, (d) main steam line pressure, (e) condenser vacuum, (f) drywell pressure, (g) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line d/p, (h) HPCI and RCIC steam line pressure, and (i) reactor vessel pressure. Redundant sensor input signals from each parameter are provided for initiation of isolation.

Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below.

1. Main Steam Line Isolation The Low - Low Reactor Vessel Water Level, Low Main Steam Line Pressure, High Main Steam Line Flow - Not in RUN, and Condenser Low Vacuum Trip Functions each receive inputs from four channels. The outputs of these channels are combined in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs), MSL drain valves, and recirculation loop sample isolation valves.

The High Main Steam Line Flow Trip Function uses 16 flow channels, four for each steam line. One channel from each steam line inputs to one of the four trip strings. Two trip strings make up each trip system and both trip systems must trip to cause an isolation of all MSIVs, MSL drain valves, and recirculation sample isolation valves. Each trip string has four inputs (one per MSL), any one of which will trip the trip string. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation.

The High Main Steam Line Area Temperature Trip Function receives input from 16 channels, four for each of four main steam line areas. The logic is arranged similar to the High Main Steam Line Flow Trip Function. One channel from each steam tunnel area inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause isolation.

MSL Isolation Trip Functions isolate the Group 1 valves.

Amendment No. 236 76

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION BACKGROUND (continued)

2. Primary Containment Isolation The Low Reactor Vessel Water Level and High Drywell Pressure Trip Functions each receive inputs from four channels. For each Trip Function, the outputs of these channels are combined in a one-out-of-two taken twice logic to initiate isolation of the PCIVs identified in Reference 1.

Primary Containment Isolation Trip Functions isolate the Groups 2, 3, and 4 valves. Group 5 valves are also isolated by the Low Reactor Vessel Water Level Trip Function.

3, 4. High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation The HPCI High Steam Line d/p, RCIC High Steam Line d/p, and RCIC High Steam Line d/p Time Delay Trip Functions each receive input from two channels, with each channel in one trip system using a one-out-of-one logic. The trip systems are arranged in a one-out-of-two logic. Each of the two trip systems is connected to both valves on the associated penetration.

The HPCI and RCIC Low Steam Supply Line Pressure Trip Functions each receive input from four steam supply pressure channels. The outputs from the associated steam supply pressure channels are connected in a one-out-of-two-twice trip system logic arrangement. There are two trip system logics which provide input to one trip system. The trip system must trip to initiate isolation of both valves on the associated penetration.

The HPCI and RCIC High Main Steam Line Tunnel Temperature Trip Functions each receive input from 4 channels. Four channels, each with an associated temperature switch, are connected in a one-out-of-two-twice arrangement which provides input to two trip systems. Both trip systems must trip to initiate isolation of both valves on the associated penetration. In addition, the HPCI and RCIC High Main Steam Line Tunnel Temperature Trip Functions each have time delays. These Time Delay Trip Functions each receive input from two channels, with each channel in one of the trip system using a one-out-of-one logic. The trip systems are arranged in a one-out-of-two logic.

The HPCI and RCIC High Steam Line Space Temperature Trip Functions each receive input from 12 channels. There are three steam line areas each monitored by one set of four channels. One channel from each of the three steam line areas inputs to one of the four trip strings. Two trip strings make up each trip system and both trip systems must trip to cause an isolation of both valves on the associated penetration. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-six taken twice logic arrangement to initiate isolation.

HPCI System and RCIC System Isolation Trip Functions isolate the Group 6 valves, as appropriate.

Amendment No. 236 76a

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION BACKGROUND (continued)

5. Residual Heat Removal Shutdown Cooling Isolation The High Reactor Pressure Trip Function receives input from two channels. The outputs from these channels are arranged in a one-out-of-two logic to initiate isolation of the Shutdown Cooling (SDC) supply isolation valves.

The Residual Heat Removal Shutdown Cooling Isolation Trip Function isolates the Group 4 SDC supply isolation valves.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The isolation signals generated by the primary containment isolation instrumentation are implicitly assumed in the safety analyses of Reference 2 to initiate closure of valves to limit offsite doses.

Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Trip Functions are retained for other reasons and are described below in the individual Trip Functions discussion.

The operability of the primary containment isolation instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.2.2. Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.2. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Certain Emergency Core Cooling Systems (ECCS) valves (e.g., containment spray isolation valves) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS. Some instrumentation requirements and Actions associated with these signals are addressed in Specification 3.2.A, "Emergency Core Cooling Systems (ECCS)," and are not included in this specification.

In general, the individual Trip Functions are required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature

>212°F) consistent with the Applicability for Primary Containment Integrity requirements in Specification 3.7.A.2. Trip Functions that have different Applicabilities are discussed below in the individual Trip Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Trip Function by Trip Function basis.

Main Steam Line Isolation 1.a. Low - Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that the capability to Amendment No. 236 76b

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Low - Low Reactor Vessel Water Level Trip Function is one of the many Trip Functions assumed to be operable and capable of providing isolation signals. The Low - Low Reactor Vessel Water Level Trip Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 3). The isolation of the MSLs supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Low - Low Reactor Vessel Water Level Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Low - Low Reactor Vessel Water Level Trip Setting is chosen to be the same as the ECCS Low - Low Reactor Vessel Water Level Trip Setting (Specification 3.2.A) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 50.67 limits. The Trip Setting is referenced from the top of enriched fuel.

This Function isolates the Group 1 valves.

1.b. High Main Steam Line Area Temperature Main steam line tunnel temperature is provided to detect a leak in the RCPB in the steam tunnel and provides diversity to the high flow instrumentation.

Temperature is sensed in four different areas of the steam tunnel in the vicinity of the main steam lines. The isolation occurs when a very small leak has occurred in any one of the four areas. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. However, credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding analyses are performed for large breaks, such as MSLBs.

Main steam line area temperature signals are initiated from a total of sixteen temperature switches located in the four areas being monitored.

Sixteen channels of High Main Steam Line Area Temperature Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The High Main Steam Line Area Temperature Trip Setting is chosen to provide early indication of a steam line break.

These Functions isolate the Group 1 valves.

1.c. High Main Steam Line Flow High Main Steam Line Flow is provided to detect a break of the MSL and to initiate closure of the MSIVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover.

If the RPV water level decreases too far, fuel damage could occur. Therefore, Amendment No. 236 76c

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) the isolation is initiated on high flow to prevent or minimize core damage.

The High Main Steam Line Flow Trip Function is directly assumed in the analysis of the main steam line break (MSLB) (Ref. 4). The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 50.67 limits.

The MSL flow signals are initiated from 16 differential pressure transmitters that are connected to the four MSLs (the differential pressure transmitters sense differential pressure across a flow restrictor). The differential pressure transmitters are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow. Four channels of High Main Steam Line Flow Trip Function for each MSL (two channels per trip system) are available and are required to be operable so that no single instrument failure will preclude detecting a break in any individual MSL.

The Trip Setting is chosen to ensure that fuel peak cladding temperature and offsite dose limits are not exceeded due to the break.

This Trip Function isolates the Group 1 valves.

1.d. Low Main Steam Line Pressure Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100°F/hr if the pressure loss is allowed to continue. The Low Main Steam Line Pressure Trip Function is directly assumed in the analysis of the pressure regulator failure (Ref. 5).

For this event, the closure of the MSIVs ensures that the RPV temperature change limit (100°F/hr) is not reached. In addition, this Trip Function supports actions to ensure that Safety Limit 1.1.B is not exceeded. (This Trip Function closes the MSIVs at 800 psig prior to pressure decreasing below 785 psig [800 psia], which results in a scram due to MSIV closure, thus reducing reactor power to < 23% RATED THERMAL POWER.)

The MSL low pressure signals are initiated from four pressure switches that are connected to the MSL header. The switches are arranged such that, even though physically separated from each other, each pressure switch is able to detect low MSL pressure. Four channels of Low Main Steam Line Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting was selected to be high enough to prevent excessive RPV depressurization.

The Low Main Steam Line Pressure Trip Function is only required to be operable in the RUN Mode since this is when the assumed transient can occur (Ref. 5).

This Trip Function isolates the Group 1 valves.

Amendment No. 236 76d

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 1.e. High Main Steam Line Flow - Not in RUN High Main Steam Line Flow when the reactor mode switch is not in RUN provides protection for a turbine pressure regulator malfunction which causes the turbine control valves and turbine bypass valves to open or protection for a main steam line break. These events would result in a rapid depressurization and cooldown of the RPV. The High Main Steam Line Flow - Not in RUN Trip Function was credited in the MSLB at low power analysis.

The MSL flow signals are initiated from 4 differential pressure transmitters, one connected to each of the four MSLs (the differential pressure switches sense differential pressure across a flow restrictor). Four channels of High Main Steam Line Flow - Not in RUN Trip Function (two channels per trip system) are available and are required to be operable so that no single instrument failure will preclude providing protection against a turbine pressure regulator malfunction or a break in any individual MSL.

The Trip Setting is chosen to provide early indication of a steam line break.

The High Main Steam Line Flow - Not in RUN Trip Function is only required to be operable in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature >212°F). In the RUN Mode, protection for the depressurization resulting from a turbine pressure regulator malfunction is provided by the Low Main Steam Line Pressure Trip Function and protection for depressurization resulting from a main steam line break is provided by the High Main Steam Line Flow Trip Function.

This Trip Function isolates the Group 1 valves.

1.f. Low Condenser Vacuum The Low Condenser Vacuum Trip Function is provided to prevent overpressurization of the main condenser in the event of a loss of the main condenser vacuum. Since the integrity of the condenser is an assumption in offsite dose calculations, the Low Condenser Vacuum Trip Function is assumed to be operable and capable of initiating closure of the MSIVs. The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture, thereby preventing a potential radiation leakage path following an accident.

Condenser vacuum pressure signals are derived from four pressure switches that sense the pressure in the condenser. Four channels of Low Condenser Vacuum Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. As indicated in Footnote (b) to Table 3.2.2, the channels are not required to be operable in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature >212°F) when all turbine stop valves (TSVs) and turbine bypass valves (TBVs) are closed, since the potential for condenser overpressurization is minimized. A key lock switch is provided to manually bypass the Low Condenser Vacuum Trip Function channels to enable plant Amendment No. 236 76e

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) startup and shutdown when condenser vacuum is greater than 12 inches Hg absolute and all TSVs and TBVs are closed.

This Trip Function isolates the Group 1 valves Primary Containment Isolation 2.a. Low Reactor Vessel Water Level Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on low RPV water level supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Low Reactor Vessel Water Level Trip Function associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.

Low Reactor Vessel Water Level signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Low Reactor Vessel Water Level Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Low Reactor Vessel Water Level Trip Setting was chosen to be the same as the RPS Low Reactor Vessel Water Level scram Trip Setting (Specification 3.1.A), since isolation of these valves is not critical to orderly plant shutdown. The Trip Setting is referenced from the top of enriched fuel.

This Trip Function isolates the Groups 2, 3, 4, and 5 valves.

2.b. High Drywell Pressure High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The High Drywell Pressure Trip Function, associated with isolation of the primary containment, is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of High Drywell Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting was selected to be the same as the ECCS High Drywell Pressure (Specification 3.2.A) and RPS High Drywell Pressure (Specification 3.1.A) Trip Settings, since this may be indicative of a LOCA inside primary containment.

This Trip Function isolates the Groups 2, 3 and 4 valves.

Amendment No. 236 76f

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation 3.a, 4.c HPCI and RCIC High Steam Line Space Temperature High Steam Line Space Temperature Trip Functions are provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation.

If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Trip Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

High Steam Line Space Temperature signals are initiated from temperature switches that are appropriately located to detect a leak from the system piping that is being monitored. For each Trip Function, there are four instruments that monitor each of three locations. Twelve channels for HPCI High Steam Line Space Temperature are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function. Twelve channels for RCIC High Steam Line Space Temperature are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Settings are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Trip Functions isolate the associated Group 6 valves.

3.b., 4.d. HPCI and RCIC High Steam Line d/p (Steam Line Break)

High Steam Line d/p (Steam Line Break) Trip Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover. Therefore, the isolations are initiated on high d/p to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the requirements of 10 CFR 50.46 are met. Specific credit for these Trip Functions is not assumed in any UFSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

The HPCI and RCIC High Steam Line d/p (Steam Line Break) signals are initiated from differential pressure switches (two for HPCI and two for RCIC) that are connected to the associated system steam lines. Two channels of both HPCI and RCIC High Steam Line d/p (Steam Line Break) Trip Functions are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

Amendment No. 236 76g

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Trip Settings are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Trip Functions isolate the associated Group 6 valves.

3.c., 4.f. HPCI and RCIC Low Steam Supply Pressure Low steam supply pressure indicates that the pressure of the steam in the HPCI or RCIC turbine may be too low to continue operation of the associated system's turbine. These isolations are for equipment protection. However, they also provide a diverse signal to indicate a possible system break.

These instruments are included in Technical Specifications because of the potential for possible system initiation failure resulting from these instruments.

The HPCI and RCIC Low Steam Supply Pressure signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the associated system steam line. Four channels of both HPCI and RCIC Low Steam Supply Pressure Trip Functions are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Settings are selected to be below the pressure at which the system's turbine can effectively operate.

Since these Trip Functions are provided for equipment protection, they are only required to be operable when the HPCI and RCIC System are required to be operable. Therefore, as indicated in Footnote (c) to Table 3.2.2, in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel, the channels are only required to be operable when reactor steam pressure is > 150 psig.

These Trip Functions isolate the associated Group 6 valves.

3.d., 3.e., 4.a., 4.b. HPCI and RCIC High Main Steam Line Tunnel Temperature and Time Delay HPCI and RCIC High Main Steam Line Tunnel Temperature Trip Functions are provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Trip Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding.

HPCI and RCIC High Main Steam Line Tunnel Temperature signals are initiated from temperature switches that are appropriately located to detect a leak from the associated system piping that is being monitored. For each Trip Function, there are four instruments that monitor the area. Four channels for HPCI High Main Steam Line Tunnel Temperature are available and are Amendment No. 236 76h

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) required to be operable to ensure that no single instrument failure can preclude the isolation function. Four channels for RCIC High Main Steam Line Tunnel Temperature are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Settings are set high enough above anticipated normal operating levels to avoid spurious isolation, yet low enough to provide timely detection of a HPCI or RCIC steam line break.

These Trip Functions isolate the associated Group 6 valves.

4.e RCIC High Steam Line d/p Time Delay The RCIC High Steam Line d/p Time Delay is provided to prevent false isolations on RCIC High Steam Line d/p during system startup transients and therefore improves system reliability. This Trip Function is not assumed in any UFSAR transient or accident analyses.

The RCIC High Steam Line d/p Time Delay Trip Function delays the RCIC High Steam Line d/p (Steam Line Break) signal by use of time delay relays. When a RCIC High Steam Line d/p (Steam Line Break) signal is generated, the time delay relays delay the tripping of the associated RCIC isolation trip system for a short time. Two channels of RCIC High Steam Line d/p Time Delay Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function.

The Trip Setting is chosen to be long enough to prevent false isolations due to system starts but not so long as to impact compliance with 10CFR50.46 requirements.

This Trip Function, in conjunction with the RCIC High Steam Line d/p (Steam Line Break) Trip Function, isolates the RCIC System Group 6 valves.

Residual Heat Removal Shutdown Cooling Isolation 5.a. High Reactor Pressure The High Reactor Pressure Trip Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR) System. This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR.

The High Reactor Pressure signals are initiated from two pressure switches.

Two channels of High Reactor Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function. The Trip Function is only required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel (with reactor coolant temperature >212°F), since these are the only Modes in which the reactor can be pressurized; thus, equipment protection is needed.

The Trip Setting was chosen to be low enough to protect the system equipment from overpressurization.

This Trip Function isolates the Group 4 SDC supply isolation valves.

Amendment No. 236 76i

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION ACTIONS Table 3.2.2 ACTION Note 1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , depending on the Trip Function (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for those Trip Functions that have channel components common to RPS instrumentation, i.e., Trip Functions 2.a and 2.b, and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for those Trip Functions that do not have channel components common to RPS instrumentation, i.e., all other Trip Functions), has been shown to be acceptable (Refs. 6 and 7) to permit restoration of any inoperable channel to operable status. This out of service time is only acceptable provided the associated Trip Function is still maintaining isolation capability (refer to the next paragraph). For all Trip Functions except for Trip Functions 3.e, 4.b, and 4.e, if the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.2 ACTION Note 1.a.1) or 1.a.3), as applicable. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), the applicable actions of Table 3.2.2 ACTION Note 2 must be taken. For Trip Functions 3.e, 4.b, and 4.e, Table 3.2.2 ACTION Note 1.a.2) requires the channel to be restored to operable status. Table 3.2.2 ACTION Note 1.a.2) does not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

Table 3.2.2 ACTION Note 1.b is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in redundant automatic isolation capability being lost for the associated penetration flow path(s). The Trip Functions are considered to be maintaining isolation capability when sufficient channels are operable or in trip, such that both trip systems will generate a trip signal from the given Trip Function on a valid signal. For Trip Functions 1.a, 1.d, 1.e, 1.f, 2.a, 2.b, 3.b, 3.d, 4.a, 4.d, and 5.a, this would require both trip systems to have one channel operable or in trip. For Trip Function 1.c, this would require both trip systems to have one channel, associated with each MSL, operable or in trip. Trip Functions 1.b, 3.a and 4.c, consist of channels that monitor several locations within a given area (e.g., different locations within the main steam tunnel area). Therefore, this would require both trip systems to have one channel per location operable or in trip. For Trip Functions 3.e, 4.b and 4.e, this would require both trip systems to have one channel operable. For Trip Functions 3.c and 4.f (which only have one trip system for each Trip Function), this would require one trip system to have one channel in each trip system logic operable or in trip.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Amendment No. 236 76j

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION ACTIONS (continued)

Table 3.2.2 ACTION Note 1 also allows penetration flow path(s) to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator in the immediate vicinity of the controls of the valve, with whom Control Room communication is immediately available. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

Table 3.2.2 ACTION Notes 2.a, 2.b, 2.c and 2.d If any applicable Action and associated completion time of Table 3.2.2 ACTION Note 1.a or 1.b are not met, the applicable Actions of Table 3.2.2 ACTION Note 2 and referenced in Table 3.2.2 (as identified for each Trip Function in the Table 3.2.2 ACTIONS REFERENCED FROM ACTION NOTE 1 column) must be immediately entered and taken. The applicable Action specified in Table 3.2.2 is Trip Function and Mode or other specified condition dependent.

For Table 3.2.2 ACTION Note 2.a, if the channel is not restored to operable status or placed in trip within the allowed Completion Time the associated MSLs may be isolated, and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated), operation with that MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel. This action will generally only be used if a Trip Function 1.c channel is inoperable and untripped. The associated MSL(s) to be isolated are those whose High Main Steam Line Flow Trip Function channel(s) are inoperable. Alternately, the plant must be placed in a Mode or other specified condition in which the LCO does not apply. This is done by placing the plant in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. Table 3.2.2 ACTION Note 2.a also allows penetration flow path(s) to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator in the immediate vicinity of the controls of the valve, with whom Control Room communication is immediately available. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

For Table 3.2.2 ACTION Note 2.b, if the channel is not restored to operable status or placed in trip within the allowed Completion Time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply. This is done by placing the plant in COLD SHUTDOWN within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

For Table 3.2.2 ACTION Note 2.c, if the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a Mode or other specified condition in which the LCO does not apply. This is done by placing the plant in at least STARTUP/HOT STANDBY within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, based on operating experience, to reach STARTUP/HOT STANDBY from full power conditions in an orderly manner and without challenging plant systems.

Amendment No. 236 76k

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION ACTIONS (continued)

For Table 3.2.2 ACTION Note 2.d, if the channel is not restored to operable status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channel. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s). Table 3.2.2 ACTION Note 2.d also allows penetration flow path(s) to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator in the immediate vicinity of the controls of the valve, with whom Control Room communication is immediately available. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.B.1 As indicated in Surveillance Requirement 4.2.B.1, primary containment isolation instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.2. Table 4.2.2 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.B.1 also indicates that when a channel (and/or the affected PCIV) is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability analysis (Refs. 6 and 7) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary.

Surveillance Requirement 4.2.B.2 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel.

The automatic initiation testing required by the PCIV Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function. For Main Steam Line Isolation Trip Functions, a simulated automatic actuation, which opens all pilot valves of the main steam line isolation valves, shall be performed such that each trip system logic can be verified independent of its redundant counterpart. The Frequency of once every Operating Cycle is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Amendment No. 236 76l

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.2, Check Performance of an Instrument Check once per day for Trip Functions 1.a, 1.c, 1.e, and 2.b, ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.2, Functional Test For Trip Functions 1.a, 1.b, 1.c, 1.d, 1.e, 1.f, 2.a, 2.b, 3.a, 3.b, 3.c, 3.d, 4.a, 4.c, 4.d, 4.e, 4.f, and 5.a, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of Every 3 Months is based on the reliability analysis of References 6 and 7.

Table 4.2.2, Calibration For Trip Functions 1.a, 1.b, 1.c, 1.d, 1.e, 1.f, 2.a, 2.b, 3.a, 3.b, 3.c, 3.d, 3.e, 4.a, 4.b, 4.c, 4.d, 4.e, 4.f, and 5.a, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

Amendment No. 236 76m

VYNPS BASES: 3.2.B/4.2.B PRIMARY CONTAINMENT ISOLATION SURVEILLANCE REQUIREMENTS (continued)

For Trip Functions 1.a, 1.c, 1.e, 2.a, and 2.b, a calibration of the trip units is required (Footnote (a)) once every 3 months. Calibration of the trip units provides a check of the actual setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures.

The Frequency of every 3 months is based on the reliability analysis of References 6 and 7 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. Technical Requirements Manual.

2. UFSAR, Chapter 14.

3. UFSAR, Table 6.5.3.

4. UFSAR, Section 14.6.5.

5. UFSAR, Section 14.5.4.1.

6. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

7. NEDC-30851P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

Amendment No. 236 76n

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION BACKGROUND The reactor building ventilation isolation and Standby Gas Treatment System initiation instrumentation automatically initiates closure of the Reactor Building Automatic Ventilation System Isolation Valves (RBAVSIVs) and starts the Standby Gas Treatment (SGT) System. The function of these components and systems, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1). Reactor Building (i.e., secondary containment) isolation and establishment of vacuum with the SGT System ensures that fission products that leak from primary containment following a DBA, or are released outside primary containment, or are released during certain operations when primary containment is not required to be operable, are maintained within applicable limits.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of reactor building ventilation isolation and Standby Gas Treatment System operation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a reactor building ventilation isolation and Standby Gas Treatment System initiation signal to the isolation and initation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation and initiation logic are (1) reactor vessel water level, (2) drywell pressure, (3) reactor building ventilation radiation, and (4) refueling floor zone radiation.

Redundant sensor input signals from each parameter are provided for initiation and isolation.

For both the Low Reactor Vessel Water Level and High Drywell Pressure Trip Functions, the reactor building ventilation isolation and Standby Gas Treatment System initiation logic receives input from four channels. The outputs of the channels are arranged in one-out-of-two taken twice logics.

For the High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation Trip Functions, two radiation detectors and monitors are provided for each Trip Function. Each channel includes a radiation detector and associated monitor. The outputs of the channels are arranged in a one-out-of-two logic. In addition, the outputs of each channel are provided to both Trip Systems A and B. As such, any High Reactor Building Ventilation Radiation or High Refueling Floor Zone Radiation Trip Function channel will initiate reactor building ventilation isolation and Standby Gas Treatment System operation. (For the purposes of the Technical Specifications, the A radiation detectors and monitors should be considered to be associated with the Trip System A and the B radiation detectors and monitors should be considered to be associated with Trip System B.) Trip System A initiates startup of SGT subsystem A and initiates isolation of the reactor building supply and exhaust outboard isolation valves. Trip System B initiates startup of SGT subsystem B and initiates isolation of the reactor building supply and exhaust inboard isolation valves. As such, either Trip System isolates the secondary containment and provides the necessary filtration of fission products.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The isolation and initiation signals generated by the reactor building ventilation isolation and Standby Gas Treatment System initiation Amendment No. 236 76o

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) instrumentation are implicitly assumed in the safety analyses of References 2, 3, and 4, to initiate closure of the RBAVSIVs and start the SGT System to limit offsite doses.

Reactor building ventilation isolation and Standby Gas Treatment System initiation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The operability of the reactor building ventilation isolation and Standby Gas Treatment System initiation instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions specified in Table 3.2.3.

Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.3. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

In general, the individual Trip Functions are required to be OPERABLE in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature

> 212°F), during operations with the potential for draining the reactor vessel (OPDRVs), during movement of irradiated fuel assemblies or fuel cask in secondary containment, and during Alteration of the Reactor Core; consistent with the Applicability for the SGT System and secondary containment requirements in Specifications 3.7.B and 3.7.C. Trip Functions that have different Applicabilities are discussed below in the individual Trip Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Trip Function by Trip Function basis.

1. Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite release. The Low Reactor Vessel Water Level Trip Function is one of the Trip Functions assumed to be operable and capable of providing isolation and initiation signals. The isolation and initiation of systems on Low Reactor Vessel Water Level support actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

Low Reactor Vessel Water Level signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Low Reactor Vessel Water Level Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation and initiation function.

Amendment No. 236 76p

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Low Reactor Vessel Water Level Trip Setting was chosen to be the same as the Reactor Protection System (RPS) Low Reactor Vessel Water Level Trip Setting (Specification 3.1.A), since this could indicate that the capability to cool the fuel is being threatened. The Trip Setting is referenced from the top of enriched fuel.

The Low Reactor Vessel Water Level Trip Function is required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature > 212°F) where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a possibility of pipe breaks resulting in significant releases of radioactive steam and gas. In COLD SHUTDOWN and Refuel (with reactor coolant temperature < 212°F), the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these Modes; thus, this Trip Function is not required. In addition, the Trip Function is also required to be operable during OPDRVs to ensure that offsite dose limits are not exceeded if core damage occurs.

2. High Drywell Pressure High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite release. The isolation and initiation of systems on High Drywell Pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of High Drywell Pressure Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude performance of the isolation and initiation function.

The Trip Setting was chosen to be the same as the RPS High Drywell Pressure Trip Setting (Specification 3.1.A) since this is indicative of a loss of coolant accident (LOCA).

The High Drywell Pressure Trip Function is required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature

> 212°F) where considerable energy exists in the RCS; thus, there is a possibility of pipe breaks resulting in significant releases of radioactive steam and gas. This Trip Function is not required in COLD SHUTDOWN and Refuel (with reactor coolant temperature < 212°F) because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these Modes.

3, 4. High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation High reactor building ventilation radiation or refuel floor zone radiation is an indication of possible gross failure of the fuel cladding. The release may Amendment No. 236 76q

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) have originated from the primary containment due to a break in the RCPB or the refueling floor due to a fuel handling accident. When High Reactor Building Ventilation Radiation or High Refueling Floor Zone Radiation is detected, secondary containment isolation and actuation of the SGT System are initiated to support actions to limit the release of fission products as assumed in the UFSAR safety analyses (Ref. 4).

The High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation signals are initiated from radiation detectors that are located on the ventilation exhaust duct coming from the reactor building and the refueling floor zones, respectively. Two channels of High Reactor Building Ventilation Radiation Trip Function and two channels of High Refueling Floor Radiation Trip Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation and initiation function.

The Trip Settings are chosen to promptly detect gross failure of the fuel cladding.

The High Reactor Building Ventilation Radiation and High Refueling Floor Zone Radiation Trip Functions are required to be operable in RUN, STARTUP/HOT STANDBY, HOT SHUTDOWN, Refuel (with reactor coolant temperature > 212°F) where considerable energy exists in the RCS; thus, there is a possibility of pipe breaks resulting in significant releases of radioactive steam and gas. In COLD SHUTDOWN and Refuel (with reactor coolant temperature < 212°F), the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these Modes; thus, these Trip Functions are not required. In addition, the Trip Functions are also required to be operable during OPDRVs, during movement of irradiated fuel assemblies or fuel cask in the secondary containment, and during Alteration of the Reactor Core, because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded.

ACTIONS Table 3.2.3 ACTION Note 1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months depending on the Trip Function (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for those Trip Functions that have channel components common to RPS instrumentation, i.e.,

Trip Functions 1 and 2, and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for those Trip Functions that do not have channel components common to RPS instrumentation, i.e., all other Trip Functions), has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to operable status. This out of service time is only acceptable provided the associated Trip Function is still maintaining isolation capability (refer to next paragraph). If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.3 Note 1.a.1) or 1.a.2), as applicable. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, Amendment No. 236 76r

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION ACTIONS (continued) if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation or initiation), the Reactor Building Ventilation System must be isolated and the SGT System must be placed in operation within the next one hour. Isolating the Reactor Building Ventilation System and placing the SGT System in operation performs the intended function of the instrumentation and allows operation to continue.

Table 3.2.3 Note 1.b is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in a complete loss of isolation capability for the associated penetration flow path(s) or a complete loss of initiation capability for the SGT System. A Trip Function is considered to be maintaining isolation and initiation capability when sufficient channels are operable or in trip in both trip systems, such that a trip signal will be generated from the given Trip Function on a valid signal. This ensures that isolation of the two RBAVSIVs in the associated penetration flow path and the operation of the SGT System can be initiated on an isolation and initiation signal from the given Trip Function.

For the Trip Functions 1 and 2, this would require each trip system to have one channel operable or in trip. For Trip Functions 3 and 4, this would require one channel to be operable or in trip. The one hour Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

If any applicable Action and associated Completion Time of Table 3.2.3 ACTION Note 1.a or 1.b are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment isolation and SGT System initiation function. Isolating the associated penetration flow path(s) and starting the associated SGT System within the next one hour performs the intended function of the instrumentation and allows operation to continue. One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without unnecessarily challenging plant systems.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.C.1 As indicated in Surveillance Requirement 4.2.C.1, reactor building ventilation isolation and Standby Gas Treatment System initiation instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.3. Table 4.2.3 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.C.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains isolation and Amendment No. 236 76s

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION SURVEILLANCE REQUIREMENTS (continued) initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RBAVSIVs will isolate the penetration flow path(s) and that the SGT System will initiate when necessary.

Surveillance Requirement 4.2.C.2 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel. The testing required by the SGT System and RBAVSIVs Technical Specifications overlaps this Surveillance to provide testing of the assumed safety function.

The Frequency of once every Operating Cycle is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.3, Check Performance of an Instrument Check once per day, for Trip Function 3, and once per day during Refueling, for Trip Function 4, ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.3, Functional Test For Trip Functions 1, 2, 3, and 4, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current Amendment No. 236 76t

VYNPS BASES: 3.2.C/4.2.C REACTOR BUILDING VENTILATION ISOLATION AND STANDBY GAS TREATMENT SYSTEM INITIATION SURVEILLANCE REQUIREMENTS (continued) plant specific setpoint methodology. The Frequency of Every 3 Months is based on the reliability analysis of References 5 and 6.

Table 4.2.3, Calibration For Trip Functions 1, 2, 3, and 4, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For Trip Functions 1 and 2, a calibration of the trip units is required (Footnote (a)) once every 3 months. Calibration of the trip units provides a check of the actual setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures. The Frequency of every 3 months is based on the reliability analysis of Reference 6 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. UFSAR, Section 5.3.

2. UFSAR, Section 7.17.2.

3. UFSAR, Section 14.6.3.6.

4. UFSAR, Section 14.6.4.4.

5. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

6. NEDC-30851P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation,"

March 1989.

Amendment No. 236 76u

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION BACKGROUND Control rods provide the primary means for control of reactivity changes.

Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to backup administrative controls on control rod movement. During shutdown conditions, control rod blocks from the Reactor Mode Switch Shutdown Position Function ensure that all control rods remain inserted to prevent inadvertent criticalities.

The purpose of the RBM (Ref.1) is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during control rod manipulations. The RBM supplies a trip signal to the Reactor Manual Control System (RMCS) to appropriately inhibit control rod withdrawal during power operation above the 30% RATED THERMAL POWER setpoint when a non-peripheral control rod (except control rod 34-35) is selected. The RBM has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint. One RBM channel inputs into one RMCS rod block circuit and the other RBM channel inputs into the second RMCS rod block circuit. A rod block in either RMCS circuit will provide a control rod block to all control rods. The RBM channel signal is generated by averaging a set of local power range monitor (LPRM) signals. One RBM channel averages the signals from LPRM detectors at the A and C positions in the assigned LPRM assemblies, while the other RBM channel averages the signals from LPRM detectors at the B and D positions. Assignment of LPRMs to be used in RBM averaging is controlled by the selection of control rods. The RBM is automatically bypassed and the output set to zero if a peripheral rod (or control rod 34-35) is selected or the APRM used to normalize the RBM reading is at < 30% RATED THERMAL POWER. If any LPRM detector assigned to an RBM is bypassed, the computed average signal is automatically adjusted to compensate for the number of LPRM input signals. The minimum number of LPRM inputs required for each RBM channel to prevent an instrument inoperative trip is four when using four LPRM strings, three when using three LPRM strings, and two when using two LPRM strings. Each RBM also receives a recirculation loop flow signal from the associated flow converter.

When a control rod is selected, the gain of each RBM channel output is normalized to a reference APRM. The gain setting is held constant during the movement of that particular control rod to provide an indication of the change in the relative local power level. If the indicated power increases above the preset limit, a rod block will occur. In addition, to preclude rod movement with an inoperable RBM, a downscale trip and an inoperable trip are provided.

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained (Ref. 2). This Trip Function prevents inadvertent criticality as the result of a control rod withdrawal during COLD SHUTDOWN and HOT SHUTDOWN or during a Refueling Outage when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, each inputting into a separate RMCS rod block circuit. A rod block in either RMCS circuit will provide a control rod block to all control rods.

Amendment No. 236 77

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY 1.a, 1.b, 1.c Rod Block Monitor The RBM is not specifically credited in any accident or transient analysis, but it is retained for overall redundancy and diversity as required by the NRC approved licensing basis. The Trip Settings are based on providing operational flexibility in the MELLLA region.

Two channels of each of the RBM Trip Functions are required to be operable, with their trip setpoints within the calculational as-found tolerances specified in plant procedures, as applicable, to ensure that no single instrument failure can preclude a rod block from these Trip Functions. In addition, to provide adequate coverage of the entire core in the axial direction, LPRM inputs for each RBM channel are required from greater than or equal to half the total number of inputs from any LPRM level for every non-peripheral control rod selected for movement. The upper limit of the RBM Upscale (Flow Bias) Trip Function is clamped to provide protection at greater than 100% rated core flow. Trip Settings are specified for RBM Upscale (Flow Bias) and RBM Downscale Trip Functions. The terms for the Trip Setting of the RBM Upscale (Flow Bias) Trip Function are defined as follows: W is percent of rated two loop drive flow where 100% rated drive flow is that flow equivalent to 48 X 106 lbs/hr core flow; and W is the difference between two loop and single loop drive flow at the same core flow (this difference must be accounted for during single loop operation). W = 0 for two loop operation and W = 8% for single loop operation.

Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.5. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Amendment No. 236 77a

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

2. Reactor Mode Switch Shutdown Position During HOT SHUTDOWN and COLD SHUTDOWN, and during Refueling Outages when the reactor mode switch is in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed.

The Reactor Mode Switch Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch Shutdown Position Trip Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Two channels are required to be operable to ensure that no single channel failure will preclude a rod block when required. There is no Trip Setting for this Trip Function since the channels are mechanically actuated based solely on reactor mode switch position. During shutdown conditions (HOT SHUTDOWN and COLD SHUTDOWN, and Refueling Outages when the reactor mode switch is in the shutdown position), no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be operable. With the reactor mode switch in the refueling position, the refuel position one-rod-out interlock provides the required control rod withdrawal blocks.

ACTIONS Table 3.2.5 ACTION Note 1 With one RBM Trip Function 1.a, 1.b, or 1.c channel inoperable, the remaining operable channel is adequate to perform the control rod block function; however, overall reliability is reduced because a single failure in the remaining operable RBM channel can result in no control rod block capability for the RBM. For this reason, Table 3.2.5 ACTION Note 1.a requires restoration of the inoperable channel to operable status. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the low probability of an event occurring coincident with a failure in the remaining operable channel.

If the Table 3.2.5 ACTION Note 1.a required action is not met and the associated Completion Time has expired, the inoperable channel must be placed in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . If both RBM Trip Function 1.a, 1.b, or 1.c channels are inoperable, the RBM is not capable of performing its intended function; thus, one channel must also be placed in trip. This initiates a control rod withdrawal block, thereby ensuring that the RBM function is met. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities and is acceptable because it minimizes risk while allowing time for restoration or tripping of inoperable channels.

Table 3.2.5 ACTION Note 2 With one Reactor Mode Switch Shutdown Position control rod withdrawal block channel inoperable, the remaining operable channel is adequate to perform the Amendment No.236 77b

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION ACTIONS (continued) control rod withdrawal block function. However, since the required actions of Table 3.2.5 ACTION Note 2 are consistent with the normal action of an operable Reactor Mode Switch Shutdown Position Trip Function (i.e.,

maintaining all control rods inserted), there is no distinction between having one or two channels inoperable.

In both cases (one or both channels inoperable), suspending all control rod withdrawal and initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical with adequate Shutdown Margin ensured by Specification 3.3.A.1. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.E.1 As indicated in Surveillance Requirement 4.2.E.1, control rod block instrumentation shall be functionally tested and calibrated as indicated in Table 4.2.5. Table 4.2.5 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.E.1 also indicates that when an RBM channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken.

This allowance is based on the reliability analysis (Ref. 4) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that a control rod block will be initiated when necessary.

Table 4.2.5, Functional Test For Trip Functions 1.a, 1.b, and 1.c, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function. The Functional Test of the RBM channels includes the Reactor Manual Control Select Relay Matrix System input. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of Every 3 Months is based on the reliability analysis of Reference 5.

For Trip Function 2, a Functional Test is performed to ensure that the entire channel will perform the intended function. The Functional Test for the Reactor Mode Switch Shutdown Position Trip Function is performed by attempting to withdraw any control rod with the reactor mode switch in the Amendment No. 236 77c

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION SURVEILLANCE REQUIREMENTS (continued) shutdown position and verifying a control rod block occurs. As noted in Table 4.2.5 Footnote (a), the Surveillance must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable links.

This allows entry into the HOT SHUTDOWN and COLD SHUTDOWN Modes if the Every Refueling Outage Frequency is not met. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the Surveillance Requirement. The Frequency of Every Refueling Outage is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.5, Calibration For Trip Functions 1.a and 1.b, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

The RBM is automatically bypassed when power is below a specified value or if a peripheral control rod is selected. The power level is determined from the APRM signals input to each RBM channel. The automatic bypass setpoint must be verified periodically to be < 30% RATED THERMAL POWER. As a result, the Instrument Calibration of Trip Function 1.a must also include calibration of the RBM Reference Downscale function (i.e., RBM Upscale (Flow Bias) Trip Function is not bypassed when > 30% RATED THERMAL POWER), as noted in Footnote (c). In addition, it must also be verified that the RBM is not bypassed when a control rod that is not a peripheral control rod is selected (only one non-peripheral control rod is required to be verified). If any bypass setpoint is nonconservative, then the affected RBM channel is considered inoperable. Alternatively, the APRM channel can be placed in the conservative condition to enable the RBM. If placed in this condition, the Surveillance Requirement is met and the RBM channel is not considered inoperable.

As noted in Footnote (b), neutron detectors are excluded from the Surveillance because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 7 day heat balance calibration and the 2000 MWD/T LPRM calibration against the Traversing Incore Probe System of the Reactor Protection System Technical Specification.

Amendment No. 236 77d

VYNPS BASES: 3.2.E/4.2.E CONTROL ROD BLOCK ACTUATION REFERENCES

1. UFSAR, Section 7.5.8.

2. UFSAR, Section 7.7.4.3.2.

3. UFSAR, Section 14.5.3.1.

4. GENE-770-06-1-A, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," December 1992.

5. NEDC-30851-P-A, Supplement 1, "Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation," October 1988.

Amendment No. 236 77e

VYNPS BASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION BACKGROUND The mechanical vacuum pump isolation instrumentation initiates an isolation of the mechanical vacuum pump following events in which main steam radiation monitors exceed a predetermined value. Tripping and isolating the mechanical vacuum pumps limits control room and offsite doses in the event of a control rod drop accident (CRDA).

The mechanical vacuum pump isolation instrumentation includes sensors, relays and switches that are necessary to cause initiation of mechanical vacuum pump isolation. The channels include electronic equipment that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an isolation signal to the mechanical vacuum pump isolation logic.

The isolation logic consists of two independent trip systems, with two channels of the High Main Steam Line Radiation Trip Function in each trip system. Each trip system is a one-out-of-two logic for this Trip Function.

Thus, either channel of the High Main Steam Line Radiation Trip Function in a trip system is needed to trip the trip system. The outputs of the channels in a trip system are arranged in a logic so that both trip systems must trip to result in an isolation signal.

The mechanical vacuum pump isolation valve is also associated with this Trip Function.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The mechanical vacuum pump isolation is assumed in the safety analysis for the CRDA. The mechanical vacuum pump isolation instrumentation initiates an isolation of the mechanical vacuum pump to limit control room and offsite doses resulting from fuel cladding failure in a CRDA.

The mechanical vacuum pump isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The operability of the mechanical vacuum pump isolation instrumentation is dependent on the operability of the four High Main Steam Line Radiation Trip Function instrumentation channels with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Surveillance Requirement 4.2.F.1.c as required by the CRDA analysis. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions. The High Main Steam Line Radiation Trip Setting was chosen to be as low enough to ensure that control room and offsite dose limits are not exceeded in the event of a CRDA, but high enough to avoid spurious isolation due to nitrogen-16 spikes, instrument instabilities, and other operational occurrences. Channel operability also includes the mechanical vacuum pump isolation valve.

Amendment No. 236 78

VYNPS BASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The mechanical vacuum pump isolation is required to be operable in RUN and STARTUP/HOT STANDBY when the mechanical vacuum pump is in service to mitigate the consequences of a postulated CRDA. In this condition, fission products released during a CRDA could be discharged directly to the environment.

Therefore, the mechanical vacuum pump isolation is necessary to assure conformance with the radiological evaluation of the CRDA. In other Modes or conditions, the consequences of a control rod drop are insignificant, and are not expected to result in any fuel damage or fission product releases. When the mechanical vacuum pump is not in operation in RUN and STARTUP/HOT STANDBY, fission product releases via this pathway would not occur.

ACTIONS Specification 3.2.F.2.a With one or more High Main Steam Line Radiation Trip Function channels inoperable, but with mechanical vacuum pump isolation capability maintained (refer to Specification 3.2.F.2.b Bases), the mechanical vacuum pump isolation instrumentation is capable of performing the intended function.

However, the reliability and redundancy of the mechanical vacuum pump isolation instrumentation is reduced, such that a single failure in one of the remaining channels could result in the inability of the mechanical vacuum pump isolation instrumentation to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to operable status. Because of the low probability of an extensive number of inoperabilities affecting multiple channels, and the low probability of an event requiring the initiation of mechanical vacuum pump isolation, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to operable status. Alternately, the inoperable channel or associated trip system may be placed in trip, since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable mechanical vacuum pump isolation valve, since this may not adequately compensate for the inoperable mechanical vacuum pump isolation valve (e.g., the isolation valve may be inoperable such that it will not close). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel would result in loss of condenser vacuum), or if the inoperable channel is the result of an inoperable mechanical vacuum pump isolation valve, Specification 3.2.F.2.b must be entered and its required actions taken.

Specification 3.2.F.2.b With any required Action and associated completion time of Specification 3.2.F.2.a not met, the plant must be brought to a Mode or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Alternately, the mechanical vacuum pump may be isolated since this performs the intended function of the instrumentation. An additional option is provided to isolate Amendment No. 236 78a

VYNPS BASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION ACTIONS (continued) the main steam lines, which may allow operation to continue. Isolating the main steam lines effectively provides an equivalent level of protection by precluding fission product transport to the condenser. This isolation is accomplished by isolation of all main steam lines and main steam line drains which bypass the main steam isolation valves.

Specification 3.2.F.2.b is also intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels result in the High Main Steam Line Radiation Trip Function not maintaining mechanical vacuum pump isolation capability. The High Main Steam Line Radiation Trip Function is considered to be maintaining mechanical vacuum pump isolation capability when sufficient channels are operable or in trip such that the mechanical vacuum pump isolation instruments will generate a trip signal from a valid High Main Steam Line Radiation signal, and the mechanical vacuum pump will be isolated.

This requires one channel of the High Main Steam Line Radiation Trip Function in each trip system to be operable or in trip, and the mechanical vacuum pump isolation valve to be operable.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.F.1 As indicated in Surveillance Requirement 4.2.F.1, the High Main Steam Line Radiation Trip Function for mechanical vacuum pump isolation shall be checked, functionally tested and calibrated as indicated Surveillance Requirements 4.2.F.1.a, b, c, d, and e.

Surveillance Requirement 4.2.F.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains mechanical vacuum pump isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that a mechanical vacuum pump will isolate when necessary.

Surveillance Requirement 4.2.F.1.a, Instrument Check Performance of an Instrument Check once each day ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based Amendment No. 236 78b

VYNPS BASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION SURVEILLANCE REQUIREMENTS (continued) on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Surveillance Requirement 4.2.F.1.b, Instrument Functional Test An Instrument Functional Test is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Frequency of once every 3 months is based on the reliability analysis of Reference 1.

Surveillance Requirements 4.2.F.1.c and 4.2.F.1.d, Instrument Calibrations An Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. Surveillance Requirement 4.2.F.1.c requires a calibration to be performed once every 3 months using a current source. This current source is provided downstream of the radiation detectors. As such, the radiation detectors are excluded from the 3 month calibration. Surveillance Requirement 4.2.F.1.d requires a calibration to be performed once each Refueling Outage using a radiation source. The radiation detectors are included in the once each Refueling Outage calibration. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

Surveillance Requirement 4.2.F.1.e, Logic System Functional Test The Logic System Functional Test demonstrates the operability of the required trip logic for a specific channel. Actuation of the mechanical vacuum pump isolation valve is included as part of this Surveillance to provide complete testing of the assumed safety function. Therefore, if the isolation valve is incapable of actuating, the instrument channel would be inoperable. The Frequency of once every Operating Cycle is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Amendment No. 236 78c

VYNPS BASES: 3.2.F/4.2.F MECHANICAL VACUUM PUMP ISOLATION REFERENCES

1. NEDC-30851P-A, Supplement 2, Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation, March 1989.

Amendment No. 236 78d

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION BACKGROUND The primary purpose of the post-accident monitoring (PAM) instrumentation is to display, in the control room, plant variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events. The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I, in accordance with Regulatory Guide 1.97 (Ref. 1).

The operability of the post-accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1.

APPLICABLE SAFETY ANALYSES The PAM instrumentation Specification ensures the operability of Regulatory Guide 1.97, Type A variables so that the control room operating staff can:

Perform the diagnosis specified in the Emergency Operating Procedures (EOPs). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs), (e.g., loss of coolant accident (LOCA)), and

Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.

The PAM instrumentation Specification also ensures operability of most Category I, non-Type A, variables so that the control room operating staff can:

Determine whether systems important to safety are performing their intended functions;

Determine the potential for causing a gross breach of the barriers to radioactivity release;

Determine whether a gross breach of a barrier has occurred; and

Initiate action necessary to protect the public and for an estimate of the magnitude of any impending threat.

The plant specific Regulatory Guide 1.97 analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables.

Post-accident monitoring instrumentation that satisfies the definition of Type A in Regulatory Guide 1.97 meets Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Category I, non-Type A, instrumentation is retained in Technical Specifications (TS) because they are intended to assist operators in Amendment No. 236 79

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION APPLICABLE SAFETY ANALYSES (continued) minimizing the consequences of accidents. Therefore, these Category I variables are important for reducing public risk.

LCO Specification 3.2.G and Table 3.2.6 require two operable channels for each Function to ensure that no single failure prevents the operators from being presented with the information necessary to determine the status of the plant and to bring the plant to, and maintain it in, a safe condition following an accident. Furthermore, providing two channels allows an Instrument Check during the post accident phase to confirm the validity of displayed information.

The following list is a discussion of the specified instrument Functions listed in Table 3.2.6.

1. Drywell Atmospheric Temperature Drywell atmospheric temperature is a Type A and Category I variable provided to detect a reactor coolant pressure boundary (RCPB) breach and to verify the effectiveness of Emergency Core Cooling System (ECCS) functions that operate to maintain containment integrity. Two redundant temperature signals are transmitted from separate temperature elements for each channel. The output of one of these channels is recorded on a recorder in a control room. The output of the other channel is displayed on an indicator in the control room.

The drywell atmospheric temperature channels measure from 0°F to 350°F.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

2. Drywell Pressure Drywell pressure is a Type A and Category I variable provided to detect breach of the RCPB and to verify ECCS functions that operate to maintain Reactor Coolant System (RCS) integrity. Two drywell pressure signals are transmitted from separate pressure transmitters for each channel. The output of these channels is displayed on two independent indicators in the control room. The pressure channels measure from -15 psig to 260 psig. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

3. Torus Pressure Torus pressure is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach. Two torus pressure signals are transmitted from separate pressure transmitters and displayed on two independent indicators in the control room. The range of Amendment No. 236 79a

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION LCO (continued) indication is - 15 psig to 85 psig. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

4. Torus Water Level Torus water level is a Type A and Category I variable provided to detect a breach in the RCPB. This variable is also used to verify and provide long term surveillance of ECCS function. The Torus Water Level Function provides the operator with sufficient information to assess the status of both the RCPB and the water supply to the ECCS. The Torus Water Level Function channels monitor the torus water level from 0-25 feet referenced to the bottom of the torus. Two torus water level signals are transmitted from separate level transmitters to two independent control room indicators in the control room. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

5. Torus Water Temperature Torus water temperature is a Type A and Category I variable provided to detect a condition that could potentially lead to containment breach and to verify the effectiveness of ECCS actions taken to prevent containment breach.

Two redundant temperature signals are transmitted from separate temperature elements for each channel. The temperature channels output to two independent control room indicators. The range of the torus water temperature channels is 0°F to 250°F. Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

6. Reactor Pressure Reactor pressure is a Type A and Category I variable provided to support monitoring of RCS integrity and to verify operation of the ECCS. Two independent pressure transmitters, with a range of 0 psig to 1500 psig, monitor pressure and provide pressure indication to the control room. The output from these channels is provided to two independent indicators in the control room. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

7. Reactor Vessel Water Level Reactor vessel water level is a Type A and Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS.

Water level is measured by independent differential pressure transmitters for each channel. Each channel measures from -200 inches to + 200 inches, referenced to the top of enriched fuel. The output from these channels is provided to two independent indicators in the control room. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

Amendment No. 236 79b

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION LCO (continued)

8. Torus Air Temperature Torus air temperature is a Type A and Category I variable provided to detect a RCPB breach and to verify the effectiveness of ECCS functions that operate to maintain containment integrity. Two redundant temperature signals are transmitted from separate temperature elements for each channel. The output of one of these channels is recorded on a recorder in a control room with a range of 50°F to 300°F. The output of the other channel is displayed on an indicator in the control room with a range of 0°F to 350°F. Therefore, the PAM Specification deals specifically with this portion of the instrument channels.

9. Containment High Range Radiation Monitor Containment high range radiation is a Category 1 variable provided to monitor the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Two redundant radiation detectors are mounted in the drywell. Each radiation detector provides a signal to an independent monitor in the control room, which has a range from 100 R/hr to 107 R/hr. The outputs of these radiation monitors are displayed on two independent indicators located in the control room. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

APPLICABILITY The PAM instrumentation Specification is applicable in the RUN and STARTUP/HOT STANDBY Modes. These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in the RUN and STARTUP/HOT STANDBY Modes. In other Modes and conditions, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be operable in these other Modes or conditions.

Amendment No. 236 79c

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION ACTIONS Table 3.2.6 ACTION Note 1 Table 3.2.6 ACTION Note 1.a.1) requires that, when one or more Functions (except Function 9) have one required channel that is inoperable, the required inoperable channel must be restored to operable status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining operable channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval. If the inoperable channel of each affected Function has not been restored to operable status in 30 days, Table 3.2.6 ACTION Note 1.a.2) requires a special written report be submitted to the NRC within the next 14 days. The report will outline the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation to operable status. This action is appropriate in lieu of a shutdown requirement, since another operable channel is monitoring the Function, an alternate method of monitoring is available, and given the likelihood of plant conditions that would require information provided by this instrumentation.

Table 3.2.6 ACTION Note 1.b.1) requires that, when one or more Functions, except Function 9, have two required channels that are inoperable (i.e., two channels inoperable in the same Function), one channel in the Function should be restored to operable status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur. If at least one channel of each affected Function has not been restored to operable status in 7 days, Table 3.2.6 ACTION Note 1.b.2) requires the plant to be brought to a Mode in which the LCO does not apply. To achieve this status, the plant must be brought to at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Table 3.2.6 ACTION Note 2 Table 3.2.6 ACTION Note 2.a.1) requires that, when Function 9 has one required channel that is inoperable, the required inoperable channel must be restored to operable status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining operable channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval. If the inoperable channel has not been restored to operable status in 30 days, Table 3.2.6 ACTION Note 2.a.2) requires a special written report be submitted to the NRC within the next 14 days. The report will outline the preplanned alternate Amendment No. 236 79d

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION ACTIONS (continued) method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation to operable status. This action is appropriate in lieu of a shutdown requirement, since another operable channel is monitoring the Function, an alternate method of monitoring is available, and given the likelihood of plant conditions that would require information provided by this instrumentation.

Table 3.2.6 ACTION Note 2.b.1) requires that, when Function 9 has two required channels that are inoperable, one channel should be restored to operable status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.

Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.

Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

Since alternate means of monitoring drywell radiation have been developed and tested, the action required by Table 3.2.6 ACTION 2.b.2), if at least one channel has not been restored to operable status within 7 days, is not to shut down the plant, but rather to submit a special written report to the NRC within the next 14 days. The report will outline the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the normal PAM instrumentation to operable status.

The alternate means of monitoring may be temporarily installed if the normal PAM channel cannot be restored to operable status within the allotted time.

The report provided to the NRC should also describe the degree to which the alternate means are equivalent to the installed PAM channels and justify the areas in which they are not equivalent.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.G.1 As indicated in Surveillance Requirement 4.2.G.1, post-accident monitoring instrumentation shall be checked and calibrated as indicated in Table 4.2.6.

Table 4.2.6 identifies, for each Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.G.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance is acceptable since it does not significantly reduce the probability of properly monitoring post-accident parameters, when necessary.

Amendment No. 236 79e

VYNPS BASES: 3.2.G/4.2.G POST-ACCIDENT MONITORING INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.6, Check Performance of an Instrument Check once each day ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.6, Calibration An Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. The specified Instrument Calibration Frequencies are based on operating experience.

REFERENCES

1. Regulatory Guide 1.97, "Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," Revision 3, May 1983.

2. NRC letter, M.B. Fairtile (NRC) to L.A. Tremblay (VYNPC), "Conformance to Regulatory Guide 1.97 for Vermont Yankee Nuclear Power Station," December 4, 1990.

Amendment No. 236 79f

VYNPS BASES: 3.2.I/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION BACKGROUND The Anticipated Transient Without Scram (ATWS) Prevention/Mitigation System initiates a Recirculation Pump Trip (RPT), adding negative reactivity, following events in which a scram does not but should occur, to lessen the effects of an ATWS event. Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases. When Low - Low Reactor Vessel Water Level or High Reactor Pressure setpoint is reached, the reactor recirculation motor generator (RRMG) field breakers trip.

The RPT Instrumentation (Ref. 1) of the ATWS Prevention/Mitigation System includes sensors, relays, and switches that are necessary to cause initiation of an RPT. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPT signal to the trip logic.

The RPT Instrumentation consists of two independent and identical trip systems (A and B), with two channels of High Reactor Pressure and two channels of Low - Low Reactor Vessel Water Level in each trip system. Each RPT Instrumentation trip system is a two-out-of-two logic for each Trip Function. Thus, either two Low - Low Reactor Water Level or two High Reactor Pressure signals will trip a trip system. In addition, a combination of one Low - Low Reactor Vessel Water Level signal and one High Reactor Pressure signal (in the same trip system) will trip the trip system. The outputs of the channels in a trip system are combined in a logic so that either trip system will trip both recirculation pumps (by tripping the respective RRMG field breakers). Each Low - Low Reactor Vessel Water Level channel output must remain below the setpoint for approximately 10 seconds for the channel output to provide an actuation signal to the associated trip system.

There is one RRMG field breaker provided for each of the two recirculation pumps for a total of two breakers. The output of each trip system is provided to both RRMG field breakers.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The RPT Instrumentation is not assumed to mitigate any accident or transient in the safety analysis. The RPT Instrumentation initiates an RPT to aid in preserving the integrity of the fuel cladding following events in which a scram does not, but should, occur. Based on its contribution to the reduction of overall plant risk, however, the instrumentation meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).

The operability of the RPT Instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions. Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Amendment No. 236 80

VYNPS BASES: 3.2.I/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Trip Settings specified in Table 3.2.7. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Channel operability also includes the associated recirculation pump trip breakers (i.e., RRMG field breakers).

The individual Trip Functions are required to be operable in the RUN Mode to protect against common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated ATWS event. The High Reactor Pressure and Low - Low Reactor Vessel Water Level Trip Functions are required to be operable in the RUN Mode, since the reactor is producing significant power and the recirculation system could be at high flow. During this Mode, the potential exists for pressure increases or low water level, assuming an ATWS event. In the STARTUP/HOT STANDBY Mode, the reactor is at low power and the recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an ATWS event. Therefore, the RPT Instrumentation is not necessary. In HOT SHUTDOWN and COLD SHUTDOWN, the reactor is shut down with all control rods inserted; thus, an ATWS event is not significant and the possibility of a significant pressure increase or low water level is negligible. In Refuel, the one rod out interlock ensures that the reactor remains subcritical; thus, an ATWS event is not significant.

The specific Applicable Safety Analyses and LCO discussions are listed below on a Trip Function by Trip Function basis.

1, 2. Low - Low Reactor Vessel Water Level and Time Delay Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, RPT is initiated at low-low RPV water level to aid in maintaining level above the top of the active fuel. The reduction of core flow reduces the neutron flux and thermal power and, therefore, the rate of coolant boiloff.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

Four channels of Low - Low Reactor Vessel Water Level, with two channels in each trip system, are available and required to be operable to ensure that no single instrument failure can preclude an RPT from this Trip Function on a valid signal. In addition, a time delay is associated with each Low - Low Reactor Vessel Water Level channel which delays the Low - Low Reactor Vessel Water Level Trip Function channel output signal from providing input to the associated trip system. Four channels of Time Delay, with two channels in each trip system, are available and required to be operable to ensure that no single instrument failure can preclude an RPT from the Low - Low Reactor Vessel Water Level Trip Function on a valid signal.

Amendment No. 236 80a

VYNPS BASES: 3.2.I/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Low - Low Reactor Vessel Water Level Trip Setting is chosen so that RPT will not interfere with the Reactor Protection System. The Trip Setting is referenced from the top of enriched fuel. The Trip Setting of the Time Delay associated with the Low - Low Reactor Vessel Water Level Trip Function is chosen to avoid making the consequences of a loss of coolant accident more severe while ensuring the delay has an insignificant affect on the ATWS consequences.

3. High Reactor Pressure Excessively high RPV pressure may rupture the RCPB. An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and thermal power, which could potentially result in fuel failure and overpressurization. The High Reactor Pressure Trip Function initiates an RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation. For the overpressurization event, the RPT aids in the termination of the ATWS event and, along with the safety valves, limits the peak RPV pressure to within the required limit.

The High Reactor Pressure signals are initiated from four pressure transmitters that monitor reactor pressure. Four channels of High Reactor Vessel Pressure, with two channels in each trip system, are available and are required to be operable to ensure that no single instrument failure can preclude an RPT from this Trip Function on a valid signal. The High Reactor Vessel Pressure Trip Setting is chosen to provide an adequate margin to the maximum allowable Reactor Coolant System pressure.

ACTIONS Table 3.2.7 ACTION Note 1 For Trip Functions 1, 2, and 3, with one or more Trip Function channels inoperable, but with RPT trip capability for each Trip Function maintained (refer to next paragraph), the RPT instrumentation is capable of performing the intended function. However, the reliability and redundancy of the RPT Instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the RPT Instrumentation to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to operable status. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Trip Functions, and the low probability of an event requiring the initiation of RPT, 14 days is provided to restore the inoperable channel (Table 3.2.7 ACTION Note 1.a.1)).

Alternately, for Trip Functions 1 and 3, the inoperable channel may be placed in trip (Table 3.2.7 ACTION Note 1.a.2)), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Inoperable channels may be placed in trip using test jacks or other permanently installed circuits. As noted in Table 3.2.7 ACTION Note 1.a.2), placing the channel in trip with no Amendment No. 236 80b

VYNPS BASES: 3.2.I/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION ACTIONS (continued) further restrictions is not allowed if the inoperable channel is a Trip Function 2 channel (i.e., Time Delay Trip Function) or is the result of an inoperable breaker, since this may not adequately compensate for the inoperable Trip Function 2 channel or inoperable breaker (e.g., the breaker may be inoperable such that it will not open), as applicable. If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Table 3.2.7 ACTION Note 2 must be entered and its required Actions taken.

Table 3.2.7 ACTION Note 1.b is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Trip Function result in the Trip Function 1 and 2 not maintaining RPT trip capability or Trip Function 3 not maintaining RPT trip capability. A Trip Function is considered to be maintaining RPT trip capability when sufficient channels are operable or in trip such that the RPT Instrumentation will generate a trip signal from the given Trip Function in either of the two trip systems on a valid signal, and both recirculation pumps can be tripped. For Trip Functions 1 and 2, this requires two channels of each Trip Function in the same trip system to be operable or in trip and the RRMG field breakers to be operable or in trip. For Trip Function 3, this requires two channels in the same trip system to be operable or in trip and the RRMG field breakers to be operable or in trip. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the RPT instrumentation during this period and that Trip Functions 1 and 2 or Trip Function 3 still maintain RPT trip capability.

Table 3.2.7 ACTION Note 1.c is intended to ensure that appropriate Actions are taken if multiple, inoperable, untripped channels within Trip Functions 1, 2, and 3 result in Trip Functions 1, 2, and 3 not maintaining RPT trip capability. The description of a Trip Function maintaining RPT trip capability is discussed in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time for restoring all but one of the Trip Functions is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the RPT Instrumentation during this period.

Table 3.2.7 ACTION Note 2 With any required Action and associated completion time not met, the plant must be brought to a Mode or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least STARTUP/HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Table 3.2.7 ACTION Note 2.b).

Alternately, the associated recirculation pump may be removed from service since this performs the intended function of the instrumentation (Table 3.2.7 ACTION Note 2.a). The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, both to reach STARTUP/HOT STANDBY from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.

Amendment No. 236 80c

VYNPS BASES: 3.2.I/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.I.1 As indicated in Surveillance Requirement 4.2.I.1, RPT Instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.7.

Table 4.2.7 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.I.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Trip Function maintains recirculation pump trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that recirculation pumps will trip when necessary.

Surveillance Requirement 4.2.I.2 The Logic System Functional Test demonstrates the operability of the required initiation logic and simulated automatic operation for a specific channel. A system functional test of the recirculation pump trip breakers (i.e., RRMG field breakers) is included in this Surveillance to provide complete testing of the assumed safety function. Therefore, if an RRMG field breaker is incapable of operating, the associated instrument channel(s) would be inoperable. The Frequency of Once every Operating Cycle is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.7, Check Performance of an Instrument Check once per day, for Trip Functions 1 and 3, ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel Amendment No. 236 80d

VYNPS BASES: 3.2.I/4.2.I RECIRCULATION PUMP TRIP INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued) is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Table 4.2.7, Functional Test For Trip Functions 1 and 3, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. For Trip Functions 1 and 3, the Frequency of Every 3 Months is based on the reliability analysis of Reference 2.

Table 4.2.7, Calibration For Trip Functions 1, 2, and 3, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For Trip Functions 1, 2, and 3, a calibration of the trip units is required (Footnote (a)) once every 3 months. Calibration of the trip units provides a check of the actual setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures. The Frequency of every 3 months is based on the reliability analysis of Reference 2 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. UFSAR, Section 7.18.

2. GENE-770-06-1-A, "Bases for Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications," December 1992.

Amendment No. 236 80e

VYNPS BASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The Degraded Grid Protective System instrumentation monitors the 4.16 kV emergency buses.

Offsite power is the preferred source of power for the 4.16 kV emergency buses. If the monitors determine that insufficient voltage is available and an ECCS initiation signal is present, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4.16 kV emergency bus has its own independent Degraded Grid Protective System instrumentation and associated trip logic. The voltage for each bus is monitored for degraded voltage.

The Degraded Bus Voltage - Voltage Trip Function is monitored by two undervoltage relays for each 4.16 kV emergency bus, whose outputs are arranged in a two-out-of-two logic configuration (Ref. 1). The Degraded Bus Voltage - Voltage Alarm Trip Function is monitored by the same undervoltage relays as the Voltage Trip Function, however the outputs are arranged in a one-out-of-two logic configuration. For the Degraded Bus Voltage - Time Delay Trip Function, one channel for each 4.16 kV emergency bus is provided and is dedicated to the DG start function. For the Degraded Bus Voltage -

Alarm Time Delay Trip Function, one channel for each 4.16 kV emergency bus is also provided and is dedicated to a control room annunciator function from which manual action is taken for degraded grid protection when an accident signal is not present. The Degraded Bus Voltage - Time Delay and Alarm Time Delay Trip Functions are nominally adjusted to 10 seconds since this would be indicative of a sustained degraded voltage condition. When a Degraded Bus Voltage - Voltage Alarm Trip Function setpoint has been exceeded and persists for nominally ten seconds, either one of the two Degraded Bus Voltage -

Voltage Alarm Trip Function channels on an associated 4.16 kV emergency bus will actuate a control room annunciator to alert the operator of the degraded voltage condition. If this sustained degraded voltage condition occurs coincident with a loss of coolant accident (LOCA), both of the Degraded Bus Voltage - Voltage Trip Function channels will actuate causing the associated 4.16 kV emergency bus to be disconnected from the offsite power source and connected to the DG power source. If the sustained degraded voltage condition does not exist at the time of a LOCA, the 4.16 kV emergency buses are not disconnected from the offsite power sources and the ECCS loads will start immediately from their normal supplies.

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The degraded grid protection assures the ECCS loads and other assumed systems powered from the DGs are powered from the offsite power system as long as offsite power system voltage is within an acceptable value and it assures that loads are powered from the DGs when bus voltage is insufficient for continuous operation of the connected loads. The Degraded Grid Protective System instrumentation is required for Engineered Safety Features to function in any accident with a degradation or loss of offsite power. The required Amendment No. 236 80f

VYNPS BASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) channels of Degraded Grid Protective System instrumentation ensure that the ECCS and other assumed systems powered from the DGs, provide plant protection in the event of any of the Reference 2 and 3 analyzed accidents in which a loss of offsite power is assumed. The initiation of the DGs on degradation or loss of offsite power, and subsequent initiation of the ECCS, ensures that the requirements of 10 CFR 50.46 are met.

Accident analyses credit the loading of the DGs based on the loss of offsite power coincident with a loss of coolant accident (LOCA). The diesel starting and loading times have been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.

The Degraded Grid Protective System instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The operability of the Degraded Grid Protective System instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions. Each Trip Function must have the required number of operable channels in each trip system, with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with actual trip setpoints within calculational as-found tolerances provides reasonable assurance that, under worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.8.

As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below for the Degraded Grid Protective System instrumentation Trip Functions.

1.a, 1.b, 1.c, 1.d. Degraded Bus Voltage - Voltage Trip, Degraded Bus Voltage - Time Delay Trip, Degraded Bus Voltage - Voltage Alarm and Degraded Bus Voltage - Alarm Time Delay A reduced voltage condition on a 4.16 kV emergency bus indicates that, while offsite power may not be completely lost to the respective emergency bus, available power may be insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function.

Therefore, power supply to the bus is automatically transferred from offsite power to onsite DG power when the voltage on the bus drops below the Degraded Bus Voltage - Voltage Trip Function trip setpoint, is sustained in a degraded condition for approximately 10 seconds and a LOCA condition exists (as indicated by ECCS Low - Low Reactor Vessel Water Level or High Drywell Pressure Trip Function signals). This ensures that adequate power will be available to the required equipment.

In addition, when the voltage on the bus drops below the Degraded Bus Voltage

- Voltage Alarm Trip Function trip setpoint, and is sustained in a degraded condition for approximately 10 seconds, a control room annunciator is actuated. This annunciator alerts the operator of the degraded voltage Amendment No. 236 80g

VYNPS BASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) condition so that manual action can be taken for degraded grid protection when an accident signal is not present.

The Degraded Bus Voltage and Voltage Alarm Trip Settings are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Trip Settings are long enough to provide time for voltage on the station emergency bus to recover from transients such as motor starts or fault clearing, but short enough to ensure that the operating equipment is not damaged by low voltage.

Two channels of Degraded Bus Voltage - Voltage Trip Function and one channel of Degraded Bus Voltage - Time Delay Trip Function per associated bus are required to be operable when the associated DG is required to be operable to ensure that no single instrument failure can preclude the DG function.

In addition, two channels of Degraded Bus Voltage - Voltage Alarm Trip Function and one channel of Degraded Bus Voltage - Alarm Time Delay Trip Function per asociated bus are required to be operable when the associated DG is required to be operable to ensure that no single instrument falure can preclude the alarm function.

ACTIONS Table 3.2.8 ACTION Note 1 With one or more required channels of the Degraded Bus Voltage - Voltage Trip Function inoperable, the Trip Function is not capable of performing the intended function. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to operable status. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.8 ACTION Note 1.a. The inoperable channel may be tripped using test jacks or other permanently installed circuits. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the Degraded Grid Protective System instrumentation), and allow operation to continue. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

If placing an inoperable channel in the tripped condition would result in an initiation, then Action Note 1.a cannot be met. If the Action and associated completion time of Table 3.2.8 ACTION Note 1.a are not met, the associated Trip Function is not capable of performing the intended function. Therefore, the associated DG(s) is declared inoperable immediately. This requires entry into the applicable LCO and required Actions of the DG Technical Specifications, which provide appropriate actions for the inoperable DG(s).

Amendment No. 236 80h

VYNPS BASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION ACTIONS (continued)

Table 3.2.8 ACTION Note 2 With one or more required channels of the Degraded Bus Voltage - Time Delay Trip Function inoperable, the Trip Function is not capable of performing the intended function. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to operable status (Table 3.2.8 ACTION Note 2.a). Table 3.2.8 ACTION Note 2.a. does not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time is acceptable because it minimizes risk while allowing time for restoration of channels.

If the Action and associated completion time of Table 3.2.8 ACTION Note 2.a are not met, the associated Trip Function is not capable of performing the intended function. Therefore, the associated DG(s) is declared inoperable immediately. This requires entry into applicable LCO and required Actions of the DG Technical Specifications, which provide appropriate actions for the inoperable DG(s).

Table 3.2.8 ACTION Note 3 With one of the required channels, for one or more buses, of the Degraded Bus Voltage - Voltage Alarm Trip Function inoperable, the Trip Function is not capable of performing the intended function assuming a single failure. Since this Trip Function is not common to RPS, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed to restore the inoperable channel to operable status (Table 3.2.8 ACTION Note 3.b). With both of the required channels, for one or more buses, of the Degraded Bus Voltage - Voltage Alarm Trip Function inoperable, or with the one required channel, for one or more buses, of the Degraded Bus Voltage - Alarm Time Delay Trip Function inoperable, the Trip Function is not capable of performing the intended function. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore at least one channel of the Degraded Bus Voltage - Voltage Alarm Trip Function and the one channel of the Degraded Bus Voltage - Alarm Time Delay Trip Function to operable status (Table 3.2.8 ACTION Note 3.a). Table 3.2.8 ACTION Notes 3.a and 3.b do not allow placing an inoperable channel in trip since this action would not necessarily result in a safe state for the channel in all events. The completion times are intended to allow the operator time to evaluate and repair any discovered inoperabilities. The completion times are acceptable because they minimize risk while allowing time for restoration of channels.

If the Action and associated completion times of Table 3.2.8 ACTION Notes 3.a or 3.b are not met, the associated Trip Function may not be capable of performing the intended function. Therefore increased voltage monitoring of the associated 4.16 kV emergency bus(es) is initiated. This action will compensate for the inoperable control room annunciator function to ensure manual action is taken for degraded grid protection when an accident signal is not present.

Amendment No. 236 80i

VYNPS BASES: 3.2.K/4.2.K DEGRADED GRID PROTECTIVE SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.K As indicated in Surveillance Requirement 4.2.K, Degraded Grid Protective System instrumentation shall be functionally tested and calibrated as indicated in Table 4.2.8. Table 4.2.8 identifies, for each Trip Function, the applicable Surveillance Requirements.

Table 4.2.8, Functional Test For Trip Functions 1.a and 1.b, as indicated in Table 4.2.8 Footnote (a),

separate Functional Tests are not required since Trip Function operability is demonstrated during the Trip Function Calibration and integrated ECCS test performed once per Operating Cycle. For the Trip Function Calibration, the once per Operating Cycle Frequency is based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses. For the integrated ECCS test, the once per Operating Cycle Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the integrated ECCS test when performed at the specified Frequency.

Table 4.2.8, Calibration For Trip Functions 1.a and 1.b, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

REFERENCES

1. UFSAR, Section 8.5.3.

2. UFSAR, Section 6.5.

3. UFSAR, Chapter 14.

Amendment No. 236 80j

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is insufficient or unavailable, such that RCIC System initiation occurs and maintains sufficient reactor water level such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of the RCIC System is provided in UFSAR, Section 4.7 (Ref. 1).

RCIC System automatic initiation occurs for conditions of Low - Low Reactor Vessel Water Level. The variable is monitored by four transmitters that are connected to four trip units. The Low - Low Reactor Vessel Water Level Trip Function is a single trip system with two trip system logics. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement.

The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow.

The RCIC System also monitors the water level in the condensate storage tank (CST) since this is the initial source of water for RCIC operation. Reactor grade water in the CST is the normal source. Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open.

If the water level in the CST falls below a preselected level, the RCIC suppression pool suction valves automatically open. When the suppression pool suction valves are both fully open, the RCIC CST suction valve automatically closes. Two level transmitters are used to detect low water level in the CST. Either transmitter can cause the suppression pool suction valves to open and the CST suction valve to close (one trip system arranged in a one-out-of-two logic).

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level trip (one trip system arranged in a two-out-of-two logic), at which time the RCIC steam admission valve closes.

The RCIC System automatically restarts if a Low - Low Reactor Vessel Water Level signal is subsequently received APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The function of the RCIC System to provide makeup coolant to the reactor is used to respond to transient events. The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the system, and therefore its instrumentation, meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).

The operability of the RCIC System Instrumentation is dependent on the operability of the individual instrumentation channel Trip Functions. Each Trip Function must have the required number of operable channels with their trip setpoints within the calculational as-found tolerances specified in plant procedures. Operation with the actual trip setpoints within the calculational as-found tolerances provides reasonable assurance that, under Amendment No. 236 80k

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) worst case design basis conditions, the associated trip will occur within the Trip Settings specified in Table 3.2.9. As a result, a channel is considered inoperable if its actual trip setpoint is not within the calculational as-found tolerances specified in plant procedures. The actual trip setpoint is calibrated consistent with applicable setpoint methodology assumptions.

The individual Trip Functions are required to be operable in the RUN Mode and in STARTUP/HOT STANDBY, HOT SHUTDOWN, and Refuel with reactor steam pressure

> 150 psig since this is when RCIC is required to be operable.

The specific Applicable Safety Analyses and LCO discussions are listed below on a Trip Function by Trip Function basis.

1. Low - Low Reactor Vessel Water Level Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated on a Low - Low Reactor Vessel Water Level signal to assist in maintaining water level above the top of the enriched fuel.

Low - Low Reactor Vessel Water Level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Low - Low Reactor Vessel Water Level Trip Setting is chosen to be the same as the ECCS Low - Low Reactor Vessel Water Level Trip Setting (Specification 3.2.A). The Trip Setting is referenced from the top of enriched fuel.

Four channels of Low - Low Reactor Vessel Water Level Trip Function are available and are required to be operable when RCIC is required to be operable to ensure that no single instrument failure can preclude RCIC initiation.

2. Low Condensate Storage Tank Water Level Low water level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally, the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, the RCIC suppression pool suction valves automatically open. When the suppression pool suction valves are both fully open, the RCIC CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump.

Amendment No. 236 80l

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Two level transmitters are used to detect low water level in the CST. The Low Condensate Storage Tank Water Level Trip Function Trip Setting is set high enough to ensure adequate pump suction head while water is being taken from the CST. The trip setting is presented in terms of percent instrument span.

Two channels of Low Condensate Storage Tank Water Level Trip Function are available and are required to be operable when RCIC is required to be operable to ensure that no single instrument failure can preclude RCIC swap to the suppression pool source.

3. High Reactor Vessel Water Level High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the high water level signal is used to close the RCIC steam admission valve to prevent overflow into the main steam lines (MSLs).

High Reactor Vessel Water Level signals for RCIC are initiated from two level transmitters, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The High Reactor Vessel Water Level Trip Setting is high enough to preclude closing the RCIC steam admission valve during normal operation, yet low enough to trip the RCIC System to prevent reactor vessel overfill. The Trip Setting is referenced from the top of enriched fuel.

Two channels of High Reactor Vessel Water Level Trip Function are available and are required to be operable when RCIC is required to be operable.

ACTIONS Table 3.2.9 ACTION Note 1 Table 3.2.9 ACTION Note 1.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels of Trip Function 1 result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Trip Function 1 channels in the same trip system logic are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.9 ACTION Note 1.b is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.9 ACTION Note 1.a, the completion time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Low -

Amendment No. 236 80m

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION ACTIONS (continued)

Low Reactor Vessel Water Level channels in the same trip system logic. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to operable status. If the inoperable channel cannot be restored to operable status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.9 ACTION Note 1.b. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

With any required Action and associated completion time of Table 3.2.9 ACTION Note 1.a or 1.b not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

Table 3.2.9 ACTION Note 2 Table 3.2.9 ACTION 2.a is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels of Trip Function 2 result in automatic RCIC initiation (i.e., suction swap) capability being lost. In this case, automatic RCIC suction swap capability is lost if two Trip Function 2 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Table 3.2.9 ACTION Note 2.b is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability when the RCIC System suction is aligned to the CST. Table 3.2.9 ACTION Note 2.a is only applicable if the RCIC System suction is not aligned to the suppression pool since, if aligned, the Trip Function is already performed. The completion time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. For Table 3.2.9 ACTION Note 2.a, the completion time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in Trip Function 2. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to operable Amendment No. 236 80n

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION ACTIONS (continued) status within the allowable out of service time, the channel must be placed in the tripped condition per Table 3.2.9 ACTION Note 2.b, which performs the intended function of the channel (shifting the suction source to the suppression pool). Alternatively, Table 3.2.9 ACTION Note 2.b allows the manual alignment of the RCIC System suction to the suppression pool, which also performs the intended function. If either action of Table 3.2.9 ACTION Note 2.b is performed, measures should be taken to ensure that the RCIC System piping remains filled with water.

With any required Action and associated completion time of Table 3.2.9 ACTION Note 2.a or 2.b not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

Table 3.2.9 ACTION Note 3 A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 2) is acceptable to permit restoration of any inoperable Trip Function 3 channel to operable status (Table 3.2.9 ACTION Note 3.a). A required Action (similar to Table 3.2.9 ACTION Note 1.a) limiting the allowable out of service time, if a loss of automatic RCIC initiation capability (i.e., loss of high water level trip capability) exists, is not required. Table 3.2.9 ACTION Note 3 applies to the High Reactor Vessel Water Level Trip Function whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability. As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable. One inoperable channel may result in a loss of high water level trip capability but will not prevent RCIC System automatic start capability. However, the Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events (a failure of the remaining channel could prevent a RCIC System start).

With any required Action and associated completion time of Table 3.2.9 ACTION Note 3.a not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE REQUIREMENTS Surveillance Requirement 4.2.L.1 As indicated in Surveillance Requirement 4.2.L.1, RCIC System instrumentation shall be checked, functionally tested and calibrated as indicated in Table 4.2.9. Table 4.2.9 identifies, for each Trip Function, the applicable Surveillance Requirements.

Surveillance Requirement 4.2.L.1 also indicates that when a channel is placed in an inoperable status solely for performance of required instrumentation Surveillances, entry into associated LCO and required Actions may be delayed Amendment No. 236 80o

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued) as follows: (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Function 3; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Trip Functions 1 and 2, provided the associated Trip Function maintains RCIC initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to operable status or the applicable LCO entered and required Actions taken. This allowance is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC System will initiate when necessary.

Surveillance Requirement 4.2.L.2 The Logic System Functional Test demonstrates the operability of the required initiation logic for a specific channel. The system functional testing performed in Surveillance Requirement 4.5.G.1 overlaps this Surveillance to provide complete testing of the safety function. The Frequency of once every Operating Cycle is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has demonstrated that these components will usually pass the Surveillance when performed at the specified Frequency.

Table 4.2.9, Check Performance of an Instrument Check once per day, for Trip Function 1, ensures that a gross failure of instrumentation has not occurred. An Instrument Check is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. An Instrument Check will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each Calibration. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit. The Frequency is based upon operating experience that demonstrates channel failure is rare. The Instrument Check supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

Amendment No. 236 80p

VYNPS BASES: 3.2.L/4.2.L REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS (continued)

Table 4.2.9, Functional Test For Trip Functions 1, 2 and 3, a Functional Test is performed on each required channel to ensure that the channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. For Trip Functions 1, 2 and 3, the Frequency of Every 3 Months is based on the reliability analysis of Reference 2.

Table 4.2.9, Calibration For Trip Functions 1, 2, and 3, an Instrument Calibration is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

An Instrument Calibration leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. The specified Instrument Calibration Frequencies are based upon the time interval assumptions for calibration used in the determination of the magnitude of equipment drift in the associated setpoint analyses.

For Trip Functions 1, 2, and 3, a calibration of the trip units is required (Footnote (a)) once every 3 months. Calibration of the trip units provides a check of the actual setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the calculational as-found tolerances specified in plant procedures. The Frequency of every 3 months is based on the reliability analysis of Reference 2 and the time interval assumption for trip unit calibration used in the associated setpoint calculation.

REFERENCES

1. UFSAR, Section 4.7.

2. GENE-770-06-2P-A, Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications, December 1992.

Amendment No. 236 80q

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION 3.3 CONTROL ROD SYSTEM 4.3 CONTROL ROD SYSTEM Applicability: Applicability:

Applies to the operational Applies to the surveillance status of the control rod requirements of the control rod system. system.

Objective: Objective:

To assure the ability of the To verify the ability of the control rod system to control control rod system to control reactivity. reactivity.

Specification: Specification:

A. Reactivity Limitations A. Reactivity Limitations

1. Reactivity Margin - Core 1. Reactivity Margin - Core Loading Loading The core loading shall Verify that the required be limited to that which SDM is met prior to'each can be made subcritical in-vessel fuel movement in the most reactive during the fuel loading condition during the sequence.

operation cycle with the highest worth, operable Within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after control rod in its fully criticality following withdrawn position and fuel movement within the all other operable rods reactor pressure vessel inserted. or control rod replacement, verify the To ensure this capabi- required shutdown margin lity, the shutdown will be met at any time margin shall be provided in the subsequent as follows any time operation cycle with the there is fuel in the highest worth operable core: control rod fully withdrawn and all other (a) >0.38% Ak/k with operable rods inserted the highest worth (except as provided in rod analytically Specifications 3.122.D determined; and 3.12.E).

or (b) >0.28% Ak/k with the highest worth rod determined by test.

With the required shutdown margin not met during power operation, either restore the required shutdown margin within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , or be in hot shutdown within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Amendment No. @4, 148 81 SEP 25 1996

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION With the required shutdown margin not met and the mode switch in the "Refuel" position, immediately suspend Alteration of the Reactor Core except for control rod insertion and fuel assembly removal; immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies; within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , initiate action to restore the integrity of the Secondary Containment System.

2. Reactivity Margin 2. Reactivity Margin Inoperable Control Rods Inoperable Control Rods Control rod drives which Each partially or fully cannot be moved with withdrawn operable control rod drive control rod shall be pressure shall be exercised one,notch at considered inoperable. least once each month.

If a partially or fully This test shall be withdrawn control rod ~erformed at 'least once drive cannot be moved per f4 hours in the event with drive or scram power operation is pressure, the reactor continuing with two or shall be brought to a more inoperable control shutdown condi~ion within rods or in the event 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months unless power operation is investigation continuing with one fully demonstrates that the or partially withdrawn cause of the failure is rod which cannot be moved not due to a failed and for which control rod control rod drive drive mechanism'damage mechanism collet housing. . has not been, ruled out.

The control rod The surveillance need not directional control be completed within valvesfo~ inoperable 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the number

'control rods shall be Amendment No. +4&, ~ 233 8la

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION disarmed except for of inoperable rods has control rods which are been reduced to less inoperable because of than two and if it has scram times greater than been demonstrated that those specified in control rod drive Specification 3.3.C. In mechanism collet housing no case shall the number failure is not the cause of inoperable rods which of an immovable control are not fully inserted rod.

be greater than six during power operation.

B. Control Rods B. Control Rods

1. Each control rod shall 1. The coupling integrity be either coupied to its shall be verified:

drive or placed in the .!

inserted position and (a) When a rod is fully its directional valves withdrawn, observe disarmed. When removing that the rod does control rod drives for not go to the inspection and the over-travel reactor is in the position.

refueling mode, this requirement does not (b) Prior to declaring apply. a control rod OPERABLE after work on a control rod or CRD system that could affect coupling, each rod shall be fully' withdrawn and

.verified that the rod does not go to the over-travel po s i.t Lon-.

Amendment No. ~ 233 82

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION

2. The Control Rod Drive 2. The Control Rod Drive Housing Support Syste~ Housing Support System shall be in place when shall be inspected after the Reactor Coolant reassembly.

System is pressurized above atmospheric pressure with fuel in the

'reactor vessel unless all operable control rods are fully inserted.

3. While the reactor is 3. Prior to control rod below 17% power, the Rod withdrawal for startup Worth Minimizer (RWM) the' Rod Worth Minimizer shall be operating while (RWM) shall be verified moving control rods as operable by performing except that: the following:

(a) If after withdrawal (a) Verify that the, of at least 12 control rod control rods during withdrawal sequence a startup, the RWM for the Rod Worth fails, the startup Minimizer computer may continue is corr~ct.

provided a second licensed operator verifies that the operator at the reactor console is following the control rod program; or (b) If all rods, except (b) The ,Rod Worth those that cannot be Minimizer diagnostic moved with control test shall be rod drive pressure, performed.

are fully inserted,'

no more than two rods may be moved.

Amendment No. ~, 9, %, N9 233 83

VYNPS 3.3 LiMITING CONDITIONS fOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION (c) Out-oi-sequence control rods in each distinct RWM group shall be selected and the annunciator of the selection errors verified.

(dl An out-oi-sequence control rod shall be withdrawn no more than three notches and the rod block function verified.

4. Control rod patterns and 4. The control rod pattern the sequence of and sequence of withdrawal or insertion withdrawal or insertion shall be established shall be verified to such that the rod drop comply with accident limit of Specification 3.3.B.4.

280 cal/g is not exceeded.

5. Control rods shall not 5. Prior to control rod be withdrawn for startup withdrawal for s ta r t up or refueling unless at or during refueling, least two source range verification shall be channels have an made that at least two observed count rate source range* channels greater than or equal to have an observed count three counts per second. rate of at least three counts per second.

6. If the above 6. Deleted specifications are not; satisfied, an orderly shutdown shall be initiated and the reactor shall be in the HOT SHUTDOWN condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

7. Deleted

'Amendment No. ~, ~, ~, ~,244 84

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION C. Scram Insertion Times C. Scram Insertion Times

1. When the reactor is in ---------------NOTE:-------------

the STARTUP or RUN During single control rod scram MODES; time Surveillances, the control rod drive (CRD) pumps shall be

a. No more than 6 isolated from the associated scram OPERABLE control accumulator.

rods shall be "slow," in accordance with 1.a. Prior to exceeding 40% RATED Table 4.3. C-l, THERMAL POWER (RTP) after each reactor shutdown of ~

AND 120 days, verify each control rod scram time is

b. No more than 2 within the limits of Table OPERABLE control 4.3.C-1 with reactor steam rods that are dome pressure ~ 800 psig.

"slow" shall occupy diagonally or face

b. Every 200 days cumulative adjacent locations. operation in RUN MODE, verify, for a representative sample, each tested control rod scram time is within the limits of Table 4.3.C-l with reactor steam dome pressure

~ 800 psig.

c. Prior to declaring a control rod OPERABLE after work on a control rod or the CRD System that could affect scram time, verify each affected control rod scram time is within the limits of Table 4.3.C-1 with any reactor steam dome pressure.

d. Prior to exceeding 40% RTP after fuel movement within the affected core cell AND prior to exceeding 40% RTP after work on a control rod or the CRD System that. could affect scram time, verify each affected control rod scram time is within the limits of Table 4.3.C-1 with reactor steam dome pressure

~ 800 psig.

Amendment No. H, 8 , ~, :+G, +:3-, ~ 233 85

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION TABLE 4.3.C-l Control Rod Scram Times

~---NOTES---------~----

1. OPERABLE control rods with scram times not within the limits of this Table are considered "slow."

2. Follow the Required Actions of LCO 3.3.C.4 for control rods with scram times> 7 seconds to notch position 06. These control rods are inoperable, in accordance with SR 4.3.C.2, and are not considered "slow."

NOTCH (a) (b)

SCRAM TIMES POSITION (seconds)

WHEN REACTOR STEAM DOME PRESSURE 2: 800 psig 46 0.44 36 1. 08 26 1. 83 06 3.35 (a)

Maximum scram time from fully withdrawn position, based on de energization of scram pilot valve solenoids at time zero.

(b)

Scram times as a function of reactor steam dome pressure, when < 800 psig, are within established limits.

2. The maximum scram 2. In accordance with SR's insertion "time to notch 4.1.C.l.a,b,c & d above, position 06 of any verify each control rod scram OPERABLE control rod time from fully withdrawn to shall not exceed notch position 06 is ~ 7 seconds.

7.00 seconds.

Amendment No. ~, +G 233 86

VYNPS 3.3 LIMITING CONDITIONS FOR 4'.3 SURVEILLANCE REQUIREMENTS OPERATION

3. If Specification 3.3.C.l. cannot be met, the reactor shall not be made supercritical; if*

operating, the reactor shall be placed in the HOT SHUTDOWN condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

4. If Specification 3.3.C.2 cannot be met, the deficient control rod shall be considered inoperable, fully inserted into the core within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , and disarmed within the following 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

D. Control Rod Accumulators D, Control Rod Accumulators Each control rod scram Once every 7 days verify accumulator shall be each control rod scram OPERABLE when in the STARTUP accumulator nitrogen or RUN MODES. pressure is ~ 940 psig.

NOTE------------

Separate action item entry is allowed for each control rod scram accumulator.

1. If a control rod scram accumulator is inoperable with reactor steam dome pressure ~ 900 psig:

~NOTE-------------

Only applicable if the associated control rod scram time was within the limits of Table 4.3.C-l during the last scram time Surveillance.

a. Declare the associated control rod scram time "slow" within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ,

-OR

b. Declare the associated control rod inoperable within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Amendment No. +G 233 87

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION

2. If two or more control rod scram accumulators are inoperable with reactor steam dome pressure ~ 900 psig:

a. Verify/restore the charging water header pressure to

~ 940 psig within 20 minutes.

-AND

NOTE------------

Only applicable if the associated control rod scram time was within the limits of Table 4.3.C-1 during the last scram time Surveillance.

b.1 Declare the associated control rod scram time "slow" within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ,

-OR b.2 Declare the associated control rod inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

3. If one or more control rod scram accumulators are inoperable with reactor steam dome pressure < 900 psig:

a. Verify all control rods associated with inoperable accumulators are fully inserted immediately upon discovery of charging water header pressure

< 940 psig.

-AND

b. Declare the associated control rod inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Amendment No. 233 87a

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION

4. If Specifications 3.3.D.2.a or 3.3.D.3.a are not met, ensure all rods are fully inserted immediately.

NOTE------------

The above specification is not applicable if all inoperable control rod scram accumulators are associated with fully inserted control rods.

Amendment No. 233 87b

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION E. Reactivity Anomalies E. Reactivity Anomalies The reactivity equivalent of During the startup test the difference between the program and startups actual critical rod following refueling outages, configuration and the the critical rod expected configuration during configurations will be power operation shall not compared to the expected exceed 1% Ak/k. If this configurations at selected limit is exceeded, the operating conditions. These reactor will be shut down comparisons will be used as until the cause has been base data for reactivity

determined and corrective monitoring during subsequent actions have been taken if power operation throughout such actions are appropriate. the fuel cycle. At specific power operating conditions, the critical rod configuration will be compared to the configuration expected based upon appropriately corrected past data. This comparison will be made at least every equivalent full power month.

F. Scram Discharge Volume Vent F. Scram Di.'3charge Volume Vent and Drain Valves and Drain Valves

1. Each scram discharge 1. ----------NOTE---------

volume (SDV) Vent and Not required to be met on drain valve shall be vent and drain valves OPERABLE when the reactor closed' during performance is in the STARTUP or RUN of SR 4.3.F.2.

MODES.

~---~-------NOTES---------- Verify each

Separate Condition entry is pneumatically-operated allowed for each SDV vent SOV vent and drain valve and drain line. is open at least once pe~

month. .

An isolated SDV line may be unisolated under 2. Cycle each SOV vent and administrative control to drajn valve to the fully allow draining and venting closed and fully open of the SOV. position in accordance with Specification

~. If there is one or 4.6.E.2.

more SOV vent or drain line with one 3. At least once per valve inoperable, operating cycle, verify then isolate the each pneumatically~

associated SOV line operated SOV vent and within 7 days. drain valve:

a. Closes in ~ 30 seconds after receipt of an actual or simulated scram signal and Amendment No. ~, -l-JHI., ~, ~ , 244 88

VYNPS 3.3 LIMITING CONDITIONS FOR 4.3 SURVEILLANCE REQUIREMENTS OPERATION

b. If there is one or b. Opens when the actual more SDV vent or or simulated scram drain line with both signal is reset.

valves inoperable, then isolate the associated SDV line within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

c. If Specifications 3.3. F .l.a or 3.3.F.l.b are not met then the reactor shall be in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Amendment No. 244 BSa

VYNPS BASES:

3.3 & 4.3 CONTROL ROD SYSTEM A. Reactivity Limitations

1. Reactivity Margin - Core Loading The specified shutdown margin (SDM) limit accounts for the uncertainty in the demonstration of SDM by testing. Separate SDM limits are provided for testing where the highest worth control rod is determined analytically or by measurement. This is due to the reduced uncertainty in the SDM test when the highest worth control rod is determined by measurement (e.g., SDM may be demonstrated by an in-sequence control rod withdrawal, in which the highest worth control rod is analytically determined, or by local criticals, where the highest worth rod is determined by testing).

Following a refueling, adequate SDM must be demonstrated to ensure that the reactor can be made subcritical at any point during the cycle. Since core reactivity will vary during the cycle as a function of fuel depletion and poison burnup, the beginning of cycle (BOC) test must also account for changes in core reactivity during the cycle. Therefore, to obtain the SDM, the initial measured value must exceed LCO 3.3.A.1 by an adder, "R", which is the difference between the calculated value of maximum core reactivity during the operating cycle and the calculated BOC core reactivity. If the value of "R" is negative (that is, BOC is the most reactive point in the cycle), no correction to the BOC measured value is required. The value of R shall include the potential shutdown margin loss assuming full B4C settling in all inverted poison tubes present in the core.

The frequency of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reaching criticality is allowed to provide a reasonable amount of time to perform the required calculations and have appropriate verification.

When SDM is demonstrated by calculations not associated with a test (e.g., to confirm SDM during the fuel loading sequence),

additional margin must be included to account for uncertainties in the calculation. During refueling, adequate SDM is required to ensure that the reactor does not reach criticality during control rod withdrawals. An evaluation of each in-vessel fuel movement during fuel loading (including shuffling fuel within the core) is required to ensure adequate SDM is maintained during refueling. This evaluation ensures that the intermediate loading patterns are bounded by the safety analyses for the final core loading pattern. For example, bounding analyses that demonstrate adequate SDM for the most reactive configurations during the refueling may be performed to demonstrate acceptability of the entire fuel movement sequence. These bounding analyses include additional margins to account for the associated uncertainties in the calculation.

Amendment No. 20, NVY 87-131, 148, 233 89

VYNPS BASES: 3.3 & 4.3 (Cont'd)

2. Reactivity Margin - Inoperable Control Rods Specification 3.3.A.2 requires that a rod be taken out of service if it cannot be moved with drive pressure. If a rod is disarmed, its position shall be consistent with the shutdown reactivity limitation stated in Specification 3.3.A.1. This assures that the core can be shutdown at all times with the remaining control rods, assuming the highest worth, operable control rod does not insert. An allowable pattern for control rods valved out of service will be available to the reactor operator. The number of rods permitted to be inoperable could be many more than the six allowed by the Specification, particularly late in the operation cycle; however, the occurrence of more than six could be indicative of a generic control rod drive problem and the reactor will be shutdown. Also if damage within the control rod drive mechanism and in particular, cracks in drive internal housing, cannot be ruled out, then a generic problem affecting a number of drives cannot be ruled out. Circumferential cracks resulting from stress assisted intergranular corrosion have occurred in the collet housing of drives at several BWRs. This type of cracking could occur in a number of drives and if the cracks propagated until severance of the collet housing occurred, scram could be prevented in the affected rods. Limiting the period of operation with a potentially severed collet housing and requiring increased surveillance after detecting one stuck rod will assure that the reactor will not be operated with a large number of rods with failed collet housings.

The monthly control rod exercise test serves as a periodic check against deterioration of the Control Rod System and also verifies the ability of the control rod drive to scram. The frequency of exercising the control rods under the conditions of two or more control rods valved out of service provides even further assurance of the reliability of the remaining control rods.

B. Control Rods

1. Control rod dropout accidents as discussed in the UFSAR can lead to significant core damage. If coupling integrity is maintained, the possibility of a rod dropout accident is eliminated.

Coupling verification is performed to ensure the control rod is connected to the CRDM and will perform its intended function when necessary. The Surveillance requires verifying a control rod does not go to the withdrawn over-travel position. The over-travel position feature provides a positive check on the coupling integrity since only an uncoupled CRD can reach the over-travel position. The verification is required to be performed any time a control rod is withdrawn to the "full out" position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling.

This includes control rods inserted one notch and then returned to the "full out" position during the performance of SR 4.3.A.2.

This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved and operating experience related to uncoupling events.

Amendment No. 148, 149, 233 89a

VYNPS BASES: 3.3 & 4.3 (Cont'd)

2. The control rod housing support restricts the outward movement of a control rod to less than 3 inches in the extremely remote event of a housing failure. The amount of reactivity which could be added by this small amount of rod withdrawal, which is less than a normal single withdrawal increment, will not contribute to any damage of the primary coolant system. The design basis is given in Subsection 3.5.2 of the FSAR, and the design evaluation is given in Subsection 3.5.4. This support is not required if the reactor coolant system is at atmospheric pressure since there would then be no driving force to rapidly eject a drive housing.

3. In the course of performing normal startup and shutdown procedures, a pre-specified sequence for the withdrawal or insertion of control rods is followed. Control rod dropout accidents which might lead to significant core damage, cannot occur if this sequence of rod withdrawals or insertions is followed. The Rod Worth Minimizer restricts withdrawals and insertions to those listed in the pre-specified sequence and provides an additional check that the reactor operator is following prescribed sequence. Although beginning a reactor startup without having the RWM operable would entail unnecessary risk, continuing to withdraw rods if the RWM fails subsequently is acceptable if a second licensed operator verifies the withdrawal sequence. Continuing the startup increases core power, reduces the rod worth and reduces the consequences of dropping any rod. Withdrawal of rods for testing is permitted with the RWM inoperable, if the reactor is subcritical and all other rods are fully inserted. Above 17% power, the RWM is not needed since even with a single error an operator cannot withdraw a rod with sufficient worth, which if dropped, would result in anything but minor consequences.

4. Refer to the General Electric Standard Application for Reactor Fuel (GESTAR II), NEDE-24011-P-A, (the latest NRC-approved version will be listed in the COLR).

5. The Source Range Monitor (SRM) system provides a scram function in noncoincident configuration. It does provide the operator with a visual indication of neutron level. The consequences of reactivity accidents are a function of the initial neutron flux. The requirement of at least three counts per second assures that any transient, should it occur, begins at or above the initial value of 10-8 of rated power used in the analyses of transients from cold conditions. One operable SRM channel is adequate to monitor the approach to criticality, therefore, two operable SRM's are specified for added conservatism.

6. The action statement for TS 3.3.B.6 requires that the plant be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months if the required actions of TS 3.3.B.1 through 3.3.B.5 are not satisfied. This ensures that all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The allowed completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based upon operating experience to reach HOT SHUTDOWN from full power in an orderly manner and without challenging plant systems.

Amendment No. 25, 73, 148, BVY 99-111, BVY 01-40, 229, 233 90

VYNPS BASES: 3.3 & 4.3 (Cont'd)

7. Deleted C. Scram Insertion Times BACKGROUND The scram function of the Control Rod Drive (CRD) System controls reactivity changes during abnormal operational transients to ensure that specified acceptable fuel design limits are not exceeded. The control rods are scrammed by positive means using hydraulic pressure exerted on the CRD piston.

When a scram signal is initiated, control air is vented from the scram valves, allowing them to open by spring action. Opening the exhaust valve reduces the pressure above the main drive piston to atmospheric pressure, and opening the inlet valve applies the accumulator or reactor pressure to the bottom of the piston. Since the notches in the index tube are tapered on the lower edge, the collet fingers are forced open by cam action, allowing the index tube to move upward without restriction because of the high differential pressure across the piston. As the drive moves upward and the accumulator pressure reduces below the reactor pressure, a ball check valve opens, letting the reactor pressure complete the scram action. If the reactor pressure is low, such as during startup, the accumulator will fully insert the control rod in the required time without assistance from reactor pressure.

APPLICABLE SAFETY ANALYSES The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. The resulting negative scram reactivity forms the basis for the determination of plant thermal limits (e.g., MCPR). Other distributions of scram times (e.g., several control rods scramming slower than the average time with several control rods scramming faster than the average time) can also provide sufficient scram reactivity. Surveillance of each individual control rods scram time ensures the scram reactivity assumed in the DBA and transient analyses can be met.

The scram function of the CRD System protects the MCPR Safety Limit (SL) (reference TS 1.1.A, "Bundle Safety Limit (Reactor Pressure >800 psia and Core Flow >10% of Rated)," and TS 3.11.C, "Minimum Critical Power Ratio (MCPR)") and the 1% cladding plastic strain fuel design limit (reference specification 3.11.A, "Average Planar Linear Heat Generation Rate (APLHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded. Above 800 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL, during the analyzed limiting power transient. Below 800 psig, the scram function is assumed to perform during the control rod drop accident (Reference 1) and, therefore, also provides protection against violating fuel damage limits during reactivity insertion accidents (Reference TS 3.3.B.3 and 3.3.B.4, regarding the Rod Worth Minimizer and control rod patterns). For the reactor vessel overpressure protection analysis, the scram function, along with the safety/relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits.

Control rod scram times satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Amendment No. 25, 73, 148, BVY 99-111, BVY 01-40, 233, 244 91

VYNPS BASES: 3.3 & 4.3 (Cont'd)

LCO The scram times specified in Table 4.3.C-1 (in the accompanying LCO) are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met (Reference 2). To account for single failures and "slow" scramming control rods, the scram times specified in Table 4.3.C-1 are faster than those assumed in the design basis analysis. The scram times have a margin that allows up to approximately 7% of the control rods (e.g., 89 x 7% 6) to have scram times exceeding the specified limits (i.e., "slow" control rods) assuming a single stuck control rod (as limited by TS 3.3.A.

Reactivity Limitations) and an additional control rod failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup")

when the index tube passes a specific location and then opens

("dropout") as the index tube travels upward. Verification of the specified scram times in Table 4.3.C-1 is accomplished through measurement of the "dropout" times. To ensure that local scram reactivity rates are maintained within acceptable limits, no more than two of the allowed "slow" control rods may occupy adjacent locations.

Table 4.3.C-1 is modified by two Notes which state that control rods with scram times not within the limits of the Table are considered "slow" and that control rods with scram times > 7 seconds are considered inoperable as required by SR 4.3.C.2. Slow scramming control rods may be conservatively declared inoperable and not accounted for as "slow" control rods.

APPLICABILITY In STARTUP and RUN MODES, a scram is assumed to function during transients and accidents analyzed for these plant conditions. These events are assumed to occur during startup and power operation; therefore, the scram function of the control rods is required during these MODES. In SHUTDOWN, the control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod scram capability during these conditions. In REFUELING, only one control rod is able to be withdrawn. Additional restrictions and requirements when in REFUELING can be found in TS 3.12 Refueling and Spent Fuel Handling.

REQUIRED ACTIONS TS 3.3.C.3 When the requirements of TS 3.3.C.1 are not met, the rate of negative reactivity insertion during a scram may not be within the assumptions of the safety analyses. Therefore, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least the HOT SHUTDOWN condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach the SHUTDOWN MODE from full power conditions in an orderly manner and without challenging plant systems.

Amendment No. 233 91a

VYNPS BASES: 3.3 & 4.3 (Cont'd)

TS 3.3.C.4 Specification 3.3.C.2 requires that no operable control rod have a scram time greater than 7 seconds. TS 3.3.C.4 requires that for control rods that do not satisfy the 7 second requirement, that they be considered inoperable. In addition, the subject control rod must be fully inserted into the core within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months and (electrically or hydraulically) disarmed within the following 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected. The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. The control rods can be electrically disarmed by disconnecting power from all four directional control valve solenoids.

The allowed completion times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS (SR)

The four surveillances of SR 4.3.C.1 are modified by a Note stating that during a single control rod scram time surveillance, the CRD pumps shall be isolated from the associated scram accumulator. With the CRD pump isolated, (i.e., charging valve closed) the influence of the CRD pump head does not affect the single control rod scram times. During a full core scram, the CRD pump head would be seen by all control rods and would have a negligible effect on the scram insertion times.

SR 4.3.C.1.a The scram reactivity used in DBA and transient analyses is based on an assumed control rod scram time. Measurement of the scram times with reactor steam dome pressure 800 psig demonstrates acceptable scram times for the transients analyzed.

Maximum scram insertion times occur at a reactor steam dome pressure of approximately 800 psig because of the competing effects of reactor steam dome pressure and stored accumulator energy. Therefore, demonstration of adequate scram times at reactor steam dome pressure 800 psig ensures that the measured scram times will be within the specified limits at higher pressures. Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed. To ensure that scram time testing is performed within a reasonable time following a shutdown 120 days or longer, control rods are required to be tested before exceeding 40% RTP following the shutdown. This frequency is acceptable considering the additional surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by fuel movement within the associated core cell and by work on control rods or the CRD System.

Amendment No. 233 91b

VYNPS BASES: 3.3 & 4.3 (Cont'd)

SR 4.3.C.1.b Additional testing of a sample of control rods is required to verify the continued performance of the scram function during the cycle. A representative sample contains at least 10% of the control rods. The sample remains representative if no more than 7.5% of the control rods in the sample tested are determined to be "slow." With more than 7.5%

of the sample declared to be "slow" per the criteria in Table 4.3.C-1, additional control rods are tested until this 7.5% criterion (e.g.,

7.5% of the entire sample size) is satisfied, or until the total number of "slow" control rods (throughout the core, from all surveillances) exceeds the LCO limit. For planned testing, the control rods selected for the sample should be different for each test. Data from inadvertent scrams should be used whenever possible to avoid unnecessary testing at power, even if the control rods with data may have been previously tested in a sample. The 200 day Frequency is based on operating experience that has shown control rod scram times do not significantly change over an operating cycle. This Frequency is also reasonable based on the additional Surveillances done on the CRDs at more frequent intervals in accordance with SR 4.3.A.2 Notch Testing and SR 4.3.D, "Control Rod Accumulators."

SR 4.3.C.1.c When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate the affected control rod is still within acceptable limits. The limits for reactor pressures < 800 psig are established based on a high probability of meeting the acceptance criteria at reactor pressures 800 psig. Limits for 800 psig are found in Table 4.3.C-1. If testing demonstrates the affected control rod does not meet these limits, but is within the 7 second limit of Table 4.3.C-1, Note 2, the control rod can be declared OPERABLE and "slow."

Specific examples of work that could affect the scram times are (but are not limited to) the following: removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator, isolation valve or check valve in the piping required for scram.

The Frequency of once prior to declaring the affected control rod OPERABLE is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.

Amendment No. 233 91c

VYNPS BASES: 3.3 & 4.3 (Cont'd)

SR 4.3.C.1.d When work that could affect the scram insertion time is performed on a control rod or CRD System, or when fuel movement within the reactor pressure vessel occurs, testing must be done to demonstrate each affected control rod is still within the limits of Table 4.3.C-1 with the reactor steam dome pressure 800 psig. Where work has been performed at high reactor pressure, the requirements of SR 4.3.C.1.c and SR 4.3.C.1.d can be satisfied with one test. For a control rod affected by work performed while shut down, however, a zero pressure and high pressure test may be required. This testing ensures that, prior to withdrawing the control rod for continued operation; the control rod scram performance is acceptable for operating reactor pressure conditions. Alternatively, a control rod scram test during hydrostatic pressure testing could also satisfy both criteria. When fuel movement within the reactor pressure vessel occurs, only those control rods associated with the core cells affected by the fuel movement are required to be scram time tested. During a routine refueling outage, it is expected that all control rods will be affected.

The Frequency of once prior to exceeding 40% RTP is acceptable because of the capability to test the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.

SR 4.3.C.2 Verifying that the scram time for each control rod to notch position 06 is 7 seconds provides reasonable assurance that the control rod will insert when required during a DBA or transient, thereby completing its shutdown function. This SR is performed in conjunction with the control rod scram time testing of SR 4.3.C.1.a, SR 4.3.C.1.b, SR 4.3.C.1.c, and SR 4.3.C.1.d. The associated Frequencies are acceptable, considering the more frequent testing performed to demonstrate other aspects of control rod OPERABILITY and operating experience, which shows scram times do not significantly change over an operating cycle.

REFERENCES

1. NEDE-24011-P-A-9, General Electric Standard Application for Reactor Fuel, Section 3.2.4.1, September 1988.

2. Letter from R.F. Janecek (BWROG) to R.W. Starostecki (NRC), BWR Owners Group Revised Reactivity Control System Technical Specifications, BWROG-8754, dated September 17, 1987.

D. Control Rod Accumulators BACKGROUND The control rod scram accumulators are part of the Control Rod Drive (CRD) System and are provided to ensure that the control rods scram under varying reactor conditions. The control rod scram accumulators store sufficient energy to fully insert a control rod at any reactor vessel pressure. The accumulator is a hydraulic cylinder with a free floating piston. The piston separates the water used to scram the control rods from the nitrogen, which provides the required energy.

The scram accumulators are necessary to scram the control rods within the required insertion times of LCO 3.3.C, "Scram Insertion Times."

Amendment No. 233 91d

VYNPS BASES: 3.3 & 4.3 (Cont'd)

APPLICABLE SAFETY ANALYSES The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. OPERABILITY of each individual control rod scram accumulator, along with LCO 3.3.A.2, Reactivity Margin - Inoperable Control Rods, LCO 3.3.B "Control Rods," and LCO 3.3.C "Scram Insertion Times", ensures that the scram reactivity assumed in the DBA and transient analyses can be met.

The existence of an inoperable accumulator may invalidate prior scram time measurements for the associated control rod.

The scram function of the CRD System, and therefore the OPERABILITY of the accumulators, protects the MCPR Safety Limit (reference TS 1.1.A, "Bundle Safety Limit (Reactor Pressure >800 psia and Core Flow >10% of Rated)," and TS 3.11.C, "Minimum Critical Power Ratio (MCPR)") and 1%

cladding plastic strain fuel design limit (reference specification 3.11.A, "Average Planar Linear Heat Generation Rate (APLHGR),") and TS 3.11.B, "Linear Heat Generation Rate (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded. In addition, the scram function at low reactor vessel pressure (i.e., startup conditions) provides protection against violating fuel design limits during reactivity insertion accidents (Reference TS 3.3.B.3 and 3.3.B.4, regarding the Rod Worth Minimizer and control rod patterns).

Control rod scram accumulators satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The OPERABILITY of the control rod scram accumulators is required to ensure that adequate scram insertion capability exists when needed over the entire range of reactor pressures. The OPERABILITY of the scram accumulators is based on maintaining adequate accumulator pressure.

APPLICABILITY In STARTUP and RUN MODES, the scram function is required for mitigation of DBAs and transients, and therefore the scram accumulators must be OPERABLE to support the scram function. In SHUTDOWN, control rods are not allowed to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod scram accumulator OPERABILITY during these conditions. In REFUELING, only one control rod is able to be withdrawn. Additional restrictions and requirements when in REFUELING can be found in TS 3.12 Refueling and Spent Fuel Handling.

REQUIRED ACTIONS The required actions of TS 3.3.D is modified by a Note indicating that a separate condition entry is allowed for each control rod scram accumulator. This is acceptable since the required actions for each condition provide appropriate compensatory actions for each inoperable accumulator. Complying with the Required Actions may allow for continued operation.

Amendment No. 233 91e

VYNPS BASES: 3.3 & 4.3 (Cont'd)

TS 3.3.D.1.a and 1.b With one control rod scram accumulator inoperable and the reactor steam dome pressure 900 psig, the control rod may be declared "slow," since the control rod will still scram at the reactor operating pressure but may not satisfy the required scram times in Table 4.3.C-1. Required action 1.a is modified by a Note indicating that declaring the control rod "slow" only applies if the associated control scram time was within the limits of Table 4.3.C-1 during the last scram time test.

Otherwise, the control rod would already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (required action 1.b) and LCO 3.3.C.4 is entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function.

The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, based on the large number of control rods available to provide the scram function and the ability of the affected control rod to scram only with reactor pressure at high reactor pressures.

TS 3.3.D.2.a, 2.b.1 and 2.b.2 With two or more control rod scram accumulators inoperable and reactor steam dome pressure 900 psig, adequate pressure must be supplied to the charging water header. With inadequate charging water header pressure, all of the accumulators could become inoperable, resulting in a potentially severe degradation of the scram performance. Therefore, within 20 minutes from discovery of charging water header pressure <

940 psig concurrent with condition 2, adequate charging water header pressure must be restored. The allowed completion time of 20 minutes is reasonable, to place a CRD pump into service to restore the charging header pressure, if required. This completion time is based on the ability of the reactor pressure alone to fully insert all control rods.

The control rod may be declared "slow," since the control rod will still scram using only reactor pressure, but may not satisfy the times in Table 4.3.C-1. Required action 2.b.1 is modified by a Note indicating that declaring the control rod "slow" only applies if the associated control scram time is within the limits of Table 4.3.C-1 during the last scram time test. Otherwise, the control rod would already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (required action 2.b.2) and LCO 3.3.C.4 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function.

The allowed completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the ability of only the reactor pressure to scram the control rods and the low probability of a DBA or transient occurring while the affected accumulators are inoperable.

Amendment No. 233 91f

VYNPS BASES: 3.3 & 4.3 (Cont'd)

TS 3.3.D.3.a and 3.b With one or more control rod scram accumulators inoperable and the reactor steam dome pressure < 900 psig, the pressure supplied to the charging water header must be adequate to ensure that accumulators remain charged. With the reactor steam dome pressure < 900 psig, the function of the accumulators in providing the scram force becomes much more important since the scram function could become severely degraded during a depressurization event or at low reactor pressures.

Therefore, immediately upon discovery of charging water header pressure

< 940 psig, concurrent with condition 3, all control rods associated with inoperable accumulators must be verified to be fully inserted.

Withdrawn control rods with inoperable accumulators may fail to scram under these low pressure conditions. The associated control rods must also be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The allowed completion time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable for required action 3.b, considering the low probability of a DBA or transient occurring during the time that the accumulator is inoperable.

TS 3.3.D.4 The reactor must be shutdown immediately if either required action and associated completion time associated with loss of the CRD charging pump (required actions 2.a and 3.a) cannot be met. Shutting down the reactor ensures that all insertable control rods are inserted and that the reactor would then be in a condition that does not require the active function (i.e., scram) of the control rods. This required action is modified by a Note stating that the action is not applicable if all control rods associated with the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed.

SURVEILLANCE REQUIREMENTS SR 4.3.D SR 4.3.D requires that the accumulator pressure be checked every 7 days to ensure adequate accumulator gas pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator gas pressure. A minimum accumulator gas pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator gas pressure of 940 psig is well below the expected pressure of 1100 psig. Declaring the accumulator inoperable when the minimum gas pressure is not maintained ensures that significant degradation in scram times does not occur.

The 7 day frequency has been shown to be acceptable through operating experience and takes into account indications available in the control room.

Amendment No. 233 91g

VYNPS BASES: 3.3 & 4.3 (Cont'd)

E. Reactivity Anomalies During each fuel cycle, excess operating reactivity varies as fuel depletes and as any burnable poison in supplementary control is burned.

The magnitude of this excess reactivity may be inferred from the critical rod configuration. As fuel burnup progresses, anomalous behavior in the excess reactivity may be detected by comparison of the critical rod pattern selected base states to the predicted rod inventory at that state. Power operation base conditions provide the most sensitive and directly interpretable data relative to core reactivity. Furthermore, using power operating base conditions permits frequent reactivity comparisons. Reactivity anomaly is used as a measure of the predicted versus measured core reactivity during power operation. If the measured and predicted rod density for identical core conditions at BOC do not reasonably agree, then the assumptions used in the reload cycle design analysis or the calculation models used to predict rod density may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured value. Requiring a reactivity comparison at the specified frequency assures that a comparison will be made before the core reactivity change exceeds 1%

k/k. Deviations in core reactivity greater than 1% k/k are not expected and require thorough evaluation. One percent reactivity limit is considered safe since an insertion of the reactivity into the core would not lead to transients exceeding design conditions of the Reactor System.

F. Scram Discharge Volume Vent and Drain Valves BACKGROUND The pneumatically-operated Scram Discharge Volume (SDV) vent and drain valves are normally open and discharge any accumulated water in the SDV to ensure that sufficient volume is available at all times to allow a complete scram. During a scram, the pneumatically-operated SDV vent and drain valves close to contain reactor water. The scram discharge volumes are used to limit the loss of and contain the reactor vessel water from all the drives during a scram. These volumes are provided in the scram discharge header. There are two separate, independent SDVs, each with its own vent and drain lines. Each SDV receives approximately half of the CRD discharges. Each drain line contains two pneumatically-operated valves connected in series that drain to the Reactor Building (RB) equipment drain sumps. Each vent line contains a single pneumatically-operated valve and a check valve.

APPLICABLE SAFETY ANALYSES The SDV vent and drain valves are designed to isolate the SDV when reactor water is discharged to the SDV through the scram discharge header and allow free venting and draining of the SDV after a scram. The SDV vent and drain valves are required to support the safety related rapid control rod insertion function.

Isolation of the SDV can also be accomplished by manual closure of the pneumatically-operated SDV valves. Additionally, the discharge of reactor coolant to the SDV can be terminated by scram reset or closure of the HCU manual isolation valves. The SDV vent and drain valves allow continuous drainage of the SDV during normal plant operation to ensure that the SDV has sufficient capacity to contain the reactor coolant discharge during a full core scram. To automatically ensure this capacity, a reactor scram is initiated if the SDV water level in the instrument volume exceeds a specified setpoint. The setpoint is chosen so that all control rods are inserted before the SDV has insufficient volume to accept a full scram.

Amendment No. 233, 244 91h

VYNPS BASES: 3.3 & 4.3 (Cont'd)

LCO The OPERABILITY of all SDV vent and drain valves ensures that the SDV vent and drain valves will close during a scram to contain reactor water discharged to the SDV piping. Since the drain lines are provided with two pneumatically-operated valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. The vent line contains a single pneumatically-operated valve and a check valve as a backup. Additionally, the valves are required to open on scram reset to ensure that a path is available for the SDV piping to drain freely at other times.

APPLICABILITY In the STARTUP and RUN MODES, scram may be required; therefore, the SDV vent and drain valves must be OPERABLE.

In the HOT SHUTDOWN and COLD SHUTDOWN MODES, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. Also, during the REFUELING MODE, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and only one rod may be withdrawn and subject to scram.

REQUIRED ACTIONS 3.3.F.1 is modified by a note indicating that a separate condition entry is allowed for each SDV vent and drain line. This is acceptable, since the required actions for each condition provide appropriate compensatory actions for each inoperable SDV line. Complying with the required actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent condition entry and application of associated required actions.

When a line is isolated, the potential for an inadvertent scram due to high SDV level is increased. During these periods, the line may be unisolated under administrative control. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level. This is acceptable since the administrative controls ensure the valve can be closed quickly, by a dedicated operator, if a scram occurs with the valve open. These controls consist of stationing a dedicated operator, with whom Control Room communication is immediately available, in the immediate vicinity of the valve controls.

3.3.F.1.a When one SDV vent or drain valve is inoperable in one or more lines, the associated line must be isolated to contain the reactor coolant during a scram. The 7 day completion time is reasonable, given the level of redundancy in the lines and the low probability of a scram occurring while the valve(s) are inoperable and the line is not isolated. The SDV is still isolable since the redundant valve in the affected line is OPERABLE. During these periods, the single failure criterion may not be preserved, and a higher risk exists to allow reactor water out of the primary system during a scram. Once the associated SDV line is isolated continued operation is permissible.

3.3.F.1.b If both vent or drain valves in a line are inoperable, the line must be isolated to contain the reactor coolant during a scram. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months completion time to isolate the line is based on the low probability of a scram occurring while the line is not isolated and unlikelihood of Amendment No. 244 91i

VYNPS BASES: 3.3 & 4.3 (Cont'd) significant CRD seal leakage. Once the associated SDV line is isolated continued operation is permissible.

3.3.F.1.c If any required action and associated completion time are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed completion time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach HOT SHUTDOWN from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 4.3.F.1 During normal operation, the pneumatically-operated SDV vent and drain valves should be in the open position (except when performing SR 4.3.F.2) to allow for drainage of the SDV piping. Verifying that each valve is in the open position ensures that the pneumatically-operated SDV vent and drain valves will perform their intended functions during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position. The monthly frequency is based on engineering judgment and is consistent with the procedural controls governing valve operation, which ensure correct valve positions.

SR 4.3.F.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping. Cycling each valve through its complete range of motion (closed and open) ensures that the valve will function properly during a scram. The valves are tested in accordance with the requirements of the Inservice Testing Program.

SR 4.3.F.3 SR 4.3.F.3 is an integrated test of the pneumatically-operated SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the pneumatically-operated SDV vent and drain valves is verified. Similarly, after receipt of a simulated or actual scram reset signal, the opening of the pneumatically-operated SDV vent and drain valves is verified. The Logic System Functional Test in SR 4.1.A.4 and the scram time testing of control rods in SR 4.3.C overlap this surveillance to provide complete testing of the assumed safety function. The operating cycle frequency is based on the need to perform this surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power.

Amendment No. 244 91j

VYNPS 3.4 LIMITING CONDITIONS FOR 4.4 SURVEILLANCE REQUIREMENTS OPERATION 3.4 REACTOR STANDBY LIQUID CONTROL 4.4 REACTOR STANDBY LIQUID CONTROL SYSTEM SYSTEM Applicability: Applicability:

Applies to the operating status Applies to the periodic testing of the Reactor Standby Liquid requirement for the Reactor Control System. Standby Liquid Control System.

Objective: Objective:

To assure the availability of an To verify the operability of the independent reactivity control Standby Liquid Control System.

mechanism.

Specification: Specification:

A. Normal Operation A. Normal Operation Except as specified in 3.4.B The Standby Liquid Control below, the Standby Liquid System shall be verified Control System shall be operable by:

operable when the reactor mode switch is in either the 1. Testing pumps and valves "Startup/Hot Standby" or in accordance with "Run" position, except to Specification 4.6.E.

allow testing of A minimum flow rate of instrumentation associated 35 gpm at 2 1325 psig I with the reactor mode switch shall be verified for interlock functions each pump.

provided:

2. Verifying the continuity

1. Reactor coolant of the explosive charges temperature is less than at least monthly.

or equal to 2120 F; In addition, at least once

2. All control rods remain during each operating cycle, fully inserted in core the Standby Liquid Control cells containing one or System shall be verified more fuel assemblies; operable by:

and

3. Deleted

3. No core alterations are in progress.

4. Initiating one of the standby liquid control loops, excluding the primer chamber and inlet fitting, and verifying that a flow path from a pump to the reactor vessel is available.

Both loops shall be tested over the course of two operating cycles.

Amendment No. 4-n, 1&4, i44, i-7, Q4D, Q42, 229 92

VY11PS 3.4 LIMITING CONDITIONS FOR 4.4 SURVEILLANCE REQUIREMENTS OPERATION

5. Testing the new trigger assemblies by installing one of the assemblies in the test block and firing it using the installed circuitry.

Install the unfired assemblies, taken from the same batch as the fired one, into the explosion valves.

6. Recirculating the borated solution.

B. Operation with Inoperable B. Operation with Inoperable Components Components From and after the date that Deleted.

a redundant component is made or found to be inoperable, reactor operation is permissible during the succeeding seven days unless such component is sooner made operable.

C. Standbv Liquid Control System C. Standby Liquid Control System Tank - Borated Solution Tank - Borated Solution At all times when the Standby Liquid Control System is required to be operable, the following conditions shall be met:

1. The net volume versus 1. The solution volume in concentration of the the tank and temperature sodium pentaborate in the tank and suction solution in the standby piping shall be checked liquid control tank at least daily.

shall meet the requirements of Figure 3.4.1.

Amendment No. 4-0a, 444, 4-6, 4.7-s, 209 93

,AG 14 2V

VYNPS 3.4 LIMITING CONDITIONS FOR 4.4 SURVEILLANCE REQUIREMENTS OPERATION

2. The solution 2. Sodium pentaborate temperature, including concentration shall be that in the pump suction determined at least once piping, shall be a month and within maintained above the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following the curve shown in addition of water or Figure 3.4.2. boron, or if the solution temperature

3. The combination of drops below the limits Standby Liquid Control specified by System pump flow rate, Figure 3.4.2.

boron concentration, and boron enrichment shall satisfy the following 3. The boron-10 enrichment relationship for the Standby Liquid Control of the borated solution System to be considered required by Specification operable: 3.4.C.3 shall be tested and verified once per Q M251 C E operating cycle.

I - x - x - x - 2 1.29 86 M 13 19.8 where:

C = the concentration of sodium pentaborate solution (weight percent) in the Standby Liquid Control System tank E ' the boron-lO enrichment (atom percent) of the sodium pentaborate solution I Q2 35 gpm M251

- a constant (the M ratio of mass of water in the reference plant compared to VY)

D. If Specification 3.4.A or B is not met, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

E. If Specification 3.4.C is not met, action shall be immediately initiated to correct the deficiency. If at the end of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months the system has not been restored to full operability, then a shutdown shall be initiated with the reactor in cold shutdown within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of initial discovery.

Amendment No. 46, &7-&, 02 G 4-, , 229 94

VYNPS FIGURE 3.4.1 0 50LUTIM:N TN TANZ (Callons) 95

VYNPS FIGURE 3.4.2 SODIUM PENTABORATE SOLUTION TEMPERATURE REOUIREENTS o) .0.:: ,

0J . . a, _7 I -. ; i I ! l1 Lilljso<T I . ; : I .

I . . I

. X . -

96

VYNPS BASES:

3.4 & 4.4 REACTOR STANDBY LIQUID CONTROL SYSTEM A. Normal Operation The design objective of the Reactor Standby Liquid Control System (SLCS) is to provide the capability of bringing the reactor from full power to a cold, xenon-free shutdown assuming that none of the withdrawn control rods can be inserted. To meet this objective, the Standby Liquid Control System is designed to inject a quantity of boron which produces a concentration of 800 ppm of natural boron in the reactor core in less than 138 minutes. An 800 ppm natural boron concentration in the reactor core is required to bring the reactor from full power to a subcritical condition. An additional margin (25% of boron) is added for possible imperfect mixing of the chemical solution in the reactor water. A minimum quantity of 3850 gallons of solution having a 10.1% natural sodium pentaborate concentration is required to meet this shutdown requirement.

The time requirement (138 minutes) for insertion of the boron solution was selected to override the rate of reactivity insertion due to cooldown of the reactor following the xenon poison peak. For a required minimum pumping rate of 35 gallons per minute, the maximum net storage volume of the boron solution is established as 4830 gallons.

In addition to its original design basis, the Standby Liquid Control System also satisfies the requirements of 10CFR50.62(c)(4) on anticipated transients without scram (ATWS) by using enriched boron.

The ATWS rule adds hot shutdown and neutron absorber (i.e., boron-10) injection rate requirements that exceed the original Standby Liquid Control System design basis. However, changes to the Standby Liquid Control System as a result of the ATWS rule have not invalidated the original design basis.

With the reactor mode switch in the Run or Startup/Hot Standby position, shutdown capability is required. With the mode switch in Shutdown, control rods are not able to be withdrawn since a control rod block is applied. This provides adequate controls to ensure that the reactor remains subcritical. With the mode switch in Refuel, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Determination of adequate shutdown margin by Specification 3.3.A ensures that the reactor will not become critical.

Therefore, the Standby Liquid Control System is not required to be operable when only a single control rod can be withdrawn.

Pump operability testing (by recirculating demineralized water to the test tank)in accordance with Specification 4.6.E is adequate to detect if failures have occurred. Flow, circuitry, and trigger assembly testing at the prescribed intervals assures a high reliability of system operation capability. The maximum SLCS pump discharge pressure during the limiting ATWS event is 1325 psig. This value is based on a reactor vessel lower plenum pressure of 1292 psia that occurs during the limiting ATWS event at the time of SLCS initiation, i.e., 120 seconds into the event. There is adequate margin to prevent the SLCS relief valve from lifting. Recirculation of the borated solution is done during each operating cycle to ensure one suction line from the boron tank is clear. In addition, at least once during each operating cycle, one of the standby liquid control loops will be initiated to verify that a flow path from a pump to the reactor vessel is available by pumping demineralized water into the reactor vessel.

Amendment No. 102, 114, 128, 175, BVY 03-38, 219, 224, 229 97

VYNPS BASES: 3.4 & 4.4 (Contd)

B. Operation With Inoperable Components Only one of the two standby liquid control pumping circuits is needed for proper operation of the system. If one pumping circuit is found to be inoperable, there is no immediate threat to shutdown capability, and reactor operation may continue while repairs are being made. Assurance that the system will perform its intended function is obtained from the results of the pump and valve testing performed in accordance with the Requirements of Specification 4.6.E.

C. Standby Liquid Control System Tank - Borated Solution The solution saturation temperature varies with the concentration of sodium pentaborate. The solution shall be kept at least 10ºF above the saturation temperature to guard against boron precipitation. The 10ºF margin is included in Figure 3.4.2. Temperature and liquid level alarms for the system are annunciated in the Control Room.

Once the solution has been made up, boron concentration will not vary unless more boron or water is added. Level indication and alarm indicate whether the solution volume has changed which might indicate a possible solution concentration change. Considering these factors, the test interval has been established.

Sodium pentaborate concentration is determined within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following the addition of water or boron, or if the solution temperature drops below specified limits. The 24-hour limit allows for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of mixing, subsequent testing, and notification of shift personnel.

Boron concentration, solution temperature, and volume are checked on a frequency to assure a high reliability of operation of the system should it ever be required. Isotopic tests of the sodium pentaborate are performed periodically to ensure that the proper boron-10 atom percentage is being used.

10CFR50.62(c)(4) requires a Standby Liquid Control System with a minimum flow capacity and boron content equivalent to 86 gpm of 13 weight percent natural sodium pentaborate solution in the 251-inch reactor pressure vessel reference plant. Natural sodium pentaborate solution is 19.8 atom percent boron-10. The relationship expressed in Specification 3.4.C.3 also contains the ratio M251/M to account for the difference in water volume between the reference plant and Vermont Yankee. (This ratio of masses is 628,300 lbs./401,247 lbs.)

To comply with the ATWS rule and the plant-specific ATWS analysis, the combination of three Standby Liquid Control System parameters must be considered: boron concentration, Standby Liquid Control System pump flow rate, and boron-10 enrichment. If the product of the expression in Specification 3.4.C.3 is equal to or greater than 1.29, the Standby Liquid Control System satisfies the requirements of 10CFR50.62(c)(4) and the plant-specific ATWS analysis.

Amendment No. 102, 128, 175, 209, 219, 226, 229 98

vyflPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATIONS 3.5 CORE AND CONTAINMENT COOLING 4.5 CORE AND CONTAINMENT COOLING SYSTEMS SYSTEMS Applicability: Applicability:

Applies to the operational status Applies to periodic testing of of the Emergency the emergency cooling I Cooling Subsystems. subsystems.

Objective: Objective:

To assure adequate cooling To verify the operability of the capability for heat removal in core containment cooling the event of a loss-of-coolant subsystems.

accident or isolation from the normal reactor heat sink.

Specification: Specification:

A. Core Spray and Low Pressure A. Core Spray and Low Pressure Coolant Injection Cooling Injection

1. Except as specified in Surveillance of the Core Specifications 3.5.A.2 Spray and LPCI Subsystems through 3.5.A.4 below shall be performed as and 3.5.H.3 and 3.5.H.4, follows.

both Core Spray and the LPCI Subsystems shall be 1. General Testing operable* whenever irradiated fuel is in the Item Frequency reactor vessel and prior to a reactor startup from the a. Simulated Each re-cold shutdown condition. Automatic fueling Actuation outage Test

b. Operability testing of pumps and valves shall be in accordance with Specification 4.6.E.

c. Flow Rate Each re-Test-Core fueling Spray pumps outage

Note: During Hot Shutdown, LPCI shall deliver subsystems may be considered at least OPERABLE during alignment and 3000 gpm operation for decay heat removal (torus to with reactor vessel pressure torus) less than the RHR shutdown against a cooling permissive pressure, if system head capable of being manually of 120 psig.

realigned and not otherwise Each LPCI inoperable. pump shall deliver 7450 +/- 150 gpm (vessel to vessel).

Amendment No. i-, G-, -321, 449, 4 209 99 AUG14 m

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION

2. From and after the date 2. Deleted.

that one of the Core Spray Subsystems is made or found to be inoperable for any reason, reactor operation is permissible only during the succeeding seven days unless such subsystem is sooner made operable, provided that during such seven days, the other Core Spray Subsystem and the LPCI Subsystems shall be operable.

3. From and after the date 3. Deleted.

that one of the LPCI pumps is made or found to be inoperable for any reason, reactor operation is permissible only during the succeeding seven days unless such pump is sooner made operable, provided that during such seven days, the LPCI and Containment Cooling Subsystem with the inoperable pump is not. otherwise inoperable, and the other LPCI and Containment Cooling Subsystem and both Core Spray Subsystems shall be operable.

Amendment No. G, 4, -i", Gil, Gee, 213 100

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION

4. From and after the date 4. Deleted.

that a LPCI Subsystem is made or found to be inoperable for any reason, reactor operation is permissible only during the succeeding seven days unless it is sooner made operable, provided that during that time the other LPCI and the Containment Cooling Subsystem and the Core Spray Subsystems shall be operable.

Amendment No. Gq, a-i4, a 18, g --

4, 213 101

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION

5. All recirculation pump 5. Operability testing of discharge valves and recirculation pump bypass valves shall be discharge valves and operable or closed prior bypass valves shall be to reactor startup. in accordance with Specification 4.6.E.

6. If the requirements of Specifications 3.5.A cannot be met, an orderly shutdown of the reactor shall be initiated and the reactor shall be in a cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . B. Containment Spray Cooling Capability B. Containment Spray Cooling 1. Surveillance of the Capability drywell spray loops shall be performed as

1. Both containment cooling follows. An air test I spray loops are required shall be performed on to be operable when the the drywell spray reactor water headers and nozzles temperature is greater following maintenance than 2120 F except that a that could result in Containment Cooling nozzle blockage.

Subsystem may be inoperable for thirty days.

2. Deleted.

2. If this requirement cannot be met, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Amendment No. Go, -. 11, 444, 44-&, &, 2G49, 2-2i 228 102

VYnPS 3.5 -LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION C. Residual Heat Removal (RHR) C. Residual Heat Removal (RHP)

Service Water System Service Water System Surveillance of the RHR Service Water System shall be performed as follows:

1. Except as specified in 1. RHR Service Water Specifications 3.5.C.2, Subsystem testing:

and 3.5.C.3 below, both RHR Service Water operability testing of Subsystem loops shall be pumps and valves-shall be operable whenever in accordance with irradiated fuel is in the Specification 4.6.E.

reactor vessel and prior to reactor startup from a cold condition.

2. From and after the date 2. Deleted.

that one of the RHR service water pumps is made or found to be inoperable for any reason, reactor operation is permissible only during the succeeding thirty days unless such pump is sooner made operable, provided that during such thirty days, the RHR Service Water Subsystem with the inoperable pump is not otherwise inoperable and the other RHR Service Water Subsystem is operable.

3. From and after the date 3. Deleted.

that one RHR Service Water Subsystem is made or found to be inoperable for any reason, reactor operation is permissible only during the succeeding seven days unless such subsystem is sooner made operable, provided that during such seven days, the other RHR Service Water Subsystem and both Core Spray Subsystems shall be operable.

Amendment No. '14, s8, a-Ge, 2G, 213 103

VYNPS 3.5 LIMITING CONDITION FOR 4 .5 SURVEILLANCE REQUIRENT OPERATION

4. If the requirements of Specification 3.5.C cannot be met, an orderly shutdown shall be initiated and the reactor shall be in a cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

D. Station Service Water and D. Station Service Water and Alternate Cooling Tower Alternate Cooling Tower Systems Systems

1. Except as specified in Surveillance of the Station Specifications 3.5.D.2 Service Water and Alternate and 3.S.D.3, the Station Cooling Tower Systems shall Service Water System and be performed as follows:

both essential equipment cooling loops and the 1. Operability testing of alternate cooling tower pumps and valves shall be shall be operable in accordance with whenever irradiated fuel Specification 4.6.E.

is in the reactor vessel and reactor coolant temperature is greater than 212 0F.

2. From and after the date 2. Deleted.

that the Station Service Water System is made or found to be unable to provide adequate cooling to one of the two essential equipment cooling loops, reactor operation is permissible only during the succeeding 15 days unless adequate cooling capability to both essential equipment cooling loops is restored sooner, provided that during such 15 days, the remaining essential equipment cooling loop and the Station Service Water and Alternate Cooling Tower Systems are operable.

Amendment No. bi44 2-&, 4-G6, b-0G, 213 104

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLAANCE REQUIREMENT OPERATION

3. From and after the date 3. Deleted.

that the Alternate Cooling Tower System is made or found to be inoperable for any reason, reactor operation is permissible only during the succeeding seven days, unless the Alternate Cooling Tower System is sooner made operable, provided that during such seven days, the Station Service Water System and both essential equipment cooling loops are operable.

4. If the requirements of Specification 3.5.D cannot be met, an orderly shutdown shall be initiated and the reactor shall be in a cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

E. High Pressure Cooling E. High Pressure Coolant Injection (HPCI) System Injection (HPCI) System Surveillance of HPCI System shall be performed as follows:

1. Except as specified in 1. Testing Specification 3.5.E.2, whenever irradiated fuel a. A simulated automatic is in the reactor vessel actuation test of the and reactor steam HPCI System shall be pressure is greater than performed during each 150 psig: refueling outage.

b. Operability testing of

a. The HPCI System shall the pump and valves be operable. shall be in accordance with Specification

b. The condensate storage 4.6.E.

tank shall contain at least 75,000 gallons c. Upon reactor startup, of condensate water. HPCI operability testing shall be performed as required by Specification 4.6.E within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after exceeding 150 psig reactor steam pressure.

Amendment No. G4, ii4, a;?9, ARC6,, sAl, C9, 213 105

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION

2. From and after the date d. The HPCI System shall that the HPCI System is deliver at least 4250 made-or found to be gpm at normal reactor inoperable for any reason, operating pressure when reactor operation is recirculating to the permissible only during Condensate Storage the succeeding 14 days Tank.

unless such system is sooner made operable, 2. Deleted.

provided that:

a. The RCIC System is immediately verified by administrative means to be operable, and

b. During such 14 days, I the Automatic Depressurization System, the Core Spray Subsystems, the LPCI Subsystems, and the RCIC System are operable.

3. If the requirements of either Specification 3.5.E or Specification 4.5.E.l.c cannot be met, an orderly shutdown shall be initiated and the reactor pressure shall be reduced to

150 psig within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

F. Automatic Depressurization F. Automatic Depressurization System System

1. Except as specified in Surveillance of the Automatic Specification 3.5.F.2 Depressurization System shall below, the entire be performed as follows:

Automatic Depressurization Relief 1. Operability testing of System shall be operable the relief valves shall at any time the reactor be in accordance with steam pressure is above Specification 4.6.E.

150 psig and irradiated fuel is in the reactor vessel.

2. From and after the date 2. Deleted.

that one of the four relief valves of the Automatic Depressurization Subsystem are made or found to be inoperable Amendment No. , 4'4, 444, l44, 7 #8-,

o, #4, 213 106

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION due to malfunction of the electrical portion of the valve when the reactor is pressurized above 150 psig with irradiated fuel in the reactor vessel, continued reactor operation is permissible only during the succeeding seven days unless such a valve is sooner made operable, provided that during such seven days both the remaining Automatic Relief System valves and the HPCI System are operable.

3. If the requirements of Specification 3.5.F cannot be met, an orderly shutdown shall be initiated and the reactor pressure shall be reduced to < 150 psig within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

G. Reactor Core Isolation G. Reactor Core Isolation Cooling System (RCIC) Cooling System (RCIC)

1. Except as specified in Surveillance of the RCIC Specification 3.5.G.2 System shall be performed as below, the RCIC System follows:

shall be operable whenever the reactor 1. Testing steam pressure is greater than 150 psig and a. A simulated automatic irradiated fuel is in the actuation test of the reactor vessel. RCIC System shall be I performed during each

2. From and after the date refueling outage.

that the RCIC System is made or found to be b. Operability testing of inoperable for any the pump and valves reason, reactor operation shall be in accordance is permissible only with Specification during the succeeding 4.6.E.

14 days unless such system is sooner made c. Upon reactor startup, operable, provided that: RCIC operability testing shall be

a. The HPCI System is performed as required immediately verified by Specification 4.6.E by administrative within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after means to be operable, exceeding 150 psig and reactor steam pressure.

Amendment No. a4, 27, 1ly, aaa, 64, 7, -es , 216 3107

VYNPS 3.:5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION

b. During such 14 days, d. The RCIC System shall the HPCI System is deliver at least 400 operable. gpm at normal reactor operating pressure when

3. If the requirements of recirculating to the either Specification Condensate Storage 3.5.G or Specification Tank.

4.5.G.1.c cannot be met, an orderly shutdown shall be initiated and the reactor pressure shall be reduced to < 150 psig within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

H. Minimum Core and Containment H. Minimum Core and Containment Cooling System Availability Cooling System Availability

1. Deleted. 1. Deleted.

I

2. Any combination of inoperable components in the Core and Containment Cooling Systems shall not defeat the capability of the remaining operable components to fulfill the core and containment cooling functions.

3. When irradiated fuel is in the reactor vessel and the reactor is in either a refueling or cold shutdown condition, all Core and Containment Cooling Subsystems may be inoperable provided no work is permitted which has the potential for draining the reactor vessel.

Amendment No. , 44, 1C4, -177, 9, a-9S, a, 213 108

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION

4. When (1) irradiated fuel is in the reactor vessel; (2) the reactor is in either a cold shutdown or refueling condition; and (3) operations with a potential for draining the reactor vessel are in progress:

a. Two low pressure ECCS injection/spray subsystems and one diesel generator associated with one of the ECCS subsystems shall be operable.

b. A source of water

>300,000 gallons shall be available to the operable ECCS subsystems. With S300,000 gallons available, all ECCS injection/spray subsystems shall be considered inoperable.

c. With Specification 3.5.H.4.a not met, but with one low pressure ECCS injection/spray subsystem operable, restore compliance within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

d. If the required action and associated completion time of Specification 3.5.H.4.c are not met, or if no low pressure ECCS injection/spray subsystems are operable, immediately initiate action to suspend operations with a potential for draining the reactor vessel.

Amendment No. 4-2-8, 195 109 NOV 17 2000

VYNPS 3.5 LIMITING CONDITION FOR 4.5 SURVEILLANCE REQUIREMENT OPERATION I. Maintenance of Filled I. Maintenance of Filled Discharge Pipe Discharge Pipe Whenever core spray The following surveillance subsystems, LPCI subsystem, requirements shall be adhered HPCI, or RCIC are required to to to assure that the be operable, the discharge discharge piping of the core piping from the pump spray subsystems, LPCI discharge of these systems to subsystem, HPCI and RCIC are the last block valve shall be filled:

filled.

1. Every month and prior to the testing of the LPCI subsystem and core spray subsystem, the discharge piping of these systems shall be vented from the high point and water flow observed.

2. Following any period where the LPCI subsystem or core spray subsystems have not been required to be operable, the discharge piping of the inoperable system shall be vented from the high point prior to the return of the system to service.

3. Whenever the HPCI or RCIC system is lined up to take suction from the torus, the discharge piping of the HPCI and RCIC shall be vented from the high point of the system and water flow observed on a monthly basis.

Amendment No. +2-&,195 109a NOV 17 2DJO

VYNPS BASES:

3.5 CORE AND CONTAINMENT COOLANT SYSTEMS A. Core Spray Cooling System and Low Pressure Coolant Injection System This Specification assures that adequate standby cooling capability is available whenever irradiated fuel is in the Reactor Vessel.

Based on the loss-of-coolant analyses, the Core Spray and LPCI Systems provide sufficient cooling to the core to dissipate the energy associated with the loss-of-coolant accident and to limit the accident-caused core conditions as specified in 10CFR50, Appendix K. The analyses consider appropriate combinations of the two Core Spray Subsystems and the two LPCI Subsystems associated with various break locations and equipment availability in accordance with required single failure assumptions.

(Each LPCI Subsystem consists of the LPCI pumps, the recirculation pump discharge valve, and the LPCI injection valve which combine to inject torus water into a recirculation loop.)

The LPCI System is designed to provide emergency cooling to the core by flooding in the event of a loss-of-coolant accident. This system is completely independent of the Core Spray System; however, it does function in combination with the Core Spray System to prevent excessive fuel clad temperature. The LPCI and the Core Spray Systems provide adequate cooling for break areas up to and including the double-ended recirculation line break without assistance from the high pressure emergency Core Cooling Subsystems.

Specification 3.5.A.1 is modified by a Note that allows LPCI subsystems to be considered OPERABLE during alignment and operation for decay heat removal with reactor pressure less than the RHR shutdown cooling permissive pressure, if capable of being manually realigned (remote) to the LPCI mode and not otherwise inoperable. This allows operation in the RHR shutdown cooling mode during Hot Shutdown, if necessary.

The intent of these specifications is to prevent startup from the cold condition without all associated equipment being operable. However, during operation, certain components may be out of service for the specified allowable repair times. Assurance that the systems will perform their intended function is obtained from the results of the pump and valve testing performed in accordance with the requirements of Specification 4.6.E.

B. and C. Containment Spray Cooling Capability and RHR Service Water System The containment heat removal portion of the RHR System is provided to remove heat energy from the containment in the event of a loss-of-coolant accident. For the flow specified, the containment long-term pressure is limited to less than 5 psig and, therefore, the flow is more than ample to provide the required heat removal capability.

Reference:

Section 14.6.3.3.2 FSAR.

Each Containment Cooling Subsystem consists of two RHR service water pumps, 1 heat exchanger, and 2 RHR (LPCI) pumps. Either set of equipment is capable of performing the containment cooling function. In fact, an analysis in Section 14.6 of the FSAR shows that one subsystem consisting of 1 RHR service water pump, 1 heat exchanger, and 1 RHR pump has sufficient capacity to perform the cooling function. Assurance that the systems will perform their intended function is obtained from the results of the pump and valve testing performed in accordance with the requirements of Specification 4.6.E.

Amendment No. 27, 114, 128, 199, 209, 226 110

VYNPS BASES: 3.5 (Cont'd)

D. Station Service Water and Alternate Cooling Tower Systems The Station Service Water System consists of pumps, valves and associated piping necessary to supply water to two essential equipment cooling loops and additional essential and nonessential equipment cooling loads. Each of the two Station Service Water essential equipment cooling loops includes valves, piping and associated instrumentation necessary to provide a flowpath to essential equipment. The Station Service Water essential equipment cooling loops provide redundant heat sinks to dissipate residual heat after a shutdown or accident. Each Station Service Water essential equipment cooling loop provides sufficient heat sink capacity to perform the required heat dissipation. Analyses have shown that any two service water pumps are capable of providing adequate cooling capability to the essential equipment cooling loops. To ensure this capability, four Service Water pumps and two Service Water essential equipment cooling loops must be operable. This ensures that at least two operable Service Water Pumps and one operable essential equipment cooling loop will be available in the event of the worst single active failure occurring coincident with a loss of off-site power. A Service Water pump is considered operable when it is capable of taking suction from an intake bay and transferring water to a Service Water essential equipment cooling loop at the specified pressures and flow rates. An essential equipment cooling loop is considered operable when it has a flow path capable of transferring water to the essential equipment, when required.

The Alternate Cooling Tower System will provide the necessary heat sink for normal post-shutdown conditions in the event that the Station Service Water System becomes incapacitated due to a loss of the Vernon Dam with subsequent loss of the Vernon Pond, flooding of the Service Water intake structure (due to probable maximum flood in the river or an upstream dam failure) or fire in the Service Water intake structure which disables all four Service Water pumps.

If one or more Station Service Water component(s) are inoperable such that the Station Service Water System would not be capable of performing its safety function, assuming a single active failure (e.g., a pump, valve or diesel generator), then at least one essential equipment cooling loop is inoperable. If one or more component(s) are inoperable such that the Station Service Water System would not be capable of performing its safety function, even without assuming a single active failure, then both essential equipment cooling loops are inoperable.

Although the Station Service Water (SSW) System can perform its safety function with only two operable SSW pumps, the SSW System may not be capable of performing its safety function assuming one or two inoperable SSW pumps and assuming a worst case single active failure (e.g., failure of a diesel generator, SSW pump, SSW valve, etc.). Therefore, reactor operation with one or two inoperable SSW pumps is limited to 15 days provided that during this time both the normal and emergency power supplies for the remaining operable SSW pumps are also operable, in addition to requiring the operability of all remaining active components of the SSW system which perform a safety function and the alternate cooling tower fan.

If the SSW System would not be capable of performing its safety function for a reason other than one or two SSW pumps being inoperable, assuming a worst case single active failure (e.g., failure of a diesel generator, Amendment No. 27, 114, 169, 209 111

VYNPS BASES: 3.5 (Cont'd)

SSW pump, SSW valve, etc.), then reactor operation is limited to 15 days provided that during this time both the normal and emergency power supplies for the remaining operable equipment are also operable, in addition to requiring the operability of all remaining active components of the SSW system which perform a safety function and the alternate cooling tower fan.

If the SSW System would not be capable of performing its safety function for any reason, even without assuming a worst case single active failure, then the reactor must be placed in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

E. High Pressure Coolant Injection System The High Pressure Coolant Injection System (HPCIs) is provided to adequately cool the core for all pipe breaks smaller than those for which the LPCI or Core Spray Cooling Subsystems can protect the core.

The HPCIs meets this requirement without the use of outside power. For the pipe breaks for which the HPCIs is intended to function the core never uncovers and is continuously cooled; thus, no clad damage occurs and clad temperatures remain near normal throughout the transient.

Reference:

Subsection 6.5.2.2 of the FSAR.

In accordance with Specification 3.5.E.2, if the HPCI System is inoperable and the RCIC System is verified to be operable, the HPCI System must be restored to operable status within 14 days during reactor power operation. In this condition, adequate core cooling is ensured by the operability of the redundant and diverse low pressure emergency core cooling system (ECCS) injection and spray subsystems in conjunction with the Automatic Depressurization System (ADS). Also, the RCIC System will automatically provide makeup water at reactor operating pressures above 150 psig. During reactor power operation, immediate verification of RCIC operability is therefore required when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is out of service for maintenance or other reasons. It does not mean it is necessary to perform the surveillances needed to demonstrate the operability of the RCIC System.

If operability of the RCIC System cannot be verified, however, Specification 3.5.E.3 requires that an orderly shutdown be initiated and reactor pressure reduced to 150 psig within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

F. Automatic Depressurization System The Automatic Depressurization System (ADS) consists of the four safety-relief valves and serves as a backup to the High Pressure Coolant Injection System (HPCI). ADS is designed to provide depressurization of the reactor coolant system during a small break loss-of-coolant accident if HPCI fails or is unable to maintain sufficient reactor water level.

Since HPCI operability is required above 150 psig, ADS operability is also required above this pressure.

ADS operation reduces the reactor pressure to within the operating pressure range of the low pressure coolant injection and core spray systems, so that these systems can provide reactor coolant inventory makeup.

Amendment No. 27, 114, 169, 177, 195, 205, 209 111a

VYNPS BASES: 3.5 (Cont'd)

G. Reactor Core Isolation Cooling System The Reactor Core Isolation Cooling System (RCIC) is provided to maintain the water inventory of the reactor vessel in the event of a main steam line isolation and complete loss of outside power without the use of the emergency core cooling systems. The RCIC meets this requirement.

Reference Section 14.5.4.4 FSAR. The HPCIS provides an incidental backup to the RCIC system such that in the event the RCIC should be inoperable no loss of function would occur if the HPCIS is operable.

In accordance with specification 3.5.G.2, if the RCIC System is inoperable and the HPCI System is verified to be operable, the RCIC System must be restored to operable status within 14 days during reactor power operation. In this condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high reactor pressure since the HPCI System is the only high pressure system assumed to function during a loss of coolant accident. Operability of HPCI is therefore verified immediately when the RCIC System is inoperable during reactor power operation. This may be performed as an administrative check, by examining logs or other information, to determine if HPCI is out of service for maintenance or other reasons. It does not mean it is necessary to perform surveillances needed to demonstrate the operability of the HPCI System. If the operability of the HPCI System cannot be verified, however, Specification 3.5.G.3 requires that an orderly shutdown be initiated and reactor pressure reduced to 150 psig within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCI) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of the reactor water level. therefore, a limited time (14 days) is allowed to restore the inoperable RCIC System to operable status.

H. Minimum Core and Containment Cooling System Availability The core cooling and containment cooling subsystems provide a method of transferring the residual heat following a shutdown or accident to a heat sink. Based on analyses, this specification assures that the core and containment cooling function is maintained with any combination of allowed inoperable components.

Operability of low pressure ECCS injection/spray subsystems is required during cold shutdown and refueling conditions to ensure adequate coolant inventory and sufficient heat removal capability for the irradiated fuel in the core in case of inadvertent draindown of the vessel. It is permissible, based upon the low heat load and other methods available to remove the residual heat, to disable all core and containment cooling systems for maintenance if the reactor is in cold shutdown or refueling and there are no operations with a potential for draining the reactor vessel (OPDRV). However, if OPDRVs are in progress with irradiated fuel in the reactor vessel, operability of low pressure ECCS injection/spray subsystems is required to ensure capability to maintain adequate reactor vessel water level in the event of an inadvertent vessel draindown. In this condition, at least 300,000 gallons of makeup water must be available to assure core flooding capability. In addition, only one diesel generator associated with one of the ECCS injection/spray subsystems is required to be operable in this condition since, upon loss of normal power supply, one ECCS subsystem is sufficient to meet this function.

Amendment No. 205, 214 111b

VYNPS BASES: 3.5 (Cont'd)

The low pressure ECCS injection/spray subsystems consist of two core spray (CS) and two low pressure coolant injection (LPCI) subsystems.

During cold shutdown and refueling conditions, each CS subsystem requires one motor driven pump, piping, and valves to transfer water from the suppression pool or condensate storage tank to the reactor pressure vessel (RPV). Also, during cold shutdown and refueling conditions, each LPCI subsystem requires one motor driven pump, piping, and valves to transfer water from the suppression pool to the RPV. Under these conditions, only a single LPCI pump is required per subsystem because of the larger injection capacity in relation to a CS subsystem. During shutdown and refueling conditions, LPCI subsystems may be considered operable during RHR system alignment and operation for decay heat removal, if those subsystems are capable of being manually realigned to the LPCI mode and are not otherwise inoperable. Because of low pressure and low temperature conditions during cold shutdown and refueling, sufficient time will be available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated fuel uncovery.

I. Maintenance of Filled Discharge Pipe Full discharge lines are required when the core spray subsystems, LPCI subsystems, HPCI and RCIC are required to be operable to preclude the possibility of damage to the discharge piping due to water hammer action upon a pump start.

Amendment No. 18, BVY 99-144, 195, 205, 209 112

VYNPS BASES:

4.5 CORE AND CONTAINMENT COOLANT SYSTEMS A. Core Spray and LPCI During normal plant operation, manual tests of operable pumps and valves shall be conducted in accordance with Specification 4.6.E to demonstrate operability.

During each refueling shutdown, tests (as summarized below) shall be conducted to demonstrate proper automatic operation and system performance.

Periodic testing as described in Specification 4.6.E will demonstrate that all components which do not operate during normal conditions will operate properly if required.

The automatic actuation test will be performed by simulation of high drywell pressure or low-low water level. The starting of the pump and actuation of valves will be checked. The normal power supply will be used during the test. Testing of the sequencing of the pumps when the diesel generator is the source of power will be checked during the testing of the diesel. Following the automatic actuation test, the flow rate will be checked by recirculation to the suppression chamber.

The pump and valve operability checks will be performed by manually starting the pump or activating the valve. For the pumps, the pump motors will be run long enough for them to reach operating temperatures.

B. and C. Containment Spray Cooling Capability and RHR Service Water Systems The periodic testing requirements specified in Specifications 4.5.B and C will demonstrate that all components will operate properly if required. Since this is a manually actuated system, no automatic actuation test is required. The system will be activated manually and the flow checked by an indicator in the control room.

Surveillance 4.5.B.1 is performed following maintenance that could result in nozzle blockage, to verify that the spray nozzles are free of obstructions by blowing air through them and demonstrating an open flow path. The frequency for performance of this surveillance test is adequate due to the passive nozzle design, its normally dry state and has been shown to be acceptable through operating experience.

Amendment No. 27, 114, 128, 177, 228 113

VYNPS BASES: 4.5 (Cont'd)

D., E., and F. Station Service Water and Alternate Cooling Tower Systems and High Pressure Coolant Injection and Automatic Depressurization System HPCI system testing demonstrates operational readiness of equipment and detects degradations which may affect reliable operation. Testing is conducted during each reactor startup if maintenance that affects operability was performed on the HPCI system. Periodic testing is also performed in accordance with Specification 4.6.E and the inservice testing program.

Sufficient steam flow must be available prior to HPCI testing to avoid inducing an operational transient when steam is diverted to the HPCI system. Reactor startup is allowed prior to performing the required surveillance testing in order to achieve adequate steam pressure and flow. However, a 24-hour limitation is imposed for performing operability testing once reactor steam pressure exceeds 150 psig. The short duration before full functional testing is performed is considered acceptable.

The Automatic Depressurization System is tested during refueling outages to avoid an undesirable blowdown of the Reactor Coolant System.

The HPCI Automatic Actuation Test will be performed by simulation of the accident signal. The test is normally performed in conjunction with the automatic actuation of all Core Standby Cooling Systems.

G. Reactor Core Isolation Cooling System The frequency and conditions for testing of the RCIC system are the same as for the HPCI system. Testing is conducted in accordance with Specification 4.6.E and provides assurance that the system will function as intended.

H. Minimum Core and Containment Cooling System Availability Deleted.

I. Maintenance of Filled Discharge Pipe Observation of water flowing from the discharge line high point vent as required by Specification 4.5.I assures that the Core Cooling Subsystems will not experience water hammer damage when any of the pumps are started. Core Spray Subsystems and LPCI Subsystems will also be vented through the discharge line high point vent following a return from an inoperable status to assure that the system is "solid" and ready for operation.

Amendment No. 18, 27, 114, 128, 177, 209, 228 114

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION 3.6 REACTOR COOLANT SYSTEM 4.6 REACTOR COOLANT SYSTEM Applicability: Applicability:

Applies to the operating status Applies to the periodic of the reactor coolant system. examination and testing requirements for the reactor coolant system.

Objective: Objective:

To assure the integrity and safe To determine the condition of the operation of the reactor coolant reactor coolant system and the system. operation of the safety devices related to it.

Specification: Specification:

A. Pressure and Temperature A. Pressure and Temperature Limitations Limitations

1. The reactor coolant 1. The reactor coolant system temperature and temperature and pressure pressure shall be limited shall be recorded at in accordance with the least once per hour limit lines shown on during system heatup, Figures 3.6.1, 3.6.2 and cooldown and inservice 3.6.3, as appropriate. leak and hydrostatic testing operations.

2. The maximum heatup or 2. The reactor coolant cooldown rate is 100'F temperature and pressure when averaged over any shall be recorded at the one hour period. time of reactor criticality.

3. The reactor vessel head 3. When the reactor vessel bolting shall not be head bolting is being tensioned unless the tightened or loosened, temperature of the vessel the reactor vessel shell head flange and the head temperature immediately is greater than 70'F. below the vessel flange shall be permanently recorded.

4. The pump in an idle recirculation loop shall 4. Prior to and after not be started unless the startup of an idle temperatures of the recirculation loop, the coolant within the idle temperature of the and operating reactor coolant in the recirculation loops are operating and idle loops within 50'F of each other. shall be recorded.

Amendment No. 23, 203 115 MAY 0 4 2001

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION B. Coolant Chemistry B. Coolant Chemistry

1. a. During reactor power 1. a. A sample of reactor operation, the coolant shall be radioiodine taken at least every concentration in the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months and reactor coolant analyzed for shall not exceed radioactive iodines 1.1 microcuries of of 1-131 through I-131 dose I-135 during power equivalent per gram operation. In of water, except as addition, when steam allowed in jet air ejector Specification monitors indicate an 3.6.B.l.b. increase in radioactive gaseous effluents of 25 percent or 5000 dCi/sec, whichever is greater, during steady state reactor operation a reactor coolant sample shall be taken and analyzed for radioactive iodines.

Amendment No. 23, O6, 2-GOa. 218

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION

b. The radioiodine b. An isotopic concentration in analysis of a the reactor coolant reactor coolant shall not exceed sample shall be 1.1 microcuries of made at least once I-131 dose per month.

equivalent per gram of water, for greater than 24 consecutive hours.

c. The radioiodine c. Whenever the concentration in radioiodine the reactor coolant concentration of shall not exceed prior steady-state 4.0 microcuries of reactor operation 1-131 dose is greater than equivalent per gram 0.011 pCi/gm but of water. less than 0.11 ACi/gm, a sample of reactor coolant shall be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the next reactor startup and analyzed for radioactive iodines of I-131 through I-135.

d. Whenever the radioiodine concentration of prior steady-state reactor operation is greater than 0.11 ACi/gm, a sample of reactor coolant shall be taken prior to the next reactor startup and analyzed for radioactive iodines of 1-131 through I-135, as well as within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following a reactor startup. I Amendment No. 91 117

3.6 LIMI::NG CON-:7:: SFCR 4. -3 3:--RV--E-:zL.NCE RE_:QU IREXE-"NT-.

OPERA T I.,

e. ',;ith the rac _ od_-e concentration -

reactor coolant areater than

.1 microcur es:

cram dose equiva.en.

--13', a sample of reactcr coolan:

shall be taken ever-4 hours and analyzes for radioactive iodines of I-131 through 1-135, uznt_-:

the specific activity of the reactor coolant is restored below 1.1 microcuries/

gram dose equivalent.

1-131.

2. If Specification 3.6.B

.s not met, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

C. Coolant Leakage C. Coolant Leakage l.a. Any time irradiated 1. Reactor coolant system fuel is in the reactor leakage, for the purpose vessel and reactor of satisfying coolant temperature is Specification 3.6.C.1, above 2120 F, reactor shall be checked and coolant leakage into logged once per shift, the primary not to exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

containment from unidentified sources shall not exceed 5 gpm. In addition, the total reactor coolant system leakage into the primary containment shall not exceed 25 gpm.

b. While in the run mode, reactor coolant leakage into the I primary containment from unidentified sources shall pot Amendment No. 94, 4-3-, 4-E64,190 118

'1UL I 8 En

3.6 '-:M:TNG rCcnD:T:CNS FOR 4.6 .1 ---- 7 OPERAT: ON increase by more than 2 gpm wit;hn any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ceriod.

2. Both the sump and aqr sampling systems sha" be operable during power operation. From and after the date that one of these systems is made or

.ound inoperable for any reason, reactor operation is permissible only during succeeding seven days.

3. If these conditions cannot be met, initiate an orderly shutdown and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Amendment No. 139, 190 119 JUL 18 2000

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION

2. Operability testing of safety-related pumps and valves shall be performed in accordance with the Code of Record as required by 10 CFR 50.55a, except where specific written relief has been granted by the NRC.

F. Jet Pumps F. Jet Pumps

1. Whenever the reactor is 1. Whenever there is in the startup/hot recirculation flow with standby or run modes, all the reactor in the jet pumps shall be intact startup/hot standby or and all operating jet run modes, jet pump pumps shall be operable. integrity and operability If it is determined that shall be checked daily by a jet pump is inoperable, verifying that the an orderly shutdown shall following two conditions be initiated and the do not occur reactor shall be in a simultaneously:

cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . a. The recirculation pump flow differs by more than 10% from the established speed-flow characteristics.

b. The indicated total core flow is more than 10% greater than the core flow value derived from established power-core flow relationships.

2. Flow indication from each 2. In the event that the jet of the twenty jet pumps pump(s) fail the tests in shall be verified prior Specifications 4.6.F.l.a to initiation of reactor and 4.6.F.l.b, determine startup from a cold their operability by shutdown condition. verifying that each individual jet pump AP%

deviation from average loop AP does not vary from its normal established deviation by more than 10%.

Amendment No. 4a, 9, 4-44, 4-9., 226 121

C.a VYN PS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION

3. The indicated core flow 3. The surveillance is the sum of the flow requirements of 4.6.F.1 indication from each of and 4.6.F.2 do not apply the twenty jet pumps. If to the idle loop and flow indication failure associated jet pumps when occurs for two or more in single loop operation.

jet pumps, immediate corrective action shall 4. The baseline data be taken. If flow required to evaluate the indication for all but conditions in one jet pump cannot be Specifications 4.6.F.1 obtained within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and 4.6.F.2 shall be an orderly shutdown shall acquired each operating be initiated and the cycle. Baseline data for reactor shall be in a evaluating 4.6.F.2 while cold shutdown condition in single loop operation within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . shall be updated as soon as practical after G. Single Loop Operation entering single loop operation.

1. The reactor may be started and operated or operation may continue with a single recirculation loop provided that:

a. The designated adjustments for APRM flux scram setting (Specification 2.1.A.l.a and Table 3.1.1), rod block monitor trip setting (Table 3.2.5), MCPR fuel cladding integrity safety limit (Specifi-cation 1.1.A), and MCPR operating limits and MAPLHGR limits, provided in the Core Operating Limits Report, are initiated within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . During the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , either these adjustments must be completed or the reactor brought to Hot Shutdown.

Amendment No. 4-, .94, -6, 4-4-, 4--, 4-8-, 4-96 211 122 AUG 27 2002

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION

b. The requirements for avoiding potentially unstable thermal hydraulic conditions defined in Technical Specification 3.6.J are met.

c. The idle loop is isolated by electrically disarming the breaker to the recirculation pump motor generator set drive motor prior to startup or, if disabled during reactor operation, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and until such time as the inactive recirculation loop is to be returned to service.

d. The recirculation system controls will be placed in the manual flow control mode.

Amendment No. "I 146 123 AUG 9 1995

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION This page hasibeen deleted.

Amendment No. .4 146 124 AUG 9 1995

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION This page has been deleted.

Amendment No. "1146 125 AUG 9 1995

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION H. Recirculation System

1. Operation with one recirculation loop is permitted according to Specification 3.6.G.1.

2. With no Reactor Coolant System recirculation loops in operation, initiate measures such that the unit is in hot shutdown within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Amendment No. A@4, 94, 94, 146 126 AUG 9 1995

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION This page hasibeen deleted.

Amendment No. 4, 146 127 AUG 9 1995

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION This page intentionally left blank Pages 129 through 133 have been deleted Amendment No. 24, 44, -94, 4-44, 230 128

VYNPS 3.6 LIMITING CONDITIONS FOR 4.6 SURVEILLANCE REQUIREMENTS OPERATION J. Thermal Hydraulic Stability J. Thermal Hvdraulic Stability

1. When the reactor mode switch is in RUN:

a. Under normal operating conditions the reactor shall not intentionally be operated within the power flow exclusion region defined in Core Operating Limits Report (COLR).

b. If the reactor has entered the power flow exclusion region (COLR), the operator shall immediately insert control rods and/or increase recirculation flow to establish operation outside of the region.

Amendment No. 34, 44, @4, 4, 146 134 AUG 9 1995

VYNPS Figure 3.6.1 Reactor Vessel Pressure-Temperature Limitations Hydrostatic Pressure and Leak Tests, Core Not Critical 40°F/hr Heatup/Cooldown Limit Valid Through 4.827E8 MWH(t)

_ I _I I_ JI I I I _ I,- .-,1I I 1_/L 1_- I ___

I I -_I_ l I 1200 . , , , . 1

_I1 Bottom Head Curve: _- 1 _, !- _- A I- -- Use minimum of bottom - - - ,- _ I _[

-I-- - tL - - I_, Upper Reions:

fluid temperature and _ _ _ _ I_ _ I _' _ :I _ _ _ _ -_/ Use minimum of downcomer I

I I I' I I s _ region fluid temperature and 1100 _- I_

bottom head surface temperature. __ I _ I I s I- flange region outside surface I I I I I ___I_ -_: w I_:

_ _ _ _ temperature, except when

- - _ _ -- _ 4 -

7 I- - -j- -

I I I _ _ flange temperature is greater

_ than 11 0°F, use only the I

_ _-LT._ _I_ _ _

I I- I - .--#I_!-T---_I_

~__ __I__J) __ I / __I _ TI _ _:::_: I -

downcomer region fluid temperature.

- --- r - --- t- -r- - --- r - - -o L T - - I- -I - --1-- - T - -1I- - - - -I- - t - - L -

i 900

/I e I - - T - -1I- - -

- -- - r- -I- - - __ ,1 In ._ _ _ _ L _ -: _ - - -r -

1- - I - -r >-- - - -_ _ 1 _ _ :_ _ _

- - IL - _l- -IL- -

- ,- -L - _- - ,

I -I - - t - - - - I- - I - - I- - - -- - -I- - t - - - - I - - I _ _, __

0 800 I I I I I I I IL j

_ d _

I _

r-I--

j _ I.I I - _ _ _

tI-t- I-K -

t- -

F - - - - -

-I +-- -

__1-__

_:_ _ e _ -_ I I

ul i_-I

-. - - - ~ ~~_ F1--I--T

- - -1 I

-- --I- -

1 - -

-I - _:- --

1 7 I

1_

l_-I

- - - -- I l I-I I--I

- 1l - - -

_I ---

, 700 I I I _ I_ I

- -4A- - -- -I- - - I{, I ,i iI - - 4- - I I I w I I II I i I I I I I - - - I~~1- -Ir -

-_ -J- _ _,_ _ I If - - - - I - TI, - -I Ir--- -r-- -

T--I -

t - , -I nI-I - II - - - -- L .

I I I I I I I I I- - Bottom Upper V 600 - I - r -I r 1 , - II l _-

- - _ L - -I - j - 6 - 1. - L- - -- I - - - - - Temperature Head Regions -

I I I L I I I - - TI-z r- - r- n-- r - - I- (OF) (psig) (psig)

_ _I_ _ _L-

- - -j -

I L __

I I I I I I 80 0 0 F 500 N ___'_ _ I _ 80 665 253

-I - _ I _ II I I I I It _ _- _

I I w - -

I-.I -- 1-- I -I-I - - I_

_ _1I- -It - 85 712 253 I__ _I__L__ _ _ _I_1 _

I I 90 764 253 Cf 400 Lu 1- -L__'-- __L_ -_ I - - - 95 821 253 I I , I w -

_ _, _ _ - _ :_ - L _- l I _ - - - I- - -- I - - -- - - - 100 885 253

_W_ -T - _ I

_ - - I - n - - rI- -I I I I

-r-,I In I I I I t 105 954 253

--- I ll l 110 1032 253 Quu l - - b l l l l l l s l l I I I I I rI '---- - II I _ _1_ 1 _ 110 1032 842 I I I

-n--I-

- -I I I I_ .- -I- - 7 - 115 1117 885 200 I I I I I I I I I I

I I 120 1211 932

- - t--I- - - -r-I- - - - -- - t -- r- n I- --- - t -

125 1316 984 I I I I I I I I I I I

-- - - -I- - I - _ ^ - I - - e - - - - I - - I _ I _ - __-I-- t- 130 1042 100 I II I I I I I I I I I I I I I I 135 1105

- - -_ - _ - -I- _ _ -I- _ + _

- - -_ _ _ _- _ - _ _L_ -I _ __ - _ _ 4- _

I I- _

I q- _ _- -I - - I-_ 140 1175

- --j - - - -- -

_ I_ I 145 1253 -

III I I I I, I1 0

60 80 100 120 140 160 180 200 TEMPERATURE (F)

Amendment No. ?4, 46-, 4-, .9, 4-Q, 2-3, 24-8, 229 135

VYNPS Figure 3.6.2 Reactor Vessel Pressure-Temperature Limitations Normal Operation, Core Not Critical Upper Regions:

100°Flhr Heatup/Cooldo wn Limit Use minimum of Valid Through 4.827E8 MWH(t) downcomer region fluid i temperature and flange I' I I _,,, I I I ' IB region outside surface temperature, except when flange temperature is I I I I Il I I greater than 140°F, use I I I I II III I only the downcomer region fluid temperature.

1100 , , I , i I I I I otto'm Head Curve: II I I 1I/

4-j

-- - - - -- II- 4 -Use minimum of T- /r ,

_ I- - bottom fluid L_I -I- _ Bottom Upper 1000 - temperatureand ,

I _ __ T aenM Head Ragons

'------ - bottom head surface T -ur

_4__-__;__ __-_l_ temperature. -- :----- -- _

Fl (fosia) (:sia) 80 0 0 900 ~ T - - , - -- - - - -

80 439 253 85 474 253 I I I I I I 90 513 253

0. 95 555 253 L 800 - - - F'- -7 , I 100 603 253

-- I- --- - - - - - - ----

I-Iiij~~ I _I I I I I 105 655 253 i-u 7 _f __I_ I _ LL I _I Y 110 713 253

./-H/-I--

I I I I I I I I _lI 115 m 253 i

_ _ _I _ _I_T_

I I

- - L _ J _ _- -

-1t- - - --

I I I 120 848 253 I _ I _ I I. _ I _

__I_ I l I _ .

-1l - - I I - - L - .1 - -I- - _l_ - L

-i

_4 -_ - - I- I

-I I

- LF -

I I- - -- I I I I 125 9gm 253 600 rt 130 1013 253 0 I I 1 1 1 I I I 135 1108 253

-- -- -- --- - ----- +---I-- 140 1214 253 500 ' ' I ' IT I I ' ' 140 1214 830

-n1~--I---r--l-x/ rn--

I

~~r -- I f- - ,

I 145 1312 889

, I I , I {, , , , , , I I I I I 150 - 953 Ir U, -I-I-- -I II

$ 400 155 - 1024 Ir rL -I

_ _- I_

_ -I

- -I-- L- j - - - - II,, - -t. -LI - I T I 1 160 - 1103

- - I - - -I- - - I I I [- _ + - -I - - F, -

- - I- - I- -Ir - 165 - 1190

- iI- - t i I I I -- - -_ _-_ _ I I I I I I-T I I I I 4 4 170 - 1258 300 - I I I t

L l;__

--- ~l~~ I I

-- :-_-r-l .

- T--T I_

I

--T~

-r----j~~

l;

~- iI 4 T - -j - - - -I I I t~l~

,~~ ~ ~ ~~~~~~~~ ' ' ' , _l__lFl__l--Ll__+_

fi'j

- -; 4-- During tensioning and detensioning operations with the vessel vented and the vessel fluid -

200 -i---- level below the flange regi.n, the flange temperature may be monitored with test

.1... - - -

- - L - Jinstrumentation in lieu of process instrumentation for the downcomer region fluid _

-- r -t temperature and permanent flange region outside surface temperature. The test -_ -_

l- --- 'instrumentation uncertainty must be less than +/- 2°F. The flange region temperatures mustl- - - -

100 l ---- ,e b maintained greater than or equal to 72 *F when monitored with test instrumentation l-- r - during tensioning, detensiDning, and when tensioned. - -- _

1 F_ tl - 7 -7 +-Fe-F- F T1~~I-~+~~ -- '-+--

O(

61II 80 100 12C0 140 160 180 200 TEMPERATURE (°F)

Amendment No. 34s, .9-, 203,, 2414, 229 13 6

V1'NPS Figure 3.6.3 Reactor Vessel Pressure-Temperature Limitations Normal Operation, Core Critical 100°F/hr Heatup/Cooldown Limit If Pressure < 253 psig, Water Level must be within i Normal Range for Power Operation Valid Through 4.827E8 MWH(t)

.I I I I . I . . . . . . , , . . .

. . . I I

I.

I .

. I .. -

Bottom All ,- _---t,' --F ,L . .- 'L -' I' 1

1200 Temp Head Regions

-i_

Bottom Head _--+-

I,._,.

I -.

(F)

\ ,

(Dsig)

\. _,

(Dsei)

a. vs I

_ I I a_- - - - 4 -

Region:

1-

_ Il I _ I _

80 0 1I- II I I I I -

Use minimum of %

1100 80 114 253 253

_I I bottom fluid --

".- I

-I -

I

- ,I -

lI I -I temperature and _- - L- - -- L -

__--r- -- -I Ir - - - L-, - - - III - -

114 402 - bottom head I I I- I _ I I s I 1000 - 115 407 I- -I-surface

- - - temperature. I "I I 116 413 0 - - I #- -I -It- __-- r -t __I_-_

120 439 253 11 - __- I sI I

- - L- -

125 474 253 I I 77 I .I I I I.

900 130 I513 253 0.

rX 135 I555 253 ;;~~~ -; ;; ;; ; I 140 1I303 253 800 1.

+/- 51

__,__11 - ,-r- --- T-I -T --- -- r--

145 355 253 -$ -l-~I-0 LU 150 713 253

-J 700 155 160 1.

777 848 253 253 I~~~ ' Ii+/-1 1 I I-I U) 165 926 253 I' I I I8 I I I I I I I e--s--- -- -I -- I--+a-------+--,--H- -- I--H ---F-III 170 013 253 I r I I I I I I F - I I I I 600 175 108 253 w - - - - - t -

,1 - l I,l, 7 I I I I a,

W.'

180 214 253 ,,~~ , 111 L AL, I-l-T Il---rl---l---jl---l-- T-I -- r-

'LI 180 214 830 500 185 312 889 0.

190 - 953 195 - 1024 400 200 - 1103 205 - 1190

- - I I - I Upprer Reaions:

1 - jI- - -- r I -]I I I_ itL_- I 210 - 1258 Use minimum of II I _l I I I I I I I I_ _I _ I _ _I__I 300 .I I I I I i I I . t 1 downcomer region

-Il- - r 1 r 1 IT LI I r- -,--~~~T~~~-I--- -T- -- - I -- fluid temperature and T

- -'- - r - i

- I -> - _,_ _ flange region outside

-- - r 2 I I_ ,

- r- -

1. .

I I i i;- 1 I-I

-i I

I I

-T--

I I, ,

surface temperature, except when flange I-.I I I

_ -_ I_ I_ I I -

li I

- - -I - -I-I

-I-I 11 temperature is I- - ,- - t - j - -I -- - - r- -

__'__'__ L_ l_ _'_ _ L _ i- _

-I- - . - _:_~~ + _ !1_ __*- -i _I I greater than 180°F,

-- - -I- I- -- - - -I - - - - t - - I I I . I I I -F - +- - I_ _ I I I use only the I I I Il l 100 -- 1------. +1downcomer region t - -I. - - r-~I - l- -I--T -- 1- -j

- l - - l_ -

fluid temperature.

I I I L _ _l _- -- - - -i T -!l -

I_ L. _ I _ J _ _

0 I I I F - l- _ : -; -IL -

l ~l-J 60.00 80.00 100.00 120.00 140.00 160.00 180.00 200.00 TEMPERATURE (°F)

Amendment No. -3, -3, 2--3, 2-8-, 229 137

VYNPS BASES:

3.6 and 4.6 REACTOR COOLANT SYSTEM A. Pressure and Temperature Limitations All components in the Reactor Coolant System are designed to withstand the effects of cyclic loads due to system temperature and pressure changes. These cyclic loads are introduced by normal load transients, reactor trips, and startup and shutdown operations. The various categories of load cycles used for design purposes are provided in Section 4.2 of the FSAR. During startup and shutdown, the rates of temperature and pressure changes are limited so that the maximum specified heatup and cooldown rates are consistent with the design assumptions and satisfy the stress limits for cyclic operation.

The Pressure/Temperature (P/T) curves included as Figures 3.6.1, 3.6.2, and 3.6.3 were developed using 10CFR50 Appendix G, 1995 ASME Code,Section XI, Appendix G (including the Summer 1996 Addenda), and ASME Code Case N-640. These three curves provide P/T limit requirements for Pressure Test, Core Not Critical, and Core Critical. The P/T curves are not derived from Design Basis Accident analysis. They are prescribed to avoid encountering pressure, temperature or temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the reactor pressure boundary, a condition that is unanalyzed.

During heating events, the thermal gradients in the reactor vessel wall produce thermal stresses that vary from compressive at the inner wall to tensile at the outer wall. During cooling events the thermal stresses vary from tensile at the inner wall to compressive at the outer wall. The thermally induced tensile stresses are additive to the pressure induced tensile stresses. In the flange region, bolt preload has a significant affect on stress in the flange and adjacent plates.

Therefore heating/cooling events and bolt preload are used in the determination of the pressure-temperature limitations for the vessel.

The guidance of Branch Technical Position - MTEB 5-2, material drop weight, and Charpy impact test results were used to determine a reference nil-ductility temperature (RTNDT) for all pressure boundary components. For the plates and welds adjacent to the core, fast neutron (E > 1 Mev) irradiation will cause an increase in the RTNDT.

For these plates and welds an adjusted RTNDT (ARTNDT) of 89°F and 73°F (1/4 and 3/4 thickness locations) was conservatively used in development of these curves for core region components. Based upon plate and weld chemistry, initial RTNDT values, predicted peak fast neutron fluence (3.18 x 1017 n/cm2 at the reactor vessel inside surface) for a gross power generation of 4.827 x 108 MWH(t), these core region ARTNDT values conservatively bound the guidance of Regulatory Guide 1.99, Revision 2.

There were five regions of the reactor pressure vessel (RPV) that were evaluated in the development of the P/T Limit curves: (1) the reactor vessel beltline region, (2) the bottom head region, (3) the feedwater nozzle, (4) the recirculation inlet nozzle, and (5) the upper vessel flange region. These regions will bound all other regions in the vessel with respect to considerations for brittle fracture.

Two lines are shown on each P/T limit figure. The dashed line is the Bottom Head Curve. This is applicable to the bottom head area only and includes the bottom head knuckle plates and dollar plates. Based on bottom head fluid temperature and bottom head surface temperature, the reactor pressure shall be maintained below the dashed line at all times.

Amendment No. 33, 62, 81, 93, 94, 120, 146, 203, 218, 229 138

VYNPS BASES: 3. 6 and 4. 6 (Cont Due to convection bottom head area is subject to lower temperatures than the balance of the pressure vessel.

ART~T used for the beltline.

to the same high level of stress as the flange and feedwater nozzle regions. The enveloping curve used for the upper regions of the vessel and provides Operator s with a conservative, but less restrictive PiT limit for the cooler bottom head region.

The solid line is the Upper Region Curve.

bounds all regions of the vessel including the most limiting beltline and flange areas.

temperature requirement (vertical temperature and flange temperature, the reactor pressure shall be maintained below the solid 10CFR50 Appendix G minimum temperature requirement, the allowable pressure based on the flange is much higher than the beltline Therefore, when the flange temperature exceeds the 10CFR50 Appendix G minimum temperature requirement, the reactor pressure shall be maintained below the solid line based on downcomer temperature.

The Pressure Test curve (3. 1) is applicable for heatup/cooldown rates up to 40o F/hr. 2) and the Core Critical curve (3. 3) are applicable for heatup/cooldown rates up to 100o F/hr. In anticipated operational occurrences Integrity Report, SIR 155). For inj ection of 500 F cold water into the nozzle was postulated in the development of all three independently evaluated for AOOs in addition to 40o F/hr and 100o F/hr heatup/cooldown rates.

requirements of the bottom head would be maintained for transients that would bound rapid cooling as well as step increases in temperature.

The rapid cooling event would bound scrams and other upset condition (level B) cold water injection events.

evaluated for a series of step heatup transients.

hot sweep transients typically associated with reinitiation of recirculation flow with stratified conditions in the lower plenum.

This demonstrated that there was significant margin to PiT limits with GE SIL 251 recommendations for reinitiating recirculation flow in stratified conditions.

Adjustments for temperature and pressure instrument uncertainty have been included in the PiT curves 1, 3. 2 and 3. 3).

minimum temperature requirements were all increased by 100 compensate for temperature loop uncertainty error.

pressure values were all decreased by 30psi to account for pressure loop uncertainty error.

further to account for static elevation head assuming the level was at the top of the reactor and at 70o Specification 3. 6 . A. 3 flange and the head be greater than 700 before tensioning. The 700 F is an analytical limit and does not include instrumentation uncertainty, which must be procedurally included depending upon which temperature monitoring instrumentation is being used.

on Figures 3. , 3. 2 and 3. 3 include a 100 instrumentation uncertainty.

Amendment No. 139

VYNPS BASES: 3.6 and 4.6 (Cont'd)

A Note is included in Figure 3.6.2 that specifies test instrumentation uncertainty must be +/- 2°F and the flange region temperatures must be maintained greater than or equal to 72°F when using such instrumentation in lieu of permanently installed instrumentation.

Qualified test instrumentation may only be used for the purpose of maintaining the temperature limit when the vessel is vented and the fluid level is below the flange region. If permanently installed instrumentation (with a 10°F uncertainty) is used during head tensioning and detensioning operations, the 80°F limit must be met.

In order to prevent undue stress on the vessel nozzles and bottom head region, the recirculation loop temperatures will be maintained within 50°F of each other prior to startup of an idle loop.

Vermont Yankee is a participant in the Boiling Water Reactor Vessel and Internals Project Integrated Surveillance Program (ISP) for monitoring changes in the fracture toughness properties of ferritic materials in the reactor pressure vessel (RPV) beltline region. (See UFSAR Section 4.2 for additional ISP details.) As ISP capsule test reports become available for RPV materials representative of VYNPS, the actual shift in the reference temperature for nil-ductility transition (RTNDT) of the vessel material may be re-established. In accordance with Appendix H to 10CFR50, VY is required to review relevant test reports and make a determination of whether or not a change in Technical Specifications is required as a result of the surveillance data.

B. Coolant Chemistry A steady-state radioiodine concentration limit of 1.1 µCi of I-131 dose equivalent per gram of water in the Reactor Coolant System can be reached if the gross radioactivity in the gaseous effluents is near the limit, as set forth in the Offsite Dose Calculation Manual, or if there is a failure or prolonged shutdown of the cleanup demineralizer.

Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure that in the event of a release of any radioactive material to the environment during a design basis accident, radiation doses are maintained within the limits of 10CFR50.67.

The Limiting Conditions for Operation contain iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of DOSE EQUIVALENT I-131. The allowable levels are intended to limit the 2-hour radiation dose to an individual at the site boundary to within 10CFR50.67 dose guidelines.

The iodine spike limit of four (4) microcuries of I-131 dose equivalent per gram of water provides an iodine peak or spike limit for the reactor coolant concentration to assure that the radiological consequences of a postulated LOCA are within 10CFR50.67 dose guidelines.

The reactor coolant sample will be used to assure that the limit of Specification 3.6.B.1 is not exceeded. The radioiodine concentration would not be expected to change rapidly during steady-state operation over a period of 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . In addition, the trend of the radioactive gaseous effluents, which is continuously monitored, is a good indicator of the trend of the radioiodine concentration in the reactor coolant.

When a significant increase in radioactive gaseous effluents is indicated, as specified, an additional reactor coolant sample shall be taken and analyzed for radioactive iodine.

Amendment No. 33, 62, 91, 93, 164, 193, 203, 218, 223 140

INFORMATION ONLY VYNPS ELECTRONIC VERSION BASES: 3.6 and 4.6 (Cont'd)

Whenever an isotopic analysis is performed, a reasonable effort will be made to determine a significant percentage of those contributors representing the total radioactivity in the reactor coolant sample.

Usually at least 80 percent of the total gamma radioactivity can be identified by the isotopic analysis.

It has been observed that radioiodine concentration can change rapidly in the reactor coolant during transient reactor operations, such as reactor shutdown, reactor power changes, and reactor startup if failed fuel is present. As specified, additional reactor coolant samples shall be taken and analyzed for reactor operations in which steady-state radioiodine concentrations in the reactor coolant indicate various levels of iodine releases from the fuel. Since the radioiodine concentration in the reactor coolant is not continuously measured, reactor coolant sampling would be ineffective as a means to rapidly detect gross fuel element failures. However, some capability to detect gross fuel element failures is inherent in the radiation monitors in the off-gas system and on the main steam line.

Isotopic analyses required by Specification 4.6.B.1.b may be performed by a gamma scan and gross beta and alpha determination.

Amendment No. 91, Change 142 (errata), 190, BVY 01-52 141

VYNPS BASES: 3.6 and 4.6 (Cont'd)

C. Coolant Leakage The 5 gpm limit for unidentified leaks was established assuming such leakage was coming from the reactor coolant system. Tests have been conducted which demonstrate that a relationship exists between the size of a crack and the probability that the crack will propagate. These tests suggest that for leakage somewhat greater than the limit specified for unidentified leakage, the probability is small that imperfections or cracks associated with such leakage would grow rapidly. Leakage less than the limit specified can be detected within a few hours utilizing the available leakage detection systems. If the limit is exceeded and the origin cannot be determined in a reasonably short time the plant should be shutdown to allow further investigation and corrective action.

The 2 gpm increase limit in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period for unidentified leaks was established as an additional requirement to the 5 gpm limit by Generic Letter 88-01, "NRC Position on Intergranular Stress Corrosion Cracking (IGSCC) in BWR Austenitic Stainless Steel Piping."

The removal capacity from the drywell floor drain sump and the equipment drain sump is 50 gpm each. Removal of 50 gpm from either of these sumps can be accomplished with considerable margin.

D. Safety and Relief Valves Safety analyses have shown that only three of the four relief valves are required to ensure compliance with the MCPR safety limit for the analyzed transients.

The setpoint tolerance value for as-left or refurbished valves is specified in Section III of the ASME Boiler and Pressure Vessel Code as

+/-1% of set pressure. However, the code allows a larger tolerance value for the as-found condition if the supporting design analyses demonstrate that the applicable acceptance criteria are met. For the purposes of this limiting condition, a relief valve that is unable to actuate within tolerance of its set pressure is considered to be as inoperable as a mechanically malfunctioning valve. Safety analysis has been performed which shows that with all safety and safety relief valves within +/-3% of the specified set pressures in Table 2.2.1 and with one inoperable safety relief valve, the reactor coolant pressure safety limit of 1375 psig and the MCPR safety limit are not exceeded during the limiting overpressure transient.

Change 16/March 28, 1974, 13, 18, 128, 139,150, 160, 164, 190, 229 142

INFORMATION ONLY VYNPS ELECTRONIC VERSION BASES: 3.6 and 4.6 (Cont'd)

E. Structural Integrity and Operability Testing A pre-service inspection of the components listed in Table 4.2-3 of the FSAR was conducted after site erection to assure freedom from defects greater than code allowance; in addition, this serves as a reference base for further inspections. Prior to operation, the reactor primary system was free of gross defects. In addition, the facility has been designed such that gross defects should not occur Amendment No. 139, 164 142a

INFORMATION ONLY VYNPS ELECTRONIC VERSION BASES: 3.6 and 4.6 (Cont'd)

Agreement of indicated core flow with established power-core flow relationships provides the most assurance that recirculation flow is not bypassing the core through inactive or broken jet pumps. This bypass flow is reverse with respect to normal jet pump flow. The indicated total core flow is a summation of the flow indications for the twenty individual jet pumps. The total core flow measuring instrumentation sums reverse jet pump flow as though it were forward flow (except in the case of single loop operation when reverse flow is subtracted from the total jet pump flow). Thus, the indicated flow is higher than actual core flow by at least twice the normal flow through any backflowing pump. Reactivity inventory is known to a high degree of confidence so that even if a jet pump failure occurred during a shutdown period, subsequent power ascension would promptly demonstrate abnormal control rod withdrawal for any power-flow operating map point.

A nozzle-riser system failure could also generate the coincident failure of a jet pump body; however, the converse is not true. The lack of any substantial stress in the jet pump body makes failure impossible without an initial nozzle-riser system failure.

G. Single Loop Operation Continuous operation with one recirculation loop was justified in "Vermont Yankee Nuclear Power Station Single Loop Operation",

NEDO-30060, February 1983, with the adjustments specified in Technical Specification 3.6.G.1.a.

During single loop operation, the idle recirculation loop is isolated by electrically disarming the recirculation pump motor generator set drive motor, until ready to resume two loop operation. This is done to prevent a cold water injection transient caused by an inadvertent pump startup.

Under single loop operation, the flow control is placed in the manual mode to avoid control oscillations which may occur in the recirculation flow control system under these conditions.

H. Recirculation System Twelve hours is a reasonable period of time to reach hot shutdown conditions. Operation of the reactor may not occur without forced recirculation flow.

Amendment No. 18, 92, 94, 141, 146 144

VYNPS This page intentionally left blank Amendment No. 24, 39, 89, 94, 146, 230 145

INFORMATION ONLY VYNPS ELECTRONIC VERSION BASES: 3.6 and 4.6 (Cont'd)

J. Thermal Hydraulic Stability The reactor design criteria is such that thermal hydraulic oscillations are prevented or can be readily detected and suppressed without exceeding specified fuel design limits. To minimize the likelihood of an instability, a power/flow exclusion region to be avoided during normal operation is calculated using the approved methodology as stated in Specification 6.6.C. Since the exclusion region may change each fuel cycle, the limits are contained in the Core Operating Limits Report. Specific directions are provided to avoid operation in this region and to immediately exit upon an entry. Entries into the exclusion region are not part of normal operation. An entry may occur as a result of an abnormal event, such as a single recirculation pump trip. In these events, operation in the exclusion region may be needed to prevent equipment damage, but actual time spent inside the exclusion region is minimized. Though each operator action can prevent the occurrence and protect the reactor from an instability, the APRM flow-biased scram function is designed to suppress global oscillations, the most likely mode of oscillation, prior to exceeding the fuel safety limit. While global oscillations are the most likely mode, protection from out-of-phase oscillations are provided through avoidance of the exclusion region and administrative controls on reactor conditions which are primary factors affecting reactor stability.

Amendment No. 146, 171 145a

VYNPS 3.7 LIMITING CONDITIONS FOR 1 4.7 SURVEILLANCE REQUIREMENTS OPERATION 3.7 STATION CONTAINMENT SYSTEMS 4.7 STATION CONTAINMENT SYSTEMS Applicability: Applicability:

Applies to the operating status Applies to the primary and of the primary and secondary secondary containment system containment systems. integrity.

Objective: Objective:

To assure the integrity of the To verify the integrity of the primary and secondary containment primary and secondary systems. containments.

Specification: Specification:

A. Primary Containment A. Primary Containment

1. Whenever primary 1. Verify daily that the containment is required, suppression chamber water the volume and level and average temperature-of the water temperature are within in the suppression applicable limits.

chamber shall be i maintained within the Verify suppression pool following limits: average temperature is within the applicable

a. Maximum Water limits every 5 minutes Temperature during when performing testing normal operation - that adds heat to the 90°F suppression pool.

b. Maximum Water Whenever there is Temperature during indication of relief any test operation valve operation with the which adds heat to temperature of the the suppression pool suppression pool reaching

- 100'F; however, it 160'F or more and the shall not remain primary coolant system above 90'F for more pressure greater than than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . 200 psig, an external visual examination of the

c. If Torus Water suppression chamber shall Temperature exceeds be conducted before 110'F, initiate an resuming power operation.

immediate scram of the reactor. Power operation shall not be resumed until the pool temperature is reduced below 90'F.

d. During reactor isolation conditions, the reactor pressure vessel shall be depressurized to less than 200 psig Amendment No. 4-1, 192 146 JUL 1 9 2000

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION at normal cooldown rates if the torus water temperature exceeds 120 0F.

e. Minimum Water Volume

- 68,000 cubic feet

f. Maximum Water Volume

- 70,000 cubic feet

2. Primary containment 2. The primary containment integrity shall be integrity shall be maintained at all times demonstrated as required when the reactor is by the Primary critical or when the Containment Leakage Rate Testing Program (PCLRTP).

I reactor water temperature is above 212'F and fuel is in the reactor vessel except while performing low power physics tests at atmospheric pressure at power levels not to exceed 5 Mw(t).

3. If a portion of a system 3. (Blank) that is considered to be an extension of primary containment is to be opened, isolate the affected penetration flow path by use of at least one closed and deactivated automatic valve, closed manual valve or blind flange.

4. Whenever primary 4. In accordance with the containment integrity is PCLRTP, verify that the required: following leakage rates are within acceptable

a. The leakage rate from limits:

any one main steam isolation valve (MSIV) a. The leakage rate shall not exceed 62 through each MSIV; scfh at 44 psig (Pa);

b. The combined leakage

b. The combined leakage rate for the main steam pathways; and rate from the main steam pathways shall

c. The combined leakage not exceed 124 scfh at rate for the secondary 44 psig (Pa); and containment bypass pathways.

c. The combined leakage rate from the secondary containment bypass pathways shall not exceed 5 scfh at 44 psig (Pa).

Amendment No. SO, ar4, 4-6e, a-7-%223 147

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION

5. Pressure Suppression 5. Pressure Suppression Chamber-Reactor Building Chamber - Reactor Vacuum Breakers Building Vacuum Breakers

a. Two of two pressure a. The pressure suppression suppression chamber-reactor chamber-Reactor building vacuum Building vacuum breaker systems breaker shall be operable instrumentation at all times when including setpoint the primary shall be checked containment for proper integrity is operation every required. The three months.

setpoint of the differential b. Operability testing pressure of the vacuum instrumentation breakers shall be which actuates the in accordance with pressure Specification suppression 4.6.E. Each vacuum chamber-reactor breaker shall be building tested to determine air-operated vacuum that the force breakers shall be required to open

<0.5 psid. The the vacuum breaker self actuating does not exceed the vacuum breakers force specified in shall open fully Specification when subjected to a 3.7.A.5.a and each force equivalent to vacuum breaker or less than shall be inspected 0.5 psid acting on and verified to the valve disk. meet design requirements.

b. With one Reactor Building -

Suppression chamber vacuum breaker inoperable for opening but known to be closed, restore the inoperable vacuum breaker to OPERABLE status within seven (7) days or then be in cold shutdown within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With one Reactor Building -

Suppression chamber vacuum breaker failed open - power operation may continue provided the other vacuum breaker in that Amendment No. 128 148

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION line is verified to be closed and conditions required by 3.7.0.2 are met.

6. Pressure Suppression 6. Pressure Suppression Chamber - Drywell Vacuum Chamber - Drywell Vacuum Breakers Breakers

a. When primary a. Periodic Operability containment is Tests required, all suppression chamber Operability testing

- drywell vacuum of the* vacuum breakers shall be breakers shall be in operable except accordance with during testing and Specification 4.6.E as stated in and within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Specifications after any discharge

. 3.7.A.6.b and c, of steam to the below. Suppression suppression chamber chamber - drywell from the vacuum breakers safety/relief valves shall be considered and within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months operable if: following an operation that (1) The valve is causes any of the demonstrated vacuum breakers to to open fully open. Operability with the of the corresponding applied force position switches at all valve and position posi tions not in,dicators and exceeding alarms shall be that verified monthly and equivalent to following any 0.5 psi maintenance.

acting on the suppression b. Refuel~ng Outage chamber face Tests of the valve disk. (1) All suppression (2) The valve can chamber be closed by drywell gravity, when vacuum released breaker a f t e r ' being position opened by indication remote or and alarm manual means, systems shall to within not be calibrated greater than and the functionally equivalent of tested.

0.05 inch at all points. (2) Deleted along the seal surface of the disk.

Amendmen t No. ~; 238 149

VYNPS 3.7 'LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION (3) The position alarm system will annunciate in the control room if the valve opening exceeds the equivalent of 0.05 inch at all points along the seal surface of the disk.

b. Up to two (2) of the ( 3) A drywell to ten (10) suppression suppression chamber - drywell chamber leak vacuum breakers may rate test be determined to be shall inoperable provided demonstrate that they are' that ,with' an secured, or known to initial be, in the closed differential position. pressure of not less than

c. Reactor operation 1.0 psi, the may continue for differential fifteen (15) dayi pressure decay provided that at rate shall not' least one position exceed the alarm circuit for equivalent of each vacuum breaker the leakage is operable and each rate through a suppression chamber 1-inch

- drywell vacuum orifice.

breaker is physically verified to be closed immediately and daily thereafter.

7. Oxygen Concentration 7. Oxygen 'Concentration'

a. The primary The primary containment containment oxygen concentration shall atmosphere shall be be measured and recorded reduced to less on a weekly basis.

than 4 percent oxygen by volume with nitrogen gas while in the RUN MODE during 'the time period:

i. From 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after thermal power is greater than 15% rated thermal power following startup, to Amendment No. 1-9-, H-8-, ~,238 150

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS ii. 24 Hours pr ior to reducing thermal power to less than 15% rated thermal power prior to the next shutdown.

8. If Specification 3.7.A.l through 3.7.A.6 are not met, an orderly shutdown shall be initiated and the reactor shall be in a cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

9. If Specification 3.7.A.7 cannot be met, and the primary containment oxygen concentration cannot be restored to less than 4% oxygen by volume within the subsequent 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period, reactor thermal power shall be less than 15% rated thermal power within the next 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

10. Drywell/Suppression 10. Drywell/Suppression Chamber dip Chamber dip

a. Differential a. The differential pressure between pressure between the drywell and the drywell and suppression chamber suppression chamber shall be maintained shall be recorded

>1.7 psid while in once per shift.

the RUN MODE during the time period:

i. From 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months b. The operability of after thermal the low power is greater differential than 15% rated pressure alarm thermal power shall be verified following once per week.

startup, to ii. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to reducing thermal power to less than 15%

rated thermal power prior to the next shutdown I iii. Except as specified in 3.7.A.lO.b.

Amendment No. W, ~ 245 151

VYNPS 3,7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPE.RATION

b. The differential pressure may be reduced to <1.7 psid for a maximum of four hours (period to begin when the AP is reduced to

<1.7) during required operabi-lity testing of the HPCI system pump, the RCIC system pump, the drywell-suppression chamber vacuum breakers, and the suppression chamber-reactor building vacuum breakers, and SGTS testing.

c. If Specification I 3.7.A.10.a cannot be met, and the differential pressure cannot be restored within the subsequent eight hour period, reactor thermal power shall be less than 15%

rated thermal power within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

B. Standby Gas Treatment System B. Standby Gas Treatment System

1. a. Except as specified 1. At least once per in Specification operating cycle, not to.

3.7.B.3.a below, exceed 16 months, the whenever the reactor following conditions is in Run Mode or shall be demonstrated.

Startup Mode or Hot Shutdown condition, a. Pressure drop across both trains of the the combined HEPA Standby Gas and charcoal filter Treatment System banks is less than shall be operable at 6 inches of water at all times when 1500 cfm +/-10%.

secondary contain-ment integrity is b. Inlet heater input required. is at least 7.1 kW.

b. Except as specified in Specification 3.7.B.3.b below, whenever the reactor is in Refuel N4ode or Cold Shutdown Amendment No. 4-I, -44, 9 4-G4, 4-4q, 4-9-, 2-0 232 152

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION Treatment System 2. a. The tests and and an alternate sample analysis of electrical power Specification source, consisting 3.7.8.2 shall be of the associated performed initially Emergency Diesel and at least once Generator or Vernon per operating cycle tie, for each not to exceed standby gas 18 months, and treatment train following painting, I shall be operable at all times when fire or chemical release in any secondary ventilation zone containment communicating with integrity is the system, while required. the system is operating, that

2. a. The results of the could contaminate in-place cold DOP the HEPA filters or and halogenated charcoal adsorbers.

hydrocarbon tests at design flows on b. Cold DOP testing C HEPA and charcoal shall be performed filter banks shall after each complete show >99% DOP or partial removal and >99% replacement of the halogenated HEPA filter bank.

hydrocarbon removal. c. Halogenated hydrocarbon testing

b. The results of shall be performed laboratory carbon after each complete sample analysis or partial shall show >97.5% replacement of the radioactive methyl charcoal filter iodide removal bank.

(30°C, 70% RH).

Laboratory analysis In addition, the results shall be sample analysis of verified acceptable Specification within 31 days 3.7.B.2.b and the following sample halogenated removal. hydrocarbon test shall be performed I c. System fans shall be shown to operate after every 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months of normal within +/-10% of system operation.

design flow.

d. If Specification

d. Each train shall be operated with the I

3.7.8.2.a, heaters on at least 3.7.B.2.b, or 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months every 3.7.B.2.c is not month.

met, the applicable train of the e. An ultrasonic leak Standby Gas test shall be Treatment System performed on the shall be considered gaskets sealing the inoperable. housing panels downstream of the HEPA filters and adsorbers at least Amendment No. 4&, -4, 113, 4-9, 197 153 1.HAR 2 3 2001

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION

3. a. From and after the once per operating date that one train cycle not to exceed of the Standby Gas 18 months. If the Treatment System is ultrasonic test made or found to be indicates the inoperable for any presence of a leak, reason, reactor the condition will operation is be evaluated and the permissible only gasket repaired or during the. replaced as succeeding seven necessary.

days unless such train is sooner made f. DOP and halogenated operable, provided hydrocarbon test that during such shall be performed seven days, the following any design I other standby gas modification to .the treatment train Standby Gas shall be operable. Treatment System housing that could If this condition have an effect on cannot be met during the filter reactor operation, efficiency.

or the inoperable train is not g. An air distribution restored to operable test demonstrating status within seven uniformity within days, the actions +/-20t across the HEPA and completion times filters and charcoal of Specification adsorbers shall be 3.7.B.4.a shall performed if the

.apply. SGTS housing is modified such that

3. b. From and after the air distribution date that one train could be affected.

of the Standby Gas Treatment System is 3. a. At least once per made or found to be operating cycle inoperable for any automatic initiation reason, operations of each train of the requiring secondary Standby Gas containment are Treatment System permissible during shall be the succeeding seven demonstrated.

days unless such train is sooner made b. Operability testing operable, provided of valves shall be that during such in accordance with seven days, the Specification 4.6.E.

other standby gas treatment train and c. Deleted.

associated Emergency Diesel Generator shall be operable.

If this condition cannot be met during a refueling or cold Amendment No. S, 44, '2, as al, -, 209 213 154

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION shutdown condition, the actions and completion times of Specification 3.7.B.4.b shall apply. After seven days with an inoperable train of the Standby Gas Treatment System during refueling or cold shutdown conditions requiring secondary containment integrity, the operable train of the Standby Gas Treatment System shall be placed in operation and its associated diesel generator shall be operable, or the actions and completion times of Specification 3.7.B.4.b shall apply.

4. With two trains of the Standby Gas Treatment System inoperable, or as made applicable by Specification 3.7.B.3:

a. With the reactor in the run mode, startup mode, or hot shutdown condition, the reactor shall be placed in hot shutdown within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and cold shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

b. During movement of irradiated fuel assemblies or the fuel cask in the secondary containment, during core alterations, or during operations with the potential for draining the reactor vessel, immediately:

Amendment No. 197 155 MAR 2 3 2031

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION

b. During movement of irradiated fuel assemblies or the fuel cask in secondary containment; or

c. During alteration of the Reactor Core; or

d. During operations with the potential for draining the reactor vessel.

Amendment No. 4-4, 1-97, G-2, 226 156

rYNPS 3.7 LIMITING CONDITIONS FOR l 4.7 SURVEILLANCE REQUIREMENTS OPERATION

2. With Secondary 2. Intentionally blank.

Containment Integrity not maintained with the reactor in the Run Mode, Startup Mode, or Hot Shutdown condition, restore Secondary Containment Integrity within four (4) hours.

3. If Specification 3.7.C.2 3. Intentionally blank.

cannot be met, place the reactor in the Hot Shutdown condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in the Cold Shutdown condition within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. With Secondary 4. Intentionally blank.

Containment Integrity not maintained during movement of irradiated fuel assemblies or the fuel cask in secondary containment, during alteration of the Reactor Core, or during operations with the potential for draining the reactor vessel, immediately perform the following actions:

a. Suspend movement of irradiated fuel assemblies and the fuel cask in secondary containment; and

b. Suspend alteration of the Reactor Core; and

c. Initiate action to suspend operations with the potential for draining the reactor vessel.

Amendment No. 44, -97, 226 157

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION D. Primary Containment Isolation D. Primary Containment Isolation Valves Valves

1. During reactor power 1. Surveillance of the operating conditions all primary containment containment isolation isolation valves should be valves and all instrument performed as follows:

line flow check valves shall be operable except a. The operable isolation as specified in valves that are power Specification 3.7.D.2. operated and automatically initiated shall be tested for automatic initiation and closure time at least once per operating cycle.

b. Operability testing of the primary containment isolation valves shall be performed in accordance with Specification 4.6.E.

c. Deleted

2. Whenever a containment

2. In the event any isolation valve is containment isolation inoperable, verify the valve becomes inoperable, affected penetration reactor power op~ration flow path is isolated may continue provided the once per 31 days.

affected penetration flow path is isolated by the use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange.

3. If Specifications 3.7.0.1 and 3.7.0.2 cannot be met, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Amendment No. -+/--2-B-, -!-34, ~, ~, ~, i8+, 242 158

VYNPS 3.7 LIMITING CONDITIONS FOR 4.7 SURVEILLANCE REQUIREMENTS OPERATION E. Reactor Building Automatic E. Reactor Buildinq Automatic Ventilation System Isolation Ventilation System Isolation Valves (RBAVSIVs) Valves (RBAVSIVs)

When secondary containment 1. When secondary containment integrity is required, each integrity is required, with RBAVSIV shall be operable, except one or more penetration flow as provided below. paths with one or more RBAVSIVs inoperable, verify

1. With one or more penetration the affected penetration flow flow paths with one RBAVSIV path is isolated once per 31 inoperable, isolate the days.

affected penetration flow path by use of at least one 2. Operability testing of the closed and de-activated RBAVSIVs shall be performed in automatic valve or blind accordance with Specification flange within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . 4.6.E.

2. With one or more penetration flow paths with two RBAVSIVs inoperable, isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve or blind flange within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

3. If the actions and completion times of Specification 3.7.E.1 or 3.7.E.2 cannot be met when the reactor is in the run mode, startup mode, or hot shutdown condition, the reactor shall be placed in hot shutdown within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and cold shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

4. If the actions and completion times of Specification 3.7.E.1 or 3.7.E.2 cannot be met during movement of irradiated fuel assemblies or the fuel cask in the secondary containment, during core alterations, or during operations with the potential for draining the reactor vessel, immediately:

a. Suspend movement of irradiated fuel assemblies and the fuel cask in secondary containment; and

b. Suspend core alterations; and

c. Initiate action to suspend operations with the potential for draining the reactor vessel.

Amendment No.1 9 7 158a M!1AR 2 3 2631

v-iPS Intentionally Blank 159 4ss, 494 210

&O, 9+, G-3, I Amendment No.

AUG 21 2002

ViRIPS Intentionally Blank K->

160 I Amendment No. -8, 46, 4, @4, 2 1X, 210 AUG 21 2002

VYNPS Blank Intentionally 161 210

&8, GE, 4B5, 4-22,4A, I Amendment No. AUG 2 1 2002

VrNlps Intentionally Blank 162 l Amendment No. 9, a94, 210 AUG 2 1 2002

VYNPS BASES:

3.7 STATION CONTAINMENT SYSTEMS A. Primary Containment The integrity of the primary containment and operation of the core standby cooling systems in combination limit the off-site doses to values less than to those suggested in 10CFR50.67 in the event of a break in the primary system piping. Thus, containment integrity is specified whenever the potential for violation of the primary reactor system integrity exists. Concern about such a violation exists whenever the reactor is critical, above atmospheric pressure and temperature above 212°F. An exception is made to this requirement during initial core loading and while a low power test program is being conducted and ready access to the reactor vessel is required.

The reactor may be taken critical during the period; however, restrictive operating procedures will be in effect again to minimize the probability of an accident occurring. Procedures and the Rod Worth Minimizer would limit control worth to less than 1.30% delta k.

The pressure suppression pool water provides the heat sink for the reactor primary system energy release following postulated rupture of the system. The pressure suppression chamber water volume must absorb the associated decay and structural sensible heat released during primary system blowdown for normal operating pressure.

Since all the gases in the drywell are purged into the pressure suppression chamber air space during a loss-of-coolant accident, the pressure resulting from isothermal compression plus the vapor pressure of the liquid must not exceed 62 psig, the allowable internal design pressure for the pressure suppression chamber. The design volume of the suppression chamber (water and air) was obtained by considering that the total volume of reactor coolant to be condensed is discharged to the suppression chamber and that the drywell volume is purged to the suppression chamber (Reference Section 5.2 FSAR).

Using the minimum or maximum water volumes given in the specification, the calculated peak accident containment pressure is approximately 44 psig, which is below the ASME design pressure of 56 psig.(3) The minimum volume of 68,000 ft3 results in a submergency of approximately four feet. The majority of the Bodega tests(2) were run with a submerged length of four feet and with complete condensation. Thus, with respect to downcomer submergence, this specification is adequate.

The maximum temperature at the end of blowdown tested during the Humbolt Bay(1) and Bodega Bay tests was 170°F and this is conservatively taken to be the limit for complete condensation of the reactor coolant, although condensation would occur for temperature above 170°F.

(1) Robbins, C. H., "Tests on a Full Scale 1/48 Segment of the Humbolt Bay Pressure Suppression Containment", GEAP-3596, November 17, 1960.

(2) Bodega Bay Preliminary Hazards Summary Report, Appendix 1, Docket 50-205, December 28, 1962.

(3) Internal design pressure is 62 psig.

Amendment No. Ltr dtd 7/1/85, BVY 01-52, 214, 223 163

VYNPS BASES: 3.7 (Cont'd)

In conjunction with the Mark I Containment Long-Term Program, a plant unique analysis was performed (see Vermont Yankee letter, dated April 27, 1984, transmitting Teledyne Engineering Services Company Reports, TR-5319-1, Revision 2, dated November 30, 1983 and TR-5319-2, Revision 0) which demonstrated that all stresses in the suppression chamber structure, including shell, external supports, vent system, internal structures, and attached piping meet the structural acceptance criteria of NUREG-0661. The maintenance of a drywell-suppression chamber differential pressure of 1.7 psid and a suppression chamber water level corresponding to a downcomer submergence of less than 4.54 ft. will assure the integrity of the suppression chamber when subjected to post-LOCA suppression pool hydrodynamic forces.

Using a 50°F rise (Section 5.2.4 FSAR) in the suppression chamber water temperature and a minimum water volume of 68,000 ft3, the 170°F temperature which is used for complete condensation would be approached only if the suppression pool temperature is 120°F prior to the DBA-LOCA. Maintaining a pool temperature of 90°F will assure that the 170°F limit is not approached.

In the event a relief valve inadvertently opens or sticks open, operating procedures define the action to be taken. This action would include: (1) use of all available means to close the valve, (2) initiate suppression pool water cooling heat exchangers, (3) initiate reactor shutdown, and (4) if other relief valves are used to depressurize the reactor, their discharge shall be separated from that of the stuck-open relief valve to assure mixing and uniformity of energy insertion to the pool.

Generally, double isolation valves are provided on lines which penetrate the primary containment and open to the free space of the containment. Closure of one of the valves in each line would be sufficient to maintain the integrity of the pressure suppression system. Automatic initiation is required to minimize the potential leakage paths from the containment in the event of a loss-of-coolant accident. Details of the isolation valves are discussed in Section 5.2 of the FSAR.

Manual primary containment isolation valves that are required to be closed by the definition of Primary Containment Integrity may be opened intermittently under administrative controls. These controls consist of stationing a dedicated operator, with whom Control Room communication is immediately available, in the immediate vicinity of the valve controls. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

Amendment No. 16, 50, 88, Ltr dtd 7/1/85, 165, BVY 99-55, BVY 00-78, BVY 01-52 164

VYNPS BASES: 3.7 (Cont'd)

The purpose of the vacuum relief valves is to equalize the pressure between the drywell and suppression chamber and suppression chamber and reactor building so that the structural integrity of the containment is maintained.

Technical Specification 3.7.A.10.b is based on the assumption that the operability testing of the pressure suppression chamber-reactor building vacuum breaker, when required, will normally be performed during the same four hour testing interval as the pressure suppression chamber-drywell vacuum breakers in order to minimize operation with <1.7 psi, differential pressure.

The vacuum relief system from the pressure suppression chamber to Reactor Building consists of two 100% vacuum relief breakers (2 parallel sets of 2 valves in series). Operation of either system will maintain the pressure differential less than 2 psig; the external design pressure is 2 psig. With one vacuum breaker out of service there is no immediate threat to accident mitigation or primary containment and, therefore, reactor operation can be continued for 7 days while repairs are being made.

The capacity of the ten (10) drywell vacuum relief valves is sized to limit the pressure differential between the suppression chamber and drywell during post-accident drywell cooling operations to the design limit of 2 psig. They are sized on the basis of the Bodega Bay pressure suppression tests. The ASME Boiler and Pressure Vessel Code,Section III, Subsection B, for this vessel allows eight (8) operable valves, therefore, with two (2) valves secured, containment integrity is not impaired.

Each drywell-suppression chamber vacuum breaker is fitted with a redundant pair of limit switches to provide fail-safe signals to panel mounted indicators in the Reactor Building and alarms in the Control Room when the disks are open more than 0.050" at all points along the seal surface of the disk. These switches are capable of transmitting the disk closed to open signal with 0.01" movement of the switch plunger. Continued reactor operation with failed components is justified because of the redundance of components and circuits and, most importantly, the accessibility of the valve lever arm and position reference external to the valve. The fail safe feature of the alarm circuits assures operator attention if a line fault occurs.

The requirement to inert the containment is based on the recommendation of the Advisory Committee on Reactor Safeguards. This recommendation, in turn, is based on the assumption that several percent of the zirconium in the core will undergo a reaction with steam during the loss-of-coolant accident. This reaction would release sufficient hydrogen to result in a flammable concentration in the primary containment building. The oxygen concentration is therefore kept below 4% to minimize the possibility of hydrogen combustion.

Amendment No. 16, 50, 88, Ltr dtd 7/1/85, 165, BVY 08-076 164a

VYNPS BASES: 3.7 (Cont'd)

General Electric has estimated that less than 0.1% of the zirconium would react with steam following a loss-of-coolant due to operation of emergency core cooling equipment. This quantity of zirconium would not liberate enough hydrogen to form a combustible mixture.

Drywell-to-suppression chamber differential pressure must be controlled when the primary containment is inert. The primary containment must be inert in RUN MODE, since this is the condition with the highest probability for an event that could produce hydrogen. It is also the condition with the highest probability of an event that could impose large loads on the primary containment.

Inerting primary containment is an operational problem because it prevents primary containment access without an appropriate breathing apparatus. Therefore, the primary containment is inerted as late as possible in the unit startup and is de-inerted as soon as possible in the unit shutdown. As long as reactor power is <15% RTP, the probability of an event that generates hydrogen or excessive loads on primary containment occuring within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following a startup or within the last 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to a shutdown is low enough that these "windows," with the primary containment not inerted, are also justified. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period is a reasonable amount of time to allow plant personnel to perform inerting or de-inerting.

The use of the 18" purge and vent flow path isolation valves AC-7A (16-19-7A), AC-7B (16-19-7B), AC-8 (16-19-8), AC-10 (16-19-10) has been restricted to 90 hours0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months per year. Normal plant operations (other than inerting and de-inerting) will have AC-8 and AC-10 closed and nitrogen will be supplied to the drywell via the 1" nitrogen makeup supply. The differential pressure maintained between the drywell and torus will allow the nitrogen to "bubble over" into the suppression chamber. A normally open AC-6B (3") allows for venting. A normally closed AC-6A (3") is periodically opened for performance of Amendment No. 49, Bases Change, 119, 147, 161, BVY 08-076 165

INFORMATION ONLY VYNPS ELECTRONIC VERSION BASES: 3.7 (Cont'd) surveillances such as monthly torus to drywell vacuum breaker tests.

Procedurally, when AC-6A is open, AC-6 and AC-7 are closed to prevent overpressurization of the SBGT system or the reactor building ductwork, should a LOCA occur. For this and similar analyses performed, a spurious opening of AC-6 or AC-7 (one of the closed containment isolation valves) is not assumed as a failure simultaneous with a postulated LOCA. Analyses demonstrate that for normal plant operation system alignments, including surveillances such as those described above, that SBGT integrity would be maintained if a LOCA was postulated. Therefore, during normal plant operations, the 90 hour0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months clock does not apply. Accordingly, opening of the 18 inch atmospheric control isolation valves AC-7A, AC-7B, AC-8 and AC-10 will be limited to 90 hours0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months per calendar year (except for performance of the subject valve stroke time surveillances - in which case the appropriate corresponding valves are closed to protect equipment should a LOCA occur). This restriction will apply whenever primary containment integrity is required. The 90 hour0.00104 days 0.025 hours 1.488095e-4 weeks 3.4245e-5 months clock will apply anytime purge and vent evolutions can not assure the integrity of the SBGT trains or related equipment.

B. and C. Standby Gas Treatment System and Secondary Containment System The secondary containment is designed to minimize any ground level release of radioactive materials which might result from a serious accident. The Reactor Building provides secondary containment during reactor operation, when the drywell is sealed and in service; the Reactor Building provides primary containment when the reactor is shutdown and the drywell is open, as during refueling. Because the secondary containment is an integral part of the complete containment system, secondary containment is required at all times that primary containment is required except, however, for initial fuel loading and low power physics testing.

In the Cold Shutdown condition or the Refuel Mode,the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these conditions. Therefore, maintaining Secondary Containment Integrity is not required in the Cold Shutdown condition or the Refuel Mode, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor vessel, during alteration of the Reactor Core, or during movement of irradiated fuel assemblies or the fuel cask in the secondary containment.

In order for secondary containment integrity to be met, the secondary containment must function properly in conjunction with the operation of the Standby Gas Treatment System to ensure that the required vacuum can be established and maintained. This means that the reactor building is intact with at least one door in each access opening closed, and all reactor building automatic ventilation system isolation valves are operable or the affected penetration flow path is isolated.

With the reactor in the Run Mode, the Startup Mode, or the Hot Shutdown condition, if Secondary Containment Integrity is not maintained, Secondary Containment Integrity must be restored within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during the Run Mode, the Startup Mode, and the Hot Shutdown condition.

This time period also ensures that the probability of an accident (requiring Secondary Containment Integrity) occurring during periods where Secondary Containment Integrity is not maintained, is minimal.

Amendment No. 49, 143, 147, 161, 197 165a

VYNPS BASES: 3.7 (Cont'd)

If Secondary Containment Integrity cannot be restored within the required time period, the plant must be brought to a mode or condition in which the LCO does not apply.

Movement of irradiated fuel assemblies or the fuel cask in the secondary containment, alteration of the Reactor Core, and operations with the potential for draining the reactor vessel can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Alteration of the Reactor Core and movement of irradiated fuel assemblies and the fuel cask must be immediately suspended if Secondary Containment Integrity is not maintained. Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend operations with the potential for draining the reactor vessel to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until operations with the potential for draining the reactor vessel are suspended.

Amendment No. 143, 147, 161 165b

VYNPS BASES: 3.7 (Cont'd)

The Standby Gas Treatment System (SGTS) is designed to filter and exhaust the Reactor Building atmosphere to the stack during secondary containment isolation conditions, with a minimum release of radioactive materials from the Reactor Building to the environs. To insure that the standby gas treatment system will be effective in removing radioactive contaminates from the Reactor Building air, the system is tested periodically to meet the intent of ANSI N510-1975. Laboratory charcoal testing will be performed in accordance with ASTM D3803-1989, except, as allowed by GL 99-02, testing can be performed at 70%

relative humidity for systems with humidity control. Both standby gas treatment fans are designed to automatically start upon containment isolation and to maintain the Reactor Building pressure to approximately a negative 0.15 inch water gauge pressure; all leakage should be in-leakage. Should the fan fail to start, the redundant alternate fan and filter system is designed to start automatically.

Each of the two fans has 100% capacity. This substantiates the availability of the operable train and results in no added risk; thus, reactor operation or refueling operation can continue. If neither train is operable, the plant is brought to a condition where the system is not required.

When the reactor is in cold shutdown or refueling the drywell may be open and the Reactor Building becomes the only containment system.

During cold shutdown the probability and consequences of a DBA LOCA are substantially reduced due to the pressure and temperature limitations in this mode. However, for other situations under which significant radioactive release can be postulated, such as during operations with a potential for draining the reactor vessel, during core alterations, or during movement of irradiated fuel in the secondary containment, operability of standby gas treatment is required.

Both trains of the Standby Gas Treatment System are normally operable when secondary containment integrity is required. However, Specification 3.7.B.3 provides Limiting Conditions for Operation when one train of the Standby Gas Treatment System is inoperable.

Provisional, continued operation is permitted since the remaining operable train is adequate to perform the required radioactivity release control function. If the applicable conditions of Specification 3.7.B.3 cannot be met, the plant must be placed in a mode or condition where the Limiting Conditions for Operation do not apply.

Entry into a refueling condition with one train of SBGTS inoperable is acceptable and there is no prohibition on mode or condition entry in this situation. In this case, the requirements of TS 3.7.B.3.b are sufficient to ensure that adequate controls are in place. During refueling conditions, accident risk is significantly reduced, and the primary activities of concern involve core alterations, movement of irradiated fuel assemblies, and OPDRVs.

During refueling and cold shutdown conditions Specification 3.7.B.3.b provides for the indefinite continuance of refueling operations with one train of the Standby Gas Treatment System inoperable. When the seven-day completion time associated with Specification 3.7.B.3.b is not met and secondary containment integrity is required, the operable train of the Standby Gas Treatment System should immediately be placed into operation. This action ensures that the remaining train is operable, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected. An alternative to placing the operable train of Standby Gas Treatment in operation is to immediately suspend activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the plant in a condition that minimizes risk.

Amendment No. 16, 49, 143, 189, 197 166

VYNPS BASES: 3.7 (Cont'd)

An alternate electrical power source for the purposes of Specification 3.7.B.1.b shall consist of either an Emergency Diesel Generator (EDG) or the Vernon Hydro tie line. Maintaining availability of the Vernon Hydro tie line as an alternative to one of the EDGs in this condition provides assurance that standby gas treatment can, if required, be operated without placing undue constraints on EDG maintenance availability. Inoperability of both trains of the SGTS or both EDGs during refueling operations requires suspension of activities that represent a potential for releasing radioactive material to the secondary containment, thus placing the plant in a condition that minimizes risk.

Use of the SGTS, without the fan and the 7.1 kW heater in operation, as a vent path during torus venting does not impact subsequent adsorber capability because of the very low flows and because humidity control is maintained by the standby 1 kW heaters, therefore operation in this manner does not accrue as operating time.

D. Primary Containment Isolation Valves The primary containment design includes lines that penetrate the primary containment with different containment isolation valve configurations including double and single valve isolation. Automatic initiation is required to minimize the potential leakage paths from the containment in the event of a loss-of-coolant accident. These lines typically include additional automatic valves or manual maintenance isolation valves, close to the containment boundary, that can serve as interim isolation devices while repairs to a containment isolation valve are made. Isolation using at least one closed de-activated automatic valve, closed manual valve, or blind flange in each line is sufficient to maintain the integrity of the primary containment. The selected isolation device should be the closest available device to the primary containment.

E. Reactor Building Automatic Ventilation System Isolation Valves (RBAVSIVs)

The function of the RBAVSIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). The operability requirements for RBAVSIVs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. The RBAVSIVs must be operable (or the penetration flow path isolated) to ensure secondary containment integrity and to limit the potential release of fission products to the environment. The valves covered by this Limiting Condition for Operation are included in the Inservice Testing Program.

In the event that there are one or more RBAVSIVs inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. The required action must be completed within the eight hour or four hour completion time, as applicable. The specified time periods are reasonable considering the time required to isolate the penetration, and the probability of a DBA occurring during this short time.

Amendment No. 143, 197, BVY 01-52, 210 242 166a

VYNPS BASES: 3.7 (Cont'd)

If any required action or completion time cannot be met as a result of one or more inoperable RBAVSIVs, the plant must be placed in a mode or condition where the Limiting Condition for Operation does not apply. To achieve this status during reactor power operation, the reactor must be brought to at least hot shutdown within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to cold shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . If applicable, core alterations and the movement of irradiated fuel assemblies and the fuel cask in the secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

4.7 STATION CONTAINMENT SYSTEMS A. Primary Containment System The interiors of the drywell and suppression chamber are painted with an inorganic zinc primer to prevent rusting that could lead to degradation of the containment pressure boundary. The inspection of the painted surfaces as part of inservice inspection under 10 CFR 50.55a(b)(2)(vi) assures that the paint and the underlying base metal have not degraded. Experience with this type of coating during plant operating cycles between 1972 and the present indicates that this inspection methodology and interval are adequate.

Because of the large volume and thermal capacity of the suppression pool, the level and temperature normally changes very slowly and monitoring these parameters daily is sufficient to establish any temperature trends.

The average temperature is determined by taking an arithmetic average of OPERABLE suppression pool water temperature channels. The daily frequency has been shown, based on operating experience, to be acceptable. The frequencies are further justified in view of other indications available in the Control Room, including alarms, to alert operators to an abnormal condition.

When heat is being added to the suppression pool by testing, however, it is necessary to monitor suppression pool temperature more frequently. The 5 minute frequency during testing is justified by the rate at which tests will heat up the suppression pool. This has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded.

The requirement for an external visual examination following any event where potentially high loadings could occur provides assurance that no significant damage was encountered. Particular attention should be focused on structural discontinuities in the vicinity of the relief valve discharge since these are expected to be the points of highest stress. Visual inspection of the suppression chamber including water line regions each refueling outage is adequate to detect any changes in the suppression chamber structures.

Amendment No. 143, 164, 174, 192, 242 166b

VYNPS BASES: 4.7 (Cont'd)

The primary containment preoperational test pressures are based upon the calculated primary containment pressure response in the event of a loss-of-coolant accident. The calculated peak accident containment pressure would be about 44 psig, which would reduce to 27 psig within about 20 seconds following the pipe break. The suppression chamber pressure rises to about 25 psig within 30 seconds, equalizes with drywell pressure, and then decays with drywell pressure.(1)

The ASME design pressure of the drywell and absorption chamber is 56 psig.(2) The design leak rate is 0.5%/day at this pressure. As pointed out above, the pressure response of the drywell and suppression chamber following an accident would be the same after about 10 seconds. Based on the primary containment pressure response and the fact that the drywell and suppression chamber function as a unit, the primary containment will be tested as a unit rather than the individual components separately.

Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program (PCLRTP) required by Specification 6.7.C. The PCLRTP specifies the leakage rate test requirements, schedules, and acceptance criteria for tests of the leak tight integrity of the primary reactor containment and systems and components which penetrate the containment.

The PCLRTP implements the leakage rate testing of the primary containment as required by 10CFR50.54(o) and 10CFR50, Appendix J, Option B as modified by approved exemptions. The leakage limits prescribed by the PCLRTP are consistent with the design of VYNPS and the analytical models used to calculate the radiological consequences of design basis accidents described in the Updated Final Safety Analysis Report.

Consistent with the limiting assumptions used in the associated accident consequence analyses, the PCLRTP differentiates three leakage pathways to the environment: (1) primary containment leakage to secondary containment, which is filtered through the standby gas treatment system before being released via the plant stack; (2) main steam pathways; and (3) secondary containment bypass pathways. Leakage effluent from the main steam and secondary containment bypass pathways have different pathways (ground level) to the environment than the leakage into secondary containment. These pathways are defined in the PCLRTP.

(1) Section 14.6 of the FSAR.

(2) 62 psig is the maximum internal design pressure for this ASME design (56 psig) pressure.

Amendment No. 131, BVY 01-52, 223 167

VYNPS BASES: 4.7 (Cont'd)

The maximum allowable test leak rate at the peak accident pressure of 44 psig (La) is 0.80 weight % per day. The maximum allowable test leak rate at the retest pressure of 24 psig (Lt) has been conservatively determined to be 0.59 weight percent per day. This value was verified to be conservative by actual primary containment leak rate measurements at both 44 psig and 24 psig upon completion of the containment structure.

As most leakage and deterioration of integrity is expected to occur through penetrations, especially those with resilient seals, a periodic leak rate test program of such penetration is conducted at the peak accident pressure of 44 psig to insure not only that the leakage remains acceptably low but also that the sealing materials can withstand the accident pressure.

The Primary Containment Leak Rate Testing Program is based on Option B to 10CFR50, Appendix J, for development of leak rate testing and surveillance schedules for reactor containment vessels.

Surveillance of the suppression Chamber-Reactor Building vacuum breakers consists of operability checks and leakage tests (conducted as part of the containment leak-tightness tests). These vacuum breakers are normally in the closed position and open only during tests or an accident condition. Operability testing is performed in conjunction with Specification 4.6.E. Calibrations are performed during the refueling outages; this frequency being based on equipment quality, experience, and engineering judgment.

The ten (10) drywell-suppression vacuum relief valves are designed to open to the full open position (the position that curtain area is equivalent to valve bore) with a force equivalent to a 0.5 psi differential acting on the suppression chamber face of the valve disk.

This opening specification assures that the design limit of 2.0 psid between the drywell and external environment is not exceeded. Once each refueling outage each valve is tested to assure that it will open fully in response to a force less than that specified.

The containment design has been examined to establish the allowable bypass area between the drywell and suppression chamber as 0.12 ft2.

This is equivalent to one vacuum breaker open by three-eighths of an inch (3/8") as measured at all points around the circumference of the disk or three-fourths of an inch (3/4") as measured at the bottom of the disk when the top of the disk is on the seat. Since these valves open in a manner that is purely neither mode, a conservative allowance of one-half inch (1/2") has been selected as the maximum permissible valve opening. Assuming that permissible valve opening could be evenly divided among all ten vacuum breakers at once, valve open position assumed to indication for an individual valve must be activated less than fifty-thousandths of an inch (0.050") at all points along the seal surface of the disk. Valve closure within this limit may be determined by light indication from two independent position detection and indication systems. Either system provides a control room alarm for a nonseated valve.

Amendment No. 50, 128, 152, 164, 238 168

VYNPS BASES: 4.7 (Cont'd)

At the end of each refueling cycle, a leak rate test shall be performed to verify that significant leakage flow paths do not exist between the drywell and suppression chamber. The drywell pressure will be increased by at least 1 psi with respect to the suppression chamber pressure and held constant. The 2 psig set point will not be exceeded. The subsequent suppression chamber pressure transient (if any) will be monitored with a sensitive pressure gauge. If the drywell pressure cannot be increased by 1 psi over the suppression chamber pressure it would be because a significant leakage path exists; in this event the leakage source will be identified and eliminated before power operation is resumed. If the drywell pressure can be increased by 1 psi over the suppression chamber the rate of change of the suppression chamber pressure must not exceed a rate equivalent to the rate of leakage from the drywell through a 1-inch orifice. In the event the rate of change exceeds this value then the source of leakage will be identified and eliminated before power operation is resumed.

The drywell-suppression chamber vacuum breakers are exercised in accordance with Specification 4.6.E, following termination of discharge of steam into the suppression chamber from the safety/relief valves and following any operation that causes the vacuum breakers to open. This monitoring of valve operability is intended to assure that valve operability and position indication system performance does not degrade between refueling inspections.

When a vacuum breaker valve is exercised through an opening-closing cycle, the position indicating lights are designed to function as follows:

Full Closed 2 White - On (Closed to <0.050" open)

Open 2 White - Off

(>0.050" open to full open)

Experience has shown that a weekly measurement of the oxygen concentration in the primary containment assures adequate surveillance of the primary containment atmosphere.

B. and C. Standby Gas Treatment System and Secondary Containment System Initiating reactor building isolation and operation of the standby gas treatment system to maintain at least a 0.15 inch of water vacuum within the secondary containment provides an adequate test of the operation of the reactor building isolation valves, leakage tightness of the reactor building, and performance of the standby gas treatment system. The testing of reactor building automatic ventilation system isolation valves in accordance with Technical Specification 4.6.E demonstrates the operability of these valves. In addition, functional testing of initiating sensors and associated trip channels demonstrates the capability for automatic actuation. Periodic testing gives sufficient confidence of reactor building integrity and standby gas treatment system performance capability.

Amendment No. 128, 147, 238 169

VYNPS BASES: 4.7 (Cont'd)

The test frequencies are adequate to detect equipment deterioration prior to significant defects, but the tests are not frequent enough to load the filters, thus reducing their reserve capacity too quickly.

That the testing frequency is adequate to detect deterioration was demonstrated by the tests which showed no loss of filter efficiency after 2 years of operation in the rugged shipboard environment on the NS Savannah (ORNL 3726). Pressure drop tests across filter sections are performed to detect gross plugging of the filter media.

Considering the relatively short time that the fans may be run for test purposes, plugging is unlikely, and the test interval is reasonable.

Such heater tests will be conducted once during each operating cycle.

Considering the simplicity of the heating circuit, the test frequency is sufficient. Air distribution tests will be conducted once during each operating cycle.

The in-place testing of charcoal filters is performed using a halogenated hydrocarbon, which is injected into the system upstream of the charcoal filters. Measurements of the challenge gas concentration upstream and downstream of the charcoal filters is made. The ratio of the inlet and outlet concentrations gives an overall indication of the leak tightness of the system. Although this is basically a leak test, since the filters have charcoal of known efficiency and holding capacity for elemental iodine and/or methyl iodine, the test also gives an indication of the relative efficiency of the installed system.

High-efficiency particulate air filters are installed before and after the charcoal filter to minimize potential release of particulates to the environment and to prevent clogging of the iodine filters. An efficiency of 99% is adequate to retain particulates that may be released to the Reactor Building following an accident. This will be demonstrated by testing with DOP as testing medium.

The efficiencies of the particulate and charcoal filters are sufficient to prevent exceeding 10CFR50.67 limits for the accidents analyzed. The analysis of post-accident hydrogen purge assumed a charcoal filter efficiency of 95%. Hence requiring in-place test efficiencies of 99%

for these filters and a laboratory methyl iodide test of 97.5% for the charcoal provides adequate margin.

The test interval for filter efficiency was selected to minimize plugging of the filters. In addition, testing for methyl iodide removal efficiency will be demonstrated. This will be done either by removal of a charcoal sample cartridge which contains charcoal equivalent to the bed thickness or removing one adsorber tray from the system and using the charcoal therein, after mixing, to obtain at least two samples equivalent to the bed thickness. Any HEPA filters found defective should be replaced with filters qualified according to Regulatory Position C.3.d of Regulatory Guide 1.52. If laboratory test results are unacceptable, all charcoal adsorbent in the system should be replaced with charcoal adsorbent qualified according to Regulatory Guide 1.52.

Amendment No. 15, 189, 223 170

VYNPS BASES: 4.7 (Cont'd)

D. Primary Containment Isolation Valves Those large pipes comprising a portion of the reactor coolant system whose failure could result in uncovering the reactor core are supplied with automatic isolation valves (except those lines needed for emergency core cooling system operation or containment cooling). The closure times specified herein and per Specification 4.6.E are adequate to prevent loss of more cooling from the circumferential rupture of any of these lines outside the containment than from a steam line rupture.

Therefore, the isolation valve closure times are sufficient to prevent uncovering the core.

Purge and vent valve testing performed by Allis-Chalmers has demonstrated that all butterfly purge and vent valves installed at Vermont Yankee can close from full open conditions at design basis containment pressure. However, as an additional conservative measure, limit stops have been added to valves 16-19-7/7A, limiting the opening of these valves to 50 open while operating, as requested by NRC in their letter of May 22, 1984. (NVY 84-108)

The main steam isolation valves are primary containment isolation valves and are tested in accordance with the requirements of the Inservice Testing program.

The containment is penetrated by a large number of small diameter instrument lines. The flow check valves in these lines are tested for operability in accordance with Specification 4.6.E.

E. Reactor Building Automatic Ventilation System Isolation Valves (RBAVSIVs)

In the event that there are one or more RBAVSIVs inoperable when secondary containment integrity is required, the affected penetrations that have been isolated must be verified to be isolated on a periodic basis. This is necessary to ensure that those penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be in the isolated position should an event occur. The verification frequency of once per 31 days is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.

Verification of isolation does not require any testing or device manipulation. Rather, it involves verification that the affected penetration remains isolated.

The RBAVSIVs covered by this surveillance requirement, along with their test requirements, are included in the Inservice Testing Program.

Amendment No. 91, 128, 185, 197, 223, BVY 10-047 171

VYNPS 3.8 LIMITING CONDITIONS FOR 4.8 SURVEILLANCE REQUIREMENTS OPERATION 3.8 RADIOATIVE EFFLUENTS 4.8 RADIOACTIVE EFFLUENTS Applicability: Applicability:

Applies to the release of all Applies to the required radioactive effluents from the surveillance of all radioactive plant. effluents released from the plant.

Objective: Objective:

To assure that radioactive To ascertain that all radioactive effluents are kept "as low as is effluents released from the plant reasonably achievable" in are kept "as low as is reasonably accordance with 10CFR50, Appendix achievable" in accordance with I and, in any event, are within 10CFR50, Appendix I and, in any the dose limits for Members of the event, are within the dose limits Public specified in 10CFR20. for Members of the Public specified in 10CFR20.

Specification: Specification:

A. Deleted A. Deleted B. Deleted B. Deleted C. Deleted C. Deleted D. Liquid Holdup Tanks D. Liquid Holdup Tanks

1. The quantity of 1. The quantity of radioactive material radioactive material contained in any outside contained in each of the tank* shall be limited to liquid holdup tanks* shall less than or equal to be determined to be within 10 curies, excluding the limits of tritium and dissolved or Specification 3.8.D.1 by entrained noble gases. analyzing a representative sample of the tank's

2. With the quantity of contents within one week radioactive material in following the addition of any outside tank* radioactive materials to exceeding the limit of the tank. One sample may Specification 3.8.D.l, cover multiple additions.

immediately take action to suspend all additions of radioactive material to the tank. Within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , reduce the tank contents to within the limit.

VOTE: Tanks included in this Specification are only those outdoor tanks that are not surrounded by liners, dikes, or walls capable of holding the tank's contents, or that do not have tank overflows and surrounding area drains connected to the liquid radwaste treatment system.

Amendment No. 8G, os, 1 193 172 AUG 2 4 2mO

VYNPS 3.8 LIMITING CONDITIONS FOR 4.8 SURVEILLANCE REQUIREMENTS OPERATION E. Deleted E. Deleted F. Deleted F. Deleted G. Deleted G. Deleted H. Deleted H. Deleted I. Deleted I. Deleted J. Explosive Gas Mixture J. Explosive Gas Mixture

1. If the hydrogen 1. The concentration of concentration in the hydrogen in the off-gas off-gas downstream of the system downstream of the operating recombiner recombiners shall be reaches four percent, continuously monitored by take appropriate action the hydrogen monitor that will restore the required operable by the concentration to within Offsite Dose Calculation the limit within Manual.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No. 8,3 193 173 AUG 2 4 2000

VYNPS

3.8 LIMITING CONDITIONS FOR 4.8 SURVEILLANCE REQUIREMENTS OPERATION K. Steam Jet Air Ejector (SJAE) K. Steam Jet Air Ejector (SJAE)

1. Gross radioactivity release rate from the 1. The gross radioactivity SJAE shall be limited to release rate shall be less than or equal to continuously monitored in 0.16 Ci/sec (after accordance with the 30 minutes decay). Offsite Dose Calculation Manual.

2. With the gross radioactivity release rate at the SJAE exceeding the above limit, restore the gross radioactivity release 2. The gross radioactivity rate to within its limit release rate of noble within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in gases from the SJAE shall at least Hot Standby be determined to be within the subsequent within the limit of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Specification 3.8.K.1 at the following frequencies

3. With the gross by performing an isotopic radioactivity release analysis (for Xe-138, rate at the SJAE greater Xe-135, Xe-133, Kr-88, than or equal to Kr-85m, Kr-87) on a 1.5 Ci/sec (after representative sample of 30-minute decay), restore gases taken at the the gross radioactivity discharge.

release rate to less than 1.5 Ci/sec (after a. Once per week.

30-minute decay), or be b. Within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months in Hot Standby within following an 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .. increase of 25% or 5000 microcuries/sec, whichever is greater, in steady-state activity levels during steady-state reactor operation, as indicated by the SJAE monitor.

L. Deleted L. Deleted M. Deleted M. Deleted N. Deleted N. Deleted Amendment No. 83, 193 174 AUG 2 4 2000

VYNPS BASES:

3.8 RADIOACTIVE EFFLUENTS A. Deleted B. Deleted C. Deleted D. Liquid Holdup Tanks The tanks listed in this Specification include all outdoor tanks that contain radioactivity that are not surrounded by liners, dikes, or walls capable of holding the tank contents, or that do not have tank overflows and surrounding area drains connected to the liquid radwaste treatment system.

Restricting the quantity of radioactive material contained in the specified tanks provides assurance that in the event of an uncontrolled release of the tanks' contents, the resulting concentrations would be less than the limits of 10CFR Part 20.1001-20.2402, Appendix B, Table 2, Column 2, at the nearest potable water supply and in the nearest surface water supply in an Unrestricted Area.

E. Deleted F. Deleted G. Deleted H. Deleted I. Deleted J. Explosive Gas Mixture The hydrogen monitors are used to detect possible hydrogen buildups which could result in a possible hydrogen explosion. Automatic isolation of the off-gas flow would prevent the hydrogen explosion and possible damage to the augmented off-gas system. Maintaining the concentration of hydrogen below its flammability limit provides assurance that the releases of radioactive materials will be controlled.

K. Steam Jet Air Ejector (SJAE)

Restricting the gross radioactivity release rate of gases from the main condenser SJAE provides reasonable assurance that the total effective dose equivalent to an individual at the exclusion area boundary will not exceed the limits of 10CFR50.67 in the event this effluent is inadvertently discharged directly to the environment without treatment.

This specification implements the requirements of General Design Criteria 60 and 64 of Appendix A to 10CFR Part 50.

Amendment No. 83, 151, 161, 193, BVY 01-52, 223 175

VYNPS BASES: 3.8 (Cont'd)

L. Deleted M. Deleted N. Deleted Pages 177 through 189 have been intentionally deleted.

Amendment No. 83, 151, 161, 193 176

VYNPS Sections 3.9 / 4.9 deleted Pages 191 through 210 have been intentionally deleted.

Amendment No. 8", 103, 144, 151, .44, 466, 44--3 193 190 AUG 2 4 2000

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION 3.10 AUXILIARY ELECTRICAL POWER 4.10 AUXILIARY ELECTRICAL POWER SYSTEMS SYSTEMS Applicability: Applicability:

Applies to the auxiliary Applies to the periodic testing electrical power systems. requirements of the auxiliary electrical power systems.

Objective: Objective:

To assure an adequate supply of To verify the operability of electrical power for operation the auxiliary electrical power of those systems required for systems.

reactor safety.

Specification: Specification:

A. Normal Operation A. Normal Operation The reactor shall not be 1. Diesel Generators made critical unless all of the following conditions Note: All diesel are satisfied. generator starts may be preceded

1. Diesel Generators by an engine prelube and Both emergency diesel warmup generators shall be procedures.

operable and capable of starting and reaching a. Monthly rated voltage and frequency in not more 1. Each diesel than 13 seconds. generator shall be manually started using the undervoltage, automatic starting circuit, the speed increased from idle to synchronous and then gradually loaded to expected maximum emergency loading not to exceed the continuous rating to demonstrate operational readiness. The test shall continue for a minimum period of one hour.

Amendment No. 4+8, 138 211

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

2. Each diesel generator starting air compressor shall be checked for operation and its ability to recharge the air receivers.

3. Once each six months, in lieu of Specification 4.10.A.l.a.1, each diesel generator shall be manually started using the undervoltagr automatic starting ci and loaded to demonstrate that it will reach rated frequency and voltage within specified time limits.

The diesel generator shall then be gradually loaded to expected maximum emergency loading not to exceed the continuous rating and run for a minimum period of one hour. The time taken to reach the rated frequency and voltage shall be logged.

b. Operating Cycle Test The actual conditions under which the diesel generators are required to start automatically will be simulated and a test conducted to demonstrate that they will start Amendment No. 138 211a

3.10 LIMITING COlDITTIONS FOR 4.'0 SURVEILLANCE REQUIREMENTS OPERATION within 13 seconds and accept the emergency loads and start each load within the specified starting time. The results shall be logged.

c. Each diesel fuel oil transfer pump shall be tested in accordance with Specification 4.6.E.

2. Battery Svstems 2. Battery Systems The following battery a. Every week the systems shall be specific gravity, operable: temperature, level, and voltage of the

a. The four Neutron pilot cell and Monitoring and overall battery Process Radiation voltage shall be Batteries, measured and associated logged.

chargers, and 24 VDC Distribution b. Every three months Panels. the voltage, temperature, level,

b. The two main and specific station batterv gravity of each systems ccnsistina cell, and overall of: battery voltage shall be measured

1. Battery Al, and logged.

Battery Charger A or C, and Bus DC-1.

I 2. Battery B1, Battery Charger B or D, and Bus DC-2.

Amendment No. -5, 4-25, 4-As, 43-,198 212 MIA 2 bill

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

c. Deleted. c. Once per operating cycle each Alternate Shutdown AS-2 battery, and Main Station battery shall be sUbjected to a Service (Load Profile) discharge test. The specific

d. Deleted. gravity and voltage of each cell shall

e. The Alternate Shutdown be measured after AS-2 battery, one of the recharge at the the two associated end of the' chargers, and DC discharge test and Distribution panel logged.

DC-2AS.

d. Once every five

f. Both UPS batteries, years, each UPS, associated AS-2, and Main Uninterruptible Power Station Battery Supplies and MCC 89A sh~ll be subjected and B. to a Performance (capacity)

Discharge Test.

This test will be performed in lieu of the Service Test requirements of 4.l0.A.2.c above.

e. Each 480 V Uninterruptible Power System shall be checked daily . . ,

f. 480 V Motor Control Centers 89A and 89B shall be checked daily.

g. Once per operating cycle, the actual conditions under which the 480 V Uninterruptible Power Systems are required will be simulated and a test conducted to demonstrate equipment performance.

Amendment No. 8-, H-§., G-+/-- 234 213

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

3. Emercency Buses 3. Emereencv Buses The emergency 4160 volt The emergency 4160 volt Buses 3 and 4, and buses and 480 volt 480 volt Buses 8 and 9 buses shall be checked shall be energized and daily.

operable.

4. Off-Site Power 4. Off-Site Power Two qualified off-site a. The status of the I power sources off-site power consisting of the sources shall be immediate access source checked daily.

and the delayed access source shall be b. Once per operating energized and operable. cycle, the delayed access source shall be established within one hour.

5. Reactor Protection 5. Reactor Protection Svstem Power Protection System Power Protection.

Two RPS power Once per operating protection panels for cycle, the operability each inservice RPS MG of each overvoltage, set or alternate power undervoltage, and source shall be under frequency operable. protective device shall be demonstrated by the performance of an instrument channel calibration test.

Settings shall be verified to be in accordance with Table 4.'0.1.

Amendment No. 26, 112, 2-5,155 214 MAAR 2 4 1998

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION B. Operation With Inoperable B. Operation With Inoperable Components Comoonents Whenever the reactor is in Run Mode or Startup Mode with the reactor not in the Cold Condition, the requirements of 3.10.A shall be met except:

1. Diesel Generators 1. Diesel Generator From and after the date When one of the diesel that one of the diesel generators is made or generators is made or found to be inoperable:

I found to be inoperable for any reason and the a. Within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months remaining diesel determine that the generator is operable, remaining diesel continued operation is generator is not permissible only during inoperable due to the succeeding 7 days, common cause provided that either: failure; or

a. all required b. The remaining diesel systems, subsystems, generator shall have trains, components been or shall be and devices (i.e., demonstrated to be required features) operable within 24 supported by the hours.

operable diesel generator are operable, or

b. if required feature(s) supported by the operable diesel generator are inoperable, the redundant required feature(s) supported by the inoperable diesel generator are immediately declared inoperable and the applicable Technical Specification action(s) taken.

Otherwise, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Amendment No. Go, 12, aa4, eGig 213 215

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

2. Batteries 2. Batteries

a. From and after the Samples of the Battery date that Room atmosphere shall ventilation is lost be taken daily for in the Battery Room hydrogen concentration portable determination.

ventilation equipment shall be provided.

b. From and after the date that one of the two 125 volt Station Battery Systems is made or found to be inoperable for any reasons, continued reactor operation is permissible only during the succeeding three days provided that during such three days, all required systems, subsystems, trains, components and devices supported by the operable 125 volt Station Battery System are operable, unless such Battery System is sooner made operable. If this requirement cannot be met, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. Deleted.

d. From and after the date that the AS-2 125 Volt battery system is made or found to be inoperable for any reason, continued reactor operation is permissible provided Diesel Generator DG-1-1A control power is transferred to Station Battery BE.

Amendment No. SE, G4-, 2-4S., l, a-G0l, 213 216

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

e. From and after the date that one of the two 24 Volt Neutron Monitoring and Process Radiation Monitoring battery systems is found or made to be inoperable for any reason, continued reactor operation is permissible providing the minimum channel requirements of Sections 3.1 and 3.2 for the Neutron Monitoring and

'Process Radiation Monitoring systems are met.

f. Deleted

3. Off-Site Power 3. Off-Site Power

a. From and after the a. When one off-site date one off-site power source is power source is unavailable, the made or found to be remaining power inoperable for any source shall be reason, reactor verified operable operation may within one hour and continue for seven once per eight days provided the hours thereafter.

remaining off-site power source and both diesel generators are operable, and either:

Amendment No. ~, ~, ~, ~, ~ 234 217

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

1. all required systems, subsystems, trains, components and devices (i.e.,

required features) supported by the operable off-site power source are operable, or

2. if required feature(s) supported by the operable off-site power source are inoperable, the redundant required feature(s) with no off-site power are immediately declared inoperable and the applicable Technical Specification action(s) taken.

Otherwise, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months unless the conditions of Specification 3.10.B.3.b are applicable.

b. From and after the b. When either off-site date that either power source and one off-site power diesel are I source and one unavailable:

diesel generator are made or found 1. The other to be inoperable off-site power for any reason, source shall be I continued operation verified is permitted for operable within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as long as one hour and the remaining once per eight hours thereafter.

Amendment No. 4-55, bg, 213 2 11a

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIEMIENTS OPERATION off-site power source and the remaining diesel generator are operable, and either:

1. all required systems, subsystems, trains, components and devices (i.e.,

required features) supported by the operable off-site power source are operable and all required features supported by the operable diesel generator are operable, or

2. if required 2. The requirements feature(s) of Specification supported by the 4.10.B.l shall be operable off-site met within power source are 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

inoperable or if required feature(s) supported by the operable diesel generator are inoperable, the redundant required feature(s) with no off-site power and the redundant required feature(s) supported by the inoperable diesel generator are immediately declared inoperable and the applicable Technical Specification action(s) taken.

Otherwise, an orderly shutdown shall be initiated and the reactor shall be in the cold shutdown condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Amendment No. fi, 213 213 217b

VYNPS 3.10 LIMITING CONDITIONS FOR 4.10 SURVEILLANCE REQUIREMENTS OPERATION

4. 480 V Uninterruptible Power Systems From and after the date that one Uninterruptible Power System or its associated Motor Control Center are made or found to be inoperable for any reason, the requirements of Specification 3.5.A.4 shall be satisfied.

5. RPS Power Protection From and after the date that one of the two redundant RPS power protection panels on an in-service RPS MG set or alternate power supply is made or found to be inoperable, the associated RPS MG set or alternate supply will be taken out of service until the panel is restored to operable status.

C. Diesel Fuel C. Diesel Fuel There shall be a minimum 7 1. The quantity of diesel day supply of usable diesel generator fuel shall be fuel in the diesel fuel'oil logged weekly and after storage tank. each operation of the unit.

2. Once a month a sample of diesel fuel shall be taken, checked for quality in accordance with the applicable ASTM Standards and logged.

Amendment No. -a4, -I-, -4, 2-8-0, 2-2*-4,231 218

VYNPS TABLE 4.10.1 REACTOR PROTECTION SYSTEM POWER PROTECTION Setpoints for Parameter Panels Al, A2, Bl, B2, Cl, C2 Overvoltage < 125.5 volts Overvoltage Time Delay < 0.35 seconds Undervoltage > 111 volts Undervoltage Time Delay < 0.35 seconds Underfrequency > 56.5 Hz Underfrequency Time Delay < 0.35 seconds Amendment No. 112 219

VYNPS BASES:

3.10 AUXILIARY ELECTRIC POWER SYSTEMS A. The objective of this Specification is to assure that adequate power will be available to operate the emergency safeguards equipment. Adequate power can be provided by any one of the following sources: an immediate access source through both startup transformers, backfeed through the main transformer, or either of the two diesel generators. The backfeed through the main transformer is a delayed access off-site power source. The delayed access source is made available by opening the generator no load disconnect switch and establishing a feed from the 345 kV switchyard through the main generator step up transformer and unit auxiliary transformer to the 4.16 kV buses. The delayed access source is available within an hour of loss of main generator capability to assure that fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.

Electric power can be supplied from the off-site transmission network to the on-site Emergency Safeguards Electric Power Distribution System by two independent sources, one immediate access and one delayed access, designed and located so as to minimize to the extent practicable the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. An additional off-site source, a 4160 V tie line to Vernon Hydroelectric Station, can supply either 4160 V emergency bus. It is used to meet station blackout and Appendix R licensing requirements.

Off-site power is supplied to the Vermont Yankee (VY) 345 kV switchyard from the transmission network via two independent 345 kV tie lines from the Vernon 345 kV switchyard. Both 345 kV tie lines are sized to carry the entire output of Vermont Yankee. Each 345 kV tie line is protected by two diverse and redundant channels of line protection. The loss of one tie line does not affect the reliability or operability of the other. The new Vernon 345 kV switchyard is located just north of the VY 345 kV switchyard. The Vernon 345 kV switchyard is connected to the 345 kV grid by four 345 kV transmission lines utilizing a breaker and a half scheme.

With this redundant configuration, either 345 kV tie line meets the requirements for an operable delayed access source.

In the VY 345 kV switchyard, a 400 MVA autotransformer is connected between the 345 kV north bus and the VY 115 kV bus through the K-1 breaker. A second 400 MVA transformer, located in the new Vernon switchyard, connects the Vernon 345 kV switchyard to the Vernon 115 kV yard. This second autotransformer also feeds the VY 115 kV switchyard through the 115 kV K-40 tie line from the Vernon 115 kV switchyard. The two autotransformers are operated in parallel to feed the VY 115 kV bus but are physically separated and electrically independent. The loss of one autotransformer will not cause loss of the other one. The two autotransformers are the normal source of power for the 115 kV bus and the station startup transformers. They also feed the 115 kV transmission line to Chestnut Hill/Vernon Road.

The immediate access source power is provided to the 4160 buses through two startup transformers fed from the VY 115 kV switchyard through disconnect T-3. It is available within seconds following a design basis accident to assure core cooling, containment integrity and other vital functions are being maintained. The normal supply to the VY 115 kV switchyard bus is from the two paralleled, but independent, 345 kV/115 kV autotransformers described above. In the unlikely event that both autotransformers are out of service, an alternate immediate access source through the Chestnut Hill/Vernon Road line, Vernon 115 kV yard and K-40 Tie Line may be made available. Its availability is dependent on its preloading of the Chestnut Hill/Vernon Road line which must be limited by system Amendment No. 26, 124, 155, BVY 01 52, 213, BVY 08-060, BVY 10-027, 220 BVY 10-056

VYNPS BASES: 3.10 (Cont'd) dispatchers prior to its being declared an immediate access source.

The availability of any one of these three sources of power to the VY 115 kV bus will fulfill the requirements for an Immediate Access Source to the start-up transformers.

A qualified source consists of all breakers, transformers, switches, interrupting devices, cabling, controls and circuit paths (including feeder breakers to both 4160 V emergency buses) required to transmit adequate power from the off-site transmission network to the on-site Emergency Safeguards Buses 3 and 4.

Two 480 V Uninterruptible Power Systems supply power to the LPCIS valves via designated Motor Control Centers. The 480 V Uninterruptible Power Systems are redundant and independent of any on-site ac power sources. A 480 V Uninterruptible Power System consists of a battery and a motor generator unit.

This Specification assures that at least two off-site and two on-site power sources, and both 480 V Uninterruptible Power Systems will be available before the reactor is made critical. In addition to assuring power source availability, all of the associated switchgear must be operable as specified to assure that the emergency cooling equipment can be operated, if required, from the power sources.

Station service power is supplied to the station through either the unit auxiliary transformer or the startup transformers. In order to start up the station, the startup transformers are required to supply the station auxiliary load. After the unit is synchronized to the system, the unit auxiliary transformer carries the station auxiliary load, except for the station cooling tower loads which are always supplied by one of the startup transformers. The station cooling tower loads are not required to perform an engineered safety feature function in the event of an accident; therefore, an alternate source of power is not essential. Normally one startup transformer supplies 4160 volt Buses 1 and 3, and the other supplies Buses 2 and 4.

A battery charger is supplied for each battery. In addition, the two 125 volt main station battery systems have two chargers available for each system. Either charger is capable of supplying its respective 125 VDC bus.

Power for the Reactor Protection System is supplied by 120 V ac motor generators with an alternate supply from MCC-8B. Two redundant, Class 1E, seismically qualified power protection panels are connected in series with each ac power source. These panels provide overvoltage, undervoltage, and underfrequency protection for the system. Setpoints are chosen to be consistent with the input power requirements of the equipment connected to the bus.

B. An Operable delayed access source is defined as 1) either one of the two 345 kV tie lines from the Vernon 345 kV switchyard providing power to the VY 345 kV switchyard ring bus, plus 2) either of the two generator breakers being available to provide power from the VY 345 kV switchyard ring bus through disconnect T-1 to backfeed the Main Step-up transformer and the 22 kV Isolated Phase Bus, plus 3) the auxiliary transformer available to provide power to the 4 kV buses with the generator disconnect switch GD-1 open.

Adequate power is available to operate the emergency safeguards equipment from the immediate access source or for minimum engineered safety features from either of the emergency diesel generators.

Therefore, reactor operation is permitted for up to seven days with the delayed-access off-site power source unavailable provided all required systems, subsystems, trains, components and devices (i.e.,

Amendment No. 58, 112, 125, 155, 198, 213, BVY 10-027, BVY 10-056 221

VYNPS BASES: 3.10 (Cont'd) required features) supported by the operable off-site power source are operable. Provided at least one off-site power source is available to each 4160 V Emergency Safeguards Bus, no additional action requirements exist due to a required feature being inoperable.

However, if both off-site power sources are lost to one or both 4160 V Emergency Safeguards Buses and a required feature is inoperable, then redundant required features with no off-site power are required to be immediately declared inoperable and the applicable Technical Specification action(s) taken. These provisional requirements ensure that, during the seven day allowed outage time, a loss of off-site power with a coincident single failure of a diesel generator does not result in a loss of safety function of critical systems. Required features are systems, subsystems, trains, components and devices supported by the off-site power sources and diesel generators and are required to be operable by the Technical Specifications in the existing plant mode or condition.

Each of the diesel generator units is capable of supplying 100 percent of the minimum emergency loads required under postulated design basis accident conditions. Each unit is physically and electrically independent of the other and of any off-site power source. Adequate power is also available to operate the emergency safeguards equipment from the immediate access source or from the delayed access source of off-site power. Therefore, one diesel generator can be allowed out of service for a period of seven days without jeopardizing the safety of the station provided all required systems, subsystems, trains, components and devices (i.e., required features) supported by the operable diesel generator are operable. If required feature(s) supported by the operable diesel generator are inoperable, the redundant required feature(s) supported by the inoperable diesel generator are required to be immediately declared inoperable and the applicable Technical Specification action(s) taken. These provisional requirements ensure that, during the seven day allowed outage time, a loss of off-site power does not result in a loss of safety function of critical systems. Required features are systems, subsystems, trains, components and devices supported by the off-site power sources and diesel generators and are required to be operable by the Technical Specifications in the existing plant mode or condition.

In the event that the immediate access source is unavailable, adequate power is available to operate the emergency safeguards equipment from the emergency diesel generators or from the delayed-access off-site power source. Therefore, reactor operation is permitted for up to 7 days with the immediate access source unavailable provided all required systems, subsystems, trains, components and devices (i.e.,

required features) supported by the operable off-site power source are operable. Provided at least one off-site power source is available to each 4160 V Emergency Safeguards Bus, no additional action requirements exist due to a required feature being inoperable.

However, if both off-site power sources are lost to one or both 4160 V Emergency Safeguards Buses and a required feature is inoperable, then redundant required features with no off-site power are required to be immediately declared inoperable and the applicable Technical Specification action(s) taken. These provisional requirements ensure that, during the seven day allowed outage time, a loss of off-site power with a coincident single failure of a diesel generator does not result in a loss of safety function of critical systems. Required features are systems, subsystems, trains, components and devices supported by the off-site power sources and diesel generators and are required to be operable by the Technical Specifications in the existing plant mode or condition.

Amendment No. 58,61,155,NVY 98-52,BVY 99-55,180,201,BVY 01-40,213, 221a BVY 10-027, BVY 10-056

VYNPS BASES: 3.10 (Cont'd)

In the event that both emergency diesel generators are lost, adequate power is available to operate the emergency safeguards equipment from the immediate access source or from the delayed-access off-site power source within one hour.

The plant is designed to accept one hundred percent load rejection without adverse effects to the plant or the transmission system.

Network stability analysis studies indicate that the loss of the Vermont Yankee unit will not cause instability and consequent tripping of the connecting 345 kV and 115 kV lines. Thus, the availability of the off-site power sources is assured in the event of a turbine trip.

In the event that one off-site power source and one emergency diesel generator are unavailable, adequate power is available to operate both emergency safeguards buses from the operable off-site power source and to operate 100% of the minimum emergency safeguards loads from the operable diesel generator. In addition, the station blackout alternate ac source of power is capable of supplying power to the bus with the inoperable diesel generator. Therefore, continued operation is permitted for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months with one off-site power source and one emergency diesel generator unavailable provided all required systems, subsystems, trains, components and devices (i.e., required features) supported by the operable off-site power source are operable and all required features supported by the operable diesel generator are operable. If required feature(s) supported by the operable off-site power source are inoperable or if the required feature(s) supported by the operable diesel generator are inoperable, the redundant required feature(s) with no off-site power available and the redundant required feature(s) supported by the inoperable diesel generator are required to be immediately declared inoperable and the applicable Technical Specification action(s) taken. These provisional requirements ensure that, during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed outage time, a loss of off-site power does not result in a loss of safety function of critical systems.

Required features are systems, subsystems, trains, components and devices supported by the off-site power sources and diesel generators and are required to be operable by the Technical Specifications in the existing plant mode or condition.

Either of the two main station batteries has sufficient capacity to energize the vital buses and supply d-c power to the associated emergency equipment for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months without being recharged.

Due to the high reliability of battery systems, one of the two batteries may be out of service for up to three days provided all required systems, subsystems, trains, components and devices supported by the operable 125 volt Station Battery System are operable. The provisional requirement ensures that, during the three day allowed outage time, a loss of safety function of critical systems does not exist. Required systems, subsystems, trains, components and devices are those supported by 125 volt Station Battery System and are required to be operable by the Technical Specifications in the existing plant mode or condition. This minimizes the probability of unwarranted shutdown by providing adequate time for reasonable repairs. A station battery or an Uninterruptible Power System battery is considered inoperable if one cell is out of service. A cell will be considered out of service if its float voltage is below 2.13 volts and the specific gravity is below 1.190 at 77 F.

Amendment No. BVY 01.40, 213, BVY 06-085, 234, BVY 09-021 BVY 10-027, 221b BVY 10-056

VYNPS BASES: 3.10 (Cont'd)

The Battery Room is ventilated to prevent accumulation of hydrogen gas.

With a complete loss of the ventilation system, the accumulation of hydrogen would not exceed 4 percent concentration in 2 1/2 days.

Therefore, on loss of Battery Room ventilation, the use of portable ventilation equipment and daily sampling provide assurance that potentially hazardous quantities of hydrogen gas will not accumulate.

C. The minimum diesel fuel supply of 36,000 gallons will supply one diesel generator for a minimum of seven days of operation at its continuous duty rating of 2750kW. Additional fuel can be obtained and delivered to the site from nearby sources within the seven-day period.

Amendment No. BVY 10-056 221c

VYNPS BASES:

4.10 AUXILIARY ELECTRICAL POWER SYSTEMS A. The monthly tests of the diesel generators are conducted to check for equipment failures and deterioration. The test of the undervoltage automatic starting circuits will prove that each diesel will receive a start signal if a loss of voltage should occur on its emergency bus.

The loading of each diesel generator is conducted to demonstrate proper operation at less than the continuous rating and at equilibrium operating conditions. Generator experience at other generator stations indicates that the testing frequency is adequate to assure a high reliability of operation should the system be required.

Both diesel generators have air compressors and air receivers tanks for starting. It is expected that the air compressors will run only infrequently. During the monthly check of the units, each receiver will be drawn down below the point at which the compressor automatically starts to check operation and the ability of the compressors to recharge the receivers.

Following the tests of the units and at least weekly, the fuel volume remaining will be checked. At the end of the monthly load test of the diesel generators, the fuel oil transfer pump will be operated to refill the day tank. Fuel oil transfer pump operability testing is in accordance with Specification 4.6.E.

The test of the diesels and Uninterruptible Power Systems during each refueling interval will be more comprehensive in that it will functionally test the system; i.e., it will check starting and closure of breakers and sequencing of loads. The units will be started by simulation of a loss of coolant accident. In addition, a loss of normal power condition will be imposed to simulate a loss of off-site power.

The timing sequence will be checked to assure proper loading in the time required. Periodic tests between refueling intervals check the capability of the diesels to start in the required time and to deliver the expected emergency load requirements. Periodic testing of the various components plus a functional test at a refueling interval are sufficient to maintain adequate reliability.

The purpose of establishing the delayed access source once per operating cycle is to demonstrate that the delayed access source can be established within the required time of one hour and to demonstrate proper operation of the generator no load disconnect switch. The test demonstrates that power can be transferred to the delayed access source in a timely fashion. The test is not intended to simulate an actual loss of the immediate access source, failure of both diesel generators and consequent loss of power to the station buses.

B. Although the Main Station, AS-2, and UPS batteries will deteriorate with time, utility experience indicates there is almost no possibility of precipitous failure. The type of surveillance described in this specification is that which has been demonstrated over the years to provide an indication of a cell becoming irregular or unserviceable long before it becomes a failure.

The Performance Discharge Test (4.10.A.2.d), performed in the as-found condition after the battery has been in service, provides adequate indication and assurance that the batteries have the specified ampere hour capacity. The rate of discharge during this test shall be in accordance with the manufacturer's discharge characteristic curves Amendment No. 26, 125, 128, 155, 201, BVY 01-40, BVY 06-085 222

VYNPS BASES: 4.10 (Cont'd) for the associated batteries. The results of these tests will be logged and compared with the manufacturer's recommendations of acceptability.

The Service Discharge Test (4.10.A.2.c) is a test of the batteries ability to satisfy the design requirements of the associated dc system. This test will be performed using simulated or actual loads at the rates and for the durations specified in the design load profile (battery duty cycle).

Assurance that the diesels will meet their intended function is obtained by periodic surveillance testing and the results obtained from the pump and valve testing performed in accordance with the requirements of Specification 4.6.E. Specification 4.10.B.1.a provides an allowance to avoid unnecessary testing of the operable emergency diesel generator (EDG). If it can be determined that the cause of the inoperable EDG (e.g., removal from service to perform routine maintenance or testing) does not exist on the operable EDG, demonstration of operability of the remaining EDG does not have to be performed. If the cause of inoperability exists on the remaining EDG, it is declared inoperable upon discovery, and Limiting Condition for Operation 3.10.B.1 requires reactor shutdown within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Once the failure is repaired, and the common cause failure no longer exists, Specification 4.10.B.1.a is satisfied. If the cause of the initial inoperable EDG cannot be confirmed not to exist on the remaining EDG, performance of Surveillance Requirement (SR) 4.10.B.1.b suffices to provide assurance of continued operability of that EDG.

In the event the inoperable EDG is restored to operable status prior to completing either SR 4.10.B.1.a or SR 4.10.B.1.b, the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in the condition of SR 4.10.B.1 or SR 4.10.B.3.b.2.

According to NRC Generic Letter 84-15, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the operable EDG is not affected by the same problem as the inoperable EDG.

Verification of operability of an off-site power source within one hour and once per eight hours thereafter as required by 4.10.B.3.b.1 may be performed as an administrative check by examining logs and other information to determine that required equipment is available and not out of service for maintenance or other reasons. It does not require performing the surveillance needed to demonstrate the operability of the equipment.

C. Logging the diesel fuel supply weekly and after each operation assures that the minimum fuel supply requirements will be maintained.

During the monthly test for quality of the diesel fuel oil, a viscosity test and water and sediment test will be performed as described in ASTM D975-09. The quality of the diesel fuel oil will be acceptable if the results of the tests are within the limiting requirements for diesel fuel oils shown on Table 1 of ASTM D975-09.

Amendment No. 125, 155, BVY 01-40, 209, 213, 214, 226, BVY 06-085, 234, 223 BVY 09-055

VYNPS 3.11 LIMITING CONDITIONS FOR 4.11 SURVEILLANCE REQUIREMENTS OPERATION 3.11 REACTOR FUEL ASSEMBLIES 4.11 REACTOR FUEL ASSEMBLIES Applicability: Applicability:

The Limiting Conditions for The Surveillance Requirements Operation associated with the apply to the parameters which fuel rods apply to these monitor the fuel rod operating parameters which monitor the conditions.

fuel rod operating conditions.

Objective: Objective:

The Objective of the Limiting The Objective of the Conditions for Operation is to Surveillance Requirements is to assure the performance of the specify the type and frequency fuel rods. of surveillance to be applied to the fuel rods.

Specifications: Specifications:

A. Average Planar Linear Heat A. Average Planar Linear Heat Generation Rate (APLHGR) Generation Rate (APLHGR)

During operation at The APLHGR for each type of 2 23% Rated Thermal fuel as a function of Power, the APLHGR for average planar exposure, each type of fuel as a power, and flow shall be function of average determined once within 12 planar exposure, power, hours after 2 23% Rated I and flow shall not Thermal Power and daily exceed the limiting during operation at 2 23% I values provided in the Rated Thermal Power Core Operating Limits thereafter.

Report. For single recirculation loop operation, the limiting values shall be the values provided in the Core Operating Limits Report listed under the heading "Single Loop Operation." If at any time during operation at 2 23% Rated Thermal Power it is determined by normal surveillance that the limiting value for APLHGR is being exceeded, APLHGR(s) shall be returned to within prescribed limits within two (2) hours; otherwise, the reactor shall be brought to < 23% Rated Thermal Power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits.

Amendment No. 4i, 4G, 44, 9g, 94, ,10# d4, 18&, 24, 229 224

VYNPS 3.11 LIMITING CONDITIONS FOR 4.11 SURVEILLANCE REQUIREMENTS OPERATION B. Linear Heat Generation Rate B. Linear Heat Generation Rate (LHGR) (LHGR)

I During operation at 2 23% The LHGR as a function of Rated Thermal Power, the core height shall be checked linear heat generation rate once within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after (LHGR) of any rod in any 2 23% Rated Thermal Power I fuel assembly at any axial and daily during operation location shall not exceed at 2 23% Rated Thermal Power I the maximum allowable LHGR thereafter.

provided in the Core Operating Limits Report.

If at any time during I operation at 2 23% Rated Thermal Power it is determined by normal surveillance that the limiting value for LHGR is being exceeded, LHGR(s) shall be returned to within the prescribed limits within two (2) hours; otherwise, the reactor shall be brought I to < 23% Rated Thermal Power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits.

Amendment No. id, 4-, -64, a-G4, 44-S, a846, 229 225

VYNPS 3.11 LIMITING CONDITIONS FOR 1 4.11 SURVEILLANCE REQUIREMENTS OPERATION C. Minimum Critical Power Ratio C. Minimum Critical Power Ratio (MCPR) (MCPR)

1. During operation at MCPR shall be determined I 2 23% Rated Thermal once within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after Power the MCPR operating 2 23% Rated Thermal Power I value shall be equal to and daily during operation or greater than the MCPR at 2 23% Rated Thermal Power limits provided in the thereafter.

Core Operating Limits Report. For single recirculation loop operation, the MCPR Limits at rated flow are also provided in the Core Operating Limits Report. If at any time during operation at I 2 23% Rated Thermal Power it is determined by normal surveillance that the limiting value for MCPR is being exceeded, MCPR(s) shall be returned to within the prescribed limits within two (2) hours; otherwise, the reactor power shall be brought I to < 23% Rated Thermal Power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits.

Amendment No. -t, 4-v-,., 4, A4, .44, 214, 229 226

VYNPS BASES:

3.11 FUEL RODS A. Average Planar Linear Heat Generation Rate (APLHGR)

Refer to the appropriate topical reports listed in Specification 6.6.C for analyses methods.

(Note: All exposure increments in this Technical Specification section are expressed in terms of megawatt-days per short ton.)

The MAPLHGR reduction factor for single recirculation loop operation is based on the assumption that the coastdown flow from the unbroken recirculation loop would not be available during a postulated large break in the active recirculation loop. See Core Operating Limits Report for the cycle-specific reduction factor.

APLHGR is the average LHGR of all the fuel rods in a fuel assembly at any axial location. APLHGR limits ensure that the peak cladding temperature (PCT) during a design basis loss-of-coolant accident (LOCA) does not exceed 2200ºF. LOCA analyses are performed to verify this.

APLHGR limits are specified in the cycle-specific COLR.

B. Linear Heat Generation Rate (LHGR)

Refer to the appropriate topical reports listed in Specification 6.6.C for analyses methods.

LHGR is the linear heat generation rate of a fuel rod at a given nodal plane in a bundle. LHGR limits are bundle type dependent and monitored to assure all mechanical design requirements are met.

Flow dependent LHGR limits were designed to assure adherence to all fuel thermal-mechanical design bases. The same transient events used to support the MCPR(F) operating limits were analyzed, and the resulting overpowers were statistically evaluated as a function of the initial and maximum core flow. From the bounding overpowers, the LHGRFAC(F)limits were derived such that peak transient LHGR would not exceed fuel mechanical limits. The flow-dependent LHGR limits are cycle-independent and are specified in terms of multipliers, LHGRFAC(F), to be applied to the rated LHGR values.

Power-dependent LHGR limits, expressed in terms of a LHGR multiplier, LHGRFAC(P), are applied to assure adherence to the fuel thermal-mechanical design bases. Both incipient centerline melting of fuel and plastic strain of the cladding are considered in determining the power dependent LHGR limit. The power-dependent LHGRFAC(P) multipliers were generated using the same database as used to determine the MCPR multiplier (Kp). Appropriate LHGRFAC(P) multipliers are selected based on plant-specific transient analyses with suitable margin to assure applicability to future reloads. These limits are derived to assure that the peak transient LHGR for any transient is not increased above the fuel design bases values.

The LHGRFAC multipliers also provide adequate protection for the off-rated LOCA conditions since a constant local peaking factor is used in the LOCA evaluation.

LHGR limits are specified in the cycle-specific COLR.

Amendment No. 18, 47, 70, 83, 94, 95, 100, 116, 150, BVY 99-55, 171, 219 227 BVY 07-052

VYNPS BASES:

3.11 FUEL RODS (Continued)

C. Minimum Critical Power Ratio (MCPR)

Operating Limit MCPR

1. The MCPR operating limit is a cycle-dependent parameter which can be determined for a number of different combinations of operating modes, initial conditions, and cycle exposures in order to provide reasonable assurance against exceeding the Fuel Cladding Integrity Safety Limit (FCISL) for potential abnormal occurrences. The MCPR operating limits are justified by the analyses, the results of which are presented in the current cycle's Supplemental Reload Licensing Report. Refer to the appropriate topical reports listed in Specification 6.6.C for analysis methods. The increase in MCPR operating limits for single loop operation accounts for increased core flow measurement and TIP reading uncertainties.

Flow-dependent MCPR limits, MCPR(F), are necessary to assure that the Safety Limit MCPR (SLMCPR) is not violated during recirculation flow increase events. The design basis flow increase event is a slow (maximum two pump runout rate of 1%/second) recirculation flow increase event which is not terminated by scram, but which stabilizes at a new core power corresponding to the maximum possible core flow. Flow runout events were analyzed along a constant xenon, constant feedwater temperature flow control line assuming a quasi steady-state plant heat balance. The ARTS-based MCPR(F) limit is specified as an absolute value and is cycle-independent. The operating limit is based on the maximum core flow limiter setting of 109.5% in the Recirculation Flow Control System.

Above the power at which the scram is bypassed (Pbypass), bounding power-dependent trend functions have been developed. This trend function, Kp, is used as multiplier to the rated MCPR operating limits to obtain the power-dependent MCPR limits, MCPR(P). Below the power at which the scram is automatically bypassed (Below Pbypass), the MCPR(P) limits are actual absolute Operating Limit MCPR (OLMCPR) values, rather than multipliers on the rated power OLMCPR.

Amendment No. 219, BVY 07-052 227a

VYNPS BASES:

4.11 FUEL RODS A. The APLHGR, LHGR and MCPR shall be checked daily when operating at 23% Rated Thermal Power to determine if fuel burnup, or control rod movement has caused changes in power distribution. Since changes due to burnup are slow, and only a few control rods are removed daily, a daily check of power distribution is adequate. For a limiting value to occur below 23% of rated thermal power, an unreasonably large peaking factor would be required, which is not the case for operating control rod sequences. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after thermal power 23% Rated Thermal Power is achieved is acceptable given the large inherent margin to operating limits at low power levels.

B. At certain times during plant startups and power changes the plant technical staff may determine that surveillance of APLHGR, LHGR and/or MCPR is necessary more frequently than daily. Because the necessity for such an augmented surveillance program is a function of a number of interrelated parameters, a reasonable program can only be determined on a case-by-case basis by the plant technical staff. The check of APLHGR, LHGR and MCPR will normally be done using the plant process computer. In the event that the computer is unavailable, the check will consist of either a manual calculation or a comparison of existing core conditions to those existing at the time of a previous check to determine if a significant change has occurred.

If a reactor power distribution limit is exceeded, an assumption regarding an initial condition of the DBA analysis, transient analyses, or the fuel design analysis may not be met. Therefore, prompt action should be taken to restore the APLHGR, LHGR or MCPR to within the required limits such that the plant operates within analyzed conditions and within design limits of the fuel rods. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months completion time is sufficient to restore the APLHGR, LHGR, or MCPR to within its limits and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the APLHGR, LHGR, or MCPR out of specification.

C. Minimum Critical Power Ratio (MCPR) - Surveillance Requirement At core thermal power levels less than or equal to 23%, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience indicated that the resulting MCPR value is in excess of requirements by a considerable margin. With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR. During initial start-up testing of the plant, a MCPR evaluation will be made at 23% thermal power level with minimum recirculation pump speed. The MCPR margin will thus be demonstrated such that future MCPR evaluation below this power level will be shown to be unnecessary. The daily requirement for calculating MCPR above 23% rated thermal power is sufficient since power distribution shifts are very slow during normal operation.

Amendment No. 18, 188, 219, 229 228

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION 3.12 REFUELING AND SPENT FUEL HANDLING ~.12 REFUELING AND SPENT FUEL HANDLING Applicability: Applicability:

Applies to fuel handling, core Applies to the periodic testing reactivity limitations, and spent of those interlocks and fuel handling. instruments used during refueling.

Objective: Objective:

To assure core reactivity is To verify' the operability of within capability of the control instrumentation and interlocks rods, to prevent criticality used in refueling.

during refueling, and to assure safe handling of spent fuel casks.

Specification: Specification:

A. Refueling Interlocks A. Refueling Interlocks The reactor mode switch shall Prior to any fuel handling, be locked in the "Refuel" with the Head off the reactor position during core vessel, the following alterations and; required refueling interlock inputs shall be functionally

1. The refueling interlocks tested once every 7 days:

shall be operable during in-vessel fuel movement a. All-rods-in; for the equipment utilized b. Refuel platform position; in moving fuel. c. Refuel platform fuel grapple, fuel loaded; If*one or more of the d. Refuel platform frame required refueling mounted hoist, fuel interlocks are inoperable; loaded;

e. Refuel platform monorail Immediately suspend fuel mounted hoist, fuel movement with equipment loaded.

associated with the inoperable interlock(s),

-or-Immediately insert a control rod withdrawal block and verify all controy-rods are fully inserted.

2. The refueling interlocks shall be operable except as specified in Specification 3.l2.D and 3.12.E.

Amendment No. -+/--S, ~, ~ 245 229

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION B. Core Monitorinq B. Core Monitorinq During core alterations two Prior to making any SRMs shall be operable, one alterations to the core the I in the core quadrant where SRMs shall be functionally fuel or control rods are tested and checked for being moved and one in an neutron response.

adjacent quadrant. For an Thereafter, the SRMs shall be SRM to be considered operable checked daily for response.

the following conditions shall be satisfied:

1. The SRM shall be inserted to the normal operating level. (Use of special movable, dunking type detectors during initial fuel loading and major core alterations in place of normal detectors is permissible as long as the detectors are connected into the proper circuitry which contain the required rod blocks).

2. The SRM shall have a minimum of 3 cps with all rods fully inserted in the core.

Amendment No. 4*7 200 230 APR 2 0 2001

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION

3. Prior to spiral Prior to spiral unloading or unloading, the SRMs shall reloading, the SRMs shall be be proven operable as functionally tested. Prior stated in Sections to spiral reloading, the SRMs 3.12.B.1 and 3.12.B.2 shall be checked for neutron above, however, during response.

spiral unloading the count rate may drop below 3 cps.

4. Prior to spiral reloading, two diagonally adjacent fuel assemblies, which have previously accumulated exposure in the reactor, shall be loaded into core positions next to each of the 4 SRMs to obtain the required 3 cps. Until these eight bundles have been loaded, the 3 cps requirement is not necessary.

-C. Fuel Storage Pool Water Level C. Fuel Storaoe Pool Water Level Whenever irradiated fuel is Whenever irradiated fuel is stored in the fuel storage stored in the fuel storage pool the pool water level pool, the pool level shall be shall be maintained at a recorded daily.

level of at least 36 feet.

Amendment No. 6-9, 4-,181 231 DEC 1 4 1999

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION D. Control Rod and Control Rod D. Control Rod and Control Rod Drive Maintenance Drive Maintenance One control rod may b~ 1. Prior to performing this withdrawn from the core for maintenance, core the purpose of performing shutdown margin shall be control rod and/or control determined in accordance rod drive maintenance with Specification provided the following 3.3.A.1 to ensure that conditiona are satisfied: the core can be made subcritical at any time

1. The reactor mode switch during the maintenance shall be locked in the with the strongest "Refuel" position and the operable control rod required refueling fully withdrawn and all interlocks shall be other operable rods fully operable. inserted.

2. Specification 3.3.A.1 2. Alternately, if a minimum shall be met, or the of eight control control rod directional rods surrounding the control valves for a control rod out of minimum of eight control service for maintenance rods surrounding the are to be fUlly inserted drive out of service for and have their maintenance shall be directional control disarmed and sufficient valves electrically' margin to criticality disarmed, the required demonstrated. shutdown margin shall be met with the strongest

3. SRMs shall be operable in control rod remaining in the core quadrant service during the containing the control maintenance period fully rod on which main~enance withdrawn.

is being performed and in an adjacent quadrant.

The requirements for an SRM to be considered operable are given in Specification 3.12.8.

Amendment No. ~, +4&, ~ 233 232

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION E. Extended Core Maintenance E. Extended Core Maintenance One or more control rods may Prior to control rod be withdrawn or removed from withdrawal for extended core the reactor core provided the maintenance, that control following conditions are rod's control cell shall be satisfied: verified to contain no fuel assemblies.

1. The reactor mode switch 1. This surveillance shall be locked in the requirement is the same "Refuel" position. The as that given in refueling interlock which Specification 4.12.A.

prevents more than one control rod from being withdrawn may be bypassed on a withdrawn control rod after the fuel assemblies in the cell containing (controlled by) that control rod have been removed from the reactor core. The required refueling interlocks shall be operable.

2. SRMs shall be operable in 2. This surveillance the core quadrant where requirement is the same fuel or control rods are as that given in being moved, and in an Specification 4.12.B.

adjacent quadrant. The requirements for an SRM to be considered operable are given in Specification 3.12.B.

3. If the spiral unload/reload method of core alteration is to be used, the following conditions shall be met:

a. Prior to spiral unload and reload, the SRMs shall be proven operable as stated in Specification 3.12.B1 and 3.12.B2.

However, during spiral unloading, the count rate may drop below 3 cps.

Amendment No. 4&, 6-, -4, 4-4+4, 200 233 APR 2 0 2001

VYNPS

-- 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION

b. The core may be spirally reloaded to either the original configuration or a different configuration in the reverse sequence of that used to unload, with the exception that two (2) diagonally adjacent fuel assemblies, which have previously accumulated exposure in the reactor, shall be loaded into core positions next to each of the four (4) SRMs to obtain the required 3 cps.

Until these eight (8) bundles have

been loaded, the 3 cps requirement is not necessary.

Following insertion of the initial eight

'-'I (8) bundles, the reactor will be spirally reloaded around an SRM until the core is fully

.loaded.

c. At least 50% of the fuel assemblies to be reloaded into the core shall have previously accumulated a minimum exposure of 1000 Mwd/T.

Amendment No. &9, 44,181 234 DEC 1 4 1999

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION F. Fuel Movement F. Fuel Movement The reactor shall be shut Prior to any fuel handling or down for a minimum of 24 movement in the reactor core, hours prior to fuel movement the licensed operator shall within the reactor core.* verify that the reactor has been shut down for a minimum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

G. Deleted G. Deleted Amendment No. ~, ~, ~ 239 235

VYNPS 3.12 LIMITING CONDITIONS FOR 4.12 SURVEILLANCE REQUIREMENTS OPERATION H. Spent Fuel Pool Water H. Spent Fuel Pool Water Temperature Temperature Whenever irradiated fuel is Whenever irradiated fuel is stored in the spent fuel in the spent fuel pool, the pool, the pool water pool water temperature temperature shall be shall be recorded daily.

maintained below 150°F. If the pool water temperature reaches 150°F, all refueling operations tending to raise the pool water temperature shall cease and measures taken immediately to reduce the pool water temperature below 150°F.

Amendment No. ~, 239 236

VYNPS BASES:

3.12 & 4.12 REFUELING A. During refueling operations, the reactivity potential of the core is being altered. It is necessary to require certain interlocks and restrict certain refueling procedures such that there is assurance that inadvertent criticality does not occur.

To minimize the possibility of loading fuel into a cell containing no control rod, it is required that all control rods are fully inserted when fuel is being loaded into the reactor core. This requirement assures that during refueling the refueling interlocks, as designed, will prevent inadvertent criticality. Should the interlocks be made or found to be inoperable, the specifications offer an alternative to the cessation of fuel movement, not withstanding the completion of movement of a component to a safe position. The alternative is to immediately block control rod withdrawal and then perform a verification that all control rods are fully inserted. The core reactivity limitation of Specification 3.3 limits the core alterations to assure that the resulting core loading can be controlled with the Reactivity Control System and interlocks at any time during shutdown or the following operating cycle.

The addition of large amounts of reactivity to the core is prevented by operating procedures, which are in turn backed up by refueling interlocks on rod withdrawal and movement of the refueling platform.

When the mode switch is in the "Refuel" position, interlocks prevent the refueling platform from being moved over the core if a control rod is withdrawn and fuel is on a hoist.

Likewise, if the refueling platform is over the core with fuel on a hoist, control rod motion is blocked by the interlocks. With the mode switch in the refuel position, only one control rod can be withdrawn.

As discussed above, the purpose of the refueling interlocks is to prevent inadvertent criticality by ensuring that fuel is not loaded into a cell with a withdrawn control rod. The alternative identified within the specifications to continue fuel movement with inoperable interlocks satisfies this goal. The first refueling interlock safety function is to block control rod withdrawal whenever fuel is being moved in the reactor vessel. The alternative performs this function by requiring that a control rod block be placed in effect. The second refueling interlock safety function is to prevent fuel from being loaded into the vessel when a control rod is withdrawn. This function will continue to be performed by the second step of the alternative which is to verify that all control rods are fully inserted.

Therefore, the alternative provides equal assurance against inadvertent criticality during fuel handling within the reactor vessel with inoperable interlocks.

The Surveillance Requirements for the refueling interlocks identify that the required interlock inputs shall be functionally tested. The intent of this statement is that only the interlock inputs associated with the equipment actually used to facilitate the core alteration is required to be functionally tested. For example, if the main mast is to be used for fuel movement, then the interlock inputs associated with the main mast need to be functionally tested. Conversely, if the frame mounted hoist and monorail mounted hoist, will not be utilized, then the interlock inputs associated with the frame mounted hoist and monorail mounted hoist need not be functionally tested.

Amendment No. 18, 59, 77, 164, 200 237

VYNPS BASES: 3.12 & 4.12 (Cont'd)

B. The SRMs are provided to monitor the core during periods of station shutdown and to guide the operator during refueling operations and station startup. Requiring two operable SRMs in or adjacent to any core quadrant where fuel or control rods are being moved assures adequate monitoring of that quadrant during such alterations. The requirement of 3 counts per second provides assurance that neutron flux is being monitored. Under the special condition of complete spiral core unloading, it is expected that the count rate of the SRMs will drop below 3 cps before all the fuel is unloaded. Since there will be no reactivity additions, a lower number of counts will not present a hazard. When all of the fuel has been removed to the spent fuel storage pool, the SRMs will no longer be required. Requiring the SRMs to be operational prior to fuel removal assures that the SRMs are operable and can be relied on even when the count rate may go below 3 cps.

Prior to spiral reload, two diagonally adjacent fuel assemblies, which have previously accumulated exposure in the reactor, will be loaded into core positions next to each of the 4 SRMs to obtain the required 3 cps. Exposed fuel continuously produces neutrons by spontaneous fission of certain plutonium isotopes, photo fission, and photo disintegration of deuterium in the moderator. This neutron production is normally great enough to meet the 3 cps minimum SRM requirement, thereby providing a means by which SRM response may be demonstrated before the spiral reload begins. During the spiral reload, the fuel will be loaded in the reverse sequence that it was unloaded with the exception of the initial eight (8) fuel assemblies which are loaded next to the SRMs to provide a means of SRM response.

C. To assure that there is adequate water to shield and cool the irradiated fuel assemblies stored in the pool, a minimum pool water level is established. This minimum water level of 36 feet is established because it would be a significant change from the normal level, well above a level to assure adequate cooling (just above active fuel).

D. During certain periods, it is desirable to perform maintenance on a single control rod and/or control rod drive. This specification provides assurance that inadvertent criticality does not occur during such maintenance.

The maintenance is performed with the mode switch in the "Refuel" position to provide the refueling interlocks normally available during refueling operations as explained in Part A of these Bases. Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical during refueling operations.

During refueling operations, no more than one control rod is permitted to be withdrawn from a core cell containing one or more fuel assemblies. The refueling interlocks use the "full-in" position indicators to determine the position of all control rods. If the "full-in" position signal is not present for every control rod, then the "all-rods-in" permissive for the refueling equipment interlocks is not present and fuel loading and control rod withdrawal is prevented.

The refuel position one-rod-out interlock will not allow the withdrawal of a second control rod. The requirement that an adequate shutdown margin be determined with the control rods remaining in service ensures that inadvertent criticality cannot occur during this maintenance.

Disarming the directional control valves does not inhibit control rod scram capability.

Amendment No. 18, 59, 77, 148, 181, 200 238

VYNPS BASES: 3.12 & 4.12 (Cont'd)

E. The intent of this specification is to permit the unloading of a portion of the reactor core for such purposes as inservice inspection requirements, examination of the core support plate, control rod, control rod drive maintenance, etc. This specification provides assurance that inadvertent criticality does not occur during such operation.

This operation is performed with the mode switch in the "Refuel" position to provide the refueling interlocks normally available during refueling as explained in the Bases for Specification 3.12.A. In order to withdraw more than one control rod, it is necessary to bypass the refueling interlock on each withdrawn control rod which prevents more than one control rod from being withdrawn at a time. The requirement that the fuel assemblies in the cell controlled by the control rod be removed from the reactor core before the interlock can be bypassed ensures that withdrawal of another control rod does not result in inadvertent criticality. Each control rod essentially provides reactivity control for the fuel assemblies in the cell associated with that control rod. Thus, removal of an entire cell (fuel assemblies plus control rod) results in a lower reactivity potential of the core.

One method available for unloading or reloading the core is the spiral unload/reload. Spiral reloading and unloading encompass reloading or unloading a cell on the edge of a continuous fueled region (the cell can be reloaded or unloaded in any sequence.) The pattern begins (for reloading) and ends (for unloading) around a single SRM. The spiral reloading pattern is the reverse of the unloading pattern, with the exception that two diagonally adjacent bundles, which have previously accumulated exposure in-core, and placed next to each of the four SRMs before the actual spiral reloading begins. The spiral reload can be to either the original configuration or a different configuration.

Additionally, at least 50% of the fuel assemblies to be reloaded into the core shall have previously accumulated a minimum exposure of 1000 Mwd/T to ensure the presence of a minimum neutron flux as described in Bases Section 3.12.B.

F. The intent of this specification is to assure that the reactor core has been shut down for at least 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following power operation and prior to fuel handling or movement. The safety analysis for the postulated refueling accident assumed that the reactor had been shut down for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for fission product decay prior to any fuel handling which could result in dropping of a fuel assembly.

G. Deleted H. The Spent Fuel Pool Cooling System is designed to maintain the pool water temperature below 125°F during normal refueling operations. If the reactor core is completely discharged, the temperature of the pool water may increase to greater than 125°F. The RHR System supplemental fuel pool cooling may be used under these conditions to maintain the pool water temperature less than 150°F.

Amendment No. 29, 37, 59, 77, 181, 200, 231, 239 239

VYNPS Sections 3.13/4. 3 deleted Pages 241 through 252 have been intentionally deleted.

Amendment No. 43,4 , 196 240 JAN'2 S 2301

VYNPS 5.0 DESIGN FEATURES 5.1 Site The station is located on the property on the west bank of the Connecticut River in the Town of Vernon, Vermont, which Entergy Nuclear Vermont Yankee, LLC either owns or to which it has perpetual rights and easements. The site plan showing the exclusion area boundary, boundary for gaseous effluents, boundary for liquid effluents, as well as areas defined per 10CFR20 as "controlled areas" and "unrestricted areas" are on plant drawing 5920-6245. The minimum distance to the boundary of the exclusion area as defined in 10CFRIOO.3 is 910 feet.

The licensee will at all times retain the complete authority to determine and maintain sufficient control of all activities through ownership, easement, contract and/or other legal instruments on property which is closer to the reactor center line than 910 feet.

This includes the authority to exclude or remove personnel and property within the exclusion area. Only activities related to plant operation are permitted in the exclusion area.

5.2 Reactor A. The core shall consist of not more than 368 fuel assemblies.

B. The reactor core shall contain 89 cruciform-shaped control rods. The control material shall be boron carbide powder (B4C) or hafnium, or a combination of the two.

5.3 Reactor Vessel The reactor vessel and applicable design codes shall be as described in Section 4 of the FSAR.

5.4 Containment A. The principal design parameters and applicable design codes for the primary containment shall be as given in Table 5.2.1 of the FSAR.

B. The secondary containment shall be as described in subsection 5.3 of the FSAR and the applicable codes shall be as described in Section 12.0 of the FSAR.

C. Penetrations to the primary containment and piping passing through such penetrations shall be designed in accordance with standards set forth in subsection 5.2 of the FSAR.

5.5 Spent and New Fuel Storage A. The new fuel storage facility shall be such that the effective multiplication factor (K.f t ) of the fuel when dry is less than 0.90 and when flooded is less than 0.95.

B. The K. ff of the fuel in the spent fuel storage pool shall be less than or equal to 0.95.

C. Spent fuel storage racks may be moved (only) in accordance with written procedures which ensure that no rack modules are moved over fuel assemblies.

Amendment No. ~, 3-, ~, +/--§-+/-., ~, ~, R{t, 235 253

VYNPS D. The number of spent fuel assemblies stored in the spent fuel pool shall not exceed 3353.

E. The maximum core geometry infinite lattice multiplication factor of any segment of the fuel assembly stored in the spent fuel storage pool or the new fuel storage facility shall be less than or equal to 1.31 at 20 0 C.

Amendment No. -7, A'", 3a 182 254 DEC 2 1 139

VYNPS 6.0 ADMINISTRATIVE CONTROLS 6.1 RESPONSIBILITY A. The plant manager shall be responsible for overall unit operation and shall delegate in writing the succession to this responsibility during absences.

B. The plant manager or designee shall approve, prior to implementation, each proposed test, experiment, or modification to systems or equipment that affect nuclear safety.

C. The shift supervisor shall be responsible for the control room command function. During any absence of the shift supervisor from the control room while the unit is in plant startup or normal operation, an individual with an active Senior Reactor Operator (SRO) license shall be designated to assume the control room command function. During any absence of the shift supervisor from the control room while the unit is in cold shutdown or refueling with fuel in the reactor, an individual with an active SRO license or Reactor Operator license shall be designated to assume the control room command function.

6.2 ORGANIZATION A. Onsite and Offsite Organizations Organizations shall be established for unit operation and corporate management. These organizations shall include the positions for activities affecting safety of the nuclear power plant.

1. Lines of authority, responsibility, and communication shall be established and defined for the highest management levels through intermediate levels to and including all operating organizational positions. These relationships shall be documented and updated, as' appropriate, in the form of organizational charts, functional descriptions of departmental responsibilities and relationships, and job descriptions for key personnel positions, or in equivalent forms of documentation. These requiremeflts shall be documented in the Quality Assurance Program Manual. The plant-specific titles of those personnel fulfilling the responsibilities of the positions delineated in these Technical Specifications shall be documented in the Technical Requirements Manual.

2. The plant manager shall be responsible for overall unit safe operation and shall have control over those on-site activities necessary for safe operation and maintenance of the plant.

3. The site vice president shall have corporate responsibility for overall plant nuclear safety and shall take any measures needed to ensure acceptable performance of the staff in operating, maintaining, and providing technical support to the plant to ensure nuclear safety.

Amendment No. ", -*u, !_,"4-, Q414, 226 255

VYNPS 6.2 ORGANIZATION (Cont'd)

4. The individuals who train the operating staff, carry out health physics, or perform quality assurance functions may report to the appropriate on-site manager; however, these individuals shall have sufficient organizational freedom to ensure their independence from operating pressures.

B. Unit Staff The unit staff organization shall include the following:

1. A non-licensed operator shall be assigned when the reactor contains fuel and an additional non-licensed operator shall be assigned during Plant Startup and Normal Operation.

2. At least one licensed Reactor Operator (RO) or one licensed Senior Reactor Operator (SRO) shall be present in the control room when fuel is in the reactor.

3. When the unit is in Plant Startup or Normal Operation, at least one licensed Senior Reactor Operator (SRO) and one licensed Reactor Operator (RO), or two licensed Senior Reactor Operators, shall be present in the control room.

4. Shift crew composition shall meet the requirements stipulated herein and in 10 CFR 50.54(m). Shift crew composition may be less than the minimum requirement of 10 CFR 50.54(m)(2)(i) and Specifications 6.2.B.l and 6.2.B.8 for a period of time not to exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in order to accommodate unexpected absence of on-duty shift crew members, provided immediate action is taken to restore the shift crew composition to within the minimum requirements.

5. An individual qualified in radiation protection procedures shall be present on-site when there is fuel in the reactor.

The position may be vacant for not more than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , in order to provide for unexpected absence, provided immediate action is taken to fill the required position.

6. Administrative procedures shall be developed and implemented to limit the working hours of unit staff who perform safety related functions (e.g., licensed SROs, licensed ROs, radiation protection technicians, auxiliary operators, and key maintenance personnel).

7. The operations manager or an assistant operations manager shall hold an SRO license.

8. While the unit is in Plant Startup or Normal Operation, a shift engineer shall provide advisory technical support to the shift supervisor.

Amendment No. 44, -S, -9, en, 4, G#, ;4&,

6 171, 96 214 256

VYNPS 6.2 ORGANIZATION (Cont'd)

C. Unit Staff Qualifications Each member of the unit staff shall meet or exceed the minimum qualifications of the American National Standards Institute N-18.1-1971, "Selection and Training of Personnel fo?Nuclear Power Plants," except for the radiation protection manager who shall meet the qualifications of Regulatory Guide 1.8, Revision 1 (September 1975) and the shift engineer, who shall have a bachelor's degree or equivalent in a scientific or engineering discipline with specific training in plant design, and response and analysis of the plant for transients and accidents.

6.3 ACTION TO BE TAKEN IF A SAFETY LIMIT IS EXCEEDED Applies to administrative action to be followed in the event a safety limit is exceeded.

If a safety limit is exceeded, the reactor shall be shutdown immediately.

6.4 PROCEDURES Written procedures shall be established, implemented, and maintained covering the following activities:

A. Normal startup, operation and shutdown of systems and components of the facility.

B. Refueling operations.

C. Actions to be taken to correct specific and foreseen potential malfunctions of systems or components, suspected Primary System leaks and abnormal reactivity changes.

D. Emergency conditions involving potential or actual release of radioactivity.

E. Preventive and corrective maintenance operations which could have an effect on the safety of the reactor.

F. Surveillance and testing requirements.

G. Fire protection program implementation.

H. Process Control Program in-plant implementation.

I. Off-Site Dose Calculation Manual implementation.

6.5 HIGH RADIATION AREA As provided in paragraph 20.160l(c) of 10 CFR 20, the following controls shall be applied to high radiation areas in place of the controls required by paragraphs 20.160l(a) and 20.1601(b) of 10 CFR 20:

A. High Radiation Areas with dose rates greater than 0.1 rem/hour at 30 centimeters, but not exceeding 1.0 rem/hour at 30 centimeters from the' radiation source or from any surface penetrated by the radiation:

Amendment No. ~, ~, 43, ~ H-l, ~ -3:-++, .~ ~,241 257

VYNPS

1. Each entryway to such an area shall be barricaded and conspicuously posted as a high radiation area. *Such barricades may be opened as necessary to permit entry or exit of personnel or equipment.

2. Access to, and activities in, each such area shall be controlled by means of Radiation Work Permit (RWP) or equivalent that includes specification of radiation dose rates in the immediate work area(s) and other appropriate radiation protection equipment and measures.

3. Individuals qualified in radiation protection procedures and personnel continuously escorted by such individuals may be exempted from the requirement for an RWP or equivalent while performing their assigned duties provided that they are otherwise following plant radiation protection procedures for entry to, exit from, and work in .such areas.

4. Each individual or group entering such an area shall possess:

a. A radiation monitoring device that continuously displays radiation dose rates in the area, or

b. A radiation monitoring device that continuously integrates the radiation dose rates in the area and alarms when the device's dose alarm setpoint is reached, with an appropriate alarm setpoint, or

c. A radiation monitoring device that continuously transmits dose rate and cumulative dose information to a remote receiver monitored by radiation protection personnel responsible for controlling personnel r~diation exposure within the area, or

d. A self-reading dosimeter (e.g., pocket ionization

.chamber or electronic dosimeter) and,

1. Be under the surveillance, as specified in the RWP or equivalent, while in the area, of an individual qualified in radiation protection procedures, equipped with a radiation monitoring device that continuously displays radiation dose rates in the area; who is responsible for controlling personnel exposure within the area, or

2. Be under the surveillance, as specified in the RWP or equivalent, while in the area, by means of closed circuit television, of personnel qualified in radiation protection procedures, responsible for controlling personnel radiation exposure in the area, and with the means to communicate with individuals in the area who are covered by such surveillance. .

5. Except for individuals qualified in radiation protection procedures, or personnel continuously escorted by such individuals, entry into such areas shall be made only after dose rates in the area have been determined and entry personnel are knowledgeable of them. These continuously escorted. personnel will receive a pre-job briefing prior to entry into such areas. This dose rate determination, knowledge, and pre-job briefing does* not requiie ~

documentation prior to initial entry. .

Amendment No. 241 257a

VYNPS B. High Radiation Areas with dose rates greater than 1.0 rem/hour at 30 centimeters from the radiation source or from any surface penetrated by the radiation, but less than 500 rads/hour at 1 meter from the radiation source or from any surface penetrated by the radiation:

1. Each entryway to such an area shall be conspicuously posted as a high radiation area and shall be provided with a locked or continuously guarded door or gate that prevents unauthorized entry, and, in addition:

a. All such door and gate keys shall be maintained under the administrative control of the shift supervisor, and/or radiation protection manager, or his or her designee.

b. Doors and gates shall remain locked except during periods of personnel or equipment entry or exit.

2. Access to, and activities in, each such area shall be controlled by means of an RWP or equivalent that includes specification of radiation dose rates in the immediate work area(s) and other appropriate radiation protection equipment and measures.

3. Individuals qualified in radiation protection procedures may be exempted from the requirement for an RWP or equivalent while performing radiation surveys in such areas provided that they are otherwise following plant radiation protection procedures for entry to, exit from, and work in such areas.

4. Each individual or group entering such an area shall possess one of the following:

a. A radiation monitoring device that continuously integrates the radiation rates in the area and alarms when the device's dose alarm setpoint is reached, with an appropriate alarm setpoint, or

b. A radiation monitoring device that continuously transmits dose rate and cumulative dose information to a remote receiver monitored by radiation protection personnel responsible for controlling personnel radiation exposure within the area with the means to communicate with and control every individual in the area, or

c. A self-reading dosimeter (e.g., pocket ionization chamber or electronic dosimeter) and,

1. Be under the surveillance, as specified ~n the RWP or equivalent, while in the area, of an individual qualified in radiation protection procedures, equipped with a radiation monitoring device that continuously displays radiation dose rates in the area; who is responsible for controlling personnel exposure within the area, or Amendment No. 241 257b

VYNPS

2. Be under the surveillance, as specified in the RWP or equivalent, while in the area, by means of closed circuit television, of personnel qualified in radiation protection procedures, responsible for controlling personnel radiation exposure in the area, and with the means to communicate with and control every individual in the area.

d. In those cases where option Ib) and (cl, above, are impractical or determined to be inconsistent with the "As Low As is Reasonably Acihievable" principle, a radiation monitoring device that continuously displays radiation dose rates in the area.

5. Except for individuals qualified in radiation protection procedures, or personnel continuously escorted by such individuals, entry into such areas shall be made only after dose rates in the area have been determined and entry personnel are knowledgeable of them. These continuously escorted personnel will receive a pre~job briefing prior to entry into such areas. This dose rate determination, knowledge, and pre-job briefing does not require documentation prior to initial entry.

6. Such individual areas that are within a larger area where no enclosure exists for the purpose of locking and.where no enclosure can reasonably be constructed around the individual area need not be controlled by a locked door or gate, nor continuously guarded, but shall be barricaded, conspicuously posted, and a clearly visible flashing light shall be activated at the area as a warning device.

6.6 REPORTING REQUIREMENTS The following reports shall be submitted in accordance with 10 CFR 50.4.

A. Deleted Amendment No. ~ ~, ~ ~ ~,241 258

VYNPS B. Deleted C. Core Operating Limits Report The core operating limits shall be established and documented in the Core Operating Limits Report (COLR) before each reload cycle or any remaining part of a reload cycle for the following:

1. The Average Planar Linear Heat Generation Rates (APLHGR) for Specifications 3.11.A and 3.6.G.la,

2. The Minimum Critical Power Ratio (MCPR) for Specifications 3.11.C and 3.6.G.la,

3. The Linear Heat Generation Rates (LHGR) for Specifications 2.1.A.la and 3.11.B, and

4. The Power/Flow Exclusion Region for Specifications 3.6.J.l.a and 3.6.J.l.b.

The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC in:

Report, E. E. Pilat, "Methods for the Analysis of Boiling Water Reactors Lattice Physics," YAEC-1232, December 1980 (Approved by NRC SER, dated September 15, 1982).

Amendment No. .4,-44, 4-4-, 5, 4-1, 241, 2-13, 222 259 t

VYI:PS Report, D. M. VerPlanck, "Methods for the Analysis of Boiling Water Reactors Steady State Core Physics," YAEC-1238, March 1981 (Approved by NRC, SER, dated September 15, 1982).

Report, J. M. Holzer, "Methods for the Analysis of Boiling Water Reactors Transient Core Physics," YAEC-1239P, August 1981 (Approved by NRC SER, dated September 15, 1982).

Report, S. P. Schultz and K. E. St.John, "Methods for the Analysis of Guide Fuel Rod Steady-State Thermal Effects (FROSSTEY):

Code/Model Description Manual," YAEC-1249P, April 1981 (Approved by NRC SER, dated September 27, 1985).

Report, A. A. F. Ansari, "Methods for the Analysis of Boiling Water Reactors: Steady-State Core Flow Distribution Code (FIBWR)," YAEC-1234, December 1980 (Approved by NRC SER, dated September 15, 1982).

Report, S. P. Schultz and K. E. St.John, "Methods for the Analysis of Oxide Fuel Rod Steady-State Thermal Effects (FROSSTEY): Code Qualification and Application," YAEC-1265P, June 1981 (Approved by NRC SER, dated September 27, 1985).

Report, A. A. F. Ansari and J. T. Cronin, "Methods for the Analysis of Boiling Water Reactors: A System Transient Analysis Model (RETRAN)," YAEC-1233, April 1981. (Approved by NRC SERs, dated November 27, 1981 and September 4, 1984).

Report, A. A. F. Ansari, K. J. Burns and D. K. Beller, "Methods for the Analysis of Boiling Water Reactors: Transient Critical Power Ratio Analysis (RETRAN-TCPYAO1)," YAEC-1299P, March 1982 (Approved by NRC SER, dated September 15, 1982).

Report, A. S. DiGiovine, et al., "CASMO-3G Validation,"

YAEC-1363-A, April 1988.

Report, A. S. DiGiovine, J. P. Gorski, and M. A. Tremblay, "SIMULATE-3 Validation and Verification," YAEC-1659-A, September 1988.

Report, R. A. Woehlke, et al.,

"MICBURN-3/CASMO-3/TABLES-3/SIMULATE-3 Benchmarking of Vermont Yankee Cycles 9 through 13," YAEC-1683-A, March 198.9.

Report, J. T. Cronin, "Method for Generation of One-Dimensional Kinetics Data for RETRAN-02," YAEC-1694-A, June 1989.

Report, V. Chandola, M. P. LeFrancois, and J. D. Robichaud, "Application of One-Dimensional Kinetics to Boiling Water Reactor Transient Analysis Methods," YAEC-1693-A, Revision 1, November 1989.

Report, L. H. Steves, et. al, "HUXY: A Generalized Multirod Heatup Code with 10CFR50, Appendix K Heatup Option: User's Manual," XN-CC-33(A), Revision 1, dated November 14, 1975 (Approved by NRC SER, dated March 6, 1975).

Amendment No. G 4, -24, 435, 171 260 JUL 1 9 WA29

VYNPS Report, "RELAPMYA, A Computer Program for Light-Water Reactor System Thermal-Hydraulic Analysis," YAEC-1300P, October 1982 (Approved by NRC SERs, dated August 25, 1987 and October 21, 1992).

Report, R. T. Fernandez and H. C. daSilva, Jr., "Vermont Yankee BWR Loss-of-Coolant Accident Licensing Analysis Method," YAEC-1547, June 1986 (Approved by NRC SER, dated October 21, 1992).

Letter from R. W. Capstick (VYNPC) to USNRC, "HUXY Computer Code Information for the Vermont Yankee BWR LOCA Licensing Analysis Method," FVY 87-63, dated June 4, 1987 (Approved by NRC SER, dated February 27, 1991).

Letter from R. W. Capstick (VYNPC) to USNRC, "Request for Supplemental Safety Evaluation Report Supporting the Use of RELAP5YA for Vermont Yankee Nuclear Power Station," FVY 88-006, dated January 26, 1988 (Approved by NRC SERs, dated February 27, 1991 and October 21, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Supplementary Information Regarding NRC LOCA Analysis Review Effort," BVY 89-91, dated October 6, 1989 (Approved by NRC SER, dated October 21, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Supplementary Information Regarding NRC LOCA Analyses Review Effort," BVY 90-028, dated March 9, 1990 (Approved by NRC SER, dated October 21, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Response to Second RequesL for Additional Information on the Use of RELAP5YA,"

BVY 90-067, dated June 8, 1990 (Approved by NRC SER, dated February 27, 1991).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Response to Request for Additional Information on the Use of RELAP5YA," BVY 90-087, dated August 28, 1990 (Approved by NRC SER, dated October 21, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Response to Second Request for Additional Information on the Use of RELAP5YA,"

BVY 91-05, dated January 9, 1991 (Approved by NRC SER, dated October 21, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Response to Third Request for Additional Information on the Use of RELAP5YA,"

BVY 91-41, dated April 19, 1991 (Approved by NRC SER, dated October 21, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Supplementary Information Regarding the Use of RELAP5YA," BVY 92-12, dated February 7, 1992 (Approved by NRC SER, dated October 21, 1992).

Amendment No. 4-35-,171 261 JUL 1 9 IK9

VYNPS Letter from R. W. Capstick (VYNPC) to USNRC, "Vermont Yankee LOCA Analysis Method FROSSTEY Fuel Performance Code (FROSSTEY-2),"

FVY 87-116, dated December 16, 1987 (Approved by NRC SER, dated September 24, 1992).

Letter from R. W. Capstick (VYNPC) to USNRC, "Response to NRC Request for Additional Information on the FROSSTEY-2 Fuel Performance Code," BVY 89-65, dated July 14, 1989 (Approved by NRC SER, dated September 24, 1992).

Letter from R. W. Capstick (VYNPC) to USNRC, "Supplemental Information on the FROSSTEY-2 Fuel Performance Code," BVY 89-74, dated August 4, 1989 (Approved by NRC SER, dated September 24, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Responses to Request for Additional Information on FROSSTEY-2 Fuel Performance Code," BVY 90-045, dated April 19, 1990 (Approved by NRC SER, dated September 24, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Supplemental Information to VYNPC April 19, 1990 Response Regarding FROSSTEY-2 Fuel Performance Code," BVY 90-054, dated May 10, 1990 (Approved by NRC SER, dated September 24, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "Responses to Request for Additional Information on FROSSTEY-2 Fuel Performance Code," BVY 91-024, dated March 6, 1991 (Approved by NRC SER, dated September 24, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC, "LOCA-Related Responses to Open Issues on FROSSTEY-2 Fuel Performance Code," BVY 92-39, dated March 27, 1992 (Approved by NRC SER, dated September 24, 1992).

Letter from L. A. Tremblay, Jr. (VYNPC) to USNRC,."FROSSTEY-2 Fuel Performance Code - Vermont Yankee Response to Remaining Concerns,"

BVY 92-54, dated May 15, 1992 (Approved by NRC SER, dated September 24, 1992).

Report, "Loss-of-Coolant Accident Analysis for Vermont Yankee Nuclear Power Station," NEDO-21697, August 1977, as amended (Approved by NRC SER, dated November 30, 1977).

Report, "General Electric Standard Application for Reactor Fuel (GESTARII)," NEDE-24011-P-A, GE Company Proprietary (the latest NRC-approved version will be listed in the COLR).

Report, General Electric Nuclear Energy, "BWR Owner's Group Long-Term Solutions Licensing Methodology," NEDO-31960, June 1991 (Approved by NRC SER, dated July 12, 1993).

Report, General Electric Nuclear Energy, "BWR Owner's Group Long-Term Solutions Licensing Methodology," NEDO-31960, Supplement 1, March 1992 (Approved by NRC SER, dated July 12, 1993).

Amendment No. 444, 4-2-6, 435, 4-L, 171 262 JUL . 9 19'Z

VYNPS Report, N. Fujita, et al., "Method for Power/Flow Exclusion Region Calculation Using the LAPUR5 Computer Code," YAEC-1926-A (Approved by NRC SER, dated November 5, 1996).

Report, Yankee Atomic Electric Company, "Application of the FIBWR2 Core Hydraulics Code to BWR Reload Analysis," YDEC-1339-A, January 31, 1997.

The core operating limits shall be determined so that all applicable limits (e.g., fuel thermal-mechanical limits, core thermal-hydraulic limits, ECCS limits, nuclear limits such as shutdown margin, and transient and accident analysis limits) of the safety analysis are met. The COLR, including any mid-cycle revisions or supplements thereto, shall be provided upon issuance, for each reload cycle, to the NRC.

D. Radioactive Effluent Release Report The Radioactive Effluent Release Report covering the operation of the unit shall be submitted by May 15 of each year and in accordance with 10 CFR 50.36a. The report shall include a summary of the quantities of radioactive liquid and gaseous effluents and solid waste released from the unit. The material provided shall be consistent with the objectives outlined in the Offsite Dose Calculation Manual (ODCM) and Process Control Program and in conformance with 10 CFR 50.36a and 10 CFR 50, Appendix I, Section IV.B.1.

E. Annual Radiological Environmental Operating Report The Annual Radiological Environmental Operating Report covering the operation of the unit during the previous calendar year shall be submitted by May 15 of each year. The report shall include summaries, interpretations, and an analysis of trends of the results of the radiological environmental surveillance activities for the report period. The material provided shall be consistent with the objectives outlined in the Offsite Dose Calculation -

Manual (ODCM), and in 10 CFR 50, Appendix I, Sections IV.B.2, IV.B.3, and IV.C.

The Annual Radiological Environmental Operating Report shall include summarized and tabulated results of all radiological environmental samples taken during the report period pursuant to the table and figures in the ODCM. In the event that some results are not available for inclusion with the report, the report shall be submitted noting and explaining the reasons for the missing results. The missing data shall be submitted as soon as possible in a supplementary report.

6.7 PROGRAMS AND MANUALS The following programs shall be established, implemented and maintained:

A. INTEGRITY OF SYSTEMS OUTSIDE CONTAINMENT A~program to reduce leakage from systems outside containment that would or could contain highly radioactive fluids during a serious transient or accident to as low as practical levels will be Amendment No. 43, 484, .4-6, 46, G4., &7-, -x, A-&, 171 263 JUL 1 9 1999

VYNPS implemented. This program shall include the following:

1. Provisions establishing preventive maintenance and periodic visual inspection requirements.

2. System leakage inspections, to the extent permitted by system design and radiological conditions, for each system at a frequency not to exceed refueling cycle intervals. The systems subject to this testing are: (1) Residual Heat Removal, (2) Core Spray, (3) Reactor Water Cleanup, (4) HPCI, (5) RCIC, and (6) Sampling Systems.

B. OFF-SITE DOSE CALCULATION MANUAL (ODCM)

An Off-Site Dose Calculation Manual shall contain the current methodology and parameters used in the calculation of off-site doses due to radioactive gaseous and liquid effluents for the purpose of demonstrating compliance with 10 CFR 50, Appendix I, in the calculation of gaseous and liquid effluent monitoring alarm/trip setpoints, and in the conduct of the environmental radiological monitoring program.

The ODCM shall also contain the radioactive effluent controls and radiological environmental monitoring activities and descriptions of the information that should be included in the Radioactive Effluent Release Report and the Annual Radiological Environmental Operating Report required by Specification 6.6.D and Specification 6.6.E, respectively.

1. Licensee initiated changes to the ODCM:

a. Shall be submitted to the Commission in the Radioactive Effluent Release Report for the period in which the change(s) was made effective. This submittal shall contain:

i. Sufficient information to support the change together with appropriate analyses or evaluations justifying the change(s) and ii. A determination that the change will maintain the level of radioactive effluent control required by 10 CFR 20.1302, 40 CFR 190, 10 CFR 50.36a, and Appendix I to 10 CFR Part 50, and do not adversely impact the accuracy or reliability of effluent dose or setpoint calculations.

b. Shall become effective upon review by PORC and approved by the plant manager.

C. Shall be submitted to the Commission in the form of a legible copy of the affected pages of the ODCM as a part of or concurrent with the Radioactive Effluent Release Amendment No. GE, O3, 10-, -144, '1-, a4, 214 264

VYNPS Report for the period of the report in which any change to the ODCM was made. Each change shall be identified by markings in the margin of the affected pages, clearly indicating the area of the page that was changed, and shall indicate the date (e.g., month/year) the change was implemented. .. \

C. PRIMARY CONTAINMENT LEAKAGE RATE TESTING PROGRAM A program shall be established to implement the leakage rate testing of the primary containment as required by 10 CFR 50.54(0) and 10 CFR 50, Appendix J, Option B as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, entitled

~Performance Based Containment Leak-Test Program," dated September 1995, as modified by the following:

The first Type A test after the April 1995 Type A test shall be performed prior to startup from the April 2010 refuel outage.

(This is an exception to Section 9.2.3 of NEI 94-01, Rev. 0, "Industry Guideline for Implementing Performance-Based Option of 10CFR50, Appendix J.")

The leakage contributions from the main steam pathways are excluded from the sum of the leakage rates from Type Band C tests specified in (1) Section IiI.B of 10CFR50, Appendix J Option B; (2) Section 6.4.4 of ANSI/ANS 56.8-~994; and (3)

Section 10.2 of NEI 94-01, Rev. O.

The leakage contributions from the main steam pathways are excluded from the overall integrated leakage rate from Type A tests specified in (1)Section III.A of 10CFR50, Appendix J Option B; (2) Section 3.2 of ANSI/ANS 56.8-1994; and (3) .

Sections 8.0 and 9.0 of NEI 94-01, Rev. 6.

The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 44 psig.

The maximum allowable primary containment leakage rate, La, at Pa, shall be 0.8% of primary containment air weight per day.

Leakage rate acceptance criteria are:

1. Primary containment leakage rate acceptance criterion ~ 1.0 La.

2. The as-left primary containment integrated leakage rate test (Type A test) acceptance criterion is ~ 0.75 La.

3. The combined local leakage rate test acceptance criterion for Type B and Type C tests (excluding the leakage contributions from the main steam pathways) is ~ 0.6 La, calculated on a maximum pathway basis, prior to entering a mode of operation where primary containment integrity is required.

4. The combined local leakage rate test acceptance criterion for Type B and Type C tests (excluding the leakage contributions from the main steam pathways) is ~ 0.6 La, calculated on a minimum pathway basis, at all times when primary containment integrity is required.

Amendment No. +/--§.h- ~ -H-l-T ~~, ~, 2f.{) 265

VYNPS

5. Airlock overall leakage rate acceptance criterion is S 0.10 La when tested at 2 Pa.

The provision of SR for 4.0.2 for Surveillance Frequency does not apply to the test frequencies specified in the Primary Containment Leakage Rate Testing Program.

D. Radioactive Effluent Controls Program This program conforming to 10 CFR 50.36a provides for the control of radioactive effluents and for maintaining the doses to members of the public from radioactive effluents as low as reasonably achievable. The program shall be contained in the ODCM, shall be implemented by operating procedures, and shall include remedial actions to be taken whenever the program limits are exceeded. The program shall include the following elements:

a. Limitations on the functional capability of radioactive liquid and gaseous monitoring instrumentation including surveillance tests and setpoint determination in accordance with the methodology in the ODCM;

b. Limitations on the concentrations of radioactive material released in liquid effluents from the site to unrestricted areas, conforming to 10 times the concentration values in Appendix B, Table 2, Column 2, to 10 CFR 20.1001 - 20.2402;

c. Monitoring, sampling, and analysis of radioactive liquid and gaseous effluents pursuant to 10 CFR 20.1302 and with the methodology and parameters in the ODCM;

d. Limitations on the annual and quarterly doses or-dose commitment to a member of the public from radioactive materials in liquid effluents released from the unit to unrestricted areas, conforming to 10 CFR 50, Appendix I;

e. Determination of cumulative and projected dose contributions from radioactive effluents for the current calendar quarter and current calendar year in accordance with the methodology and parameters in the ODCM at least every 31 days;

f. Limitations on the functional capability and use of the liquid and gaseous effluent treatment systems to ensure that appropriate portions of these systems are used to reduce releases of radioactivity when the projected doses in a period of 31 days would exceed 2 percent of the guidelines for the annual dose or dose commitment, conforming to 10 CFR 50, Appendix I;

g. Limitations on the dose rate resulting from radioactive material released in gaseous effluents from the site to areas at or beyond the site boundary shall be limited to the following:

1. For noble gases: less than or equal to a dose rate of 500 mrems/yr to the total body and less than or equal to a dose rate of 3000 mrems/yr to the skin, and

2. For iodine-131, iodine-133, tritium, and for all radionuclides in particulate form with half lives greater than 8 days: less than or equal to a dose rate of 1500 mrems/yr to any organ; Amendment No. 4-7, 221, 223 2 66

VYNPS

h. Limitations on the annual and quarterly air doses resulting from noble gases released in gaseous effluents from the unit to areas at or beyond the site boundary, conforming to 10 CFR 50, Appendix I;

i. Limitations on the annual and quarterly doses to a member of the public from iodine-131, iodine-133, tritium, and all radionuclides in particulate form with half lives greater than 8 days in gaseous effluents released from the unit to areas beyond the site boundary, conforming to 10 CFR 50, Appendix I; and

j. Limitations on the annual dose or dose commitment to any member of the public, beyond the site boundary, due to releases of radioactivity and to radiation from uranium fuel cycle sources, conforming to 40 CFR 190.

E. TECHNICAL SPECIFICATIONS (TS) BASES CONTROL PROGRAM This program provides a means for processing changes to the Bases of these Technical Specifications.

a. Changes to the Bases of the TS shall be made under appropriate administrative controls and reviews.

b. Licensees may make changes to Bases without prior NRC approval provided the changes do not require either of the following:

1. A change in the TS incorporated in the license, or

2. A change to the updated FSAR or Bases that requires NRC approval pursuant to 10 CFR 50.59.

c. The Bases Control Program shall contain provisions to ensure that the Bases are maintained consistent with the FSAR.

d. Proposed changes that meet the criteria of Specification 6.7.E.b above shall be reviewed and approved by the NRC prior to implementation. Changes to the Bases implemented without prior NRC approval shall be provided to the NRC on a frequency consistent with 10 CFR 50.71(e).

Amendment No. 1741 , 221 267 I

ML092110065

Text

Reference:

Reference:

Navigation menu

Search