Text

Submittal of Technical Specification Bases, Revision 7
	ML092880778
Person / Time
Site:	Perry
Issue date:	10/05/2009
From:	Bezilla M; FirstEnergy Nuclear Operating Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	L-09-218
	Download: ML092880778 (175)
	v • d • e

FENOC PerryNuclear Power Station 10 Center Road FirstEnergyNuclear Operating Company Perry,Ohio 44081 Mark B. Bezilla 440-280-5382 Vice President Fax: 440-280-8029 October 5, 2009 L-09-218 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Perry Nuclear Power Plant Docket No. 50-440, License No. NPF-58 Submittal of Technical Specification Bases, Revision 7 In accordance with the requirements of Section 5.5.11 .d of the Perry Nuclear Power Plant (PNPP) Technical Specifications, the FirstEnergy Nuclear Operating Company (FENOC) is hereby submitting to the Nuclear Regulatory Commission (NRC) a copy of the PNPP Technical Specification Bases, Revision 7. This submittal reflects the changes made to the Technical Specification Bases from October 12, 2007 through August 31, 2009. The attachment lists the pages changed in Technical Specification Bases, Revision 7, and the enclosure provides the changed pages.

There are no regulatory commitments contained in this letter. If there are any questions or if additional information is required, please contact Mr. Thomas A. Lentz, Manager -

Fleet Licensing, at (330) 761-6071.

Sincerely, Mark B. Bezilla

Attachment:

Technical Specification Bases Revision 7 List of Changed Pages

Enclosure:

Changed Pages from PNPP Technical Specification Bases cc: NRC Region III Administrator NRC Resident Inspector Nuclear Reactor Regulation Project Manager A o!/

Attachment L-09-218 Technical Specification Bases Revision 7 List of Changed Pages Page 1 of 3 Page Revision Page Revision Number Number Number Number B 2.0-5 B 3.3-110 B 2.0-9 B 3.3-111 B 3.0-9b B 3.3-112 B 3.1-2 B 3.3-125 B 3.1-9 B 3.3-128 B 3.1-14 B 3.3-135 B 3.1-18 B 3.3-139 B 3.1-21 B 3.3-146 B 3.1-23 B 3.3-147 B 3.1-30 B 3.3-148 B 3.1-34 B 3.3-175 B 3.1-35 B 3.3-186 B 3.1-35a B 3.3-197 B 3.1-38 B 3.3-203 B 3.1-39 B 3.3-213 B 3.1-46 B 3.3-220 B 3.2-2 B 3.4-3 B 3.2-4 B 3.4-9 B 3.2-7a B 3.4-14 B 3.2-11 B 3.4-19 B 3.2-12 B 3.4-22 B 3.3-3 B 3.4-24 B 3.3-13 B 3.4-29 B 3.3-24 B 3.4-32 B 3.3-43 B 3.4-35 B 3.3-44 B 3.4-41 B 3.3-44a B 3.4-44 B 3.3-45 B 3.4-49 B 3.3-50 B 3.4-56 B 3.3-51 B 3.4-64 B 3.3-52 B 3.5-4 B 3.3-64 B 3.5-13 B 3.3-69 B 3.5-13a B 3.3-80 B 3.5-14 B 3.3-87 B 3.5-15 B 3.3-88 B 3.5-22 B 3.3-94 B 3.6-2 B 3.3-96' B 3.6-8 B 3.3-97 B 3.6-18

Attachment L-09-218 Page 2 of 3 Technical Specification Bases Revision 7 List of Changed Pages Page Revision Page Revision Number Number Number Number B 3.6-22 7 B 3.6-144 B 3.6-24 7 B 3.6-146 B 3.6-27 7 B 3.6-148 B 3.6-28 7 B 3.6-151 B 3.6-31a 7 B 3.7-2 B 3.6-34 7 B 3.7-7 B 3.6-36 7 B 3.7-10 B 3.6-40 7 B 3.7-10a B 3.6-41a 7 B 3.7-11 B 3.6-42 7 B 3.7-a1 a B 3.6-44 7 B 3.7-12 B 3.6-46 7 B 3.7-12a B 3.6-47 7 B 3.7-12b B 3.6-48 7 B 3.7-13 B 3.6-56 7 B 3.7-14 B 3.6-57 7 B 3.7-15 B 3.6-60 7 B 3.7-16 B 3.6-65 7 B 3.7-17a B 3.6-71 7 B 3.7-22 B 3.6-75a (deleted) B 3.7-25 B 3.6-76 7 B 3.7-29 B 3.6-80 7 B 3.7-33 B 3.6-82 7 B 3.7-42 B 3.6-85 7 B 3.8-2 B 3.6-96 7 B 3.8-15 B 3.6-102 7 B 3.8-15a B 3.6-104 7 B 3.8-35 B 3.6-107 7 B 3.8-41 B 3.6-111 7 B 3.8-42 B 3.6-114 7 B 3.8-47 B 3.6-115 7 B 3.8-47a B 3.6-119 7 B 3.8-48 B 3.6-124 7 B 3.8-53 B 3.6-129 7 B 3.8-60 B 3.6-137 7 B 3.8-64 B 3.6-140 7 B 3.8-81 B 3.6-141 7 B 3.9-2 B 3.6-142 7 B 3.9-6

Attachment L-09-218 Page 3 of 3 Technical Specification Bases Revision 7 List of Changed Pages Page Revision Page Revision Number Number Number Number B 3.9-10 7 B 3.9-12 7 B 3.9-16 7 B 3.9-20 7 B 3.9-23 7 B 3.9-25 7 B 3.9-30 7 B 3.10-:2 .7 B 3.10-6 7 B 3.10-7 7 B 3.10-12 7 B 3.10-17 7 B 3.10-22 7 B 3.10-27 7 B 3.10-30 7 B 3.10-34 7

Enclosure L-09-218 Changed Pages from PNPP Technical Specification Bases (170 Pages Follow)

Reactor Core SLs B 2.1.1 BASES SAFETY LIMIT 2.2 (continued)

VIOLATIONS with the SL within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . These actions will include restoring reactor vessel water level in accordance with the Emergency Operating Procedures (e.g., manually initiating the ECCS or depressurizing the reactor vessel). The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.

Per 10 CFR 50.36(c)(1)(i)(A), operation must not be resumed until authorized by the Nuclear Regulatory Commission.

(continued)

PERRY - UNIT 1 B 2.0-5 Revision No. 7

RCS Pressure SL B 2.1.2 BASES (continued)

SAFETY LIMIT 2.2 VIOLATIONS Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 100, "Reactor Site Criteria," limits (Ref. 4). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . These actions will include restoring reactor vessel water level in accordance with the Emergency Operating Procedures (e.g., manually initiating the ECCS or depressurizing the reactor vessel). The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.

(continued)

PERRY - UNIT 1 B 2.0-9 Revision No. 7

LCO Applicability B 3.0 BASES LCO 3.0;8 Every time the provisions of LCO 3.0.8 are used, it must be (continued) verified that at least one success path, involving equipment not associated with the inoperable snubber(s), exists to.

provide makeup and core cooling needed to mitigate LOOP accident sequences. To ensure this requirement is met, one of the following two means of heat removal must be available when LCO 3.0.8 is used:

a. At least one high-pressure makeup path (high pressure core spray or reactor core isolation cooling) and heat removal capability (e.g. suppression pool cooling or shutdown cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s), or

b. At least one low pressure makeup path (low pressure coolant injection or core spray) and heat removal capability (e.g. suppression pool cooling or shutdown Cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s).

LCO 3.0.8 only applies to the seismic function of a snubber.

In addition, a record of the design function of the inoperable snubber (i.e., seismic versus non-seismic), the implementation of the applicable restrictions, and the associated plant configuration shall all be available on a recoverable basis.

LCO 3.0.8 requires that risk be assessed and managed.

Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 must be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected division or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more

,snubbers are not able to perform their associated support function.

PERRY - UNIT 1 B 3.0O-9b Revision No. 7

SDM B 3.1.1 BASES APPLICABLE Prevention or mitigation of reactivity insertion events is SAFETY ANALYSES necessary to limit energy deposition in the fuel to prevent (continued) significant fuel damage, which could result in undue release of radioactivity. Adequate SDM provides assurance that inadvertent criticalities and potential CRDAs involving high worth control rods (namely the first control rod withdrawn) will not cause significant fuel damage.

SDM satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

tCO The specified SDM limit accounts for the uncertainty in the demonstration of SDM by testing. Separate SDM limits are provided for testing where the highest worth control rod is determined analytically or by measurement. This is due to the reduced uncertainty in the SDM test when the highest worth control rod is determined by measurement. When SDM is demonstrated by calculations not associated with a test to determine the highest worth control rod, additional margin is included to account for uncertainties in the calculation.

To ensure adequate SDM during the design process, a design margin is included to account for uncertainties in the design calculations (Ref. 5).

APPLICABILITY In MODES 1 and 2, SDM must be provided because subcriticality with the highest worth control rod withdrawn is assumed in the CRDA analysis (Ref. 3). In MODES 3 and 4, SDM is required t6 ensure the reactor will be-held subcritical with margin for a single withdrawn control rod.

SDM is required in MODE 5 to prevent an inadvertent criticality during the withdrawal of a single control rod from a core cell containing one or more fuel assemblies.

ACTIONS A.1 With SDM not within the limits of the LCO in MODE 1 or 2, SDM must be restored within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Failure to meet the specified SDM may be caused by a control rod that cannot be inserted. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is acceptable, considering that the reactor can still be shut down.

assuming no additional failures of control rods to insert, and the low probability of an event occurring during this interval.

(continued)

PERRY - UNIT 1 B 3.1-2 Revision No. 7

Reactivity Anomalies B 3.1.2 BASES SACKGROUND is critical at RTP, the excess positive reactivity is (continued) compensated by burnable absorbers (if any), control rods, and whatever neutron poisons (mainly xenon and samarium) are present in the fuel.

The predicted core reactivity, as represented by control rod density, is calculated by a 3D core simulator code as a function of cycle exposure. This calculation is performed for projected operating states and conditions throughout the cycle. The core reactivity is determined from control rod densities for actual plant conditions and is then compared to the predicted value for the cycle exposure.

APPLICABLE Accurate prediction of core reactivity is either an explicit SAFETY ANALYSES or implicit assumption in the accident analysis evaluations (Ref. 2). In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod drop accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks.

Monitoring reactivity anomaly provides additional assurance that the nuclear methods provide an accurate representation of the core reactivity.

The comparison between monitored and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the monitored and predicted rod density for identical core conditions at BOC do not reasonably agree, then the assumptions used in the reload cycle design analysis or the calculation models used to predict rod density may not be accurate. If reasonable agreement between monitored and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured value. Thereafter, any significant deviations in the monitored rod density from the redicted rod density that develop during fuel depletion may e an indication that the assumptions of the DBA and transient analyses are no longer valid, or that an unexpected change in core conditions has occurred.

Reactivity anomalies satisfy Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.1-9 Revision No. 7

Control Rod OPERABILITY B 3.1.3 BASES APPLICABLE The capability of inserting the control rods provides SAFETY ANALYSES assurance that the assumptions for scram reactivity in the (continued) DBA and transient analyses are not violated. Since the SDM ensures the reactor will be subcritical with the highest worth control rod withdrawn (assumed single failure), the additional failure of a second control rod to insert could invalidate the demonstrated SDM and potentially limit the ability of the CRD System to hold the reactor subcritical.

If the control rod is stuck at an inserted position and becomes decoupled from the CRD, a control rod drop accident (CRDA) can possibly occur. Therefore, the requirement that all control rods be OPERABLE ensures the CRD System can perform its intended function.

The control rods also protect the fuel from damage that could result in release of radioactivity. The limits protected are the MCPR Safety Limit (SL) (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1%

cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLGHR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), and the fuel damage limit (see Bases for LCO 3.1.6, "Control Rod Pattern") during reactivity insertion events.

The negative reactivity insertion (scram) provided by the CRD System provides the analytical basis for determination of plant thermal limits and provides protection against fuel damage limits during a CRDA. Bases for LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs are protected by .the CRD System.

Control rod OPERABILITY satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO OPERABILITY of an individual control rod is based on a combination of factors, primarily the scram insertion times, the control rod coupling integrity, and the ability to determine the control rod position. Accumulator OPERABILITY is addressed by LCO 3.1.5. The associated scram accumulator status for a control rod only affects the scram insertion times and-therefore an inoperable accumulator does not immediately require declaring a control rod inoperable.

Although not all control rods are required to be OPERABLE to (continued)

PERRY - UNIT 1 B 3.1.-14 Revision No. 7

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS C.1 and C.2 (continued)

The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.

D.1 and D.2 Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At

< 19.0% RTP, the standard banked position withdrawal sequence (BPWS) analysis (Ref. 7) requires inserted control rods not in compliance with BPWS to be separated by at least two OPERABLE control rods in all directions, including the diagonal. Therefore, if two or more inoperable control rods are not in compliance with BPWS and not separated by at least two OPERABLE control .rods, action must be taken to restore compliance with BPWS or restore the control rods to OPERABLE status. Required Action D.1 is utilized when the control rods that are violating the standard BPWS separation criteria cannot be restored to an OPERABLE condition.

Required Action D.1, "Restore compliance with BPWS", means to provide an analysis which demonstrates that the control rod worths of a proposed or existing rod pattern are no more than the control rod worths determined in the standard BPWS analysis. Under Required Action D.1, even after compliance with BPWS is restored through new analysis, the control rods remain inoperable per LCO 3.1.6 unless they can be moved to meet the standard separation criteria (see Required Action D.2). Required Action D.2, "Restore control rod to OPERABLE status", means to move one or both control rods back into pattern such that they can be re-declared OPERABLE, or, if the rod is inoperable for reasons other than a pattern deviation, resolve that inoperability and then move the rod to be in compliance with the standard BPWS analysis. If the requirements for use of the optional BPWS control rod insertion process contained in Reference 8 are being followed for a plant shutdown, the plant is considered to be in compliance with BPWS requirements, and Condition D need not be entered.

A Note has been added to the Condition to clarify that the Condition is not applicable when > 19.0% RTP since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is acceptable, considering the low probability of a CRDA occurring.

(continued)

PERRY - UNIT 1 B 3. 1-18 Revision No. 7

Control Rod OPERABILITY B 3.1.3 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 27, GDC 28, and GDC 29.

2. USAR, Section 4.3.2.5.5.

3. USAR, Section 4.6.1.1.2.5.3.

4. USAR, Section 5.2.2.2.2.3.

5. USAR, Section 15.4.1.

6. USAR, Section 15.4.9.

7. NEDO-21231, "Banked Position Withdrawal Sequence,"

Section 7.2, January.1977.

8. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.

PERRY - UNIT 1 B 3.1-21 Revision No. 7

Control Rod Scram Times B 3.1.4 BASES APPLICABLE The scram function of the CRD System protects the MCPR SAFETY ANALYSES Safety Limit (SL) (see Bases for LCO 3.2.2, "MINIMUM (continued) CRITICAL POWER RATIO (MCPR)"), and the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded.

Above 950 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL during the analyzed limiting power transient. Below 950 psig, the scram function is assumed to perform during the control rod drop accident (Ref. 6) and, therefore, also provides protection against violating fuel damage limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Control Rod Pattern"). For the reactor vessel overpressure protection analysis, the scram function, along with the safety/relief valves, ensure that the.peak vessel pressure is maintained within the applicable ASME Code limits.

Control rod scram times satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The scram times specified in Table 3.1.4-1 are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met. To account for single failure and "slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin to allow up to 7.5% of the control rods (i.e., 177 x 7.5% = 13) to have scram times that exceed the specified limits (i.e., "slow" control rods) assuming a single stuck control rod (as allowed by LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup") when the index tube passes a specific location and then opens

("dropout") as the index tube travels upward. Verification of the specified scram times in Table 3.1.4-1 is accomplished through measurement of the "dropout" times.

(continued)

PERRY - UNIT 1 B 3. 1-23 Revision No. 7

Control Rod Scram Accumulators B 3.1.5 BASES APPLICABLE Control rod scram accumulators satisfy Criterion 3 of the SAFETY ANALYSES NRC Final Policy Statement on Technical Specification (continued) Improvements (58 FR 39132).

LCO The OPERABILITY of the control rod scram accumulators is required to ensure that adequate scram insertion capability exists when needed over the entire range of reactor Bressures. The OPERABILITY of the scram accumulators is ased on maintaining adequate accumulator pressure.

APPLICABILITY In MODES 1 and 2, the scram function is required for mitigation of DBAs and transients and, therefore, the scram accumulators must be OPERABLE to support the scram function.

In MODES 3 and 4, control-rods are not able to be withdrawn since the reactor mode switch is in the shutdown position and a control rod block is applied. This provides adequate requirements for control rod scram accumulator OPERABILITY under these conditions. Requirements for scram accumulators in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY-Refueling."

ACTIONS The ACTIONS table is modified by a Note indicating that a sep~arate Condition entry is allowed for each control rod scram accumulator* This is acceptable since the Required Actions for each Condition provide appropriate compensatory action for each affected control rod. Complying with the Required Actions may allow for continued opera t ion and subsequent affected control rods governed by subsequent Condition entry and application of associated Required Actions.

A.1 and A.2 With one control rod scram accumulator inoperable and the reactor steam dome pressure Ž 600 psig, the control rod may be declared "slow," since the control rod will still scram at the reactor operating pressure but may not satisfy the required scram times in Table 3.1.4-1. Required Action A.1 is modified by a Note, which clarifies that declaring the control rod "slow" is only applicable if the associated control scram time was within the limits of Table 3.1.4-1 during the last scram time test. Otherwise, the control rod (continued)

PERRY - UNIT 1 B 3.1-30 Revision No. 7

Control Rod Pattern B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Control Rod Pattern BASES BACKGROUND Control rod patterns during startup conditions are controlled by the operator and the rod pattern controller (RPC) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed from the condition of all control rods fully inserted up to the low power setpoint (LPSP). The sequences effectively limit the potential amount of reactivity addition that could occur in the event of a control rod drop accident (CRDA).

This Specification ensures that the control rod patterns are i consistent with the assumptions of the CRDA analyses of References 1 and 2.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the CRDA are summarized in References 1 and 2. CRDA analyses assume that the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA.analysis. The RPC (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated.

Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage, which could result in undue release of radioactivity. Since the failure consequences for U02 have been shown to be insignificant below fuel energy depositions of 300 cal/gm (Ref. 3), the fuel damage limit of 280 cal/gm provides a margin of safety from significant core damage, which would result in release of radioactivity (Refs. 4 and 5). Generic evaluations (Ref. 6) of a design basis CRDA (i.e., a CRDA resulting in a peak fuel energy deposition of 280 cal/gm) have shown that if the peak fuel enthalpy remains below 280 cal/gm, then the maximum reactor pressure will be less than the required ASME Code limits (Ref. 7) and the calculated offsite doses will be well within the required limits (Ref. 5).

(continued)

PERRY - UNIT 1 B 3.1-34 Revision No. 7

Control Rod Pattern B 3.1.6 BASES APPLICABLE Control rod patterns analyzed in Reference 2 follow the SAFETY ANALYSES standard banked position withdrawal sequence (BPWS) analysis (continued) described in Reference 8. The BPWS is applicable from the condition of all control rods fully inserted to 19.0% RTP (Ref. 1). For the standard BPWS, the control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions (e.g., between notches 08 and 12). The banked positions are defined to minimize the maximum incremental control rod worths without being overly restrictive during normal plant operation. The standard BPWS analysis (Ref. 8) also evaluated the effect of fully inserted, inoperable control rods not in compliance with the sequence, to allow a limited number (i.e., eight) and distribution of fully inserted, inoperable control rods.

When performing a shutdown of the plant, an optional BPWS control rod sequence (Refs. 10, 11, and 12) may be used provided that all withdrawn control rods have been confirmed to be coupled. The rods may be inserted without the need to stop at intermediate positions since the possibility of a CRDA is eliminated by the confirmation that withdrawn control rods are coupled. When using the Reference 10 control rod insertion process, the rod pattern controller may be bypassed as permitted by the Applicability Note for the Rod Pattern Controller in Table 3.3.2.1-1. No control rod withdrawals are permitted while using this process.

In order to use the Reference 10 BPWS shutdown process, an extra check is required in order to consider a control rod to be "confirmed" to be coupled. This extra check ensures that no Single Operator Error can result in an incorrect coupling check, i.e., the coupling confirmation is performed once with two operators involved who both verify the rod is coupled, or the coupling confirmation is performed on two separate occasions. For purposes of this shutdown process, the method for confirming that control rods are coupled varies depending on the position of the control rod in the core. Details on this coupling confirmation requirement are provided in Sections 4 and 5 of Reference 10. If the requirements for use of the BPWS control rod insertion process contained in Reference 10 are followed, the plant is considered to be in compliance with BPWS requirements, as required by LCO 3.1.6.

Rod pattern control satisfies the requirements of Criterion 3 of the NRC Final Policy Statement on Technical Specification improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.1-35 Revision No. 7

Control Rod Pattern B 3.1.6 BASES (continued)

LCO Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the standard BPWS analysis. Compliance with the optional BPWS control rod insertion process prevents a CRDA from occurring. This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod OPERABILITY,"

consistent with the allowances for inoperable control rods in the BPWS.

APPLICABILITY In MODES 1 and 2, when THERMAL POWER is

19.0% RTP, the CRDA is a Design Basis Accident (DBA) and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is > 19.0% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Ref. 1). In MODES 3, 4, and 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will remain subcritical with a single control rod withdrawn.

(continued)

PERRY - UNIT 1 B 3.1-35a Revision No. 7 1

Control Rod Pattern B 3.1.6 BASES REFERENCES 5. 10 CFR 100.11, "Determination of Exclusion Area, Low (continued) Population Zone, and Population Center Distance."

6. NEDO-21778-A, "Transient Pressure Rises Affected Fracture Toughness Requirements for Boiling Water Reactors," December 1978.

7. ASME, Boiler and Pressure Vessel Code.

8. NEDO-21231, "Banked Position Withdrawal Sequence,"

January 1977.

9. USAR 7.6.1.5.C.

10. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.

11. USAR 4.3.2.5.2.

12. USAR 7.6.1.5.B.

PERRY - UNIT 1 B 3.1-38 Revision No. 7

SLC System B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Standby Liquid Control (SLC) System BASES BACKGROUND To meet General Design Criterion 26, the SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory (which is at the peak of the xenon transient) to a subcritical condition with the reactor in the most reactive xenon free state without taking credit for control rod movement. In addition, the SLC System satisfies the requirements of 10 CFR 50.62 (Ref. 1) on anticipated transient without scram (ATWS).

The SLC System consists of a boron solution storage tank, two positive displacement pumps and two explosive valves, which are provided in para11el for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV).

The borated solution is discharged through the high pressure core spray system sparger.

APPLICABLE The SLC System is manually initiated from the control SAFETY ANALYSES room, as directed by the Emergency Operating Procedures, if the operator believes the reactor cannot be shut down, or kept shut down, with the control rods. The SLC System is used in the event that not enough control rods can be inserted to accomplish shutdown and cooldown in the normal manner. The SLC System injects borated water into the reactor core to compensate for all of the various reactivity effects that could occur during plant operation. To meet this objective, it is necessary to inject a quantity of boron that produces a concentration of at least 816 ppm of natural boron in the reactor core at 68 0 F. To allow for potential leakage and imperfect mixing in the reactor system, an additional amount of boron equal to 25% of the amount cited above is added (Ref. 2). The concentration versus volume limits in Figure 3.1.7-1 are calculated such that the required concentration is achieved accounting for dilution in the RPV with normal water level and including the water volume in the residual heat removal shutdown cooling piping and in the recirculation loop piping. This quantity of borated solution is the amount that is above the (continued)

PERRY - UNIT 1 B 3. 1-39 Revision No. 7

SDV .Vent and Drain Valves B 3.1.8 BASES APPLICABLE allow continuous drainage of the SDV during normal plant SAFETY ANALYSES operation to ensure the SDV has sufficient capacity to (continued) contain the reactor coolant discharge during a full core scram. To automatically ensure this capacity, a reactor scram (LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation") is initiated if the SDV water level exceeds a specified setpoint. The setpoint is chosen such that all control rods are inserted before the SDV has insufficient volume to accept a full scram.

SDV vent and drain valves satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The OPERABILITY of all SDV vent and drain valves ensures that, during a scram, the SDV vent and drain valves will close to contain reactor water discharged to the SDV piping.

Since the vent and drain lines are provided with two valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. Additionally, the valves are required to be open to ensure that a path is available for the SDV piping to drain.

freely at other times.

APPLICABILITY In MODES 1 and 2, scram may be required, and therefore, the SDV vent and drain valves must be OPERABLE. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in theshutdown position and a control rod block is applied. Also, during MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and only one rod may be withdrawn and subject to scram.

ACTIONS The ACTIONS table is modified by Note 1 indicating that a separate Condition entry is allowed for each SDV vent and drain line. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SDV line. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS table is also modified by Note 2 stating that an isolated line may be unisolated under administrative control to allow draining and venting of the SDV. When a line is (continued)

PERRY - UNIT 1 B 3.1-46 Revision No. 7

APLHGR B 3.2.1 BASES APPLICABLE Based on analyses of limiting plant transients (other than SAFETY ANALYSES core flow increases) over a range of power and flow (continued) conditions, power dependent multipliers, MAPFACP, are also generated. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which turbine stop valve closure and turbine control valve fast closure scram signals are bypassed, both high and-low core flow MAPFAC limits are provided for operation at power levels between 23.8% RTP and the previously mentioned bypass power level. The exposure dependent APLHGR limits are reduced by MAPFACP and MAPFACf at various operating conditions to ensure that all fuel design criteria are met for normal operation and LOCA. A complete discussion of the analysis code is provided in Reference 6. The ECCS/LOCA analysis assumes the existence of MAPFAC.

LOCA analyses are performed to ensure that the above determined APLHGR limits are adequate to meet the PCT and maximum oxidation limits of 10 CFR 50.46. The analysis is performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K. A discussion of the analysis code is provided in Reference 7.

The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within an assembly. The APLHGR limits specified are equivalent to the LHGR of the highest powered fuel rod assumed in the LOCA analysis divided by its local peaking factor.

For single recirculation loop operati'on, the MAPFAC multiplier is limited to a maximum value which is specified in the COLR. This multiplier is due to the conservative analysis assumption of an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA.

The APLHGR satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.2-2 Revision No. 7

APLHGR B 3.2.1 BASES ACTIONS B.1 (conti nued) If the APLHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 23.8% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 23.8% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be-initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is ý 23.8% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution under normal conditions. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER Ž 23.8% RTP is achieved, is acceptable given the large inherent margin to operating limits at low power levels.

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II" (latest approved revision).

2. USAR, Chapter 15, Appendix 15B.

3. USAR, Chapter 15, Appendix 15F.

4. USAR, Chapter 15, Appendix 15E.

5. NEDE-30130-P-A, "Steady State Nuclear Methods," April 1985.

(continued)

PERRY - UNIT 1 B 3.2-4 Revision No. 7

MCPR B 3.2.2 BASES APPLICABLE There are two independent channels in the pressure SAFETY ANALYSES regulating system and the PRDF transient is not applicable (continued) when both channels are operable.

The COLR identifies the range of the modified MCPR limits and the new limits. These limits may be incorporated by either a revision to the monitoring system or appropriate administrative limits.

The MCPR satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The MCPR operating limits specified in the COLR are the result of the Design Basis Accident (DBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPRf and MCPRP limits.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 23.8% RTP, the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 23.8% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.

(continued)

PERRY - UNIT 1 B 3.2-7a Revision No. 7

LHGR B 3.2.3 BASES APPLICABLE The analysis also includes allowances for short term SAFETY ANALYSES transient operation above the operating limit to account for (continued) AQOs, plus an allowance for densification power spiking.

The LHGR limits are developed as a function of exposure and the various operating core flow and power states to ensure adherence to fuel design limits during the limiting AOOs(Refs. 3 and 4). Flow dependent Thermal-Mechanical LHGR Limits are determined using the three dimensional BWR simulator code (Ref. 5) to analyze slow flow runout transients. The flow dependent multiplier for the Thermal-Mechanical LHGR Limits is dependent on the maximum core flow runout capability. Thermal-Mechanical LHGR Limit curves are provided based on the maximum credible flow runout transient for Loop Manual and Non Loop Manual operation. The result of a single failure or single operator error during Loop Manual operation is the runout of only one loop because both recirculation loops are under independent control. Non Loop Manual operational modes allow simultaneous runout of both loops because a single controller regulates core flow.

The LHGR limits are primarily derived from fuel design evaluations and transient analyses that are assumed to occur at high power levels. Design calculations and operating experience have shown that as power is reduced, the margin to the required LHGR limits increases. This trend continues down to the power range of 4.7% to 14.2% RTP when entry into MODE 2 occurs. When in MODE 2, the intermediate ranqe monitor (IRM) scram function provides rapid scram initiation durinq any significant transient, thereby effectively removing any LHGR limit compliance concern inMODE 2, Therefore, at THERMAL POWER levels < 23.8% RTP, the reactor operates with substantial margin to the LHGR limits; thus, this LCO is not required The LHGR satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The LHGR is a basic assumption in the fuel design analysis.

The fuel has been designed to operate at rated core power with sufficient design margin to the LHGR calculated to cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR.

(continued)

PERRY - UNIT 1 B 3.2-11 Revision No. 7 1

LHGR B 3.2.3 BASES ACTIONS B.1 (continued)

Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 23.8% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is Ž 23.8% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution under normal conditions., The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER Ž 23.8% RTP is achieved, is acceptable given the large inherent margin to operating limits at lower power levels.

REFERENCES 1. NUREG-0800, "Standard Review Plan," Section 4.2, II.A.2(g), Revision 2, July 1981.

2. USAR, Chapter 15, Appendix 15B.

3. USAR, Chapter 15, Appendix 15F.

4. USAR, Chapter 15, Appendix 15E.

5. NEDE-30130-P-A, "Steady State Nuclear Methods," April 1985.

PERRY - UNIT I B 3.2-12 Revision No. 7

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE RPS instrumentation satisfies Criterion 3 of the NRC Final SAFETY ANALYSES, Policy Statement on Technical Specification Improvements (58 LCO, and FR 39132). Functions not specifically credited in the APPLICABILITY accident analysis are retained for the RPS as required by (continued) the NRC approved licensing basis.

The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1. Each Function must have a required number-of OPERABLE channels per RPS trip system, with their setpoints within the specified Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time.

Allowable Values are specified for each RPS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. ,

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,

trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters. obtained from the.

safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

(continued)

PERRY - UNIT 1 B 3.3-3 Revision No. 7

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE 4. Reactor Vessel Water Level-Low, Level 3 (continued)

SAFETY ANALYSES, LCO, and The Function is required in MODES 1 and 2 where APPLICABILITY considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at Reactor Vessel Water Level-Low Low, Level 2 and Low Low Low, Level 1 provide sufficient protection for level transients in all other MODES.

An operating bypass of the reactor vessel low water level trip is provided with the EOP keylock switches in the

'BYPASS' position and the mode switch in the 'SHUTDOWN' (MODE 3) position. The interlock with the mode switch will ensure that the reactor is in the shutdown condition prior to bypassing the reactor water level 3 scram.

5. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates a potential problem with the feedwater level control system, resulting in the addition of reactivity associated with the introduction of a significant amount of relatively cold feedwater.

Therefore, a scram is initiated at Level 8 to ensure that MCPR is maintained above the MCPR SL. The Reactor Vessel Water Level-High, Level 8 Function is one of the many Functions assumed to be OPERABLE and capable of providing a reactor scram during transients analyzed in Reference 3.

It is directly assumed in the analysis of feedwater controller failure, maximum demand (Ref. 4).

Reactor Vessel Water Level-High, Level 8 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water Level-High, Level 8 Allowable Value is specified to ensure that the MCPR SL is not violated during the assumed transient.

Four channels of the Reactor Vessel Water Level-High, Level 8 Function, with two channels in each trip system arranged in a one-out-of-two logic, are available and are required to be OPERABLE when THERMAL POWER is Ž 23.8% RTP to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. With THERMAL POWER < 23.8% RTP, this Function is not required since MCPR is not a concern below 23.8% RTP.

(continued)

PERRY - UNIT 1 B 3.3-13 Revision No. 7

RPS Instrumentation B 3.3.1.1 BASES ACTIONS 1.1 (continued) cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. Additionally, for Function 12, Manual Scram, the mode switch shall be locked in the shutdown position.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.

The Surveillances are modified by a Note to indicate that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the RPS reliability analysis (Ref. 9) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RPS will trip when necessary.

SR 3.3.1.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

(continued)

PERRY - UNIT 1 B 3.3-24 Revision No. 7

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND The purpose of the RPC is to ensure control rod patterns (continued) during startup are such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 19.0%

RTP. The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. The RPC, in conjunction with the RCIS, will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the specified sequence.

The rod block logic circuitry is the same as that described above. The RPC also uses the turbine first stage pressure to determine when reactor power is above the power at which the RPC is automatically bypassed (Ref. 1).

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal-during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch hastwo channels, with each providing inputs into a separate rod block circuit. A rod block in either circuit will provide a control rod block to all control rods.

APPLICABLE 1.a. Rod Withdrawal Limiter SAFETY ANALYSES, LCO, and The RWL is designed to prevent violation of the MCPR SL APPLICABILITY and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2. A statistical analysis of RWE events was performed to determine the MCPR response as a function of withdrawal distance and initial operating conditions. From these responses, the fuel thermal performance was determined as a function of RWL allowable control rod withdrawal distance and power level.

The RWL satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Two channels of the RWL are available and are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this Function.

(continued)

PERRY - UNIT 1 B 3.3-43 Revision No. 7

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE L.a. Rod Withdrawal Limiter (continued)

SAFETY ANALYSES, LCO, and Nominal trip set points are specified in the setpoint APPLICABILITY calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected-for calibration, process, and some of the instrument errors.

The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drive, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The RWL is assumed to mitigate the consequences of an RWE event when operating > 33.3% RTP. Below this power level, the consequences of an RWE event will not exceed the MCPR, and therefore the RWL is not required to be OPERABLE (Ref.

3).

1.b. Rod Pattern Controller The RPC enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 4, 5, and 7. The standard BPWS (Ref. 4) requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with BPWS are specified in LCO 3.1.6, "Control Rod Pattern."

(continued)

PERRY - UNIT 1 B 3.3-44 Revision No. 7

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1.b. Rod Pattern Controller (continued)

SAFETY ANALYSES, LCO, and When performing a shutdown of the plant, an optional BPWS APPLICABILITY control rod sequence (Refs. 1, 7, and 8) may be used provided that all withdrawn control rods have been confirmed to be coupled. The rods may be inserted without the need to stop at intermediate positions since the possibility of a CRDA is eliminated by the confirmation that withdrawn control rods are coupled. When using the Reference 7 control rod insertion process, the rod pattern controller may be bypassed as permitted by the Applicability Note for the Rod Pattern Controller in Table 3.3.2.1-1. No control rod withdrawals are permitted while using this process.

(continued)

PERRY - UNIT 1 B 3.3-44a Revision No. 7 1

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1.b. Rod Pattern Controller (continued)

SAFETY ANALYSES, LCO, and The Rod Pattern Controller Function satisfies Criterion 3 APPLICABILITY of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Since the RPC is a backup to operator control of control rod sequences, only a single channel would be required to be OPERABLE to satisfy Criterion 3 (Ref. 5). However, the RPC is designed as a dual channel system and will not function without two OPERABLE channels. Required Actions of LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.6 may necessitate bypassing individual control rods in the Rod Action Control System (RACS) to allow continued operation with inoperable control rods or to allow correction of a control rod pattern not in compliance with the BPWS. The individual control rods may be bypassed as required by the conditions, and the RPC is not considered inoperable provided SR 3.3.2.1.9 is met.

Compliance with the BPWS, and therefore OPERABILITY of the RPC, is required in MODES 1 and 2 with THERMAL POWER

< 19.0% RTP. When THERMAL POWER is > 19.0% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA. In MODES 3 and 4, all control rods are required to be inserted in the core. In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.

2. Reactor Mode Switch-Shutdown Position During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch-Shutdown Position Function satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.3-45 Revision No. 7

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.9 REQUIREMENTS (continued) LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed in RACS to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with BPWS. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods. No additional analyses are required for the bypassing and movement of these control rods, since these evolutions are adequately controlled by LCO 3.1.3 and LCO 3.1.6.

Individual control rods may also be required to be bypassed to allow continuous withdrawal for determining the location of leaking fuel assemblies, adjustment of control rod speed, or control rod scram time testing. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods is in conformance with specific analyses for these evolutions.

With the control rods bypassed in the RACS, the RPC will not control the movement of these bypassed control rods.

Compliance with this SR allows the RPC and RWL to be OPERABLE with these control rods bypassed.

REFERENCES 1. USAR, Section 7.6.1.5.

2. USAR, Section 15.4.2.

3. NEDE-24011-P-A-US, "General Electric Standard Application for Reload Fuel" (latest approved revision).

4. NEDO-21231, "Banked Position Withdrawal Sequence," January 1977.

5. NRC SER, Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17,"

December 27, 1987.

6. NEDC-30851-P-A. "Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation."

October 1988.

7. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.

8. USAR 4.3.2.5.2.

PERRY - UNIT 1 B 3.3-50 Revision No. 7

PAM Instrumentation B 3.3.3.1 B 3.3 INSTRUMENTATION B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display plant variables that provide information required by the control room operators during accident situations.

This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events. The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I in accordance with Regulatory Guide 1.97 (Ref.

1).

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1.

APPLICABLE The PAM instrumentation LCO ensures the OPERABILITY of SAFETY ANALYSES Regulatory Guide 1.97, Type A, variables so that the control room operating staff can:

Perform the diagnosis specified in the Emergency Operating Procedures (EOPs). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs) (e.g.,

loss of coolant accident (LOCA)); and Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.

The PAM instrumentation LCO also ensures OPERABILITY of Category I, non-Type A, variables. This ensures the control room operating staff can:

Determine whether systems important to safety are performing their intended functions; (continued)

PERRY - UNIT 1 B 3.3-51 Revision No. 7

PAM Instrumentation B 3.3.3.1 BASES APPLICABLE Determine the potential for causing a gross breach of SAFETY ANALYSES the barriers to radioactivity release; (continued)

Determine whether a gross breach of a barrier has occurred; and Initiate action necessary to protect the public and to obtain an estimate of the magnitude of any impending threat.

The plant specific Regulatory Guide 1.97 analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables.

PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Category I, non-Type A, instrumentation is retained in the Technical Specifications (TS) because it is intended to assist operators in minimizing the consequences of accidents. Therefore, these Category I, non-Type A, variables are important for reducing public risk.

LCO LCO 3.3.3.1 requires at least two OPERABLE channels for all but one Function to ensure no single failure prevents the operators from being presented with the information necessary to determine the status of the unit and to bring the unit to, and maintain it in., a safe condition following that accident.

Furthermore, provision of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.

The exception to the two channel requirement is primary containment isolation valve (PCIV) position. In this case, the important information is the status of the primary containment penetrations. The LCO requires two position indicators for each penetration flow path. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the automatic valve and prior knowledge of passive valve or via system boundary status. If a normally automatic PCIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE. In addition, Note (b) of Table 3.3.3.1-1 requires (continued)

PERRY - UNIT 1 B 3.3-52 Revision No. 7

Remote Shutdown System B 3.3.3.2 BASES APPLICABLE The criteria governing the design and the specific system SAFETY ANALYSES requirements of the Remote Shutdown System are located in (continued) 10 CFR 50, Appendix A, GDC 19 (Ref. 1).

The Remote Shutdown System is considered an important contributor to reducing the risk of accidents; as such, it has been retained in the Technical Specifications (TS) as indicated in the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The Remote Shutdown System LCO provides the requirements for the OPERABILITY of the instrumentation and controls necessary to place and maintain the plant in MODE 3 from a location other than the control room. The instrumentation and controls required are listed in applicable plant instructions.

The controls, instrumentation, and transfer switches are those required for:

Reactor pressure vessel (RPV) pressure control;

Decay heat removal;

RPV inventory control; and

Safety support systems for the above functions, including emergency service water, component cooling water, and onsite power, including the diesel generators.

The Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the remote shutdown function are OPERABLE. In some cases the required information or control capability may be available from several alternate sources. In these cases, the Remote Shutdown System is OPERABLE as long as one channel of any of the alternate information or control sources for each Function is OPERABLE.

The Remote Shutdown System instruments and control circuits covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure that the instruments and control circuits will be OPERABLE if plant conditions require that the Remote Shutdown System be placed in operation.

(continued)

PERRY - UNIT 1 B 3.3-64 Revision No. 7

EOC-RPT Instrumentation B 3.3.4.1 BASES BACKGROUND per recirculation pump. One trip system trips one of the (continued) two EOC-RPT breakers for each recirculation pump and the second trip system trips the other EOC-RPT breaker for each recirculation pump.

APPLICABLE The TSV Closure and the TCV Fast Closure, Trip Oil SAFETY ANALYSES, Pressure-Low Functions are designed to trip the LCO, and recirculation pumps from fast speed operation in the event APPLICABILITY of a turbine trip or generator load rejection to mitigate the neutron flux, heat flux, and pressure transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 1, 2, and 3.

To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps from fast speed operation after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL. The EOC-RPT function is automatically disabled when turbine first stage pressure is < 38% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58FR 39132).

The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.1.2. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated EOC-RPT breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its assumed response time.

Allowable Values are specified for each EOC-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. A channel is inoperable if (continued)

,PERRY - UNIT 1 B 3.3-69 Revision No. 7

ATWS-RPT Instrumentation B 3.3.4.2 BASES (continued)

APPLICABLE The ATWS-RPT is not assumed in the safety analysis. The SAFETY ANALYSES, ATWS-RPT initiates an RPT to aid in preserving the LCO, and integrity of the fuel cladding following events in which APPLICABILITY scram does not, but should, occur. Based on its contribution to the reduction of overall plant risk, however, the instrumentation is included as required by the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

The OPERABILITY of the ATWS-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.2.4. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated recirculation pump drive motor breakers. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.

Allowable Values are specified for each ATWS-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured outp~ut value of the process parameter exceeds the'setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g.,

drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The individual Functions are required to be OPERABLE in MODE 1 to protect against common mode failures of the (continued)

PERRY - UNIT 1 B 3.3-80 Revision No. 7

ATWS-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE SR 3.3.4.2.4 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoi nt methodology.

The Frequency is based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.4.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers, included as part of this Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be also inoperable.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

REFERENCES 1. USAR, Section 7.6.1.12.

2. GENE-770-06-1, "Bases For Changes To Surveillance Test I Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications,"

February 1991.

PERRY - UNIT 1 B 3.3-87 Revision No. 7

ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate.

appropriate responses from the systems to ensure that fuel is adequately cooled in the event of a design basis accident or transient.

For most anticipated operational occurrences (AOOs) and Design Basis Accidents (DBAs), a wide range of dependent and independent parameters are monitored.

Portions of this ECCS instrumentation actuate the Annulus Exhaust Gas Treatment (AEGT) subsystems and the diesel generators (DGs), in addition to the ECCS subsystems (Low Pressure Core Spray (LPCS), Low Pressure Coolant Injection (LPCI), High Pressure Core Spray (HPCS), and Automatic Depressurization System (ADS)). The supported systems are described in the Bases for:

- LCO 3.5.1 and 3.5.2 "ECCS-Operating" and "ECCS-Shutdown"

- LCO 3.6.4.3 "Annulus Exhaust Gas Treatment (AEGT)

System," and

- LCO 3.8.1 and 3.8.2 "AC Sources-Operating" and "AC Sources-Shutdown".

Low Pressure Core Spray System The LPCS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High. Each of these diverse variables is monitored by two redundant transmitters, which are, in turn, connected to two trip units. The outputs of the four trip units (two trip units from each of the two variables) are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. The initiation signal is a sealed in signal and must be manually reset. The logic can also be initiated by use of a manual push button. Upon receipt of an initiation signal, the LPCS pump is started immediately after power is available.

The LPCS test valve to suppression pool, which is also a Srimary containment isolation valve (PCIV), is closed on a PCS initiation signal to allow full system flow assumed in the accident analysis and maintains containment isolation in the event LPCS is not operating.

(continued)

PERRY - UNIT 1 B 3.3-88 Revision No- 7

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators (continued) standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective Engineered Safety Feature (ESF) buses if a loss of offsite power occurs. (Refer to Bases for LCO 3.3.8.1.)

AEGTs The AEGT subsystems may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High. Each of these diverse variables is monitored by two redundant transmitters per AEGT subsystem which are, in turn, connected to two trip units. The outputs of the four divisionalized trip units (two trip units from each of the two variables) are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic. The AEGT subsystems receive their initiation signals from the associated Divisions' ECCS logic (i.e., Division 1 AEGT subsystem receives an initiation signal from Division 1 ECCS (LPCS and LPCI A),

and Division 2 AEGT subsystem receives an initiation signal from Division 2 ECCS (LPCI B and LPCI C)). The AEGT subsystems can also be started manually from the control room. The AEGT initiation logic is reset by resetting the associated ECCS initiation logic.

APPLICABLE The actions of the ECCS are explicitly assumed in the SAFETY ANALYSES, safety analyses of References 1, 2, and 3'. The ECCS is LCO, and initiated to preserve the integrity of the fuel cladding by APPLICABILITY limiting the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each (continued)

PERRY - UNIT 1 B 3.3-94 Revision No. 7

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE Low Pressure Core Spray and Low Pressure Coolant Injection SAFETY ANALYSES, Systems LCO, and APPLICABILITY 1.a, 2.a Reactor Vessel Water Level-Low Low Low, Level 1 (continued)

Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result.

The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The AEGT System also receives Level 1 initiation signals to ensure a subsystem will operate following events that challenge core coverage. The Reactor Vessel Water Level-Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Water Level-Low Low Low, Level 1 Function is assumed in the analysis of the DBA LOCA (Ref. 2). The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

Two channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function per associated Division are required to be OPERABLE when the associated ECCS, DG, or AEGT subsystem is required to be OPERABLE, to ensure that no single instrument failure can preclude system initiation. (Two channels input to Division 1, while the other two channels input to Division 2.)

Refer to LCO 3.5.1 and LCO 3.5.2, "ECCS-Shutdown," for Applicability Bases for the low pressure ECCS subsystems; LCO 3.8.1, "AC Sources-Operating' and LCO 3.8.2, "AC Sources-Shutdown," for Applicability Bases for the DGs; and LCO 3.6.4.3, "Annulus Exhaust Gas Treatment (AEGT) System,"

for Applicability Bases for AEGT System.

(continued)

PERRY - UNIT 1 B 3.3-96 Revision No. 7

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.b, 2.b. Drywell Pressure-High SAFETY ANALYSES, LCO, and High pressure in the drywell could indicate a break in the APPLICABILITY reactor coolant pressure boundary (RCPB). The low pressure (continued) ECCS and associated DGs are initiated upon receipt of the Drywell Pressure-High Function in order to minimize the Bossibility of fuel damage. The AEGT System also receives rywell Pressure-High signals to ensure a subsystem will operate following a DBA LOCA. The Drywell Pressure-High Function is assumed in the analysis of the DBA LOCA (Ref.

2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment. Negative barometric fluctuations are accounted for in the Allowable Value.

The Drywell Pressure-High Function is required to be OPERABLE when the associated ECCS, DGs or AEGT subsystems are required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the LPCS and LPCI Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude system initiation. (Two channels input to Division 1, while the other two channels input to Division 2.) In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize I

the primary containment to Drywell Pressure-High setpoint.

Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems: LCO 3.8.1 for Applicability Bases for the DGs; and LCO 3.6.4.3 for Applicability Bases for the AEGT subsystems.

1.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B Start-Time Delay Relay The purpose of this time delay is to stagger the start of the two ECCS pumps that are in each of Divisions 1 and 2, thus limiting the starting transients on the 4.16 kV emergency buses. This Function is only necessary when power is being supplied from the standby power sources (DG).

(continued)

PERRY - UNIT 1 B 3.3-97 Revision No. 7

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 4.f, 5.e. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and There is no Allowable Value for this Function since the APPLICABILITY channel is mechanically actuated based solely on the position of the push buttons. Four channels of the Manual Initiation Function (two channels per ADS trip system) are only required to be OPERABLE when the ADS is required to be OPERABLE. Refer to LCO 3.5.1 for ADS Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable ECCS instrumentation channel.

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1. The applicable Condition specified in the table is Function dependent.

Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1, B.2, and B.3 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function (or in some cases, within the same monitored parameter) result in redundant automatic initiation capability being lost for the feature(s). Required Action B.1 "features" would be those that are initiated by Functions 1.a, l.b, 2.a, and 2.b (e.g., Division I and 2 diesel generators, low pressure ECCS, or the AEGT subsystems); B.1 features do not include those separately addressed with their own Instrumentation Specification (e.g., RHR Containment Spray Instrumentation). The Required Action B.2 feature would be HPCS.

(continued)

PERRY - UNIT I B 3.3-110 Revision No. 7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)

For Required Action B.1, redundant automatic initiation capability is lost for a feature if either (a) one or more of its Function l.a channels and one or more of its Function 2.a channels are inoperable and untripped, or (b) one or more of its Function 1.b channels and one or more of its Function 2.b channels are inoperable and untripped.

Since Required Action B.1 is only applicable if channels supporting both Divisions of a feature are inoperable and untripped, the affected portions of both Divisions of ECCS, DG and AEGT are declared inoperable concurrently (within I hour of discovery).

For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system.

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable with in I hour.

As noted (Note 1 to Required Action B.1 and Required Action B.2), the two Required Actions are only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the ECCS is not assumed and the probability of a LOCA is lower. Although a total loss of initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed by Required Action B.3 during MODES 4 and 5, additional controls are imposed in ORM 6.2.9. Notes are also provided (Note 2 to Required Action B.1 and Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed.

(continued)

PERRY - UNIT I B 3.3-111 Revision No. 7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "clock.""time zero" for beginning the allowed outage time For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., any Division I ECCS and any Division 2 ECCS; the Division 1 and 2 DGs: the Division 1 and 2 AEGT subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same monitored parameter as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCS System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation),

Condition H must be entered and its Required Action taken.

(continued)

PERRY - UNIT I B 3.3-112 Revision No. 7

RCIC System Instrumentation B 3.3.5.2 BASES BACKGROUND the suction valves are interlocked so that one suction path (continued) must be open before the other automatically closes.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply valve closes (the injection valve also closes due to the closure of the steam supply valve). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient LCO, and events. The RCIC System is not an Engineered Safety APPLICABILITY Feature System and no credit is taken in the safety analysis for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the RCIC System, and therefore its instrumentation, are included as required by the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.2-1. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpObnt is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations.

The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified accounts for instrument uncertainties appropriate to the Function. These uncertainties are described in the setpoint methodology.

(continued)

PERRY - UNIT 1 B 3.3-125 Revision No. 7

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 3. Condensate Storage Tank Level-Low (continued)

SAFETY ANALYSES, LCO, and Two channels of Condensate Storage Tank Level-Low Function APPLICABILITY are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to the suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases.

4. Suppression Pool Water Level-High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety/relief valves. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of RCIC from the CST to the suppression pool to eliminate the possibility of RCIC continuing to provide additional water from a source outside primary containment. This Function satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Suppression Pool Water Level-High signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated trip unit can cause the suppression pool suction valve to open and the CST suction valve to Close. The Allowable Value for the Suppression Pool Water Level-High Function is chosen to ensure that RCIC will be aligned for suction from the suppression pool before the water level reaches the point at which suppression pool design loads would be exceeded.

Two channels of Suppression Pool Water Level-High Function are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to the suppression pool source. If the automatic transfer of the suction source for RCIC from the CST to the suppression pool, due to a high suppression pool water level signal, is manually overridden by the operator, then the Suppression Pool Water Level-High Functions are considered inoperable. Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)

PERRY - UNIT 1 B 3.3-128 Revision No. 7

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.5 (continued)

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

REFERENCES 1. GENE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

PERRY - UNIT I )B 3.3-135 Revision No. 7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND 5. RHR System Isolation (continued)

The RHR System Isolation Function receives input signals from instrumentation for the Reactor Vessel Water Level-Low, Level 3; Drywell Pressure-High; Reactor Vessel Steam Dome Pressure-High; RHR Equipment Area Ambient Temperature-High Functions; and Manual Initiation. The Reactor Vessel Water Level-Low, Reactor Vessel Steam Dome Pressure-High, and Drywell Pressure-High Functions each have four channels. The outputs from the reactor vessel water level and drywell pressure channels are connected into two two-out- of-two trip systems. The reactor vessel steam dome Sressure is arranged into two one-out-of-two trip systems.

he RHR Equipment Area Ambient Temperature Function receives input from four channels with each channel in one trip system in one room using one-out-of-one logic. Each of the two trip systems is connected to one of the two valves on each RHR System shutdown cooling penetration so that operation of either trip system isolates the penetration.

APPLICABLE The isolation signals generated by the primary containment SAFETY ANALYSES, and drywell isolation instrumentation are implicitly LCO, and assumed in the safety analyses of References 1 and 2 to APPLICABILITY initiate closure of valves to limit offsite doses. Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," Applicable Safety Analyses Bases, for more detail. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell. Refer to LCO 3.6.5.3, "Drywell Isolation Valves," Applicable Safety Analyses Bases, for more detail.

Primary containment and drywell isolation instrumentation satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the primary containment and drywell instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the (continued)

PERRY - UNIT 1 B 3.3-139 Revision No. 7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a, 2.e. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY since isolation of these valves is not critical to orderly plant shutdown.

This Function is required to be OPERABLE during operations with a potential for draining the reactor vessel (OPDRVs) because the capability of isolating potential sources of leakage must be provided to ensure that offsite dose limits are not exceeded if core damage occurs. However, OPDRVs assume that one or more fuel assemblies are loaded into the core. Therefore, if the fuel is fully off-loaded from the reactor vessel, this Function is not required to be OPERABLE.

This Function isolates the 1E22-F023 Valve (Function 2.e),

and the Group 1, 5, 7, and 8 valves (Function 2.a).

2.b, 2.d, 2.f Drywell Pressure-High High drywell pressure can indicate a break in the RCPB. The isolation of some of the PCIVs on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded (for the design-basis Revised Accident Source Term (RAST) LOCA analysis, the licensing basis offsite dose limit is 25 rem-TEDE (Ref. 11)).

The Drywell Pressure-High Function associated with isolation of the primary containment is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA. In addition, Functions 2.b and 2.d provide isolation signals to certain drywell isolation valves. The isolation of.drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

High drywell pressure signals are initiated from four pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High per Function are required to be OPERABLE to ensure that no single instrument failure can reclude the isolation function. Function 2.f (Division 3) as only one trip system consisting of four channels logically combined in a one-out-of-two twice configuration.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since (continued)

PERRY - UNIT I B 3.3-146 Revision No. 7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.b, 2.d, 2.f Drywell Pressure-High (continued)

SAFETY ANALYSES, LCO, and this may be indicative of a LOCA inside primary APPLICABILITY containment.

These Functions isolate the Group 1, 5, and 8 valves (Function 2.b), Group 2 and, in conjunction with Function 3.c, the 1E51-F068, the 1E51-F077, and the 1E51-F078 valves from Group 9 (Function 2.d), and the 1E22-F023 valve (Function 2.f).

2.c. Reactor Vessel Water Level-Low Low Low, Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the primary containment occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. In addition, this Function provides an isolation signal to certain drywell isolation valves. The isolation of dryweli, isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level Low- Low-Low, Level 1 Function are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1) to ensure the valves are isolated to prevent offsite doses from exceeding 10 CFR 100 limits (for the design-basis Revised Accident Source Term (RAST) LOCA analysis, the licensing basis offsite dose limit is 25 rem TEDE (Ref. 11)).

(continued)

PERRY - UNIT 1 B 3.3-147 Revision No. 7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.c. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY This Function is required to be OPERABLE during operations with a potential for draining the reactor vessel (OPDRVs) because the capability of isolating potential sources of leakage must be provided to ensure that offsite dose limits are not exceeded if core damage occurs. However, OPDRVs assume that one or more fuel assemblies are loaded into the core. Therefore, if the fuel is fully off-loaded from the reactor vessel, this Function is not required to be OPERABLE.

This Function isolates the Group 2 isolation valves.

2.g. Containment and Drywell Purge Exhaust-Plenum Radiation-High High purge exhaust plenum radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB. When Purge Exhaust-Plenum Radiation-High is detected, valves whose penetrations communicate-with the primary containment atmosphere are isolated to limit the release of fission products. In addition, this Function provides an isolation signal to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

The Purge Exhaust-Plenum Radiation-High signals are initiated from four radiation detectors that are located on the purge exhaust plenum ductwork coming from the drywell and containment. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel.

(continued)

PERRY - UNIT I B 3.3-148 Revision No. 7

RHR Containment Spray System Instrumentation B 3.3.6.2 BASES (continued)

APPLICABLE Operation of the RHR Containment Spray System may be SAFETY ANALYSES, required to maintain containment pressure within design LCO, and limits after a LOCA. Safety analyses in Reference 2 APPLICABILITY implicitly assume that sufficient instrumentation and controls, described below, are available to initiate the RHR Containment Spray System.

The RHR Containment Spray System instrumentation satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RHR Containment Spray System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.2-1. EachFunction must have the required number of OPERABLE channels with their setpoints within the specified Allowable Values. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each Function in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g.,

drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments, as defined by 10 CFR 50.49) are accounted for.

(continued)

PERRY - UNIT 1 B 3.3-175 Revision No. 7

SPMU System Instrumentation B 3.3.6.3 BASES (continued)

APPLICABLE The SPMU System is relied upon to dump upper, containment SAFETY ANALYSES, pool water to the suppression pool to maintain drywell LCO, and horizontal vent coverage and an adequate suppression pool APPLICABILITY heat sink volume to ensure that the primary containment internal pressure and temperature stay within design limits (Ref. 2).

The SPMU System instrumentation satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132). Certain instrumentation Functions are retained for other reasons and are described in the individual Functions discussion.

The OPERABILITY of the SPMU System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functi.ons specified in Table 3.3.6.3-1. Each Function must have the required number of OPERABLE channels with their setpoints within the specified Allowable Value, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.;

Allowable Values are specified for each Function in the Table. Nominal trip setpoints are specified in theisetpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Values between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal setpoint, but within the Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors.

(continued)

PERRY - UNIT I B 3.3-186 Revision No. 7

Relief and LLS Instrumentation B 3.3.6.4 BASES BACKGROUND its assigned setpoint). Once an S/RV has been opened, it (continued) will reclose when reactor steam dome pressure decreases below the opening pressure setpoint. This logic arrangement ensures that no single instrument failure can preclude the S/RV relief function.

The LLS logic consists of two trip systems similar to the S/RV relief function. Either trip system can actuate the LLS S/RVs by energizing the associated S/RV solenoid. Each LLS trip system is enabled and sealed in upon initial S/RV actuation from the existing reactor vessel steam dome pressure sensors of any of the normal relief setpoint groups. The reactor steam dome pressure channels used to arm LLS are arranged in a one- out-of-three taken twice logic. The reactor steam dome pressure channels that control the opening and closing of the LLS S/RVs are arranged in a two-out-of-two logic. This logic arrangement ensures that no single instrument failure can preclude the LLS S/RV function. The channel.s include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a LLS or relief initiation signal, as applicable, to the initiation logic.

APPLICABLE The relief and LLS instrumentation are designed to prevent SAFETY ANALYSES overpressurization of the nuclear steam system and to ensure that the containment loads remain within the primary containment design basis (Ref. 1).

Relief and LLS instrumentation satisfies Criterion 3 of the NRC Final Policy Stafement on Technical Specification Improvements (58 FR 39132).

LCO The LCO requires OPERABILITY of sufficient relief and LLS instrumentation channels to provide adequate assurance of successfully accomplishing the relief and LLS function, assuming any single instrumentation channel failure within the LLS logic. Therefore, two trip systems are required to be OPERABLE. The OPERABILITY of each trip system is dependent upon the OPERABILITY of the reactor steam dome pressure channels associated with required relief and LLS S/RVs. Each required channel shall have its setpoint within the specified Allowable Value. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

(continued)

PERRY - UNIT 1 B 3.3-197 Revision No. 7

CRER System Instrumentation B 3.3.7.1 BASES APPLICABLE CRER System instrumentation satisfies Criterion 3 of the LCO, and NRC Final Policy Statement on Technical Specification APPLICABILITY Improvements (58 FR 39132).

(continued)

The OPERABILITY of the CRER System instrumentation is dependent upon the-OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.7.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each CRER System Instrumentation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations.

These nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint that is less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at

.which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the remaining instrument errors (e.g.,

drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

(continued)

PERRY - UNIT I B 3.3-203 Revision No. 7

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE Accident analyses credit the loading of the DG based on the SAFETY ANALYSES, loss of offsite power during a loss of coolant accident LCO, and (LOCA). The diesel starting and loading times have been APPLICABILITY included in the delay time associated with each safety (continued) system component requiring DG supplied power following a loss of offsite power.

The LOP instrumentation satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

The OPERABILITY of the LOP instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.8.1-1. Each Function must have a required number of OPERABLE channels per 4.16 kV emergency bus, with their setpoints within the specified Allowable Values. A-channel is inoperable if its actual trip setpoint is-not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

The Allowable Values are specified for each Function in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoint does not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., degraded voltage), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

(continued)

PERRY - UNIT 1 B 3.3-213 Revision No. 7

RPS Electric Power Monitoring B 3.3.8.2 BASES BACKGROUND circuit breakers has an associated independent set of (continued) Class 1E overvoltage, undervoltage, and underfrequency sensing logic. Together, a circuit breaker and its sensing logic constitute an electric power monitoring assembly. If the output of the MG set exceeds the predetermined limits of overvoltage, undervoltage, or underfrequency, a trip coil driven by this logic circuitry opens the circuit breaker, which removes the associated power supply from service.

APPLICABLE RPS electric power monitoring is necessary to meet the SAFETY ANALYSES assumptions of the safety analyses by ensuring that the equipment powered from the RPS buses can perform its intended function. RPS electric power monitoring provides protection to the RPS and other systems that receive power from the RPS buses, by disconnecting the*RPS from the power supply under specified conditions-that could damage the RPS bus powered equipment.

RPS electric power monitoring satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The OPERABILITY of each RPS electric power monitoring assembly is dependent upon the OPERABILITY of the overvoltage, undervoltage, and underfrequency logic, as well as the OPERABILITY of the associated circuit breaker.

Two electric power monitoring assemblies are required to be OPERABLE for each.inservice power supply. This provides redundant protection against any abnormal voltage or frequency conditions to ensure that no single RPS electric power monitoring assembly failure can preclude the function of RPS bus powered components. Each inservice electric power monitoring assembly's trip logic setpoints are required to be within the specific Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RPS electric power monitoring assembly trip logic (refer to SR 3.3.8.2.2).

Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less (continued)

PERRY - UNIT 1 B 3.3-220 Revision No. 7

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE several seconds until the jet pump suction is uncovered SAFETY ANALYSES (Ref. 1). The analyses assume that both loops are operating (continued) at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops, with the pipe break assumed to be in the loop with the higher flow. While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were operating at a lower flow rate), a small mismatch has been determined to be acceptable based on engineering judgement.

The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal margins during anticipated operational occurrences (AOOs) (Ref. 2), which are analyzed in Chapter 15 of the USAR.

A plant specific LOCA analysis has been performed assuming only one operating recirculation loop. This analysis has demonstrated that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling, provided THERMAL POWER is reduced to

2500 MWt, and the APLHGR and LHGR requirements are modified accordingly (Ref. 3).

The transient analyses of Chapter 15 of the USAR have also been performed for single recirculation loop operation (Ref. 3) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided THERMAL POWER is reduced to

2500 MWt, and the MCPR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System average power range monitor (APRM) instrument setpoints is also required to account for the different relationships between recirculation drive flow and reactor core flow. The APLHGR, LHGR and MCPR limits for single loop operation are specified in the COLR. The APRM flow biased simulated thermal power setpoint is in LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation."

Recirculation loops operating satisfies Criterion 2 of the NRC Final Policy Statement on Technical Speci fi cati on Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.4-3 Revision No. 7

FCVs B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 Flow Control Valves (FCVs)

BASES BACKGROUND The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how this affects the design basis transient and accident analyses. The jet pumps and the FCVs are part of the Reactor Coolant Recirculation System. The jet pumps are described in the Bases for LCO 3.4.3, "Jet Pumps."

The Recirculation Flow Control System consists of the electronic and hydraulic components necessary for the positioning of the two hydraulically actuated FCVs. The recirculation loop flow rate can be rapidly changed within the expected flow range, in response to rapid changes in system demand. Limits on the system response are required to minimize the impact on core flow response during certain accidents and transients. Solid state control logic will generate an FCV "motion inhibit" signal in response to any one of several hydraulic power unit or analog control circuit failure signals. The "motion inhibit" signal causes hydraulic power unit shutdown and hydraulic isolation such that the FCVs fail "as is."

APPLICABLE The FCV stroke rate is limited to

11% per second in SAFETY ANALYSES the opening and closing directions on a control signal failure of maximum demand. This stroke rate is an assumption of the analysis of the recirculation flow control failures on decreasing and increasing flow (Refs. 1 and 2).

Flow control valves satisfy Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO An FCV in each operating recirculation loop must be OPERABLE to ensure that the assumptions of the design basis transient and accident analyses are satisfied.

(continued)

PERRY - UNIT 1 B 3.4-9 Revision No. 7

Jet Pumps B 3.4.3 BASES APPLICABLE The capability of reflooding the core to two-thirds core SAFETY ANALYSES height is dependent upon the structural integrity of the jet (continued) pumps. If the structural system, including the beam holding a jet pump in place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.

Jet pumps satisfy Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two thirds core height during a LOCA.

OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Coolant Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1).

APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Coolant Recirculation System (LCO 3.4.1).

In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not required to be in operation, and when not in operation sufficient flow is not available to evaluate jet pump OPERABILITY.

ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability of reflooding during a design basis LOCA. If one or more of the-jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PERRY - UNIT I B 3.4-14 Revision No. 7

S/RVs B 3.4.4 BASES BACKGROUND and instrumentation for the ADS function is discussed in (continued) LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)

Instrumentation."

APPLICABLE The overpressure protection system must accommodate the SAFETY ANALYSES most severe pressure transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs) followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 2). For the purpose of the analyses, the 13 safety valves with the highest setpoints were assumed to be operational. Therefore, by requiring six S/RVs to be OPERABLE in the relief mode and seven in the, safety mode, the accident analyses assumptions are adequately met. The analysis results demonstrate that the design S/RV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig = 1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the design basis event.

Reference 3 discusses additional events that are expected to actuate the S/RVs. From an overpressure standpoint, the design basis events are bounded by the MSIV closure with flux scram event described above.

S/RVs satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The safety function of seven S/RVs is required to be OPERABLE in the safety mode, and an additional six S/RVs (other than the seven S/RVs that satisfy the safety function) must be OPERABLE in the relief mode. The requirements of this LCO are applicable only to the capability of the S/RVs to mechanically open to relieve excess pressure. In Reference 2, an evaluation was performed to establish the parametric relationship between the peak vessel pressure and the number of OPERABLE S/RVs.

The results show that with a minimum of seven S/RVs in the safety mode and six S/RVs in the relief mode OPERABLE, the ASME Code limit of 1375 psig is not exceeded.

The S/RV setpoints are established to ensure the ASME Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve be set at or (continued)

PERRY - UNIT 1 B 3.4-19 Revision No. 7

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS The successful performance of the S/RVs tested provides reasonable assurance that the remaining installed S/RVs will perform in a similar fashion. After the S/RVs are replaced, the power-operated actuator of all 19 S/RVs will be uncoupled from the S/RV stem, and cycled to ensure proper operation of the control circuit and actuator. Following cycling, the power-operated actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each S/RV will properly perform its intended function. If the valve actuator fails to operate due only to the'failure of the solenoid but is capable of opening the valve on overpressure, the'safety function of the S/RV is considered OPERABLE.

When removing and replacing the S/RVs, Foreign Material Exclusion controls will be in place to minimize the potential for unwanted materials from entering into any S/RV opening or the piping discharge lines.

SR 3.4.4.2 and the LOGIC SYSTEM FUNCTIONAL TEST performed in SR 3.3.6.4.4 overlap this surveillance-to provide complete testing of the assumed safety function.

The 24 months on a STAGGERED TEST BASIS Frequency ensures that each solenoid for each. S/RV is alternately tested. The 24 month Frequency was developed based on the .S/RV tests required by the ASME Code (Ref. 5). The 24 month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

REFERENCES 1. ASME, Boiler and Pressure Vessel Code,Section III.

2. USAR, Chapter 15, Appendix 15B.

3. USAR, Section 15.

4. NRC Safety Evaluation to NEDC-31753P, March 8, 1993.

5. ASME Code for Operation and Maintenance of Nuclear Power Plants.

PERRY - UNIT 1 B 3.4-22 Revision No. 7

RCS Operational LEAKAGE B 3.4.5 BASES (continued)

APPLICABLE The allowable RCS operational LEAKAGE limits are based on SAFETY ANALYSES the predicted and experimentally observed behavior of pipe cracKs. The normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.

The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows leak rates of hundreds of gallons per minute will precede crack instability (Ref. 6).

The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.

No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell floor drain sump capacity.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material degradation. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

(continued)

PERRY - UNIT 1 B 3.4-24 Revision No. 7

RCS PIV Leakage B 3.4.6 BASES BACKGROUND c. High Pressure Core Spray System; (continued)

d. Reactor Core Isolation Cooling System; and

e. Standby Liquid Control System.

The PIVs are listed in Reference 6.

APPLICABLE Reference 5 evaluated various PIV configurations, leakage SAFETY ANALYSES testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.

PIV leakage is not considered in any Design Basis Accident analyses. This Specification provides for monitoring the condition of the RCPB to detect PIV degradation that has the Dotential to cause a LOCA outside of containment. RCS PIV eakage satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO RCS PIV leakage is leakage into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken. Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.

The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm.

Reference 4 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential). The observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one-half power.

(continued)

PERRY - UNIT 1 B 3.4-29 Revision No. 7

RCS PIV Leakage B 3.4.6 BASES SURVEILLANCE SR 3.4.6.1 (continued)

REQUIREMENTS The Frequency required by the Inservice Testing Program is within the ASME Code Frequency requirement.

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. 10 CFR 50, Appendix A, GDC 55.

4. ASME Code for Operation and Maintenance of Nuclear Power Plants. I

5. NUREG-0677, "The Probability of Intersystem LOCA:

Impact Due to Leak Testing and Operational Changes,"

May 1980.

6. PNPP - Unit 1, Inservice Test Program.

PERRY - UNIT 1 B 3.4-32 Revision No. 7

RCS Leakage Detection Instrumentation B 3.4.7 BASES BACKGROUND Larger changes in LEAKAGE rates are detected in (continued) proportionally shorter times (Ref. 3). Condensate from the two upper drywell air coolers is routed to the drywell floor drain sump and is monitored by a flow transmitter that provides indications and alarms in the control room. This upper drywell air cooler condensate flow rate monitoring system serves as an added-qualitative indicator, but not quantifier, of RCS unidentified LEAKAGE.

APPLICABLE A threat of significant compromise to the RCPB exists if the SAFETY ANALYSES barrier contains a crack that is large enough to propagate rapidly. LEAKAGE rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 4 and 5). Each of the leakage detection systems inside the drywell is designed with the capability of detecting LEAKAGE less than the established LEAKAGE rate limits. The systems either provide appropriate alarm of excess LEAKAGE in the control room, or they are monitored at appropriate intervals to identify excess LEAKAGE.

Identification of the LEAKAGE allows the operators to evaluate the significance of the indicated LEAKAGE and, if necessary, shut down the reactor. for further investigation and corrective action. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 6).

Therefore, these actions provide adequate response before a significant break in the RCPB can occur.

RCS leakage detection instrumentation satisfies Criterion I of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The drywell floor drain sump monitoring system is required to quantify the unidentified LEAKAGE from the RCS. Thus, for the system to be considered OPERABLE, one of the two automatic methods of determining floor drain sump in leakage must be OPERABLE. The other monitoring systems provide early alarms to the operators so closer examination of other detection systems will be made to determine the extent of any corrective action that may be required. With the leakage detection systems inoperable, monitoring for LEAKAGE in the RCPB is degraded.

(conti nued)

PERRY - UNIT I B 3.4-35 Revision No. 7

RCS Specific Activity B 3.4.8 BASES APPLICABLE The limits on specific activity are values from a parametric SAFETY ANALYSES evaluation of typical site locations. These limits are (continued) conservative because the evaluation considered more restrictive parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.

RCS specific activity satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

ECO The specific iodine activity is limited to

0.2 p.Ci/gm DOSE EQUIVALENT 1-131. These limits ensure the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the 10 CFR 100 limits.

APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.

In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced.

ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT 1-131 limit, but is

4.0 ýiCi/gm, samples must be analyzed for DOSE EQUIVALENT 1-131 at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In addition, the specific activity must be restored to the LCO limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes or crud bursts) to be cleaned up with the normal processing systems.

(continued)

PERRY - UNIT I B 3.4-41 Revision No. 7

RHR Shutdown Cooling System-Hot Shutdown B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat removal is in preparation for performing maintenance operations, or for keeping the reactor in the Hot Shutdown condition.

The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal.

Each loop consists of a motor driven pump, two heat exchangers in series, and associated piping and valves.

Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cool ed by circulation through the respective heat exchangers, to the reactor via separate feedwater lines or to the reactor via the LPCI injection path. The RHR heat exchangers transfer heat to the Emergency Service Water System (LCO 3.7.1, "Emergency Service Water (ESW)

System-Divisions 1 and 2").

APPLICABLE Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety-function that must be accomplished or core damage could result. Although-the RHR Shutdown Cooling System does not meet a specific criterion of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132), it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An RHR shutdown cooling subsystem is OPERABLE when the RHR pump, two heat exchangers in series, associated piping, valves, and instrumentation and controls are OPERABLE.

Additionally, each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote (continued)

PERRY - UNIT 1 B 3.4-44 Revision No. 7

RHR Shutdown Cooling System-Cold Shutdown B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant at

200 0 F. This decay heat removal is in preparation for Berforming refueling or maintenance operations, or for eeping the reactor in the Cold Shutdown condition.

The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal.

Each loop consists of a motor driven pump, two heat exchangers in series, and associated piping and valves.

Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cool ed by circulation through the respective heat exchangers, to the reactor via separate feedwater lines or to the reactor via the LPCI injection path.

APPLICABLE Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. Although the RHR Shutdown Cooling System does not meet a specific criterion of the NRC Final Policy Statement on Technical Specificatioh Improvements (58 FR 39132), it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem is OPERABLE when the RHR pump, two heat exchangers in series, associated piping, valves, and instrumentation and controls are OPERABLE.

Additionally each RHR shutdown cooling subsystem is considered OPERABLE if it can be manually (continued)

PERRY - UNIT 1 B 3.4-49 Revision No. 7

RCS P/T Limits B 3.4.11 BASES APPLICABLE limits related to the P/T limits. Rather, theP/T limits SAFETY ANALYSES are acceptance limits themselves since they preclude (continued) operation in an unanalyzed condition.

RCS P/T limits satisfy Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The elements of this LCO are:

a. RCS pressure, temperature, and heatup or cooldown rate are within limits during RCS heatup, cooldown, and inservice leak and hydrostatic testing.

b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is within limits during recirculation Sump startup, and during increases in THERMAL POWER or oop flow while operating at low THERMAL POWER or loop flow.

c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel meets the limit during recirculation pump startup, and during increases in THERMAL POWER or oop flow while operating at low THERMAL POWER or loop flow.

-d. RCS pressure and temperature are within the criticality limits prior'to control rod withdrawal for the purpose of achieving criticality.

e. The reactor vessel flange and the head flange temperatures are within limits when tensioning the reactor vessel head bolting studs.

These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.

The rate of change of temperature limits control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and inservice leak and hydrostatic testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.

(continued)

PERRY - UNIT 1 B 3.4-56 Revision No. 7

Reactor Steam Dome Pressure B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is a so an assumed initial condition of Design Basis Accidents (DBAs) and transients.

APPLICABLE The reactor steam dome pressure of

1045 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").

Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The specified reactor steam dome pressure limit of

< 1045 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis.

Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events which may challenge the overpressure limits are possible.

(continued)

PERRY - UNIT 1 B 3.4-64 Revision No. 7

ECCS-Operating B 3.5.1 BASES (continued)

APPLICABLE The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5, 6, and 7. The required analyses and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of these analyses are described in Reference 9.

This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a LOCA assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is

2200°F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from zirconium water reaction is

0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 11.

For a LOCA, HPCS System failure is the most severe failure.

One ADS valve failure is analyzed as a limiting single failure for events'requiring ADS operation. The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.5-4 Revision No. 7

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 (continued)

REQUIREMENTS Method 1:

Manual actuation of the ADS valve with verification by the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g., tailpipe temperature or acoustic monitoring). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow is achieved to perform this test. Adequate pressure at which this test is performed is consistent with the pressure recommended by the valve manufacturer.

Method 2:

The required population of ADS S/RVs tested will be stroked in the relief mode during testing at a qualified offsite facility to verify proper operation of the S/RV.

The successful performance of the S/RVs tested provides reasonable assurance that the remaining installed S/RVs will perform in a similar fashion. After the S/RVs are replaced, the power-operated actuator of all 19 S/RVs will be uncoupled from the S/RV stem, and cycled to ensure proper operation of the control circuit and actuator.

ollowing cycling, the power-operated actuafor is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each S/RV will properly perform its intended function. If the valve actuator fails to operate due only to the failure of the solenoid but is capable of opening the valve on overpressure, the safety mode of the S/RV is considered OPERABLE.

When removing and replacing the S/RVs, Foreign Material Exclusion controls will be in place to minimize the potential for unwanted materials from entering into any S/RV opening or the piping discharge lines.

(continued)

PERRY - UNIT 1 B 3.5-13 Revision No. 7

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 (continued)

REQUIREMENTS SR 3.5.1.6 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1.6 overlap this Surveillance to provide complete testing of the safety function. The Frequency of 24 months on a STAGGERED TEST BASIS Frequency ensures that both solenoids for each ADS valve power-operated actuator are alternately tested. The Frequency of the required-power-operated actuator testing is based on the tests required by the ASME Code as implemented by the Inservice Testing Program of Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.8 This SR ensures that the ECCS RESPONSE TIMES are within limits for each of the ECCS injection and spray subsystems.

This SR is modified by a note which identifies that the associated ECCS actuation instrumentation is not required to be response time tested. Response time testing of the remaining subsystem components is required. This is supported by Reference 15. Response time testing acceptance criteria are included in Reference 16.

ECCS RESPONSE TIME tests are conducted every 24 months. The 24 month Frequency is based on the need to perform this (continued)

PERRY - UNIT 1 B 3.5-13a Revision No. 7

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.8 (continued)

REQUIREMENTS Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

REFERENCES 1. USAR, Section 6.3.2.2.3.

2. USAR, Section 6.3.2.2.4.

3. USAR, Section 6.3.2.2.1.

4. USAR, Section 6.3.2.2.2.

5. USAR, Section 15.6.6.

6. USAR, Section 15.6.4.

7. USAR, Section 15.6.5.

8. 10 CFR 50, Appendix K.

9. USAR, Section 6.3.3.

10. 10 CFR 50.46.

11. USAR, Section 6.3.3.3.

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

13. USAR, Section 5.2.2.4.1.

14. ASME Code for Operation and Maintenance of Nuclear Power Plants.

15. NEDO'32291, "System Analyses for Elimination of Selected Response Time Testing Requirements,"

January 1994.

16. USAR, Section 6.3, Table 6.3-1.

PERRY - UNIT 1 B 3.5-14 IRevision No. 7

ECCS-Shutdown B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.2 ECCS-Shutdown BASES BACKGROUND A description of the High Pressure Core Spray (HPCS) System, Low Pressure Core Spray (LPCS) System, and, low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System is provided in the Bases for LCO 3.5.1, "ECCS-Operating.

APPLICABLE ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated loss of coolant accident (LOCA). The long term cooling analysis following a design basis LOCA (Ref. 1) demonstrates that only one ECCS injection/spray subsystem is required, post LOCA, to maintain the peak cladding temperature below the allowable limit. It is reasonable to assume, based on engineering judgement, that while in MODES 4 and 5, one ECCS subsystem can maintain adequate reactor vessel water level. To provide redundancy, a minimum of two ECCS subsystems are required to be OPERABLE in MODES 4 and 5.

The ECCS satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Two ECCS injection/spray subsystems are required to be OPERABLE. The ECCS injection/s pray subsystems are defined as the three LPCI subsystems, the LPCS System, and the HPCS System. The ECCS injection/spray subsystems are further divided into the following groups:

a) The low pressure ECCS injection/spray subsystems are the LPCS System and the three LPCI subsystems; b) The ECCS injection subsystems are the three LPCl subsystems; and c) The ECCS spray subsystems are the HPCS System and the LPCS System.

One LPCI subsystem (A or B) may be considered OPERABLE during alignment and operation for decay heat removal in MODE 4 or 5, if capable of being manually realigned (remote or local) to the LPCI mode and is not otherwise inoperable.

Because of low pressure and low temperature conditions in MODES 4 and 5, sufficient time will be available to manually align and initiate LPCI subsystem operation to provide core cooling prior to postulated uncovering of the fuel.

(continued)

PERRY - UNIT 1 B 3.5-15 Revision No. 7

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow line, (continued) which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the system is included in the Technical Specifications as required by the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event.

APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig

-since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure

150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the ECCS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system, and the (continued)

PERRY - UNIT 1 B 3.5-22 Revision No. 7

Primary Containment-Operating B 3.6.1.1 BASES BACKGROUND e. The containment leakage rates are in compliance with (continued) the requirements of Specification 3.6.1.1 and Specification 3.6.1.3;

f. The suppression pool is OPERABLE; and

g. The sealing mechanism associated with each primary containment penetration, e.g., welds, bellows, or.

0-rings, is functional.

This Specification ensures that the performance of the primary containment, in the event of a DBA, meets the assumptions used in the safety analyses of References 1 and 2. SR 3.6.1.1.1 leakage rate requirements are in conformance with 10 CFR 50, Appendix J, Option B (Ref. 3),

as modified by approved exemptions.

APPLICABLE The safety design basis for the primary containment is that SAFETY ANALYSES it must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage.

Analytical methods and assumptions involving the primary containment are presented in References 1 and 2. The safety analyses assume a mechanistic fission product release following a DBA, based on NUREG 1465, which forms the basis for determination of offsite doses. The fission product release is, in turn, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded.

Primary containment satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.6-2 Revision No. 7

Primary Containment Air Locks B 3.6.1.2 BASES BACKGROUND DBA. Not maintaining air lock integrity or leak tightness (continued) may result in a leakage rate in excess of that assumed in the unit safety analysis.

APPLICABLE The DBA that postulates the maximum release of radioactive SAFETY ANALYSES material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (L ) of 0.20%

by weight of the containment and drywell air per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at the calculated maximum peak containment pressure (Pa) of 7.80 psig. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.

Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the intermediate building.

Primary containment air locks satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit the air locks. However, it was determined that a Specification should remain in place per Criterion 4 to address operations with the potential for draining the reactor vessel (OPDRVs) and fuel handling accidents.

Criterion 3 would apply if dose calculations are revised to credit the air locks during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO As part of the primary containment, the air lock's safety function is related to control of containment leakage rates following a DBA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

The primary containment air locks are required to be OPERABLE. For each air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock (continued)

PERRY - UNIT I B 3.6-8 Revision No. 7

PCIVs B 3.6.1.3 BASES (continued)

APPLICABLE The PCIVs LCO was derived from the assumptions related SAFETY ANALYSES to minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during major accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment. Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO.

The DBAs that result in a release of radioactive material for which the consequences are mitigated by crediting PCIVs, are a loss of coolant accident (LOCA), and a main steam line break (MSLB) (Refs. 1 and 2). In the analysis for each of these accidents, it is assumed that PCIVs are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through PCIVs are minimized. Of the events analyzed in Reference 1, the LOCA is the most limiting event due to radiological consequences. It is assumed that the primary containment is isolated such that release of fission products to the environment is controlled.

The inboard 42 inch purge supply and exhaust valves may be.

unable to close in the environment following a LOCA.

Therefore, each of the purge valves is required to remain sealed closed during MODES 1, 2, and 3.

The outboard MSIVs must have a safety related air source availWble for use following an accident in order fbr leakage to be within limits. Therefore, anytime that this air source from the "B" train of P57 Safety Related Air System is not available, the outboard MSIVs may not be able to maintain valve leakage within the specified limits.

PCIVs satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit the primary containment.

However, it was determined that Specifications should remain in place per Criterion 4 to address operations with the potential for draining the reactor vessel (OPDRVs) and fuel andling accidents. Criterion 3 would apply if dose calculations are revised to credit the primary containment during handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

(continued)

PERRY - UNIT 1 B 3.6-18 Revision No. 7

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) the inaccessibility of the isolation devices and the existence of other administrative controls ensuring that isolation device misalignment is an unlikely possibility.

Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment; once they have been verified to be in the proper position" is low.

B.1 With one or more penetration flow paths with two PCIVs inoperable except for inoperability due to leakage not within a limit specified in an SR for this Specification, ei~ther the inoperable PCIVs must be restored*to OPERABLE status or the affected penetration flow path must be

isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed manual valve, a closed and de-activated automatic valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.

C.1 With the secondary containment bypass leakage rate, hydrostatic leakage rate, or MSIV leakage rate not within limits, the assumptions of the safety analysis may not be met. Therefore, the leakage rate must be restored to within limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of a closedmanual valve, a closed and de-activated automatic valve, or blind flange. When a penetration is isolated, the leakage rate for the isolation penetration is assumed to be the actual pathway leakage rate through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage rate of the two (continued)

PERRY - UNIT I B 3.6-22 Revision No. 7

PCIVs B 3.6.1.3 BASES ACTIONS D.1, D.2, and D.3 (continued)

MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and the existence of other administrative controls ensuring that isolation device misalignment is an unlikely possibility.

Required Action D.2 is modified by two Notes. Note 1

,applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertentl y repositioned. Therefore, the probability of misalignment, once they-have been verified to be in proper position, is low.

For each primary containment purge valve with resilient

, ,seals that is isolated in accordance with 'Requi'red Action D.1, SR 3.6.1.3.6 must be performed at least, once every'92 days. This provides assurance that degradation of the resilient seal is detected and confirms that the leakage rate of the primary containment purge valve does not increase during the time the penetration is isolated. The normal Frequency for SR 3.6.1.3.6 is 184 days. Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often.

Therefore, a Frequency of once per 92 days was chosen and has been shown acceptable based on operating experience.

E.1 and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from, full power conditions in an orderly manner and without challenging plant systems.

(continued)

PERRY - UNIT 1 B 3.6-24 'Revision No. 7

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.2 (continued)

REQUIREMENT The SR is modified by a Note (Note 2) stating that the SR is not required to be met when the purge valves are open for the stated reasons. The Note states that these va ves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances or special testing on the purge system (e.g., testing of the containment and drywell ventilation radiation monitors) that require the valves to be open. These primary containment purge valves are capabl'e of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other PCIV requirements.,

SR 3.6.1.3.3 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside rimary containment, drywell, and steam tunnel and not ocked, sealed, or otherwise secured, and is required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits. This SR does not require any testing or isolation device manipulation. Rather, it involves verification that those devices outside primary containment, "drywell, and 'team tunnel, and capable of being"'

mispositioned, are in the correct position. Since.

verification of isolation device position for devices outside primary containment, drywell, and steam tunnel is relatively easy, the 31 day Frequency was chosen to provide added assurance that the devices are in the correct

ýositions. This SR does not apply to valves that are ocked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Three Notes are added to this SR. Note 1 provides an exception to meeting this SR in MODES other than MODES 1, 2, and 3. When not operating in MODES 1, 2, or 3, the primary containment boundary, including verification that required penetration flow paths are isolated, is addressed by LCO 3.6.1.10, "Primary Containment-Shutdown" (SR 3.6.1.10.1).

The second Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1', 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these isolation devices, once they have been (continued)

PERRY - UNIT I B 3.6-27 Revision No. 7

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 (continued)

REQUIREMENT verified to be in the proper position, is low. A third Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open.

SR 3.6.1.3.4 This SR verifies that each primary containment isolation manual valve and blind flange located inside primary containment, drywell, or steam tunnel, and not locked, sealed, or otherwise secured and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment, drywell, or steam tunnel, the Frequency of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is appropriate since these devices are operated under administrative controls and the probability of their'misalignment is low. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or

'securing. l-Four Notes are added to this SR. Note 1 provides an exception to meeting this SR in MODES other than MODES 1, 2, and 3. When not operating in MODES 1, 2, or 3, the primary containment boundary, including verification that required penetration flow paths are isolated, is addressed by LCO 3.6.1.10, "Primary Containment- Shutdown" (SR 3.6.1.10.1).

The second Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these isolation devices, once they have been verified to be in their proper position, is low. A third Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.

A fourth Note addresses removal of the Inclined Fuel Transfer System (IFTS) blind flange in MODES 1, 2, and 3 for up to 60 days per cycle. The 60 days per operating cycle is (continued)

PERRY - UNIT 1 B 3.6-28 Revision No. 7

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.10 (continued)

REQUIREMENTS A Note is added to this SR which states that these valves are only required to meet this leakage rate limit in MODES 1, 2, and 3. In other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage rate limits are not required.

SR 3.6.1.3.11 Surveillance of hydrostatically tested lines provides assurance that the calculation assumptions of Reference 2 is met. The combined leakage rate must be (continued)

PERRY - UNIT I B 3.6-31a Revision No. 7

Primary Containment Pressure B 3.6.1.4 BASES APPLICABLE containment spray event does not exceed the design value of SAFETY ANALYSES -0.8 psid.

(continued)

Primary containment pressure satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO A limitation on the primary to secondary containment differential pressure of Ž -0.1 and

1.0 psid is required to ensure that primary containment initial conditions are consistent with the initial safety analyses assumptions so that containment pressures remain within design values during a LOCA and the design value of containment negative pressure is not exceeded during an inadvertent operation of containment sprays.

APPLICABILITY In MODES 1, 2, and 3, a DBA could. result in a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining primary containment pressure within limits is not required in MODE 4 or 5.

ACTIONS A.1 When primary to secondary containment differential pressure is not within the limits of the LCO, differential pressure must be restored to within limits within 1 hour: The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment-Operating," which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.1 and B.2 If primary to secondary containment differential pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in (continued)

PERRY - UNIT I B 3.6-34 Revision No. 7

Primary Containment Air Temperature B 3.6.1.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.5 Primary Containment Air Temperature BASES BACKGROUND Heat loads from the drywell, as well as piping and equipment in the primary containment, add energy to the primary containment airspace and raise airspace temperature.

Coolers included in the unit design remove this energy and maintain an appropriate average temperature inside primary containment. The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). This primary containment air temperature limit is an initial condition input for the Reference 1 safety analyses.

APPLICABLE Primary containment performance for the DBA is evaluated for SAFETY ANALYSES a entire spectrum of break sizes for postulated loss of coolant accidents (LOCAs) inside containment (Ref. 1).

Among the inputs to the design basis analysis is the initial primary containment average air temperature. Analyses assume an initial average primary containment air temperature of 950 F. Maintaining the expected initial conditions ensures that safety analyses remain valid and ensures that the peak LOCA primary containment temperature does not exceed the maximum allowable temperature of 185 0F (Ref. 1). Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primarycontainment, and needed to mitigate the effects of a DBA, is designed to operate and be capable of operating under environmental conditions expected for the accident.

Primary containment air temperature satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO With an initial primary containment average air temperature less than or equal to the LCO temperature limit, the peak accident temperature is maintained below the primary containment design temperature. As a result, the ability of primary containment to perform its design function is ensured.

(continued)

PERRY - UNIT 1 B 3.6-36 Revision No. 7

LLS Valves B 3.6.1.6 BASES APPLICABLE specified, all six LLS S/RVs do not operate in any DBA SAFETY ANALYSES analysis.

(continued)

LLS valves satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Six LLS valves are required to be OPERABLE to satisfy the assumptions of the safety analysis (Ref. 2). The requirements of this LCO are applicable to the mechanical an electrical/pneumatic capability of the LLS valves to function for controlling the opening and closing of the S/RVs.

APPLICABILITY In MODES 1, 2, and 3, an event could cause pressurization of the reactor and opening of S/RVs. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining the LLS valves OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one LLS valve inoperable, the remaining OPERABLE LLS valves are adequate to perform the designed function.

However, the overall reliability is reduced. The 14 day Completion Time takes into account the redundant capability afforded by the remaining LLS S/RVs and the low-probability of an event in which the remaining LLS S/RV capability would be inadequate.

B.1 and B.2 If the inoperable LLS valve cannot be restored to OPERABLE status within the required Completion Time or if two or more LLS valves are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PERRY - UNIT I B 3.6-40 Revision No. 7

LLS Valves B 3.6.1.6 BASES (continued)

SURVEILLANCE SR 3.6.1,.6.1 REQUIREMENTS Method 2:

The required population of LLS S/RVs tested will be stroked in the relief mode during testing at a qualified offsite facility to verify proper operation of the S/RV.

The successful performance of the 'S/RVs tested provides reasonable assurance that the remaining installed S/RVs will perform in a similar fashion. After the S/RVs are replaced, the power-operated actuator of all 19 S/RVs will be uncoupled from the S/RV stem, and cycled to ensure proper operation of the control circuit and actuator. Following cycling, the power-operated actuator is recoupled.and the proper positioning of the stem nut is independently verified. This verifies that each S/RV will properly perform its intended function. If the valve actuator fails to operate due only to the failure of the solenoid but is capable of opening the valve on overpressure, the safety mode of the S/RV is considered OPERABLE.

When removing and replacing the S/RVs,'Foreign Material Exclusion controls will be in place to minimize the potential for unwanted materials from entering into any S/RV opening or the piping discharge lines.

The STAGGERED TEST BASIS Frequency ensures that both solenoids for each LLS valve power-operated actuator are alternately tested. The 24 Month Frequency of the required power-operated actuator testing is based on the tests required by the ASME Code (Ref. 3) as implemented by the Inservice Testing Program of Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

PERRY - UNIT 1 B 3.6-41a Revision No. 7

LLS Valves B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.2 REQUIREMENT (continued) The LLS function S/RVs are required to actuate automatically upon receipt of specific initiation signal~s. A functional test is performed to verify that the mechanical portions (i.e., solenoids) of the automatic LLS function operate as designed when initiated either by an actual or simulated automatic initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.4.4 overlaps this SR to provide complete testing of the safety function.

The 24 month Frequency is based on the need to perform this Surveillance during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is based on operating experience, and is consistent with a typical industry refueling cycle.

This SR is modified by a Note that excludes valve actuation.

This prevents a reactor pressure vessel pressure blowdown.

REFERENCES 1. GESSAR-II, Appendix 3B, Attachment A, Section 3BA.8.

2. USAR, Section 7.6.1.11.

3. ASME Code for Operation and Maintenance of Nuclear Power Plants.

PERRY - UNIT 1 B 3.6-42 Revision No. 7

RHR Containment Spray System B 3.6.1.7 BASES APPLICABLE with containment spray operation the primary containment SAFETY ANALYSES pressure remains within design limits.

(continued)

The RHR Containment Spray System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO In the event of a Design Basis Accident (DBA), a minimum of one RHR containment spray subsystem is required to mitigate potential drywell bypass leakage paths and maintain the primary containment peak pressure below design limits, and provide for containment atmosphere dose reduction. To ensure that these requirements are met, two RHR containment spray subsystems mustbe OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR containment spray subsystem is OPERABLE when the RHR pump, two heat exchangers in series, and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR containment spray subsystems OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one RHR containment spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR containment spray subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a. single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time was chosen in light of the redundant RHR containment spray capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

(continued)

PERRY - UNIT 1 B 3.6-44 Revision No. 7

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.1 (continued)

REQUIREMENTS A Note has been added to this SR that allows RHR containment spray subsystems to be considered OPERABLE during alignment and operation for decay heat removal with reactor steam pressure less than the RHR cut in permissive pressure in MODE 3, if capable of being manually realigned (remote or local) and not otherwise inoperable. This allows operation in the RHR shutdown cooling mode during MODE 3 if necessary.

SR 3.6.1.7.2 Verifying each RHR pump develops a flow rate Ž 5250 gpm with flow through the associated heat exchangers ensures that, pump performance has not degraded below the required flow rate during the cycle. It is tested in the suppression pool cooling mode to demonstrate pump OPERABILITY without spraying down equipment in primary containment. Flow is a normal test of centrifugal pump performance required by the ASME Code (Ref. 2). This test confirms one point on the pump design curve and is indicative of overall performance.

Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.1.7.3 This SR verifies that each RHR containment spray subsystem automatic valve actuates to its correct position upon receipt of an actual or simulated automatic initiation signal. Actual spray initiation is not required to meet this SR. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.3.5 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the cOnditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor.at power. The 24 month Frequency is based on (continued)

PERRY - UNIT 1 B 3.6-46 Revision No. 7

FWLCS B 3.6.1.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.8 Feedwater Leakage Control System (FWLCS)

BASES BACKGROUND The FWLCS supplements the isolation function of the motor-operated primary containment isolation valves (PCIVs) in the feedwater lines that also penetrate the secondary containment. The motor-operated valve bonnets and internal seating volumes are sealed by water from the FWLCS to prevent fission products leaking past the isolation valves and bypassing the secondary containment after a Design Basis Accident (DBA) loss of coolant accident (LOCA).

The FWLCS consists of two independent, manually initiated subsystems, either of which is capable of preventing fission product leakage from the containment post LOCA. Each subsystem uses an ECCS water leg pump and a header which provides sealing water to pressurize the feedwater motor-operated valve bonnets and internal seating volumes.

APPLICABLE The analyses described in Reference 1 provide the evaluation SAFETY ANALYSES of offsite dose consequences during accident conditions.

For the Feedwater piping, a water seal would be maintained by the feedwater system outside the containment during the initial hour after a LOCA. That is, if the feedwater system becomes inoperable during the rapid vessel depressurization following a LOCA, the water within the feedwater piping will begin to flash into the drywell. A water seal would remain for a ýufficient length of time following the accident until the operator remotely isolates the motor-operated valve.

Thus, a water seal would exist in the piping beyond the motor-operated valve. Initiation of the FWLCS then provides the water seal for the remainder of the 30 days of the accident. The offsite dose consequence calculations include consideration of any FWLCS water leakage past the seats of the gate valves.

The FWLCS satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Two FWLCS subsystems must be OPERABLE such that in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. A FWLCS subsystem is OPERABLE when all necessary components are available to supply each feedwater motor-operated valve with sufficient sealing (continued)

PERRY - UNIT 1 B 3.6-48 Revision No. 7

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.3 (continued)

REQUIREMENTS operating experience, and is consistent with a typical industry refueling cycle.

SR 3.6.1.7.4 This Surveillance is performed following maintenance which could result' in nozzle blockage using an inspection of the nozzle or an air or smoke flow test to verify that the. spray nozzles are not obstructed and that flow will be provided when required. The frequency is adequate to detect degradation in performance due to the passive nozzle design and its normally dry state and has been shown to be acceptable through operating experience.

REFERENCES 1. USAR, Section 6.2.1.1.5.

2. ASME Code for Operation and Maintenance of Nuclear Power Plants.

PERRY - UNIT 1 B 3.6-47 Revision No. 7

Primary Containment-Shutdown B 3.6.1.10 BASES BACKGROUND This Specification ensures that the performance of the (continued) primary containment, in the event of a fuel handling accident involving handling of recently irradiated fuel, or reactor vessel draindown, provides an acceptable leakage barrier to contain fission products, thereby minimizing offsite doses.

APPLICABLE The safety design basis for the primary containment is that SAFETY ANALYSES it contain fission products to limit doses at the site boundary to within limits. The primary containment OPERABILITY in conjunction with the automatic closure of selected OPERABLE containment isolation valves (LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," and LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation"), assures a leak tight fission product barrier.

The fuel handling accident calculations do not credit the primary or secondary containment; all gaseous fission roducts released from the water pool over the damaged fuel undles are assumed to be immediately discharged directly to the environment (Ref. 2).

During MODES 4 and 5, there are no accident analyses that credit the primary containment. However, it was determined that Specifications should remain in place per Criterion 4 of the NRC Final Policy Statement on echnical Specification Improvements (58 FR 39132) to address operations with the potential for draining the reactor vessel (OPDRVs) and fuel handling accidents. Cri'terion 3 of the NRC Policy Statement would apply if dose calculations are revised to credit the primary containment during handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

LCO Primary containment OPERABILITY is maintained by providing a contained volume to limit fission product escape following a fuel handling accident involving handling of recently irradiated fuel, or an unanticipated water level excursion.

Compliance with this LCO will ensure a primary containment configuration, including the equipment (continued)

PERRY - UNIT 1 B 3.6-56 Revision No. 7

Primary Containment-Shutdown B 3.6.1.10 BASES LCO hatch, that is structurally sound and that will limit (continued) leakage to those leakage rates assumed in the safety analysis. Since offsite dose analyses conservatively assume LOCA leakage pathways and rates, the isolation and closure times of automatic containment isolation valves supports an OPERABLE primary containment during shutdown conditions.

Furthermore, normal operation of the inclined fuel transfer system (IFTS) without the IFTS blind flange installed is considered acceptable for meeting Primary Containment-Shutdown OPERABILITY.

Leakage rates specified for the primary containment and air locks, addressed in LCO 3.6.1.1 and LCO 3.6.1.2 are not directly applicable during the shutdown conditions addressed in this LCO.

APPLICABILITY In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining an OPERABLE primary containment in MODE 4 or 5 to ensure a control volume, is only required during situations for which significant releases of radioactive material can be postulated; such as during movement of recently irradiated fuel assemblies in the primary containment, or during operations with a potential for draining the reactor vessel (OPDRVs). Due to radioactive decay, handling of fuel only requires OPERABILITY of Primary Containment when the fuel being handled is recently irradiated, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Although this Function retains APPLICABILITY during "movement of recently irradiated fuel", which could be interpreted to permit fuel handling before 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of radiological decay if certain buildings and filtration systems are OPERABLE, this is not the case. Fuel handling during that period is prohibited since no dose calculations exist to address a fuel handling accident within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the reactor core is sub-critical (Ref. 2).

OPDRVs assume that one or more fuel assemblies are loaded into the core. Therefore, if the fuel is fully off-loaded from the reactor vessel, the primary containment is not required to be OPERABLE.

(continued)

PERRY - UNIT 1 B 3.6-57 Revision No. 7

Containment Vacuum Breakers B 3.6.1.11 BASES APPLICABLE b. Inadvertent actuation of both primary RHR containment SAFETY ANALYSES spray subsystems during normal operation:

(continued)

The results of these two cases show that the containment vacuum breakers, with an opening setpoint of 0.1 psid, are capable of maintaining the differential pressure within design limits.

The containment vacuum breakers satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit the containment. However, it was determined that Specifications should remain in place per Criterion 4 to address operations with the potential for draining the reactor vessel (OPDRVs) and fuel handling accidents.

Criterion 3 would apply if dose calculations are revised to credit the containment during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO Only 3 of the 4 vacuum breakers must be OPERABLE for opening. All containment vacuum breakers, however, are required to be closed (except during testing or when the vacuum breakers are performing their intended design function). The vacuum breaker OPERABILITY requirement provides assurance that the containment negative differential pressure remains below the design value. The requirement that the vacuum breakers be closed ensures that there is no excessive bypasS leakage should a LOCA occur.

APPLICABILITY In MODES 1, 2, and 3, the RHR Containment Spray System is required to be OPERABLE to mitigate the effects of a DBA.

Excessive negative pressure inside the containment could occur due to inadvertent actuation of this system. The vacuum breakers, therefore, are required to be OPERABLE in MODES 1, 2, and 3, to mitigate the effects of inadvertent actuation of the RHR Containment Spray System.

In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES: therefore, maintaining containment vacuum breakers OPERABLE is not required in MODE 4 or 5.

(conti nued)

PERRY - UNIT 1 B 3.6-60 Revision No. 7

Containment Humidity Control B 3.6.1.12 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.12 Containment Humidity Control BASES BACKGROUND Primary containment temperature and humidity are initial condition inputs into the analysis that evaluates the initiation of RHR containment spray during normal plant operation. A curve was determined of initial primary containment average temperature and humidity which would maintain peak vacuum inside containment

0.72 psi (design is

0.80 psi) during the spray initiation event. This curve then determines the containment average temperature-to-humidity combinations that are acceptable whenever the conditions exist for the inadvertent containment spray initiation event (whenever the primary containment leak tight barrier has been established).

APPLICABLE Reference 1 contains the results of analyses that SAFETY ANALYSES predict the primary containment pressure response for the inadvertent initiation of the RHR Containment Spray System.

The initial containment average temperature and relative humidity have an effect on the results of this analyses. As long as the average temperature and relative humidity is maintained within the limits of Figure B 3.6.1.12-1, the design can adequately perform in the inadvertent containment spray event.

There is no need to monitor the containment average temperature-to-relative humidity when the primary containment is not OPERABLE (i.e., has large enough openings such that a vacuum would not be created during an RHR containment spray event).

The containment relative humidity satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident, analyses that credit the containment. However, it was determined that Specifications should remain in place per Criterion 4 to address OPDRVs and fuel handling accidents. Criterion 3 would apply if dose calculations are revised to credit the containment during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(continued)

PERRY - UNIT 1 B 3.6-65 Revision No. 7

Suppression Pool Average Temperature B 3.6.2.1.

BASES APPLICABLE shutdown at a pool temperature of 110OF and vessel SAFETY ANALYSES depressurization at a pool temperature of 120OF are assumed (continued) for the Reference 2 analyses. The limit-of 105 0 F, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during plant testing.

Suppression pool average temperature satisfies Criteria 2 and 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO A limitation on the suppres.sion pool average temperature is required to assure that the primary containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated DBA or any transient resulting in heatup of the suppression pool. The LCO requirements are as follows:

a. Average temperature

95°F when THERMAL POWER is > 1%

RTP and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.

b. Average temperature

105 0 F when THERMAL POWER is > 1%

RTP and testing that adds heat to the suppression pool is being performed. This requirement ensures that the plant has testing flexibility, and was selected to provide margin below the 110OF limit at which reactor shutdown is required. When testing ends, temperature must be restored to

950F within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months according to Required Action A.2. Therefore, the time period that the temperature is > 95 0 F is short enough not to cause a significant increase in plant risk.

c. Average temperature

110OF when THERMAL POWER is

1%

RTP. This requirement ensures that the plant will be shut down at > 110 0 F. The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.

Note that when the reactor is producing power essentially equivalent to 1%RTP, heat input isapproximately equal to normal system heat losses.

(conti nued)

PERRY - UNIT 1 B 3.6-71 Revision No. 7

Please remove and discard page B 3 6-75a

Suppression Pool Water Level B 3.6.2.2 BASES BACKGROUND In order to account for positive drywell-to-containment (continued) differential pressures which affect indicated suppression 0ool water levels (but not volumes), a Suppression Pool evel Adjustment Table is contained in the Plant Data Book.

This table lists water level adjustments for various drywell-to-containment differential pressures. The table adjustment factors are used to modify the indicated suppression pool water level to account for the positive drywell-to-containment differential pressures. Negative differential pressures are not required to be adjusted since these differential pressures were directly accounted for in the short-term analyses.

The suppression pool volumes (and corresponding adjusted levels) satisfy criteria or constraints imposed by:

(1) maintaining a 2 foot minimum post-LOCA horizontal vent coverage to assure steam condensation/pressure suppression, and to maintain coverage over the RHR A Test Return line, (2) adequate ECCS pump NPSH, (3) adequate depth for vortex prevention, (4) adequate depth for minimum recirculation volume, and (5) minimizing hydrodynamic loads on submerged structures during SRV and horizontal vent steam discharges.

APPLICABLE Initial suppression.pool water level affects suppression SAFETY ANALYSES pool temperature response calculations, calculated drywell pressure during vent clearing for a DBA, calculated pool swell loads for a DBA LOCA, and calculated loads due to S/RV discharges. Suppression pool water level must be maintainedwithin the limits specified so that the safety analysis of Reference 1 remains valid.

Suppression pool water level satisfies Criteria 2 and 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The limits on suppression pool water level

(Ž 17 ft 9.5 inches and

18 ft 6 inches) are required to assure that the primary containment conditions assumed for the safety analyses are met. Either high or low water level limits were used in the analyses, depending upon which is conservative for a particular calculation. The required suppression pool water level readings depend upon the drywell-to-containment differential pressure. The levels correspond to Ž 17 ft 9.5 inches and

18 ft 6 inches for a (continued)

PERRY - UNIT 1 B 3.6-76 Revision No. 7

RHR Suppression Pool Cooling System B 3.6.2.3 BASES APPLICABLE The RHR Suppression Pool Cooling System satisfies SAFETY ANALYSES Criterion 3 of the NRC Final Policy Statement on Technical (continued) Specification Improvements (58 FR 39132).

LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool cooling subsystems must be OPERABLE.

Therefore, in the event of an accident, at least one subsystem is OPERABLE, assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when the RHR pump, two heat exchangers in series, and associated piping, valves, instrumentation, and controls are OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.

ACTIONS A.1 With one RHR suppression ,pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the-OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

(continued)

PERRY - UNIT 1 B 3.6-80 Revision No. 7

RHR Suppression Pool Cooling System B 3.6.2.3 BASES SURVEILLANCE SR 3.6.2.3.2 REQUIREMENTS (

(continued) Verifying each RHR pump develops a flow rate > 7100 gpm with flow through the associated heat exchanger to the suppression pool, ensures that pump performance has not degraded during the cycle. Flow is a normal test of centrifugal pump performance required by the ASME. Code (Ref. 2). This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failuresby indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

REFERENCES 1. USAR, Section 6.2.

2. ASME Code for Operation and Maintenance of Nuclear Power Plants.

PERRY - UNIT I B 3.6-82 Revision No..7

SPMU System B 3.6.2.4 BASES APPLICABLE volume of 144,292 ft 3 in the upper containment pool and the SAFETY ANALYSES suppression pool.

(continued)

The SPMU System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO During a DBA, a minimum of one SPMU subsystem is required to maintain peak suppression pool water temperature below the design limits (Ref. 1). To ensure that these requirements are met, two SPMU subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE, assuming the worst case single active failure.

The SPMU System is OPERABLE when the upper containment pool water temperature is

110 0 F, the piping is intact, and the system va ves are OPERABLE. Additionally, the combined water levels of the upper containment pool and the suppression pool must be within limits. When the suppression pool level is maintained 2.2 inches greater than required by LCO 3.6.2.2, "'Suppression Pool Water Level", the allowed upper containment pool water level limit is reduced to 22 ft 5 inches.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause heatup and pressurization of the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SPMU System OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 When the combined water level of the upper containment pool and suppression pool is not within limits, it is inadequate to ensure that the suppression pool heat sink capability matches the safety analysis assumptions. A sufficient quantity of water is necessary to ensure long term energy sink capabilities of the suppression pool and maintain water coverage over the uppermost horizontal vents. Loss of water volume has a relatively large impact on heat sink capability. Therefore, the combined water level of the upper containment pool and suppression pool must be restored to within limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is sufficient to provide makeup water to either the suppression pool or the upper containment pool to restore (continued)

PERRY - UNIT I B 3.6-85 Revision No. 7

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES BACKGROUND When the hydrogen igniters are energized they heat up to a (continued) surface temperature Ž 1700 0 F. At this temperature, they ignite the hydrogen gas that is present in the airspace in the vicinity of the igniter. The hydrogen igniters depend on the dispersed location of the igniters so that local ockets of hydrogen at increased concentrations would burn efore reaching a hydrogen concentration significantly higher than the lower flammability limit.

APPLICABLE The hydrogen igniters cause hydrogen in containment to burn SAFETY ANALYSES in a controlled manner as it accumulates following a degraded core accident (Ref. 3). Burning occurs at the lower flammability concentration, where the resulting temperatures and pressures are relatively benign. Without the hydrogen igniters, hydrogen could build upto higher concentrations that could result in a violent reaction if ignited by a random ignition source after such a buildup.,

The hydrogen igniters are not included for mitigation of a Design Basis Accident (DBA) because an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water is far in excess-of the hydrogen calculated for the limiting DBA loss of coolant accident (LOCA). The hydrogen concentration resulting from a DBA can be maintained less than the flammability limit using the primary containment hydrogen recombiners in conjunction with the Combustible Gas Mixing System. However, the hydrogen igniters have been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that are commonly found to dominate risk for units with Mark III containment.

The hydrogen igniters are considered to be risk significant in accordance with the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Two divisions of primary containment and drywell hydrogen igniters must be OPERABLE, each with 90% or more of the igniters OPERABLE (i.e., no more than five igniters inoperable.)

(continued)

PERRY - UNIT 1 B 3.6-96 Revision No. 7

Combustible Gas Mixing System B 3.6.3.3 BASES (continued)

APPLICABLE The Combustible Gas Mixing System provides the capability SAFETY ANALYSES for reducing the drywell hydrogen concentration to approximately the bulk average primary containment concentration following a Design Basis Accident (DBA). The limiting DBA relative to hydrogen generation is a LOCA.

Hydrogen may accumulate in primary containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant; and

b. Radiolytic decomposition of water in the Reactor Coolant System.

To evaluate the potential for hydrogen accumulation in primary containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 1 are used to maximize the amount of hydrogen calculated.

The calculation confirms that when the mitigating-systems are actuated in accordance with plant procedures, the peak hydrogen concentration in the primary containment remains

< 4.0 v/o.

The Combustible Gas Mixing System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Two combustible gas mixing subsystems must be OPERABLE to ensure operation of at least one primary containment combustible gas mixing subsystem in the event of a worst case single active failure. Operation with at least one OPERABLE combustible gas mixing subsystem provides the capability of controlling the hydrogen concentration in the drywell without exceeding the flammability limit.

APPLICABILITY In MODES 1 and 2, the two combustible gas mixing subsystems ensure the capability to prevent localized hydrogen concentrations above the flammability limit of 4.0 v/o in the drywell, assuming a worst case single active failure.

In MODE 3, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that (continued)

PERRY - UNIT 1 B 3.6-102 Revision No. 7

Combustible Gas Mixing System B 3.6.3.3 BASES ACTIONS B.1 and B.2 (continued) igniters. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist. The verification may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control capabilities. It does not mean to perform the surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control capabilities. If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two combustible gas mixing subsystems inoperable for up to 7 days. Seven days is a reasonable time to allow two combustible gas mixing subsystems to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in amounts capable of exceeding the flammability limit.

C.1 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.3.1 REQUIREMENTS Operating each combustible gas mixing subsystem for

> 15 minutes after starting from the control room ensures that each subsystem is OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, compressor failure, or excessive vibration can be detected for corrective action. The 92 day Frequency is consistent with Inservice Testing Program Frequencies, operating experience, the known reliability of the compressor and controls, and the two redundant subsystems available.

(continued)

PERRY - UNIT 1 B 3.6-104 Revision No. 7

Secondary Containment B 3.6.4.1 BASES BACKGROUND b. The containment equipment hatch is closed and (continued) sealed and the shield blocks are installed adjacent to the shield building;

c. The door in each access to the secondary containment is closed, except for entry and exit;

d. The sealing mechanism associated with each shield building penetration, e.g. welds, bellows, or 0-rings, is functional;

e. The pressure within the secondary containment is less than or equal to the value required by Surveillance Requirement SR 3.6.4.1.1, except for entry and exit to the annulus; and

f. The Annulus Exhaust Gas Treatment System is OPERABLE.

APPLICABLE There is one accident for which credit is taken for SAFETY ANALYSES secondary containment OPERABILITY. This is a LOCA (Ref. 1).

The secondary containment performs no active function in response to this limiting event: however,-its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis, and that fission products entrapped within the secondary containment structure will be treated by the AEGT System prior to discharge to the environment.

Secondary containment satisfies Criterion'3 of the'NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit secondary containment.

However, it was determined that Specifications should remain in place per Criterion 4 to address OPDRVs and fuel handling accidents. Criterion 3 would apply if dose calculations are revised to credit secondary containment during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(continued)

PERRY - UNIT 1 B 3.6-107 Revision No. 7

SCIVs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs)

BASES BACKGROUND The function of the SCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1).

The OPERABILITY requirements for SCIVs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Isolation barrier(s) for the penetration are discussed in Reference 2. The isolation devices addressed by this LCO are passive. Manual valves and blind flanges are considered passivedeviceS.

Penetrations are isolated by the use of manual valves in the closed position or blind flanges.

APPLICABLE The SCIVs must be OPERABLE to ensure the secondary SAFETY ANALYSES containment barrier to fission product releases is established. The principal accident for which the secondary containment boundary is required is a loss of coolant accident (Ref. 1). The secondary containment performs no active function in response to this limiting event, but the boundary established by SCIVs is required to ensure that leakage fromthe primary containment is processed by the Annulus Exhaust Gas Treatment (AEGT) System before being released to the environment.

Maintaining SCIVs OPERABLE ensures that fission products will remain trapped inside secondary containment so that they can be treated by the AEGT System prior to discharge to the environment..

SCIVs satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit the secondary containment.

However, it was determined that Specifications should remain in place per Criterion 4 to address OPDRVs and fuel handling accidents. Criterion 3 would apply if dose calculations are revised to credit the secondary containment during handling of recently irradiated fuel, i.e., fuel that has occupied art of a critical reactor core within the previous 24 (ours.

(continued)

PERRY - UNIT 1 B 3.6-111 Revision No. 7

SCIVs B 3.6.4.2 BASES ACTIONS A.1 and A.2 (continued)

Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.

Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

B.1 With two SCIVs in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed manual valve, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the low probability of a DBA occurring during.

this shorttime.

The Condition has been modified by a Note stating that Condition B is only applicable to penetration flow paths with two isolation valves. This clarifies that only Condition A is entered if one SCIV is inoperable in each of two penetrations.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 If any Required Action and associated Completion Time of Condition A or B cannot be met during movement of recently irradiated fuel assemblies in the primary containment, (continued)

PERRY - UNIT 1 B 3.6-114 Revision No. 7

SCIVs B 3.6.4.2 BASES ACTIONS D.1 and D.2 (continued) or during OPDRVs, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies in the primary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be immediately initiated to suspend OPDRVs in order to minimize the probability of a vessel draindown and the subsequent potenti.al for fission product release.

Actions must continue until OPDRVs are suspended.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies that each secondary containment isolation manual valve and blind flange that is not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or isolation device manipulation. Rather, it involves verification that those isolation devices in secondary containment that are capable of being mispositioned are in the correct position.

,Since these'isolation devices are readily accessible to personnel during normal unit operation and verification of their position is relatively easy, the 31 day Frequency was chosen to provide added assurance that the isolation devices are in the correct positions. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Two Notes have been added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these isolation devices once they have been verified to be in the proper position, is low. A second Note has been included to clarify that (continued)

PERRY - UNIT 1 B 3.6-115 Revision No. 7

AEGT System B 3.6.4.3 BASES BACKGROUND humidity of the airstream to less than 70% (Ref. 2). The (continued) roughing filter removes large particulate matter, while the HEPA filter is provided to remove fine particulate matter and protect the charcoal from fouling. The charcoal adsorber removes gaseous elemental iodine and organic iodides, and the final HEPA filter is provided to collect any carbon fines exhausted from the charcoal adsorber.

The AEGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. AEGT System flows are controlled by two motor operated control dampers installed in branch ducts. One duct exhausts air to the unit vent, (AEGT Subsystem A exhausts to the Unit 1 plant vent; AEGT Subsystem B exhausts to the Unit 2 plant vent), while the other recirculates air back to the annulus.

APPLICABLE The design basis for the AEGT System is to mitigate the SAFETY ANALYSES consequences of a loss of coolant accident. For all events analyzed, the AEGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.

The AEGT System satisfies Criterion 3 of the NRC Final

Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit the AEGT System.

However, it was determined that Specifications should remain in place per Criterion 4 to address OPDRVs and fuel handling accidents. Criterion 3 would apply if dose calculations are' revised to credit the AEGT System during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO Following a DBA, a minimum of one AEGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two independent operable subsystems ensures operation of at least one AEGT subsystem in the event of a single active failure.

(continued)

PERRY - UNIT 1 B 3.6-119 Revision No. 7

Drywel]

B 3.6.5.1 BASES BACKGROUND c. The drywell equipment hatch is closed and sealed; (continued)

d. The drywell head is installed and sealed;

e. The Drywell Vacuum Relief System is OPERABLE except as provided in LCO 3.6.5.6, "Drywell Vacuum Relief System";

f. The drywell leakage rates are within the limits of SR 3.6.5.1.1;

g. The suppression pool is OPERABLE; and

h. The sealing mechanism associated with each drywell penetration, e.g., welds, bellows, or O-rings, is functional.

This Specification is intended to ensure that the performance of the drywell in the event of a DBA meets the assumptions used in the safety analyses (Ref. 1).

APPLICABLE Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presented in Reference 1. The safety analyses assume that for a high energy line break inside the drywell, the steam is directed to the suppression pool through the horizontal vents where it is condensed. Maintaining the pressure suppression capability assures that safety analyses remain valid and that the peak LOCA temperature and pressure in the primary containment are within design limits.

The drywell satisfies Criteria 2 and 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Maintaining the drywell OPERABLE is required to ensure that the pressure suppression design functions assumed in the safety analyses are met. The drywell is OPERABLE if the drywell structural integrity is intact and the bypass leakage is within limits, except prior to the first startup after performing a required drywell bypass leakage test. At this time, the drywell bypass leakage must be

10% of the drywell bypass leakage limit.

(continued)

PERRY - UNIT 1 B 3.6-124 Revision No. 7

Drywell Air lock B 3.6.5.2 BASES (continued)

APPLICABLE Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presented in Reference 2. The safety analyses assume that for a high energy line break inside the drywell, the steam is directed to the suppression pool through the horizontal vents where it is condensed. Since the drywell air lock is part of the drywell pressure boundary, its design and maintenance are essential to support drywell OPERABILITY, which assures that the safety analyses are met.

The drywell air lock satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The drywell air lock forms part of the drywell pressure boundary. The air lock safety function assures that steam resulting from a DBA is directed to the suppression pool.

Thus, the air lock's structural integrity is essential to the successful mitigation of such an event.

The drywell air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, and both air lock doors must be OPERABLE. The interlock allows'only one air lock door to be opened at a time. This provision ensures that a gross breach of the drywell does not exist when the drywell is required to be OPERABLE. Air lock leakage is excluded from this specification. The air lock leakage rate is part of the drywell leakage rate and is controlled as part of OPERABILITY of the drywell in LCO 3.6.5.1.

Closure of a single door in the air lock is sufficient to support drywell OPERABILITY following postulated events.

Nevertheless, both doors are kept closed when the air lock is not being used for entry into and exit from the drywell.

(continued)

PERRY - UNIT I B 3.6-129 Revision No. 7

Drywell Isolation Valves B 3.6.5.3 BASES BACKGROUND valves. The drywell air is exhausted through a line also (continued) containing two drywell purge exhaust isolation valves and is then exhausted into the exhaust portion of the Containment Vessel and Drywell Purge System. The system is used to remove trace radioactive airborne products prior to personnel entry. The drywell purge mode is not used in ODE 1, 2, or 3; therefore, the drywell purge supply and exhaust isolation valves are sealed shut during power operation.

APPLICABLE This LCO is intended to ensure that releases from the core SAFETY ANALYSES do not bypass the suppression pool so that the pressure suppression capability of the drywell is maintained.

Therefore, as part of the drywell boundary, drywell isolation valve OPERABILITY minimizes drywell bypass leakage. Therefore, the safety analysis of any event requiring isolation of the drywell is applicable to this LCO.

The limiting DBA resulting in a release of steam, water, or radioactive material within the drywell is a LOCA. In the analysis for this accident, it is assumed that drywell isolation valves are either closed or function to close within the required isolation time following event initiation.

The drywell isolation valves and drywell purge supply and exhaust isolation valves satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The drywell isolation valve safety function is to form a part of the drywell boundary.

The power operated drywell isolation valves are required to have isolation times within limits. Power operated automatic drywell isolation valves are also required to actuate on an automatic isolation signal. Additionally, drywell purge supply and exhaust isolation valves are required to be closed. While the Drywell Vacuum Relief System valves isolate drywell penetrations, they are excluded from this Specification. Controls on their isolation function are adequately addressed in LCO 3.6.5.6, "Drywell Vacuum Relief System."

(continued)

PERRY - UNIT 1 B 3.6-137 Revision No. 7

Drywell Isolation Valves B 3.6.5.3 BASES ACTIONS A.1 and A.2 (continued) isolated, will be isolated should an event occur. This Required Action does not require any testing or isolation device manipulation. Rather, it involves verification that those devices outside drywell and capable of being mispositioned are in the correct position. Since these isolation devices are inside primary containment, the specified time period of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and the existence of other administrative controls, ensuring that isolation device misalignment is an unlikely possibility.

Also, this Completion Time is consistent with the Completion Time specifiedlfor PCIVs in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)."

Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.

Allowing verification by administrative controls is considered acceptable, since access to-these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified-losed by use of administrative means. Allowing verification by administrative meansis considered acceptable, since the function of lqocking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

B.1 With one or more penetration flow paths with two drywell isolation valves inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed manual valve, a closed and de-activated automatic valve, a check valve with flow through the valve secured, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is acceptable due to the low probability of the inoperable valves resulting in excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time frame.

The Completion Time is reasonable, considering the time required to isolate the penetration, and the probability of a DBA, which requires the drywell isolation valves to close, occurring during this short time is very low.

(continued)

PERRY - UNIT 1 B 3.6-140 Revision No. 7

Drywell Isolation Valves B 3.6.5.3 BASES ACTIONS C.1 and C.2 (conti nued) If any Required Action and associated Completion Time cannot be met, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.3.1 REQUIREMENTS Each 24 (1M14-F055 A (B) and 1M14-F060 A (B)) and 36 inch (1M14-F065 and 1M14-F070) drywell purge supply and exhaust isolation valve is required to be verified sealed closed at 31 day intervals because the drywell purge supply and exhaust isolation valves are not qualified to fully close under accident conditions. This SR is designed to ensure that a gross breach of drywell is not caused by an inadvertent drywell purge supply or exhaust isolation valve opening. Detailed analysis of these 24 and 36 inch drywell.

purge supply and exhaust isolation valves failed to conclusively demonstrate their ability to close during a LOCA in time to support drywell OPERABILITY. Therefore, these valves are required to be'Th theseal:,ed closed position during MODES 1, 2*.and 3. These 24 and 36 inch drywell purge supply and exhaust isolation valves that are sealed closed must have motive power to the valve operator removed. This can be accomplished by de-energizing the source of electric power, removing the air supply to the valve operator, or providing administrative control of the valve control switches. In this application, the term "sealed" has no connotation of leak tightness. The 31 day Frequency is based on drywell purge supply and exhaust valve use during unit operations.

SR 3.6.5.3.2 Deleted SR 3.6.5.3.3 This SR verifies that each drywell isolation manual valve and blind flange that is not locked, sealed, or otherwise secured and is required to be closed during accident conditions is closed. The SR helps to ensure that drywell 1

bypass leakage is maintained to a minimum. Due to (continued)

PERRY - UNIT 1 B 3.6-141 Revision No. 7

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.3 (continued)

REQUIREMENTS the location of these isolation devices, the Frequency specified as "prior to entering MODE 2 or 3 from MODE 4, if not performed in the previous 92 days," is appropriate because of the inaccessibility of the devices and because these devices are operated under administrative controls and the probability of their misalignment is low. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these isolation devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that the drywell isolation valves thatare open under administrative controls are not required to meet the SR during the-time that the drywell isolation valves are open.

SR 3.6.5.3.4.

Verifying that the isolation time of each power operated and each automatic drywell isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the drywell isolation valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.5.3.5 Verifying that each automatic drywell isolation valve closes on a drywell isolation signal is required to prevent bypass leakage from the drywell following a DBA. This SR ensures each automatic drywell isolation valve will actuate to its isolation position on a drywell isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.,6.1.5 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power, since isolation of penetrations would eliminate cooling water flow (continued)

PERRY - UNIT I B 3.6-142 Revision No. 7

Drywell Isolation Valves B 3.6.5.3 BASES Table B 3.6.5.3-1 (page 1 of 1)

Drywell Isolation Valves Valve Number Maximum Isolation Time (seconds) 1B33-FO13A NA 1B33-FO13B NA 1B33-FO17A NA 1B33-FO17B NA 1B33-F019 5 1B33-F020 5 lC41-F006 NA 1C41-F007 NA 1G61-F030 22 1G61-F035 22 1G61-F150 22 1G61-F155 22 1M14-FO55A 4 1M14-FO55B 4 1M14-FO60A 4 1M14-FO60B 4 1M14-F065 4 1M14-F070 4 1M51-FO10A 37 1M51-F010B 37 1P22-F015 18.8 1P22-F593 NA 1P43-F355 10 1P43-F400 10 1P43-F410 10 1P43-F722 NA 1P51-F652 22.5 1P51-F653 NA 1P52-F639 NA 1P52-F646 30*

1P54-F395 20*

Standard closure time, based on nominal pipe diameter, is approximately 12 inches per minute for gate valves and approximately four inches per minute for globe valves.

PERRY - UNIT 1 B 3.6-144 Revision No. 7

Drywell Pressure B 3.6.5.4 BASES APPLICABLE probability of weir wall overflow is minimized after an SAFETY ANALYSES inadvertent upper pool dump.

(continued)

Drywell pressure satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO A limitation on the drywell-to-primary containment differential pressure of Ž -0.5 psid and

2.0 psid is required to ensure that suppression pool water is not forced over the weir wall, vent clearing does not occur during normal operation, containment conditions are consistent with the safety analyses, and LOCA drywell pressures and pool swell loads are within design values.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining the drywell-to-primary containment differential pressure limitation is not required in MODE 4 or 5.

ACTIONS A.1 With drywell-to-primary containment differential pressure not within the limits of the LCO, it must be restored within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Required Action is necessary to return .

operation to within the bounds of the safety analyses. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.5.1, "Drywell," which requires that the drywell be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.1 and B.2 If drywell-to-primary containment differential pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and (continued)

PERRY - UNIT 1 B 3.6-146 Revision No. 7

Drywell Air Temperature B 3.6.5.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.5 Drywell Air Temperature BASES BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell air coolers remove heat and maintain a suitable environment. The drywell average air temperature affects equipment OPERABILITY, personnel access, and the calculated response to postulated Design Basis Accidents (DBAs). The limitation on drywell average air temperature ensures that the peak drywell temperature during a design basis loss of coolant accident (LOCA) does not exceed the design temperature of 3300 F. The limiting DBA for drywell atmosphere temperature is a small steam line break, assuming no heat transfer to the passive steel and concrete heat sinks in the drywell.

APPLICABLE Primary containment performance is evaluated for SAFETY ANALYSES the entire spectrum of break sizes for postulated LOCAs inside containment (Ref. 1). Among the inputs to the design basis analysis is the initial drywell average air temperature. Increasing the initial drywell average air temperature could change the calculated results of the design bases analysis. The safety analyses (Ref. 1) assume an initial average drywell air temperature of 145 0 F. This limitation ensures that the safety analyses remain valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed.the maximum allowable temperature of 330 0 F. The consequence of exceeding this design temperature may result in the degradation of the drywell structure under accident loads.

Equipment inside the drywell that is required to mitigate the effects of a DBA is designed and qualified to operate under environmental conditions expected for the accident.

Drywell average air temperature satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO If the initial drywell average air temperature is less than or equal to the LCO temperature limit, the peak accident temperature can be maintained below the drywell design (continued)

PERRY - UNIT I B 3.6-148 Revision No. 7

Drywell Vacuum Relief System B 3.6.5.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.6 Drywell Vacuum Relief System BASES BACKGROUND The Mark III pressure suppression containment is designed to condense, in the suppression pool, the steam released into the drywell in the event of a loss of coolant accident (LOCA). The steam discharging to the pool carries the noncondensibles from the drywell. Therefore, the drywell atmosphere changes from low humidity air to nearly 100%

steam (no air) as the event progresses. When the drywell subsequently cools and depressurizes, noncondensibles in the drywell must be replaced. The drywell vacuum relief subsystems are the means by which noncondensibles are transferred from the primary containment back to the drywell.

The Drywell Vacuum Relief System is a potential source of drywell bypass leakage (i.e., some of the steam released into the drywell from a LOCA bypasses the suppression pool and leaks directly to the primary containment airspace). -3 Since excessive drywell bypass leakage could degrade the pressure suppression function, the Drywell Vacuum Relief System has been designed with two valves in series in each vacuum breaker line. This minimizes the potential for a stuck open valve to threaten drywell OPERABILITY. The two drywell vacuum relief subsystems use separate 10 inch lines penetrating the drywell, and each subsystem consists of a series arrangement of a motor operated isolation valve and a check valve. The only s-afety function of the Drywell Vacuum Relief System is to provide this drywell to containment isolation. The Drywell Vacuum Relief System is not required to assist in hydrogen dilution or to protect the structural integrity of the drywell following a large break LOCA.

However, their passive operation (remaining closed and not leaking during drywell pressurization) is implicit in all of the LOCA analyses (Refs. 1 and 2).

The Drywell Vacuum Relief System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The LCO ensures that in the event of a LOCA, two drywell vacuum relief subsystems are available to mitigate the potential subsequent drywell depressurization. Each vacuum (continued)

PERRY - UNIT 1 B 3.6-151 Revision No. 7

ESW System-Div. 1 and 2 B 3.7.1 BASES BACKGROUND Following a DBA or transient, the ESW System will operate (continued) automatically without operator action. Manual initiation of supported systems (e.g. suppression pool cooling) is, however, performed for iong term cooling operations.

APPLICABLE The volume of Lake Erie is such that sufficient water SAFETY ANALYSES inventory is available for all ESW System post LOCA cooling requirements for a 30 day period with no additional makeup water source available (Ref. 1). The ability of the ESW System to support long term cooling of the reactor or containment is assumed in evaluations of the equipment required for safe reactor shutdown presented in the USAR, Sections 9.2.1, 6.2.1.1.3.3, and Chapter 15, (Refs. 2, 4, and 5, respectively). These analyses include the evaluation of the long term primary containment response after a design basis LOCA. The ESW System provides cooling water for the RHR suppression pool cooling mode to limit suppression pool temperature and primary containment pressure following a LOCA. This ensures that the primary containment can perform its intended function of limiting the release of radioactive materials to the environment following a LOCA. The ESW System also provides cooling to other components assumed to function during a LOCA (e.g., RHR and Low Pressure Core Spray Systems via the Emergency Closed Cooling Water System). Also, the ability to provide onsite emergency AC power is dependent on the ability of the ESW System to cool the DGs.

The safety analyses for long term containment cooling were performed, as-discussed in the USAR, Sections 6.2.1.1.3.3 and 6.2.2 (Refs. 4 and 6, respectively),.for a LOCA, concurrent with a loss of offsite power, and minimum available DG power. The worst case single failure affecting the performance of the ESW System is the failure of one of the two standby DGs, which would in turn affect one ESW subsystem. Reference 2 discusses ESW System performance during these conditions.

The.ESW System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.7-2 Revision No. 7

ESW System-Div. 3 B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Emergency Service Water (ESW) System-Division BASES BACKGROUND The Division 3 subsystem of the ESW System is designed to provide cooling water for the removal of heat from components of the Division 3 HPCS System.

The Division 3 ESW subsystem takes suction from Lake Erie and consists of one cooling water header and the associated pump, piping, valves, and instrumentation.

Cooling water is pumped from Lake Erie by the Division 3 ESW pump to the essential components through the Division 3 ESW supply header.. After removing heat from the components, the water is discharged to Lake Erie.

The Division 3 ESW subsystem supplies cooling water to the Division 3 HPCS diesel generator jacket water coolers and HPCS pump room cooler. The Division 3 ESW pump is sized such that it will provide adequate cooling water to the equipment required for safe shutdown. Following a Design Basis Accident or transient, the Division 3 ESW subsystem will operate automatically and without operator action as described in the USAR, Section 9.2.1 (Ref. 1).

APPLICABLE The ability of the Division 3 ESW subsystem to provide SAFETY ANALYSES adequate cooling to the HPCS System is an implicit assumption for safety analyses evaluated in the USAR, Chapters 6 and 15 (Refs. 2 and 3, respectively).

The Division 3 ESW subsystem satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The Division 3 ESW subsystem is required to be OPERABLE to ensure that the HPCS System will operate as required. An OPERABLE Division 3 ESW subsystem consists of an OPERABLE pump; and an OPERABLE flow path, capable of taking suction from Lake Erie and transferring the water to the appropriate unit equipment.

(continued)

PERRY - UNIT 1 B 3.7-7 Revision No. 7

CRER System B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Control Room Emergency Recirculation (CRER) System BASES BACKGROUND The CRER System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.

The safety related function of the CRER System used to control radiation exposure consists of two independent and redundant high efficiency air filtration subsystems for treatment of recirculated air and a control room envelope (CRE) boundary that limits the inleakage of unfiltered air.

Each CRER subsystem consists of a demister, an electric heater, a prefilter, 'ahigh bfficiency particulate air (HEPA) filter, an activated charcoal adsorber section, a second HEPA filter, a fan, and the associated ductwork, dampers, and instrumentation. The demister is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70%. The prefilter removes large particulate matter, while the upstream HEPA filter is provided to remove fine particulate matter (which may be radioactive) and protect the charcoal from fouling. The charcoal adsorber removes gaseous elemental jiodine and organic iodides, and the HEPA after filter is rovidýd to6*collkt any carbon fines exhausted from the charcoal adsorber. When emergency recirculation is activated, the supply fan in the associated control room HVAC subsystem also operates, and its normal flow rate is reduced to be compatible with the CRER fan discussed above (Ref. 2).

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions.

This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is *not necessary in the event of an accident. The CRE is protected for normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, ceilings, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

(continued)

PERRY - UNIT 1 B 3.7-10 Revision No. 7

CRER System B 3.7.3 BASES BACKGROUND In addition to the safety related standby emergency (continued) filtration function, parts of the CRER System are operated to maintain the CRE environment during normal operation.

Upon receipt of the initiation signal(s) (indicative of conditions that could result in radiation exposure to CRE occupants), the CRER System automatically switches to the emergency recirculation mode of operation to minimize infiltration of contaminated air into the CRE. A system of dampers isolates the CRE, and CRE air flow is recirculated and processed through either or both of the two filter subsystems.

The CRER System is designed to maintain a habitable environment in the CRE for a 30Qday continuous occupancy after a DBA, without exceeding'5 rem total effective dose equivalent (TEDE). CRER System operation in maintaining the CRE habitability is discussed in the USAR, Sections 6.5.1 and 6..4 (Refs. 1 and 2, respectively).

(continued)

PERRY - UNIT I B 3.7-10a Revision No. 7 I

CRER System B 3.7.3 BASES (continued)

APPLICABLE The ability of the CRER System to maintain the SAFETY ANALYSES habitability of the CRE is an explicit assumption for the safety analyses presented in the USAR, Chapters 6 and 15 (Refs. 3 and 4, respectively). The emergency recirculation mode of the CRER System is assumed to operate following a DBA. The radiological doses to CRE occupants as a result of the various DBAs are summarized in Reference 4. No single active or passive failure will cause the loss of ability to recirculate air in the CRE.

The CRER can provide protection from smoke and hazardous chemicals to CRE occupants. However, an evaluation of chemical hazards from onsite, offsite, and transportation sources has determined that the probability of a hazardous chemical spill resulting in unacceptable exposures is less than NRC licensing basis criteria. As a result, the plant licensing basis does not postulate hazardous chemical release events (Refs. 2 and 5). Therefore, no quantitative limits on inleakage of hazardous chemicals into the CRE have been established. A smoke assessment consistent with the guidance in Regulatory Guide 1.196 (Ref. 7) and NEI 99-03 Rev. 0 (Ref. 10) determined that reactor control capability can be maintained from either the Control Room or the remote shutdown controls during a smoke event (Ref. 6). Therefore, no quantitative limits on inleakage of smoke into the CRE have been established. Because inleakage limits for hazardous chemicals and smoke are not necessary to protect CRE occupants, the limit established for radiological events is the limiting value for CRE inleakage.

The CRER System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) in MODES 1, 2, or 3. During MODES 4 and 5, there are no accident analyses that credit the CRER System.

However, it was determined that Specifications should remain in place per Criterion 4 to address OPDRVs and fuel handling accidents. Criterion 3 would apply if dose calculations are revised to credit the CRER System during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO Two redundant subsystems of the CRER System are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other subsystem. Total system failure, such as from a loss of both ventilation subsystems or from an inoperable CRE (continued)

PERRY - UNIT 1 B 3.7-11 Revision No. 7

CRER System B 3.7.3 BASES LCO boundary, could result in a failure to meet the dose (continued) requirements of GDC 19 in the event of a DBA (for the design-basis Alternative Source Term (AST) LOCA and fuel handling accident analyses, the licensing basis Control Room dose limit is 5 Rem TEDE (Ref. 8 and 9)).

Each CRER subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. A CRER subsystem is considered OPERABLE when its associated:

a. Fans are OPERABLE;

b. HEPA filter and charcoal adsorben arev'not excessively restricting flow and are capable of performing their filtration functions; and

c. Heater, demister, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CRER subsystems to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that, CRE occupants are protected from hazardous chemicals.and smoke.--

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.

This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For such openings (other than doors), these controls should be proceduralized and consist of stat'ioning a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area.

APPLICABILITY In MODES 1, 2, and 3, the CRER System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release.

(continued)

PERRY - UNIT 1 B 3.7-11a Revision No. 7

CRER System B 3.7.3 BASES APPLICABILITY In MODES 4 and 5, the probability and consequences of a DBA (continued) are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the CRER System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During movement of recently irradiated fuel assemblies in the primary containment or fuel handling building; and

b. During operations with a potential for draining the reactor vessel (OPDRVs).

Due to radioactive decay, handling of fuel only requires OPERABILITY of the Control Room Emergency Recirculation System when the fuel being handled is recently irradiated, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Although this Function retains APPLICABILITY during "movement of recently irradiated fuel", which could be interpreted to permit fuel handling before 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of radiological decay if certain buildings and filtration systems are OPERABLE, this is not the case. Fuel handling during that period is prohibited since no dose calculations exist to address a fuel handling

. ,,,,accijdentwithin the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the reactorcoqre is sub-critical (Ref. 4).

OPDRVs assume that one or more fuel assemblies are loaded into the core. Therefore, if the fuel is fully off-loaded from the reactor vessel, the CRER System is not required to be OPERABLE.

ACTIONS A.1 With one CRER subsystem inoperable for reasons other than an inoperable CRE boundary, the inoperable CRER subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE CRER subsystem is adequate to perform the CRE occupant protection function.

However, the overall reliability is reduced because a failure in the OPERABLE CRER subsystem could result in loss of CRER System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining CRER subsystem can provide the required capabilities:

(continued)

PERRY.- UNIT 1 B 3.7-12 Revision No. 7

CRER System B 3.7.3 BASES ACTIONS B.1, B.2, and B.3

.(continued)

If the unfiltered inleakage of potentially contaminated air past the CRE boundaryand into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 Rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. As discussed in the Applicable Safety Analyses section, the current PNPP licensing basis identifies that CRE inleakage limits for hazardous chemicals and smoke are not necessary to protect CRE occupants; therefore the limit established for radiological events is the limiting value for determining entry into Condition B for an inoperable CRE boundary. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional.

These mitigating actions are outlined in the PNPP Control Room Envelope Habitability Program.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective, measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

(continued)

PERRY - UNIT 1 B 3.7-12a Revision No. 7

CRER System B 3.7.3 BASES ACTIONS C.1 and C.2 (continued)

In MODE 1, 2, or 3, if the inoperable CRER subsystem or the CRE boundary cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

PERRY - UNIT 1 B 3.7-12b Revision No. 7

CRER System B 3.7.3 BASES ACTIONS D.1, D.2.1 and D.2.2 (continued)

The Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown. During movement of recently irradiated fuel assemblies in the primary containment or fuel handling building, or during OPDRVs, if the inoperable CRER subsystem cannot be restored to OPERABLE status within the required Completion Time of Condition A, the OPERABLE CRER subsystem may be placed in the emergency recirculation mode. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing significant amounts of radioactivitythat might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk.

If:,applicab]e, movement of recently;:irradiated fuel assemblies in the primary containment and fuel handling building must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

E.1 If both CRER subsystems are inoperable in MODE 1, 2, or 3 for reasons other than an inoperable CRE boundary (i.e.,

Condition B), the CRER System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

(continued)

PERRY - UNIT 1 B 3.7-13 Revision No. 7

CRER System B 3.7.3 BASES ACTIONS F.1 and F.2 (conti nued) During movement of recently irradiated fuel assemblies in the primary containment or fuel handling building, or during OPDRVs, with two CRER subsystems inoperable or with one or more CRER subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing significant amounts of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk.

If applicable, movement of recently irradiated fuel assemblies in the primary containment and fuel handling building must be suspended immediately.,. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE - SR 3.7.3.1 REQUIREMENTS Operating each. CRER subsystem for Ž 10 continuous hours after initiating:from the controli room and ensuring flow through the HEPA filters and charcoal adsorbers ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on for > 10 continuous hours every 31 days eliminates moisture on the adsorbers and HEPA filters. The 31 day Frequency was developed in consideration of the known reliability of fan motors and controls and the redundancy available in the system.

SR 3.7.3.2 This SR verifies that the required CRER testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter efficiency, charcoal adsorber efficiency and bypass leakage, system flow rate, and general operating parameters of the filtration system. (Note: Values identified in the VFTP are Surveillance Req uirement values.) Specific test Frequencies and additional information are discussed in detail in the VFTP.

(continued)

PERRY - UNIT 1 B 3.7-14 Revision No. 7

CRER System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.3 REQUIREMENTS (continued) This SR verifies that each CRER subsystem starts and operates on an actual or simulated initiation signal, and the isolation dampers that establish a portion of the CRE boundary close withinlO seconds. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.7.1.5 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on industry operating experience, and is consistent with a typical industry refueling cycle.

SR 3.7.3.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke.

This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered aininleakage iW,,greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 7), which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 10). These compensatory measures may be used as mitigating actions as required by Required Action B.2.

Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions (Ref. 11). Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored'to OPERABLE status.

(continued)

PERRY - UNIT 1 B 3.7-15 Revision No. 7

CRER System B 3.7.3 BASES (continued)

REFERENCES 1. USAR, Section 6.5.1.

2. USAR, Section 6.4.

3. USAR, Chapter 6.

4. USAR, Chapter 15.

5. USAR, Section 2.2

6. Letter from L. W. Pearce (FENOC) to Document Control Desk (NRC) dated May 30, 2006, "Perry Nuclear Power Plant Final Response to Generic Letter 2003-01,

'Control Room Habitability' (TAC No. MB9839)."

7. Regulatory Guide 1.196,

8. Amendment No. 103 to Facility Operating License No.

NPF-58, Perry Nuclear Power Plant, Unit 1; and Letter, D. Pickett (NRC) to L. Myers (FENOC), "Issuance of Exemption from 10 CFR Part 50, Appendix A, General Design Criterion 19", dated March 26, 1999.

9. Amendment No. 122 to Facility Operating License. No.

NPF-58, Perry Nuclear Power Plant, Unit 1.

10. NEI 99-03, "Control Room Habitability Assessment,"

June 2001.

11. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040160868)

PERRY - UNIT 1 B 3.7-16 Revision No. 7

Control Room HVAC System B 3.7.4 BASES APPLICABLE The Control Room HVAC System satisfies Criterion 3 of the SAFETY ANALYSES NRC Final Policy Statement on Technical Specification (continued) Improvements (58 FR 39132) in MODES 1, 2, and 3. During MODES 4 and 5, there are no accident analyses that credit the Control Room HVAC System. However, it was determined that Specifications should remain in place per Criterion 4 to address OPDRVs and fuel handling accidents. Criterion 3 would apply if dose calculations are revised to credit the Control Room HVAC during handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(continued)

PERRY - UNIT 1 B 3.7-17a Revision No. 7

Main Condenser Offgas B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Main Condenser Offgas BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the condenser. Air and noncondensible gases are collected in the condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.

The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission.

This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled by the offgas condenser; the water and condensibles are stripped out by the offgas condenser and moisture separator. The radioactivity of the remaining gaseous mixture (i.e., the offg~s recombiner effluent) is monitored downstream of the moisture separator prior to entering the holdup line.

APPLICABLE The main condenser offgas release rate is an initial SAFETY ANALYSES condition of the Main Condenser Offgas System failure event as discussed in the USAR, Section 15.7.1 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The release rate is controlled to ensure that during the event, the calculated'offsite doses will be well within the limits (NUREG-0800, Ref. 2) of 10 CFR 100 (Ref. 3), or the NRC staff approved licensing basis.

The main condenser offgas limits satisfy Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

The Offgas limit specified in TS 3.7.5 represents a short term conservative limit for accident analysis purposes. The operational limits defined by TS sections 5.5.1 and 5.5.4 and by the ODCM ensure that the annual average Offgas release rates are significantly under this, and ensure consistency with the design bases for annual average release limits and shielding analyses.

LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission (continued)

PERRY - UNIT I B 3.7-22 Revision No. 7

Main Turbine Bypass System B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine. The bypass capacity of the system is 28.8% (nominal) of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of two valve chests connected to the main steam lines between the main steam isolation valves and the turbine stop valves. Each of these valves is sequentially operated by hydraulic cylinders. The bypass valves are controlled by the pressure regulation function of the Steam Bypass and Pressure Regulating System, as discussed in the USAR, Section 7.7.1.5 (Ref. 1). The bypass valves are normally closed, and the pressure regulator controls the turbine control valves, directing all steam flow to the turbine. If the speed control unit or the load control unit restricts steam flow to the turbine, the pressure regulator.

controls the system pressure by opening the bypass valves.

When the bypass valves open, the steam flows from the bypass chest, through connecting piping, to the pressure breakdown assemblies, where a series of orifices are used to further reduce the steam pressure before the steam enters the condenser.

APPLICABLE The Main Turbine Bypass System is assumed to function during SAFETY ANALYSES the design basis feedwater controller failure, maximum demand event, described in the USAR, Section 15.1.2 (Ref. 2). Opening the bypass valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MCPR during the event.

The Main Turbine Bypass System satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.7-25 Revision No. 7

Fuel Pool Water Level B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Fuel Pool Water Level BASES BACKGROUND The minimum water level in the spent fuel storage pools and upper containment fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident.

A general description of the fuel handling building (FHB) spent fuel storage pools and upper containment fuel storage pool design is found in the USAR, Section 9.1.2 (Ref. 1).

he assumptions of the fuel handling accident are found in the USAR, Sections 15.7.4 and 15.7.6 (Refs. 2 and 3, respectively).

APPLICABLE The water level above the irradiated fuel assemblies is an SAFETY ANALYSES explicit assumption of the fuel handling accident. A fuel handling accident is evaluated to ensure that the offsite radiological consequences (calculated Total Effective Dose Equivalent (TEDE) doses at the exclusion area and low population zone boundaries) are

25% of the 10 CFR 50.67 (Ref. 5) exposure guidelines. The Control Room is also evaluated to ensure doses are less than the 10 CFR 50.67 exposure guidelines. A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in the Regulatory Guide 1.183 (Ref. 6).

The fOel handling accident is evaluated for the dropping of an irradiated fuel assembly onto stored fuel bundles. The consequences of a fuel handling accident inside the FHB and inside containment are documented in References 2 and 3, respectively. The water levels in the FHB spent fuel storage pools and upper containment fuel storage pools provide for absorption of water soluble fission product gases and transport delays of soluble and insoluble gases that must pass through the water before being released to the atmosphere. This absorption and transport delay reduces the potential radioactivity of the release during a fuel hand ing accident.

The fuel pool water level s atisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(conti nued)

PERRY - UNIT I B 3.7-29 Revision No. 7

Fuel Handling Bui I ding B 3.7.8 BASES BACKGROUND With the boundaries in place, the FHB Ventilation Exhaust (continued) System will assure that any releases occurring as a result of a FHA are filtered.

APPLICABLE There are no accidents for which credit is taken for FHB SAFETY ANALYSES OPERABILITY. Although there are no accident analyses that credit the FHB, it was determined that Specifications should remain in place per Criterion 4 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) to address fuel handling accidents involving handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the FHB (Ref. 1). Criterion 3 of the NRC Policy Statement would apply-if dose calculations are revised to credit the FHB during handling of recently irradiated fuel.

LCO An OPERABLE FHB provides a control volume into which fission products can be diluted and processed prior to release to the environment. For the FHB to be considered OPERABLE, it must provide proper air flow patterns to ensure that there is no uncontrolled release of radioactive material during a FHA involving handling of recently irradiated fuel in the FHB.

APPLICABILITY In plant operating MODES, OPERABILITY of the FHB is not required since leakage from the primary containment will nbt be released into the FHB. Regardless of the plant operating MODE, anytime recently irradiated fuel is being handled in the FHB there is the potential for significant radioactive releases due to a FHA, and the FHB is required to mitigate the consequences.

Due to radioactive decay, handling of fuel only requires OPERABILITY of the Fuel Handling Building when the fuel being handled is recently irradiated, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Although this Function retains APPLICABILITY during "movement of recently irradiated fuel", which could be interpreted to permit fuel handling before 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of radiological decay if certain buildings and filtration systems are OPERABLE, this is not the case. Fuel handling during that period is prohibited since no dose calculations exist to address a fuel handling accident within the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the reactor core is sub-critical (Ref. 1).

(continued)

PERRY - UNIT 1 B 3.7-33 Revision No. 7

ECCW System B 3.7.10 BASES APPLICABLE The ECCW System satisfies Criterion 3 of the NRC Final SAFETY ANALYSES Policy Statement on Technical Specification Improvements (continued) (58 FR 39132).

LCO In the event of a DBA, one ECCW subsystem is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two ECCW subsystems must be OPERABLE. At least one ECCW subsystem will operate assuming the worst single active failure occurs coincident with the loss of offsite power.

An ECCW subsystem is considered OPERABLE when:

a. The associated pump and surge tank are OPERABLE; and

b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.

The isolation of ECCWtoother components or systems may render those components or systems inoperable, but does not affect the OPERABILITY of the ECCW System.

Several valves that were originally designed as part of Unit 2's ECCW system have retained ECCW (P42) identification numbers, even though the valves have no relationship with the Unit 1 ECCW system addressed by this LCO. Several of these valves are closed in order to isolate Nuclear Closed Cooling (NCC) from the Unit 1 Emergency Service Water (ESW)-

system when ESW is to be aligned to cool the Spent Fuel Pool heat exchangers. Other valves are opened to provide the ESW flow path to the heat exchangers. Those Unit 2/Common valves do not affect OPERABILITY of Unit 1 ECCW; they are instead associated with OPERABILITY of the Unit 1 ESW system.

APPLICABILITY In MODE 1, the ECCW subsystems are in standby except when required to support RHR, LPCS, or RCIC System operations and testing. In MODES 2 and 3, the ECCW System is operated as necessary to support hot standby conditions or normal plant shutdown and cooldown using the RHR System.

In MODES 4 and 5, the requirements of the ECCW System are determined by the systems they support (Ref. 2).

(continued)

PERRY - UNIT 1 B 3.7-42 Revision No. 7

AC Sources-Operati ng B 3.8.1 BASES BACKGROUND In the event of a loss of preferred power, the ESF (continued) electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

Certain required plant loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class 1E Distribution System or to prevent overloading the DG.

Ratings for DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3). The continuous service rating is 7000 Kw for Divisions 1 and 2 and is 2600 Kw for Division 3, with 10% overload permissible for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

APPLICABLE The initial conditions of DBA and transient analyses in the SAFETY ANALYSES USAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit as discussed in Reference 2. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power: and

b. A worst case single failure.

AC sources satisfy the requirements of Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.8-2 Revision No. 7

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)

REQUIREMENTS SR 3.8.1.7 requires that, at a 184 day Frequency, the Division 1 and 2 DGs start from standby conditions and achieves required voltage and frequency within 10 seconds.

Also, this SR requires that the Division 3 DG starts from standby conditions and achieves a minimum required frequency within 10 seconds and required voltage and frequency within 13 seconds. The start time requirements support the assumptions in the design basis LOCA analysis (Ref. 5). The start time requirements are not applicable to SR 3.8.1.2 (see Note 3 of SR 3.8.1.2). Since SR 3.8.1.7 does require timed starts, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. This procedure is the intent of Note 1 of SR 3.8.1.2. Similarly, the performance of SR 3.8.1.12 or SR 3.8.1.19 also satisfies the requirements of SR 3.8.1.2 and SR 3.8.1.7.

In addition to the SR requirements, the time for the DG to reach steady state operation, unless the modified DG start method is employed, is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.

The 31 day Frequency for SR 3.8.1.2 is consistent with the industry guidelines for assessment of diesel generator performance (Ref. 14). The 184 day Frequency for SR 3.8.1.7 is a reduction in cold testing consistent with Generic Letter 84-15 (Ref. 7). These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.

SR 3.8.1.3 This Surveillance demonstrates that the DGs are capable of synchronizing and accepting greater than or equal to the equivalent of the maximum expected accident loads. The load band for the Division 1 and 2 DGs is provided to avoid routine overloading of these DGs. While this Surveillance allows operation of the Division 1 and 2 DGs in the band of 5600 kW to 7000 kW, a range of 5600 kW to 5800 kW will normally be used in order to minimize wear on the DGs.

Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

(continued)

PERRY - UNIT I B 3.8-15 Revision No. 7

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation to ensure circulating currents are minimized.

(continued)

PERRY - UNIT I B 3.8-15a Revision No. 7

AC Sources-Shutdown B 3.8.2 BASES APPLICABLE During MODES 1, 2, and 3, various deviations from the SAFETY ANALYSES analysis assumptions and design requirements are allowed (continued) within the ACTIONS. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded.

During MODES 4 and 5, performance of a significant number of required testing and maintenance activities is also required. In MODES 4 and 5, the activities are generally planned and administratively controlled. Relaxations from typical MODE 1, 2, and 3 LCO requirements are acceptable during shutdown MODES based on:

a. The fact that time in an outage is limited. This is a risk prudent goal as well as utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied tosystems credited in operating MODE analyses, or both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, and 3 OPERABILITY requirements) with systems assumed to function'during an. event.

In the event of an accident during shutdown, this LCO ensures the capability of supporting systems necessary to avoid immediate difficulty, assuming either a loss of al.l offsite power or a loss of all onsite (diesel generator (DG)) power.

The AC sources satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO One offsite circuit supplying onsite Class lE power distribution subsystem(s) of LCO 3.8.8, "Distribution Systems-Shutdown," ensures that all required loads are (continued)

PERRY - UNIT 1 B 3.8-35 Revision No. 7

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that DG for a period of 7 days while the DG is supplying maximum post loss of coolant accident load demand (Ref. 1). The maximum load demand is calculated using the assumption that at least two DGs are available. This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.

Fuel oil is transferred from each storage tank to its respective day tank by one of two transfer pumps associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All outside tanks, pumps, and piping are located underground. The fuel oil level in the storage tank is indicated in the control room.

For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) and ANSI N195 (Ref. 3) address recommended fuel oil practices, as modified by 1) the ACTIONS and Surveillance Requirements (SRS) of Specification 3.8.3, and 2) the Bases for SR 3.8.3.3, which specifies the current fuel oil testing Standards. The fuel oil properties governed by these SRs include the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level, among others.

The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions. The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. Each engine lube oil system contains an inventory capable of supporting a minimum of 7 days of operation. This supply is sufficient to allow the operator to replenish lube oil from outside sources.

Each DG has a separate air start system. Each system has two subsystems, each with adequate capacity for five successive starts on the DG without recharging the air start receiver(s).

(continued)

PERRY - UNIT 1 B 3.8-41 Revision No. 7

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES (continued)

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in USAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, reactor coolant system, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

Since diesel fuel oil, lube oil, and starting air subsystems support the operation of the standby AC power sources, they satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full load, i.e., maximumexpected post LOCA load, operation. It is also required to meet specific standards for quality. Additionally, sufficient lube oil supply must be available to ensure-the capability to operate at full load for 7 days. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

The starting air system is required to have a minimum capacity for five successive DG starts without recharging the air start receivers. Division 1, 2, and 3 have two independent air start subsystems per DG. For Division 1 and 2 DGs, one air start subsystem for an engine is required for OPERABILITY of each DG. For the Division 3 DG, two air start subsystems are required for OPERABILITY.

APPLICABILITY The AC sources, LCO 3.8.1 and LCO 3.8.2, are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition (continued)

PERRY - UNIT 1 B 3.8-42 Revision No. 7

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQU IREMENTS These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between the sample (and corresponding results) of new fuel, and addition of new fuel oil to the storage tanks to exceed 31 days. The limits and applicable ASTM Standards for the tests listed in the Diesel Fuel Oil Testing Program of Specification 5.5.9 are as follows:

a. Sample the new fuel oil in accordance with ASTM D4057-95 (Reapproved 2000)(Ref. 6);

b. Verify in accordance with the tests specified in ASTM D1298-85 (Ref. 6) that the sample has an absolute specific gravity at 60/60°F of Ž 0.83 and

0.89; an API gravity at 60°F of Ž 260 and : 390; or an API gravity of within 0.30 at 600 F, or a specific gravity within 0.0016 at 60/60°F when compared to the supplier's certificate:

c. Verify in accordance with the tests specified in ASTM D975-89 (Ref. 6), a flash point of Ž 125 0 F;

d. Verify in accordance with the tests specified in ASTM D975-89 (Ref. 6), if gravity was not determined by comparison with the supplier's certification, a kinematic viscosity at 40 0C of ý 1.9 centistokes and

4.1 centistokes; and

e. Verify that the new fuel oil has no visible free water or particulate contamination when tested in accordance with ASTM D4176-86 (Ref. 6). TS 5.5.9.a.3 also includes an option to perform a laboratory test to verify water and sediment are within limits, however, this option is not currently used; an appropriate lab test method for water and sediment can be specified herein if this option is to be utilized.

Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO since the fuel oil is not added to the storage tanks.

(continued)

PFRRY - HNTT I B 3.8-47 Revision No. 7

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS Following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-89 (Ref. 6) are met for new fuel oil when tested in accordance with ASTM D975-89 (Ref. 6). These additional analyses are required by Specification 5.5.9, Diesel Fuel Oil Testing Program, to be performed within 31 days following sampling and addition. This 31 days is (continued)

PERRY - UNIT I B 3.8-47a Revision No. 7 1

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS intended to assure: 1) that the sample taken is not more than 31 days old at the time of adding the fuel oil to the storage tank, and 2) that the results of a new fuel oil sample (sample obtained prior to addition but not more than 31 days prior to) are obtained within 31 days after addition. The 31 day period is acceptable because the fuel oil properties of interest, even if not within stated limits, would not have an immediate effect on DG operation.

This Surveillance ensures the availability of high quality fuel oil for the DGs.

Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not burn properly in a diesel engine. However, the particulate can cause fouling of filters and fuel oil injection equipment, which can cause engine failure.

Particulate concentration should be determined in accordance with ASTM D2276-88, Method A (Ref. 6). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l.

It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The Frequency of this Surveillance takes into consideration fuel oil degradation trends indicating that particulate concentration is unlikely to change between Frequency intervals.

SR 3.8.3.4 This Surveillance ensures that, without the aid of the air compressor, sufficient air start capacity for each DG is available. The system design provides for a minimum of five engine starts without recharging. The pressure specified in this SR reflects the value at which the five starts can be accomplished, but is not so high as to result in failing the limit due to normal cycling of the air compressor. Division 1, 2, and 3 DGs have two independent air start subsystems per DG. For Division 1 and 2 DGs, this Surveillance is met provided one air start receiver for an engine is pressurized (continued)

PERRY - UNIT I B 3.8-48 Revision No. 7

DC Sources-Operating B 3.8.4 BASES APPLICABLE The OPERABILITY of the DC subsystems is consistent with the SAFETY ANALYSES initial assumptions of the accident analyses and is based (continued) upon meeting the design basis of the unit. This includes maintaining DC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power or of all onsite AC power; and

b. A worst case single failure.

The DC sources satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO The DC electrical power subsystems, each subsystem consisting of either the Unit I or 2 battery, either the normal or reserve battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the divisions, are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 4).

Division 1 consists of:

1. 125 volt battery 1R42-S002 or 2R42-SO02.

2. 125 volt .iull capacity charger 1R42-S006 or OR42-SO07..

Division 2 consists of:

1. 125 volt battery 1R42-S003 or 2R42-SO03.

2. 125 volt full capacity charger 1R42-S008 or OR42-SO09.

Division 3 consists of:

1. 125 volt battery 1E22-SO05 or 2E22-SO05.

2. 125 volt full capacity charger 1E22-S006 or OR42-S011.

APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and (continued)

PERRY - UNIT 1 B 3.8-53 Revision No. 7

DC Sources-Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources-Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources-Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and.the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of recently irradiated fuel assemblies in the primary containment or fuel handling building ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is avail.Thle for monitoring and maintaining the unit."

status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident involving handling of recently irradiated fuel, i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The DC sources satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO One DC electrical power subsystem (consisting of either the Unit 1 or 2 battery, either the normal or reserve battery charger, and all the associated control equipment and interconnecting cabling supplying power to the associated (continued)

PERRY - UNIT 1 B 3.8-60 Revision No. 7

Battery Cell Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Cell Parameters BASES BACKGROUND This LCO delineates the limits on electrolyte temperature, level, float voltage, and specific gravity for the DC power source batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources-Operating," and LCO 3.8.5, "DC Sources-Shutdown."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems provide normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one division of DC sources OPERABLE during accident conditions, in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power; and

b. A worst case single failure.

Since battery cell parameters support the operation of the DC power sources, they satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO Battery cell parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA.

Electrolyte limits are conservatively established, allowing continued DC electrical system function even with limits not met.

(continued)

PERRY - UNIT 1 B 3.8-64 Revision No. 7

Distribution Systems-Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Distribution Systems-Shutdown BASES BACKGROUND A description of the AC and DC electrical power distribution systems is provided in the Bases for LCO 3.8.7, "Distribution Systems-Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC and DC electrical-power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availabi ity of necessary'power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC and DC electrical power distribution systems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC and DC electrical power sources and associated power distribution subsystems during MODES 4 and 5 and during movement of recently irradiated fuel assemblies in the primary containment or fuel handli~ng building ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident involving handling of recently irradiated fuel, i.e.,

fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The AC and DC electrical power distribution systems satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.8-81 Revision No. 7

Refueling Equipment Interlocks B 3.9.1 BASES BACKGROUND operation of the refueling equipment with fuel loaded over (continued) the core whenever any control rod is withdrawn, or to prevent control rod withdrawal whenever fuel loaded refueling equipment is over the core (Ref. 2).

The hoist switches open at a load lighter than the weight of a single fuel assembly in water.

APPLICABLE The refueling equipment interlocks are explicitly assumed in SAFETY ANALYSES the USAR analysis of the control rod removal error during refueling (Ref. 3). This analysis evaluates the consequences of control rod withdrawal during refueling. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment.

Criticality and, therefore, subsequent prompt-reactivity excursions are prevented during the insertion of fuel, provided all control rods are fully inserted during the fuel insertion. The refueling equipment interlocks accomplish this by preventing loading fuel into the core with any control rod withdrawn, or by preventing withdrawal of a control rod from the core during fuel loading.

The refueling platform location switches activate at a point outside of the reactor core, such that, considering switch hysteresis and maximum platform momentum toward the core at the time of power loss with a fuel assembly loaded and a control rod withdrawn, the fuel is not over the core.

Refueling equipment interlocks satisfy Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO To prevent criticality during refueling, the refueling equipment interlocks ensure that fuel assemblies are not loaded with any control rod withdrawn.

To prevent these conditions from developing, the all-rods-in, the refueling platform position, and the refueling platform main hoist fuel loaded inputs are required to be OPERABLE. These inputs are combined in logic circuits that provide refueling equipment interlocks or control rod blocks to prevent operations that could result in criticality during refueling operations.

(continued)

PERRY - UNIT 1 B 3.9-2 Revision No. 7

Refuel Position One-Rod-Out Interlock B .3.9.2 BASES APPLICABLE The refuel position one-rod-out interlock and adequate SDM SAFETY ANALYSES (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") prevent criticality by (continued) preventing withdrawal of more than one control rod. With one control rod withdrawn, the core will remain subcritical, thereby preventing any prompt critical excursion.

The refuel position one-rod-out interlock satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO To prevent criticality during MODE 5, the refuel position one-rod-out interlock ensures no more than one control rod may be withdrawn. At least one channel of the refuel position one-rod-out interlock is required to be OPERABLE and the reactor mode switch must be locked in the refuel position to support the OPERABILITY of these channels.

APPLICABILITY In MODE 5, with the reactor mode switch in the refuel position, the OPERABLE refuel position one-rod-out interlock provides protection against prompt reactivity excursions.

In MODES 1, 2, 3, and 4, the refuel position one-rod-out interlock is not required to be OPERABLE and is bypassed.

In MODES 1 and 2, the Reactor Protection System (LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation") and the control rods (LCO 3.1.3, "Control Rod OPERABILITY") provide mitigation of potential reactivity excursions. In MODES 3 and 4, with the reactor mode switch in the shutdown-bosition, a"control rod block (LCO 3.3.2.1, "Control Rod Block Instrumentation") ensures all control rods are inserted, thereby preventing criticality during shutdown conditions.

ACTIONS A.1 and A.2 With the refuel position one-rod-out interlock inoperable, the refueling interlocks are not capable of preventing more than one control rod from being withdrawn. This condition may lead to criticality.

Control rod withdrawal must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more (continued)

PERRY - UNIT 1 B 3.9-6 Revision No. 7

Control Rod Position B 3.9.3 BASES APPLICABLE Additionally, prior to fuel reload, all control rods must be SAFETY ANALYSES fully inserted to minimize the probability of an inadvertent (continued) criticality.

Control rod position satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO All control rods must be fully inserted during applicable refueling conditions to minimize the probability of an inadvertent criticality during refueling.

APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn may result in inadvertent criticality.

Therefore, the control rods must be inserted before loading fuel into a core cell. All control rods must be inserted before loading fuel to ensure that a fuel loading error does not result in loading fuel into a core cell with the control rod withdrawn.

In MODES 1, 2,'3, and 4, the reactor pressure vessel head is installed, and no fuel loading activities are possible.

Therefore, this Specification is not applicable in these MODES.

ACTIONS A.1 With all control rods not fully inserted when loading fuel' assemblies into the core, an inadvertent criticality could occur that is not analyzed in the USAR. All in-core fuel loading operations must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS During refueling, to ensure that the reactor remains subcritical, all control rods must be fully inserted prior to and during fuel loading. Periodic checks of the control rod position ensure this condition is maintained.

(continued)

PERRY - UNIT 1 B 3.9-10 Revision No. 7

Control Rod Position Indication B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Control Rod Position Indication BASES BACKGROUND The full-in position indication channel for each control rod provides information necessary to the refueling interlocks to prevent inadvertent criticalities during refueling operations. During refueling, the refueling interlocks (LCO 3.9.1, "Refueling Equipment Interlocks," and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") use the full-in position indication channel to limit the operation of the refueling equipment and the movement of the control rods.

The absence of the full-in position indication channel signal for any control rod removes the all-rods-in permissive for the refueling equipment interlocks and prevents fuel loading. Also, this condition causes the refuel position one-rod-out interlock to not allow the selection of any other control rod.

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The control rods serve as the system capable of maintaining the reactor subcritical in cold conditions.

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.912), the SDM (LCO 3.1.1, "SHUTYOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation").

The safety analysis for the control rod withdrawal error during refueling (Ref. 2) assumes the proper functioning of the refueling interlocks and adequate SDM. The full-in position indication channel is required to be OPERABLE so that the refueling interlocks can ensure that fuel cannot be loaded with any control rod withdrawn and that no more than one control rod can be withdrawn at a time.

Control rod position indication satisfies Criterion 3 of the NRC Final P1 icy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.9-12 Revision No. 7

Control Rod OPERABILITY-Refueling B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Control Rod OPERABILITY-Refueling BASES BACKGROUND Control rods are components of the Control Rod Drive (CRD)

System, the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes during refueling operation. In addition, the control rods provide the capability to maintain the reactor subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System.

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required independent reactivity control systems be capable of holding the reactor core subcritical under cold conditions (Ref. 1). The CRD System is the system capable of maintaining the reactor subcritical in cold conditions.

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling are provided by the refueling interlocks (LCO 3.9..1, "Refueling Equipment Interlocks," and LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"), the SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"), the intermediate range monitor neutron flux scram (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), and the control rod block instrumentation (LCO 3.3.2.1, "Control Rod Block Instrumentation").

The safety analysis for the control rod withdrawal error during refueling (Ref. 2) evaluates the consequences of control rod withdrawal during refueling. A prompt reactivity excursion during refueling could potentially result in fuel failure with subsequent release of radioactive material to the environment. Control rod scram provides protection should a prompt reactivity excursion occur.

Control rod OPERABILITY during refueling satisfies Criterion 3 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

(continued)

PERRY - UNIT 1 B 3.9-16 PRevision No. 7

RPV Water Level-Irradiated Fuel B 3.9.6 BASES APPLICABLE assembly, dropping an assembly on the RPV flange will result SAFETY ANALYSES in reduced releases of fission gases. Based on this (continued) judgment, and the physical dimensions which preclude normal operation with water level 23 feet above the flange, a slight reduction in this water level is acceptable.

RPV water level satisfies Criterion 2 of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132).

LCO A minimum water level of 22 ft 9 inches above the top of the RPV flange is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable 1imits, as provided by the guidance of Reference 1.

APPLICABILITY LCO 3.9.6 is applicable during movement of irradiated fuel assemblies with in the RPV. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis.

Requirements for handling of new fuel assemblies or control rods (where water depth to the RPV flange is not of concern) are covered by LCO 3.9.7, "RPV Water - New Fuel or Control Rods." Requirements for fuel handling accidents in the spent fuel storage pools and upper fuel storage pool are covered by LCO 3.7.7, "Fuel Pool Water Level."

ACTIONS A.1 If the water level is < 22 ft 9 inches above the top of the RPV flange, all operations involving movement of irradiated fuel assemblies within the RPV shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of irradiated fuel movement shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.6.1 REQUIREMENTS Verification of a minimum water level of 22 ft 9 inches above the top of the RPV flange ensures that the design basis for the postulated fuel handling accident analysis (continued)

PERRY - UNIT I B 3.9-20 Revision No. 7

RPV Water Level-New Fuel or Control Rods B 3.9.7 BASES APPLICABLE RPV water level satisfies Criterion 2 of the NRC Final SAFETY ANALYSES Policy Statement on Technical Specification Improvements (continued) (58 FR 39132).

LCO A minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the RPV is required to ensure that the radiological consequences of a postulated fuel handling accident are within acceptable limits, as provided by the guidance of Reference 1.

APPLICABILITY LCO 3.9.7 is applicable when moving new fuel assemblies or handling control rods (i.e., movement with other than the normal control rod drive) over irradiated fuel assemblies seated within the RPV. The LCO minimizes the possibility of a fuel handling accident-in containment that is beyond the assumptions of the safety analysis. If irradiated fuel is not present within the RPV, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel storage pools and upper-fuel storage pool are covered by LCO 3.7.7, "Fuel Pool Water Level."

Requirements for handling irradiated fuel over the RPV are covered by LCO 3.9.6, "Reactor Pressure Vessel (RPV) Water Level-Irradiated Fuel."

ACTIONS A.1 If the water level is < 23 ft above the top of irradiated fuel assemblies seated within the RPV, all operations involving movement of new fuel assemblies and handling of control rods within the RPV shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of fuel movement and control rod handling shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.7.1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of the irradiated fuel assemblies seated within the RPV ensures that the design. basis for the postulated fuel handling accident analysis during refueling operations is (continued)

PERRY - UNIT 1 B 3.9-23 Revision No. 7

RHR-High Water Level B 3.9.8 B 3.9 REFUELING OPERATIONS B 3.9.8 Residual Heat Removal (RHR-High Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required by GDC 34. The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each loop consists of one motor driven pump, two heat exchangers in series, and associated piping and valves.

Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cool ed by circulation through the respective heat exchangers, to the reactor via separate feedwater lines or to the upper containment pool or to the reactor via the low pressure coolant injection path. The RHR heat exchangers transfer heat to the Emergency Service Water System.

In addition to the above RHR subsystems, the volume of water above the reactor pressure vessel (RPV) flange provides a heat sink for decay heat removal.

APPLICABLE With the unit in MODE 5, the RHR System in the shutdown SAFETY ANALYSES cooling mode is not required for mitigation of any events or accidents evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result.

Although the RHR System in thý shutdown cooling mode does not meet a specific criterion of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132), it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR System in the shutdown cooling mode is retained as a Specification.

LCO Only one RHR shutdown cooling subsystem is required to be OPERABLE in MODE 5 with irradiated fuel in the RPV and with the water level Ž 22 ft 9 inches above the RPV flange, and heat losses to the ambient are not sufficient to maintain average reactor coolant temperature

1400 F. Only one subsystem is required because the volume of water above the RPV flange provides backup decay heat removal capability.

(continued)

PERRY - UNIT 1 B 3.9-25 Revision No. 7

RHR-Low Water Level B 3.9.9 B 3.9 REFUELING OPERATIONS B 3.9.9 Residual Heat Removal (RHR-Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and sensible heat from the reactor coolant, as required by GDC 34. The two redundant, manually controlled shutdown cooling subsystems of the RHR System promote decay heat removal function. Each loop consists of one motor driven pump, two heat exchangers in series, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after it has been cooled by circulation through the respective heat exchangers, to the reactor via separate .

feedwater lines, or to the upper containment pool or to the reactor via the low pressure coolant injection path. The RHR heat exchangers transfer heat to the Emergency Service Water System.

APPLICABLE With the unit in MODE 5, decay heat removal by the RHR SAFETY ANALYSES System in the shutdown cooling mode is not required for mitigation of any events or accidents evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result.

Although the RHR System in the shutdown cooling mode does not meet a specific criterion of the NRC Final Policy Statenent on Technical Specification Improvements .158 FR 39132), it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR System in the shutdown cooling mode is retained as a Specification.

LCO In MODE 5 with irradiated fuel in the reactor pressure vessel (RPV) and with the water level < 22 ft 9 inches above the RPV flange and heat losses to the ambient are not sufficient to maintain average reactor coolant temperature

< 140 0 F, both RHR shutdown cooling subsystems must be OPERABLE.

An RHR shutdown cooling subsystem is OPERABLE when the RHR pump, two heat exchangers in series, valves, piping, and instrumentation and controls are OPERABLE.

(continued)

PERRY - UNIT 1 B 3.9-30 Revision No. 7

Inservice Leak and Hydrostatic Testing Operation N 3.10.1 BASES APPLICABLE coolant activity above the limits of LCO 3.4.8, "Reactor SAFETY ANALYSES Coolant System (RCS) Specific Activity," are minimized. In (continued) addition, the primary containment will be OPERABLE, in accordance with this Special Operations LCO, and will be capable of handling any airborne radioactivity or steam leaks that could occur during the performance of hydrostatic or leak testing. The required pressure testing conditions provide adequate assurance that the consequences of a steam eak will be conservatively bounded by the consequences of the postulated loss of coolant accidents inside of primary containment described in Reference 2. Therefore, these requirements will conservatively limit radiation releases to the environment.

In the event of a large primary system leak, the reactor vessel would rapidly'depressurize, allowing the low pressure core cooling systems to operate. The capability of the low pressure coolant injection and low pressure core spray subsystems, as required in MODE 4 by LCO 3.5.2, "ECCS-Shutdown," would be more than adequate to keep the core flooded under this low decay heat load condition.

Small system leaks would be detected by leakage inspections before significant inventory loss occurred.

For the purposes of this test, the protection provided by normally required MODE 4 applicable LCOs, in addition to the rimary containment requirements required to be met by this pecial Operations LCO, will ensure acceptable consequences during normal hydrostatic test conditions and during postulated accident conditions.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

(continued)

PERRY - UNIT I B 3.10-2 Revision No. 7

Reactor Mode Switch Interlock Testing B 3.10.2 B 3.10 SPECIAL OPERATIONS B 3.10.2 Reactor Mode Switch Interlock Testing BASES BACKGROUND The purpose of this Special Operations LCO is to permit operation of the reactor mode switch from one position to another to confirm certain aspects of associated interlocks during periodic tests and calibrations in MODES 3, 4, and 5.

The reactor mode switch is a conveniently located, multiposition, keylock switch provided to select the necessary scram functions for various plant conditions (Ref. 1). The reactor mode switch selects the appropriate trip relays for scram functions and provides appropriate bypasses. The mode switch positions and related scram interlock functions are summarized as follows:

a. Shutdown-Initiates a reactor scram; bypasses main steam line isolation, reactor high water level scrams; and reactor low water level EOP bypass control switches become active (i.e., the EOP switches can BYPASS the level 3 trip if taken to the 'BYPASS' position);

b. Refuel-Selects Neutron Monitoring System (NMS) scram function for low neutron flux level operation (but does not disable the average power range monitor scram); bypasses main steam line isolation and reactor high water level.scrams;

c. Startup/Hot Standby-Selects NMS scram function for low neutron flux level operation (intermediate range monitors and average power range monitors); bypasses main steam line isolation and reactor high water level scrams; and

d. Run-Selects NMS scram function for power range operation.

The reactor mode switch also provides interlocks for such functions as control rod blocks, scram discharge volume trip bypass, refueling interlocks, and main steam isolation valve isolations.

APPLICABLE The acceptance criterion for reactor mode switch interlock SAFETY ANALYSES testing is to prevent fuel failure by precluding reactivity excursions or core criticality.

(continued)

PERRY - UNIT I B 3.10-6 Revision No. 7

Reactor Mode Switch Interlock Testing B 3.10.2 BASES APPLICABLE The interlock functions of the shutdown and refuel positions SAFETY ANALYSES of the reactor mode switch in MODES 3, 4, and 5 are provided (continued) to preclude reactivity excursions that could potentially result in fuel failure. Interlock testing that requires moving the reactor mode switch to other positions (run, or startup/hot standby) while in MODE 3, 4, or 5, requires administratively maintaining all control rods inserted and no other CORE ALTERATIONS in progress. With all control rods inserted in core cells containing one or more fuel assemblies and no CORE ALTERATIONS in progress, there are no credible mechanisms for unacceptable reactivity excursions during the planned interlock testing.

For postulated accidents, such as control rod removal error during refueling or loading of fuel with a control rod withdrawn, the accident analysis demonstrates that fuel failure will not occur (Ref. 2). The withdrawal of a single control rod will not result in criticality when adequate SDM is maintained. Also, loading fuel assemblies into the core with a single control ,rod withdrawn will not result in criticality, thereby preventing fuel. failure.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore no criteria of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided, in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. MODES 3, 4, and 5 operations not specified in Table 1.1-1 can be performed in accordance with other Special Operations LCOs (i.e., LCO 3.10.1, "Inservice Leak and Hydrostatic Testing Operation,"

LCO 3.10.3, "Single Control Rod -Hot Shutdown," LCO 3.10.4, "Single Control Rod Withdrawal-Cold Shutdown," and LCO 3.10.8, "SDM Test-Refueling") without meeting this LCO or its ACTIONS. If any testing is performed that involves the reactor mode switch interlocks and requires repositioning beyond that specified in Table 1.1-i for the current MODE of operation, the testing can be performed, provided all interlock functions potentially defeated are administratively controlled by a second licensed operator or other technically qualified member of the unit technical staff. In MODES 3, 4, and 5 with the reactor mode switch in (continued)

PERRY - UNIT 1 B 3.10-7 Revision No. 7

Single Control Rod Withdrawal-Hot Shutdown B 3.10.3 BASES APPLICABLE Alternate backup protection can be obtained by ensuring that SAFETY ANALYSES a five by five array of control rods, centered on the (continued) withdrawn control rod, are inserted and incapable of withdrawal.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of-the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 3 with the reactor mode switch in the refuel position can be performed in accordance with other Special Operations LCOs (i.e.,

LCO 3.10.2, "Reactor Mode Switch Interlock Testing") without meeting this Special Operations LCO or its ACTIONS.

However, if a single control rod withdrawal is desired in MODE 3, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied. "Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod, including recoupling. The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required .by this Special Operations LCO, will ensure-that only one control rod can be withdrawn.

To back up the refueling interlocks (LCO 3.9.2), the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by this Special Operations LCO's requirements in Item d.1. Alternately, provided a sufficient number of control rods in the vicinity of the withdrawn control rod are known to be inserted and incapable of withdrawal (Item d.2), the possibility of criticality on withdrawal of this control rod is sufficiently precluded, so as not to require the scram capability of the withdrawn control rod. The control rods can be made incapable of withdrawal by disarming the control rod either hydraulically or electrically. A control rod can (continued)

PERRY - UNIT 1 B 3.10-12 Revision No. 7

Single Control Rod Withdrawal-Cold Shutdown B 3.10.4 BASES APPLICABLE ensuring that a five by five array of control rods, centered SAFETY ANALYSES on the withdrawn control rod, are inserted and incapable of (continued) withdrawal. This alternate backup protection is required when removing the CRD because this removal renders the withdrawn control rod incapable of being scrammed.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 4 with the reactor mode switch in the refuel position can be performed in accordance with other LCOs (i.e., Special Operations LCO 3.10.2, "Reactor Mode Switch-Interlock Testing") without meeting this Special Operations LCO or its ACTIONS. If a single control rod withdrawal is desired in MODE 4, controls consistent with those required during refueling must be implemented and this Special Operations LCO applied.

"Withdrawal" in this application includes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod, including recoupl ing.

The refueling interlock's of LCO 3.9.2, "Refuel Position One-Rod-Out Interlock," required by this Special Operations LCO will ensure that only one control rod can be withdrawn.

At the time CRD removal begins, the disconnection of the position indication probe will cause LCO 3.9.4, "Control Rod Position Indication," and therefore, LCO 3.9.2 to fail to be met. Therefore, prior to commencing CRD removal, a control rod withdrawal block is required to be inserted to ensure that no additional control rods can be withdrawn and that compliance with this Special Operations LCO is maintained.

To back up the refueling interlocks (LCO 3.9.2) or the control rod withdrawal block, the ability to scram the withdrawn control rod in the event of an inadvertent criticality is provided by the Special Operations LCO (continued)

PERRY - UNIT 1 B 3.10-17 Revision No. 7

Single CRD Removal-Refueling B 3.10.5 BASES (continued)

APPLICABLE With the reactor mode switch in the refuel position, the SAFETY ANALYSES analyses for control rod withdrawal during refueling are applicable and, provided the assumptions of these analyses are satisfied, these analyses will bound the consequences of an accident. Explicit safety analyses in the USAR (Ref. 1) demonstrate that the proper operation of the refueling interlocks and adequate SDM will preclude unacceptable reactivity excursions.

Refueling interlocks restrict the movement of control rods and the operation of the refueling equipment to reinforce operational procedures that prevent the reactor from becoming critical. These interlocks prevent the withdrawal of more than one control rod. Under these conditions, since only one control rod can be withdrawn, the core will always be shut'down even with the highest worth control rod withdrawn if adequate SDM exists. By requiring all other control rods to. be inserted and a control rod withdrawal block initiated, the function of the inoperable refuel position one-rod-out interlock (LCO 3.9.2) is adequately maintained. This Special Operations LCO requirement to suspend all CORE ALTERATIONS adequately compensates for the inoperable all rods in permissive for the refueling equipment interlock s (LCO 3.9.1).

The control rod scram function provides backup protection in the event normal refueling procedures and the refueling interlocks, fail to prevent inadvertent criticalities during refueling. Since the scram function and refueling interlocks may be suspended, alternate backup protection required by this Special Operations LCO is obtained by, ensuring that a five by five array of control rods, centered on the withdrawn control rod, are disarmed. This alternate backup protection is required when removing the CRD because this removal renders the withdrawn control rod incapable of being inserted.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

(continued)

PERRY - UNIT 1 B 3.10-22 Revision No. 7

Multiple Control Rod Withdrawal-Refueling B 3.10.6 BASES APPLICABLE the core cell. With no fuel assemblies in the core cell, SAFETY ANALYSES the associated control rod has no reactivity control (continued) function and is not required to remain inserted. Prior to reloading fuel into the cell, however, the associated control rod must be inserted to ensure that an inadvertent criticality does not occur, as evaluated in the Reference 1 analysis.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation in MODE 5 with LCO 3.9.3, "Control Rod Position," LCO 3.9.4, "Control Rod Position Indication," or LCO 3.9.5, "Control Rod OPERABILITY-Refueling," not met, can be performed in accordance with the Required Actions of these LCOs without meeting this Special Operations LCO or its ACTIONS. If multiple control rod withdrawal or removal, or CRD removal is desired, all four fuel assemblies are required.to be removed from the associated core cells. Prior to entering this LCO, any fuel remaining in a core cell whose CRD was reviously removed .under the provisions of another LCO must e removed. "Withdrawal" in this application i'ncludes the actual withdrawal of the control rod as well as maintaining the control rod in a position other than the full-in position, and reinserting the control rod.

When loading fuel into the core with multiple control rods withdrawn, special spiral reload sequences are used to ensure that reactivity additions are minimized. Spiral reloading encompasses reloading a cell (four fuel locations immediately adjacent to a control rod) on the edge of a continuous fueled region (the cell can be loaded in any sequence). Otherwise, all control rods must be fully inserted before loading fuel.

(continued)

PERRY - UNIT I B 3.10-27 Revision No. 7

Control Rod Testing-Operating B 3.10.7 BASES APPLICABLE As described in LCO 3.0.7, compliance with Special SAFETY ANALYSES Operations LCOs is optional, and therefore, no criteria of (continued) the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Control rod testing may be erformed in compliance with the prescribed sequences of CO 3.1.6, and during these tests, no exceptions to the requirements of LCO 3.1.6 are necessary. For testing.

performed with a sequence not in compliance with LCO 3.1.6, the requirements of LCO 3.1.6 may be suspended, provided additional administrative controls are placed on the test to ensure that the assumptions of the special safety analysis for the test sequence remain valid. When deviating from the prescribed sequences of LCO 3.1.6, individual control rods must be bypassed in the Rod Action Control System (RACS).

Assurance that the test sequence is followed can be provided by a second licensed operator or other qualified member of the technical staff verifying conformance to the approved test sequence. These controls are consistent with those normally applied to operation in the startup range as defined in SR 3.3.2.1.9, when it is necessary to deviate from the prescribed sequence (e.g., an inoperable control rod that must be fully inserted). .

APPLICABILITY Control rod testing, with THERMAL POWER greater than 19.0%

RATED THERMAL POWER, is adequately controlled by the existing LCOs on power distribution limits and control rod block instrumentation. Control rod movement during these conditions is not restricted to prescribed sequences and can be performed within the constraints of LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)," and LCO 3.3.2.1. With THERMAL POWER less than or equal to 19.0% RATED THERMAL POWER, the provisions of this Special Operations LCO are necessary to perform special tests that are not in conformance with the prescribed control rod sequences of LCO 3.1.6. While in (continued)

PERRY - UNIT 1 B 3.10-30 Revision No. 7

SDM Test-Refueling B 3.10.8 BASES APPLICABLE CRDA analyses assume that the reactor operator follows SAFETY ANALYSES prescribed withdrawal sequences. For SDM tests performed (continued) within these defined sequences, the analyses of References 1 and 2 are applicable. However, for some sequences developed for the SDM testing, the control rod patterns assumed in the safety analyses of References 1 and 2 may not be met.

Therefore, special CRDA analyses, performed in accordance with an NRC approved methodology, are required to demonstrate that the SDM test sequence will not result in unacceptable consequences should a CRDA occur during the testing. For the purpose of this test, protection provided by the normally required MODE 5 applicable LCOs, in addition to the requirements of this LCO, will maintain normal test operations as well as postulated accidents within the bounds of the appropriate safety analyses (Refs. 1 and 2). In addition to the added requirements for the Rod Pattern Controller (RPC), APRM, and control rod coupling, the single notch withdrawalmode is specified for out of sequence withdrawals. Requiring the single notch withdrawal mode limits withdrawal steps to a single notch, which limits inserted reactivity, and allows adequate monitoring of changes in neutron flux, which may occur during the test.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Final Policy Statement on Technical Specification Improvements (58 FR 39132) apply. Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria.satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. SDM tests may be performed while in MODE 2, in accordance with Table 1.1-1, without meeting this Special Operations LCO or its ACTIONS. For SDM tests performed while in MODE 5, additional requirements must be met to ensure that adequate protection against potential reactivity excursions is available. To provide additional scram protection, beyond the normally required IRMs, the APRMs are also required to be OPERABLE (LCO 3.3.1.1, Functions 2a and 2d) as though the reactor were in MODE 2. Because multiple control rods will be withdrawn and the reactor will potentially become critical, the approved control rod withdrawal sequence must be enforced by the RPC (LCO 3.3.2.1, Function lb, MODE 2), or (continued)

PERRY - UNIT 1 B 3.10-34 Revision No. 7

L-09-218, Submittal of Technical Specification Bases, Revision 7

Contents

Text

SUBJECT:

Attachment:

Enclosure:

Navigation menu

L-09-218, Submittal of Technical Specification Bases, Revision 7

Text

SUBJECT:

Attachment:

Enclosure:

Navigation menu

Search