ML100550594

Developmental Revision B - Technical Specifications Bases B 3.7 - Plant Systems

ML100550594
Person / Time
Site:	Watts Bar
Issue date:	02/02/2010
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
Download: ML100550594 (78)

Text

MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)

BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.

Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the FSAR, Section 10.3.2 (Ref. 1). The MSSVs must have sufficient capacity to limit the secondary system pressure to 110% of the steam generator design pressure in order to meet the requirements of the ASME Code,Section III (Ref. 2). The MSSV design includes staggered setpoints, according to Table 3.7.1-2 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip.

APPLICABLE The design basis for the MSSVs comes from Reference 2 and its purpose SAFETY is to limit the secondary system pressure to 110% of design pressure ANALYSES for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the relieving capacity of the MSSVs, and thus Main Steam System pressure, are those characterized as decreased heat removal events, which are presented in the FSAR, Sections 15.2 and 15.4 (Ref. 3). Of these, the full power loss of normal feedwater is the limiting AOO. The transient response for this event presents no hazard to the integrity of the RCS or the Main Steam System.

(continued)

Watts Bar - Unit 2 B 3.7-1 (developmental) A

MSSVs B 3.7.1 BASES APPLICABLE Following the loss of continued subcooled feedwater addition, the primary SAFETY and secondary-side temperatures increase, resulting in a secondary-side ANALYSES pressure increase that proceeds all the way up to the lowest safety valve (continued) setpoint. The receipt of a low-low steam generator water level reactor trip signal releases the rod cluster control assemblies (RCCAs) to fall into the core and provides a turbine trip signal. Following the turbine trip, all MSSVs are briefly actuated while rods fall into the core and the hot leg inventory is purged of hot reactor coolant. After the core is shutdown, the required relief capacity is reduced, and one MSSV per steam generator remains open during the remainder of the transient.

In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled RCCA bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature T or Power Range Neutron Flux - High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The FSAR, Section 15.2 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.

The FSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s), it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux - High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on (continued)

Watts Bar - Unit 2 B 3.7-2 (developmental) A

MSSVs B 3.7.1 BASES APPLICABLE the same steam generator it is necessary to prevent this power increase SAFETY by lowering the Power Range Neutron Flux - High setpoint to an ANALYSES appropriate value.

(continued)

The MSSVs are assumed to have two active failure modes. The active failure modes are spurious opening, and failure to reclose once opened.

The MSSVs satisfy Criterion 3 of the NRC Policy Statement.

LCO The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 102% RTP. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2 and the DBA analysis.

The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.

This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB, or Main Steam System integrity.

APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization.

In MODES 4 and 5, there are no credible transients requiring the MSSVs.

The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.

With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets Reference 2 requirements.

(continued)

Watts Bar - Unit 2 B 3.7-3 (developmental) A

MSSVs B 3.7.1 BASES ACTIONS Operation with less than all five MSSVs OPERABLE for each steam (continued) generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.

A.1 In the case of only a single inoperable MSSV on one or more steam generators, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressuration in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, Required Action A.1, requires an appropriate reduction in reactor power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined using a conservative heat balance between the reactor coolant system heat generation and the steam relief through the OPERABLE MSSVs, as shown below and described in the attachment to Reference 6:

4 ws h fg Allowable THERMAL POWER Level (%) = 100 QK where: ws = Minimum total steam relief capacity of the OPERABLE MSSVs on any one steam generator, in lbm/sec.

hfg = heat of vaporization at the highest MSSV full-open pressure, in Btu/lbm.

Q = NSSS power rating of the plant (includes reactor coolant pump heat) in MWt.

K = Unit conversion factor: 947.82 Btu/sec/MWt.

(continued)

Watts Bar - Unit 2 B 3.7-4 (developmental) A

MSSVs B 3.7.1 BASES ACTIONS A.1 (continued)

Note: The values in Specification 3.7.1 include an allowance for instrument and channel uncertainties to the allowable RTP obtained with this algorithm.

B.1 and B.2 In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time for Required Action B.1 is consistent with A.1. An additional 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> is allowed in Required Action B.2 to reduce the setpoints. The Completion Time of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined using a conservative heat balance calculation as described above (Action A.1) and in the attachment to Reference 6. The values in Specification 3.7.1 include an allowance for instrument and channel uncertainties to the allowable RTP obtained with this algorithm.

Required Action B.2 is modified by a Note, indicating that the Power Range Neutron Flux - High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3, the reactor protection system trips specified in LCO 3.3.1, Reactor Trip System Instrumentation, provide sufficient protection.

(continued)

Watts Bar - Unit 2 B 3.7-5 (developmental) A

MSSVs B 3.7.1 BASES ACTIONS C.1 and C.2 (continued)

If the Required Actions are not completed within the associated Completion Time, or if one or more steam generators have 4 inoperable MSSVs, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program. The ASME OM Code (Ref. 4) requires that safety and relief valve tests be performed as follows:

a. Visual examination;

b. Seat tightness determination;

c. Setpoint pressure determination (lift setting); and

d. Compliance with owner's seat tightness criteria.

The ASME OM Code requires that all valves be tested every 5 years, and a minimum of 20% of the valves be tested every 24 months. Additional test frequency requirements apply during the initial five year period as discussed in Reference 5. The ASME OM Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift. The lift settings, according to Table 3.7.1-2 correspond to ambient conditions of the valve at nominal operating temperature and pressure.

(continued)

Watts Bar - Unit 2 B 3.7-6 (developmental) A

MSSVs B 3.7.1 BASES SURVEILLANCE This SR is modified by a Note that allows entry into and operation in REQUIREMENTS MODE 3 prior to performing the SR. The MSSVs may be either bench (continued) tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.

REFERENCES 1. Watts Bar FSAR, Section 10.3, "Main Steam Supply System."

2. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code,Section III, Article NC-7000, "Overpressure Protection," Class 2 Components.

3. Watts Bar FSAR, Section 15.2, "Condition II - Faults of Moderate Frequency," and Section 15.4, "Condition IV - Limiting Faults."

4. American Society of Mechanical Engineers (ASME) OM Code, Code for Operation and Maintenance of Nuclear Power Plants.

5. NRC Information Notice 94-60, Potential Overpressurization of the Main Steam System, August 22, 1994.

Watts Bar - Unit 2 B 3.7-7 (developmental) A

MSIVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs)

BASES BACKGROUND The MSIVs isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators.

One MSIV is located in each main steam line outside, but close to, containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam line from the others, and isolates the turbine, Steam Dump System, and other auxiliary steam supplies from the steam generators.

The MSIVs close on a main steam isolation signal generated by either low steam line pressure, high negative steam pressure rate (below P-11),

or high-high containment pressure. The MSIVs fail closed on loss of control or actuation power.

Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSIVs. The MSIVs may also be actuated manually.

A description of the MSIVs is found in the FSAR, Section 10.3 (Ref. 1).

APPLICABLE The design basis of the MSIVs is established by the containment analysis SAFETY for the large steam line break (SLB) inside containment, discussed in the ANALYSES FSAR, Section 6.2 (Ref. 2). It is also affected by the accident analysis of the SLB events presented in the FSAR, Section 15.4.2.1 (Ref. 3). The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand).

The limiting case for the containment analysis is the SLB inside containment, with a loss of offsite power following turbine trip, and failure of the MSIV on the affected steam generator to close. At lower powers, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment.

(continued)

Watts Bar - Unit 2 B 3.7-8 (developmental) A

MSIVs B 3.7.2 BASES APPLICABLE Due to reverse flow and failure of the MSIV to close, the additional mass SAFETY and energy in the steam headers downstream from the other MSIV ANALYSES contribute to the total release. With the most reactive rod cluster control (continued) assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power.

The core is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.

The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside containment at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV to close.

The MSIVs serve only a safety function and remain open during power operation. These valves operate under the following situations:

a. An HELB inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSIVs isolates the break from the unaffected steam generators.

b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.

c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.

(continued)

Watts Bar - Unit 2 B 3.7-9 (developmental) A

MSIVs B 3.7.2 BASES APPLICABLE d. Following a steam generator tube rupture, closure of the MSIVs SAFETY isolates the ruptured steam generator from the intact steam ANALYSES generators to minimize radiological releases.

(continued)

e. The MSIVs are also utilized during other events such as a feedwater line break. This event is less limiting so far as MSIV OPERABILITY is concerned.

The MSIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO This LCO requires that four MSIVs in the steam lines be OPERABLE.

The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.

This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 (Ref. 4) limits or the NRC staff approved licensing basis.

APPLICABILITY The MSIVs must be OPERABLE in MODE 1, and in MODES 2 and 3 except when closed and de-activated, when there is significant mass and energy in the RCS and steam generators. When the MSIVs are closed, they are already performing the safety function.

In MODE 4, normally most of the MSIVs are closed, and the steam generator energy is low.

In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

(continued)

Watts Bar - Unit 2 B 3.7-10 (developmental) A

MSIVs B 3.7.2 BASES (continued)

ACTIONS A.1 With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Some repairs to the MSIV can be made with the unit hot. The 8-hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs.

The 8-hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides an additional means for containment isolation.

B.1 If the MSIV cannot be restored to OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Condition C would be entered. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging plant systems.

C.1 and C.2 Condition C is modified by a Note indicating that separate Condition entry is allowed for each MSIV.

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed.

When closed, the MSIVs are already in the position required by the assumptions in the safety analysis.

The 8-hour Completion Time is consistent with that allowed in Condition A.

For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed and de-activated.

This is necessary to ensure that the assumptions in the safety analysis (continued)

Watts Bar - Unit 2 B 3.7-11 (developmental) A

MSIVs B 3.7.2 BASES ACTIONS C.1 and C.2 (continued) remain valid. The 7-day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.

D.1 and D.2 If the MSIVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed at least in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from MODE 2 conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that MSIV closure time is 6.0 seconds on an actual or simulated actuation signal. The MSIV closure time is assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage.

The Frequency is in accordance with the Inservice Testing Program or 18 months. The 18 month Frequency for valve closure time is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This test is conducted in MODE 3 with the unit at operating temperature and pressure, as discussed in Reference 5 exercising requirements.

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated.

(continued)

Watts Bar - Unit 2 B 3.7-12 (developmental) A

MSIVs B 3.7.2 BASES (continued)

REFERENCES 1. Watts Bar FSAR, Section 10.3, "Main Steam Supply System."

2. Watts Bar FSAR, Section 6.2, "Containment Systems."

3. Watts Bar FSAR, Section 15.4.2.1, "Major Rupture of a Main Steam Line."

4. 10 CFR 100.11.

5. American Society of Mechanical Engineers (ASME) OM Code, "Code for Operation and Maintenance of Nuclear Power Plants."

Watts Bar - Unit 2 B 3.7-13 (developmental) A

MFIVs and MFRVs and Associated Bypass Valves B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Regulation Valves (MFRVs) and Associated Bypass Valves BASES BACKGROUND The MFRVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following a high energy line break (HELB). The safety related function of the MFIVs is to provide the second isolation of MFW flow to the secondary side of the steam generators following an HELB. Closure of the MFIVs and associated bypass valves or MFRVs and associated bypass valves terminates flow to the steam generators.

The consequences of events occurring in the main steam lines or in the MFW lines downstream from the MFIVs will be mitigated by their closure.

Closure of the MFIVs and associated bypass valves, or MFRVs and associated bypass valves, effectively terminates the addition of normal feedwater to an affected steam generator, limiting the mass and energy release for steam line breaks (SLBs) or FWLBs inside containment, and reducing the cooldown effects for SLBs.

The MFIVs and associated bypass valves, isolate the non-safety related portions from the safety related portions of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that enters containment through the break.

One MFIV and one MFRV are located on each 16-inch MFW line. One bypass MFRV and one bypass MFIV are located on a smaller 6-inch startup and tempering flow feedwater line. Both the MFIV and bypass MFIV are located in the main steam valve vault close to containment.

The MFIVs and associated bypass valves, and MFRVs and associated bypass valves, close on receipt of a Tavg Low coincident with reactor trip (P-4), safety injection signal, or steam generator water level - high high signal. They may also be closed manually except for the bypass MFIV which has no handswitch. In addition to the MFIVs and associated bypass valves, and the MFRVs and associated bypass valves, a check valve on the 16-inch MFW line is located just outside containment in the main steam valve vault. The check valve terminates flow from the steam generator for breaks upstream of the check valve.

A description of the MFIVs and MFRVs is found in the FSAR, Section 10.4.7 (Ref. 1).

(continued)

Watts Bar - Unit 2 B 3.7-14 (developmental) A

MFIVs and MFRVs and Associated Bypass Valves B 3.7.3 BASES (continued)

APPLICABLE The design basis of the MFIVs and MFRVs and associated bypass valves SAFETY is established by the analyses for the large SLB. It is also influenced by ANALYSES the accident analysis for the large FWLB. Closure of the MFIVs and associated bypass valves, or MFRVs and associated bypass valves, may also be relied on to mitigate an SLB for core response analysis and excess feedwater event.

Failure of an MFIV, MFRV, or the associated bypass valves in a single flow path to close following an SLB or FWLB can result in additional mass and energy being delivered to the steam generators, contributing to cooldown. This failure also results in additional mass and energy releases following an SLB or FWLB event.

The MFIVs and MFRVs satisfy Criterion 3 of the NRC Policy Statement.

LCO This LCO ensures that the MFIVs, MFRVs, and their associated bypass valves will isolate MFW flow to the steam generators, following an FWLB or SLB. The MFIVs and bypass MFIVs will also isolate the non-safety related portions from the safety related portions of the system.

This LCO requires that four MFIVs and associated bypass valves and four MFRVs and associated bypass valves be OPERABLE. The MFIVs and MFRVs and the associated bypass valves are considered OPERABLE when isolation times are within limits and they close on an isolation actuation signal.

Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment. If a feedwater isolation signal on high - high steam generator level is relied on to terminate an excess feedwater flow event, failure to meet the LCO may result in the introduction of water into the main steam lines.

(continued)

Watts Bar - Unit 2 B 3.7-15 (developmental) A

MFIVs and MFRVs and Associated Bypass Valves B 3.7.3 BASES (continued)

APPLICABILITY The MFIVs and MFRVs and the associated bypass valves must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators. This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator. In MODES 1, 2, and 3, the MFIVs and MFRVs and the associated bypass valves are required to be OPERABLE, except when closed and de-activated to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are closed and de-activated or isolated by a closed manual valve, they are already performing their safety function.

In MODES 4, 5, and 6, steam generator energy is low. Therefore, the MFIVs, MFRVs, and the associated bypass valves are normally closed since MFW is not required.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each valve.

A.1 and A.2 With one MFIV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. When these valves are closed or isolated, they are performing their required safety function.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on operating experience.

Inoperable MFIVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.

(continued)

Watts Bar - Unit 2 B 3.7-16 (developmental) A

MFIVs and MFRVs and Associated Bypass Valves B 3.7.3 BASES ACTIONS B.1 and B.2 (continued)

With one MFRV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. When these valves are closed or isolated, they are performing their required safety function.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on operating experience.

Inoperable MFRVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid.

The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls to ensure that the valves are closed or isolated.

C.1 With one MFIV or MFRV bypass valve in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The inoperable valve should not be closed and isolated for long periods of time since the 6-inch bypass line provides a small tempering flow to the upper SG nozzle. This limits the temperature difference between the SG and condensate storage tank fluid which would be supplied by the AFW system. The 6-inch line may be isolated for short periods of time to support calorimetric flow measurements.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on operating experience.

(continued)

Watts Bar - Unit 2 B 3.7-17 (developmental) A

MFIVs and MFRVs and Associated Bypass Valves B 3.7.3 BASES ACTIONS D.1 (continued)

With an MFIV and an MFRV in the same flow path inoperable, there may be no redundant system to operate automatically and perform the required safety function. Under these conditions, at least one valve in the flow path must be restored to OPERABLE status, or the affected flow path isolated within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. This action returns the system to the condition where at least one valve in each flow path is performing the required safety function. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time is reasonable, based on operating experience, to complete the actions required to close the MFIV or MFRV, or otherwise isolate the affected flow path.

E.1 With two bypass valves in the same flow path inoperable, there may be no redundant system to operate automatically and perform the required safety function. Under these conditions, at least one valve in the flow path must be restored to OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The Completion Time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is consistent with Condition D.

F.1 and F.2 If the MFIV(s) and MFRV(s) and the associated bypass valve(s) cannot be restored to OPERABLE status, or the MFIV(s) or MFRV(s) closed, or isolated within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

Watts Bar - Unit 2 B 3.7-18 (developmental) A

MFIVs and MFRVs and Associated Bypass Valves B 3.7.3 BASES (continued)

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that the closure time of each MFIV, MFRV, and associated bypass valves is 6.5 seconds on an actual or simulated actuation signal. The MFIV and MFRV closure times are assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. These valves should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power. This is consistent with the American Society of Mechanical Engineers (ASME) OM Code (Ref. 2), quarterly stroke requirements during operation in MODES 1 and 2.

The Frequency for this SR is in accordance with the Inservice Testing Program or 18 months. The 18 month Frequency for valve closure is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.

REFERENCES 1. FSAR, Section 10.4.7, "Condensate and Feedwater Systems."

2. American Society of Mechanical Engineers (ASME) OM Code, "Code for Operation and Maintenance of Nuclear Power Plants."

Watts Bar - Unit 2 B 3.7-19 (developmental) A

ADVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Atmospheric Dump Valves (ADVs)

BASES BACKGROUND The ADVs provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Dump System to the condenser not be available, as discussed in the FSAR, Section 10.3 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the condensate storage tank (CST). The ADVs may also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Steam Dump System.

One ADV line for each of the four steam generators is provided. Each ADV line consists of one ADV and an associated block valve.

The ADVs are provided with upstream block valves to permit their being tested at power, and to provide an alternate means of isolation. The ADVs are equipped with pneumatic controllers to permit control of the cooldown rate.

The ADVs are provided with a pressurized air supply from the auxiliary air compressors that, on a loss of pressure in the normal instrument air supply, automatically supplies backup air to operate the ADVs. The ADVs are also supplied with nitrogen to permit local operation outside the valve rooms.

A description of the ADVs is found in Reference 1. The ADVs are OPERABLE with a DC power source and control air available. In addition, handwheels are provided for local manual operation.

APPLICABLE The design basis of the ADVs is established by the capability to cool the SAFETY unit to RHR entry conditions. The capacity of the ADVs is sufficient to ANALYSES achieve a cooldown rate of 50°F/hr throughout the entire cooldown to RHR entry conditions with 2 ADVs in service. This permits a uniform cooldown within the capacity of the cooling water supply available in the CST.

(continued)

Watts Bar - Unit 2 B 3.7-20 (developmental) A

ADVs B 3.7.4 BASES APPLICABLE In the accident analysis presented in Chapter 15.0 of the FSAR (Ref. 2),

SAFETY the ADVs are assumed to be used by the operator to cool down the unit ANALYSES to RHR entry conditions for accidents accompanied by a loss of offsite (continued) power. Prior to operator actions to cool down the unit, the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design value. For the recovery from a steam generator tube rupture (SGTR) event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for the ADVs. Four ADVs are required to be OPERABLE to satisfy the SGTR accident analysis requirements. This considers any single failure assumptions regarding the failure of one ADV to open on demand.

The ADVs are equipped with block valves in the event an ADV spuriously fails to open or fails to close during use.

The ADVs satisfy Criterion 3 of the NRC Policy Statement.

LCO Four ADV lines are required to be OPERABLE. One ADV line is required from each of four steam generators to ensure that at least two ADV lines are available to conduct a unit cooldown following an SGTR, in which one steam generator becomes unavailable, accompanied by a single, active failure of a second ADV line on an unaffected steam generator. The block valves must be OPERABLE to isolate a failed open ADV line.

Failure to meet the LCO can result in a delay in completing the SGTR recovery operations which could result in dose consequences that exceed accident analysis criteria.

An ADV is considered OPERABLE when it is capable of providing controlled relief of the main steam flow and capable of fully opening and closing on demand.

(continued)

Watts Bar - Unit 2 B 3.7-21 (developmental) A

ADVs B 3.7.4 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal, the ADVs are required to be OPERABLE.

In MODE 5 or 6, an SGTR is not a credible event.

ACTIONS A.1 With one required ADV line inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE ADV lines, a non-safety grade backup in the Steam Dump System, and MSSVs.

B.1 The four ADVs are supplied with safety-related Train A and Train B control air by the Auxiliary Control Air System (ACAS). Two valves receive Train A air and two valves receive Train B air. With one train (two ADV lines) inoperable due to an inoperable ACAS train, action must be taken to restore operability of the ACAS train to ensure operability of the ADV lines. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable since alternate means are available to operate the ADVs assuming an inoperable ACAS train, and the low probability of an event occurring during this period that would require the ADV lines. Normal control air is used to operate the valves, if available. In addition, the ADVs can be manually operated with the valve hand wheel, or by manually aligning a bottled nitrogen system to the valve operators. Each ADV is provided with a main and alternate nitrogen bottle designed to operate the valves if normal and emergency air supplies are lost. Further, the MSSVs will provide system over pressure protection if the ADVs fail to function, and the condenser steam dump valves will normally be available for plant cooldown.

C.1 With two or more ADV lines inoperable, action must be taken to restore all but one ADV line to OPERABLE status. Since the block valve can be closed to isolate an ADV, some repairs may be possible with the unit at power. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable to repair inoperable ADV lines, based on the availability of the Steam Dump System and MSSVs, and the low probability of an event occurring during this period that would require the ADV lines.

(continued)

Watts Bar - Unit 2 B 3.7-22 (developmental) A

ADVs B 3.7.4 BASES ACTIONS D.1 and D.2 (continued)

If the ADV lines cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4, without reliance upon steam generator for heat removal, within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the ADVs must be able to be opened either remotely or locally and throttled through their full range.

This SR ensures that the ADVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an ADV during a unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

SR 3.7.4.2 The function of the block valve is to isolate a failed open ADV. Cycling the block valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

REFERENCES 1. Watts Bar FSAR, Section 10.3, "Main Steam Supply System."

2. Watts Bar FSAR, Section 15.0, "Accident Analysis."

Watts Bar - Unit 2 B 3.7-23 (developmental) A

AFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps take suction from the condensate storage tank (CST) (LCO 3.7.6) and pump to the steam generator secondary side via separate connections to the main feedwater (MFW) bypass line piping. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1) or atmospheric dump valves (LCO 3.7.4). If the main condenser is available, steam may be released via the steam dump valves and recirculated to the CST.

The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains. Each motor driven pump provides 410 gpm of AFW flow, and the turbine driven pump provides 720 gpm to the steam generators, as assumed in the accident analysis. The pumps are equipped with independent recirculation lines to prevent pump operation against a closed system. Each motor driven AFW pump is powered from an independent Class 1E power supply and feeds two steam generators. The steam turbine driven AFW pump receives steam from one of two main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump.

The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions; however, the Main Feedwater System will normally perform these functions.

The turbine driven AFW pump supplies a common header capable of feeding all steam generators. One pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions. Thus, the requirement for diversity in motive power sources for the AFW System is met.

(continued)

Watts Bar - Unit 2 B 3.7-24 (developmental) A

AFW System B 3.7.5 BASES BACKGROUND The AFW System is designed to supply sufficient water to the steam (continued) generator(s) to remove decay heat with steam generator pressure at the lowest setpoint (plus 3% tolerance plus 3% accumulation) of the MSSVs.

Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the ADVs.

The AFW System actuates automatically on steam generator water level

- low-low by the ESFAS (LCO 3.3.2). The motor driven pumps start on a two-out-of-three low-low level signal in any steam generator and the turbine driven pump starts on a two-out-of-three low-low level signal in any two steam generators. The system also actuates on loss of offsite power, safety injection, and trip of both turbine-driven MFW pumps.

The AFW System is discussed in the FSAR, Section 10.4.9 (Ref. 1).

APPLICABLE The AFW System mitigates the consequences of any event with loss of SAFETY normal feedwater.

ANALYSES The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest steam generator safety valve set pressure plus 3% tolerance plus 3% accumulation.

In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to account for flow losses such as pump recirculation and line breaks.

The limiting Design Basis Accidents (DBAs) and transients for the AFW System are as follows:

a. Feedwater Line Break (FWLB); and

b. Loss of MFW.

In addition, the minimum available AFW flow and system characteristics are serious considerations in the analysis of a small break loss of coolant accident (LOCA).

(continued)

Watts Bar - Unit 2 B 3.7-25 (developmental) A

AFW System B 3.7.5 BASES APPLICABLE The AFW System design is such that it can perform its function following SAFETY an FWLB between the MFW check valves and the steam generators, ANALYSES combined with a loss of offsite power following turbine trip, and a single (continued) active failure of the steam turbine driven AFW pump. One motor driven AFW pump would deliver to the faulted steam generator. Sufficient flow would be delivered to the intact steam generators by the redundant AFW pump.

The ESFAS automatically actuates the AFW turbine driven pump and associated power operated valves and controls when required to ensure an adequate feedwater supply to the steam generators during loss of power.

Each motor driven auxiliary feedwater pump (one Train A and one Train B) supplies flow paths to two steam generators. Each flow path contains automatic air-operated level control valves (LCVs). The LCVs have the same train designation as the associated pump and are provided trained air. The turbine-driven auxiliary feedwater pump supplies flow paths to all four steam generators. Each of these flow paths contains an automatic air-operated LCV, two of which are designated as Train A, receive A-train air and provide flow to the same steam generators that are supplied by the B-train motor driven auxiliary feedwater pump. The remaining two LCVs are designated as Train B, receive B-train air, and provide flow to the same steam generators that are supplied by the A-train motor driven pump. This design provides the required redundancy to ensure that at least two steam generators receive the necessary flow assuming any single failure. It can be seen from the description provided above that the loss of a single train of air (A or B) will not prevent the auxiliary feedwater system from performing its intended safety function and is no more severe than the loss of a single auxiliary feedwater pump. Therefore, the loss of a single train of auxiliary air only affects the capability of a single motor driven auxiliary feedwater pump because the turbine-driven pump is still capable of providing flow to the two steam generators that are separated from the other motor driven pump.

The AFW System satisfies the requirements of Criterion 3 of the NRC Policy Statement.

(continued)

Watts Bar - Unit 2 B 3.7-26 (developmental) A

AFW System B 3.7.5 BASES (continued)

LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of RHR capability for all events accompanied by a loss of offsite power and a single failure.

This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs.

The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE. This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to separate steam generators. The turbine driven AFW pump is required to be OPERABLE with redundant steam supplies from each of two main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to any of the steam generators. The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE.

The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODE 4, the AFW System may be used for heat removal via the steam generators.

In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

(continued)

Watts Bar - Unit 2 B 3.7-27 (developmental) A

AFW System B 3.7.5 BASES ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train when entering MODE 1. There is an increased risk associated with entering MODE 1 with an AFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If one of the two steam supplies to the turbine driven AFW train is inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:

a. The redundant OPERABLE steam supply to the turbine driven AFW pump;

b. The availability of redundant OPERABLE motor driven AFW pumps; and

c. The low probability of an event occurring that requires the inoperable steam supply to the turbine driven AFW pump.

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

B.1 With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

(continued)

Watts Bar - Unit 2 B 3.7-28 (developmental) A

AFW System B 3.7.5 BASES ACTIONS B.1 (continued)

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

C.1 and C.2 When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE 1, 2, or 3, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in accordance with the Note that modifies the LCO. Although not required, the plant may continue to cool down and initiate RHR.

D.1 If all three AFW trains are inoperable in MODE 1, 2, or 3, the plant is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with non-safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.

Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the plant into a less safe condition.

(continued)

Watts Bar - Unit 2 B 3.7-29 (developmental) A

AFW System B 3.7.5 BASES ACTIONS E.1 (continued)

In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6, "RCS Loops - MODE 4." With one required AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.

Automatic actuation of AFW is not required in MODE 4; therefore, AFW/ERCW interface valves are not required to be in service.

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths exist for AFW operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves.

This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by American Society of Mechanical Engineers (ASME) OM Code (Ref. 2). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. Performance of inservice testing discussed in the ASME OM (Ref. 2) (only required at 3 month intervals) satisfies this requirement. The 31 day Frequency on a STAGGERED TEST BASIS results in testing each pump once every 3 months, as required by Reference 2.

(continued)

Watts Bar - Unit 2 B 3.7-30 (developmental) A

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.2 (continued)

REQUIREMENTS This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there may be insufficient steam pressure to perform the test.

SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative control.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is acceptable based on operating experience and the design reliability of the equipment. This SR is modified by a Note that states that the SR is not required in MODE 4. MODE 4 does not require automatic activation of the AFW because there is a sufficient time frame for operator action. This is based on the fact that even at 0% power (MODE 3) there is approximately a 10 minute trip delay before actuation of the AFW system to allow for operator action. In MODE 4, the heat removal requirements would be less providing more time for operator action.

SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

(continued)

Watts Bar - Unit 2 B 3.7-31 (developmental) A

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.4 (continued)

REQUIREMENTS This SR is modified by two Notes. Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there may be insufficient steam pressure to perform the test. Note 2 states that the SR is not required in MODE 4. MODE 4 does not require automatic activation of the AFW because there is a sufficient time frame for operator action. This is based on the fact that even at 0% power (MODE 3) there is approximately a 10 minute trip delay before actuation of the AFW system to allow for operator action. In MODE 4, the heat removal requirements would be less providing more time for operator action.

SR 3.7.5.5 This SR verifies that the AFW is properly aligned by verifying the flow through the flow paths from the CST to each steam generator prior to entering MODE 2 after initial fuel loading and prior to subsequent entry into MODE 2 whenever the unit has been in any combination of MODES 5 or 6 for greater than 30 days. Operability of AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown.

The Frequency is reasonable, based on engineering judgment and other administrative controls that ensure that flow paths remain OPERABLE.

To further ensure AFW System alignment, flow path OPERABILITY is verified following extended outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the CST to the steam generators is properly aligned.

REFERENCES 1. Watts Bar FSAR, Section 10.4.9, "Auxiliary Feedwater System."

2. American Society of Mechanical Engineers (ASME) OM Code, "Code for Operation and Maintenance of Nuclear Power Plants."

Watts Bar - Unit 2 B 3.7-32 (developmental) A

CST B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST)

BASES BACKGROUND The CST provides a preferred source of water to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5). The steam produced is released to the atmosphere by the main steam safety valves or the atmospheric dump valves. The AFW pumps operate with a continuous recirculation to the CST.

When the main steam isolation valves are open, the preferred means of heat removal is to discharge steam to the condenser by the non-safety grade path of the steam dump valves. The condensed steam is returned to the CST by the condenser level control valves. This has the advantage of conserving condensate while minimizing releases to the environment.

Because the CST is not designed to withstand earthquakes and other natural phenomena, including missiles that might be generated by natural phenomena, feedwater is also available from the Essential Raw Cooling Water (ERCW) System as the safety grade water source.

A description of the CST is found in the FSAR, Section 9.2.6 (Ref. 1).

APPLICABLE The CST provides the preferred cooling water to remove decay heat and SAFETY to cool down the unit following all events in the accident analysis as ANALYSES discussed in the FSAR, Chapters 6 and 15 (Refs. 2 and 3, respectively).

However, the ERCW System provides the safety grade water source to meet a DBA should the CST become unavailable. For anticipated operational occurrences and accidents that do not affect the OPERABILITY of the steam generators, the analysis assumption is generally 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at MODE 3, steaming through the MSSVs, followed by a cooldown to residual heat removal (RHR) entry conditions at the design cooldown rate.

(continued)

Watts Bar - Unit 2 B 3.7-33 (developmental) A

CST B 3.7.6 BASES APPLICABLE The limiting event for the condensate volume is the large feedwater line SAFETY break coincident with a loss of offsite power. Single failures that also ANALYSES affect this event include the following:

(continued)

a. Failure of the diesel generator powering the motor driven AFW pump to the unaffected steam generators (requiring additional steam to drive the remaining AFW pump turbine); and

b. Failure of the steam driven AFW pump (requiring a longer time for cooldown using only one motor driven AFW pump).

These are not usually the limiting failures in terms of consequences for these events.

A non-limiting event considered in CST inventory determinations is a break in either the main feedwater bypass line or AFW line near where the two join. This break has the potential for dumping condensate until terminated by operator action. This loss of condensate inventory is partially compensated for by the retention of steam generator inventory.

Because the CST is the preferred source of feedwater and is relied on almost exclusively for accidents and transients, the CST satisfies Criterion 3 of the NRC Policy Statement.

LCO As the preferred water source to satisfy accident analysis assumptions, the CST must contain sufficient cooling water to remove decay heat for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following a reactor trip from 100.6% RTP, and then to cool down the RCS to RHR entry conditions, assuming a coincident loss of offsite power and the most adverse single failure. In doing this, it must retain sufficient water to ensure adequate net positive suction head for the AFW pumps during cooldown, as well as account for any losses from the steam driven AFW pump turbine, or before isolating AFW to a broken line.

The CST level required is equivalent to a usable volume of 200,000 gallons, which is based on holding the unit in MODE 3 for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, followed by a cooldown to RHR entry conditions at 50°F/hour.

This basis is established in Reference 4 and exceeds the volume required by the accident analysis.

The OPERABILITY of the CST is determined by maintaining the tank level at or above the minimum required level.

(continued)

Watts Bar - Unit 2 B 3.7-34 (developmental) A

CST B 3.7.6 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the CST is required to be OPERABLE.

In MODE 5 or 6, the CST is not required because the AFW System is not required.

ACTIONS A.1 and A.2 If the CST level is not within limits, the OPERABILITY of the backup supply should be verified by administrative means within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter. OPERABILITY of the backup feedwater supply must include verification that the flow paths from the backup water supply to the AFW pumps are OPERABLE. The CST must be restored to OPERABLE status within 7 days, because the backup supply may be performing this function in addition to its normal functions. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, based on operating experience, to verify the OPERABILITY of the backup water supply. The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period requiring the CST.

B.1 and B.2 If the CST cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4, without reliance on the steam generator for heat removal, within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that the CST contains a volume of 200,000 gallons (value accounts for instrument error) of cooling water. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is based on operating experience and the need for operator awareness of unit evolutions that may affect the CST inventory between checks. Also, the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal deviations in the CST level.

(continued)

Watts Bar - Unit 2 B 3.7-35 (developmental) B

CST B 3.7.6 BASES (continued)

REFERENCES 1. Watts Bar FSAR, Section 9.2.6, "Condensate Storage Facilities."

2. Watts Bar FSAR, Chapter 6, "Engineered Safety Features."

3. Watts Bar FSAR, Chapter 15, "Accident Analyses."

4. TVA Calculation HCG-LCS-043085, "Minimum CST Water Level Required to Support the AFW System."

Watts Bar - Unit 2 B 3.7-36 (developmental) B

CCS B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Component Cooling System (CCS)

BASES BACKGROUND The CCS provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCS also provides this function for various non-essential components, as well as the spent fuel storage pool. The CCS serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Essential Raw Cooling Water (ERCW) System, and thus to the environment.

The CCS is arranged as two independent, full-capacity cooling trains, Train A and Train B. Train A in Unit 2 is served by CCS Hx A and CCS pump 1A-A. Pump 1B-B, which is actually Train B equipment, is also normally aligned to the Train A header in Unit 2. However, pump 1B-B can be realigned to Train B on loss of Train A.

Train B is served by CCS Hx C. Normally, only CCS pump C-S is aligned to the Train B header since few non-essential, normally-operating loads are assigned to Train B. However, pump 1B-B can be realigned to the Train B header on a loss of the C-S pump.

Each safety related train is powered from a separate bus. An open surge tank in the system provides pump trip protective functions to ensure that sufficient net positive suction head is available. The pump in each train is automatically started on receipt of a safety injection signal, and all non-essential components will be manually isolated.

Additional information on the design and operation of the system, along with a list of the components served, is presented in the FSAR, Section 9.2.2 (Ref. 1). The principal safety related function of the CCS is the removal of decay heat from the reactor via the Residual Heat Removal (RHR) System. This may be during a normal or post accident cooldown and shutdown.

(continued)

Watts Bar - Unit 2 B 3.7-37 (developmental) A

CCS B 3.7.7 BASES (continued)

APPLICABLE The design basis of the CCS is for one CCS train to remove the post loss SAFETY of coolant accident (LOCA) heat load from the containment sump during ANALYSES the recirculation phase, with a maximum CCS temperature of 110°F (Ref. 2). The Emergency Core Cooling System (ECCS) LOCA and containment OPERABILITY LOCA each model the maximum and minimum performance of the CCS, respectively. The normal temperature of the CCS is 95°F, and, during unit cooldown to MODE 5 (Tcold < 200°F),

a maximum temperature of 110°F is assumed. The CCS design based on these values, bounds the post accident conditions such that the sump fluid will not increase in temperature after alignment of the RHR heat exchangers during the recirculation phase following a LOCA, and provides a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System (RCS) by the ECCS pumps.

The CCS is designed to perform its function with a single failure of any active component, assuming a loss of offsite power.

The CCS also functions to cool the unit from RHR entry conditions (Tcold < 350°F), to MODE 5 (Tcold < 200°F), during normal and post accident operations. The time required to cool from 350°F to 200°F is a function of the number of CCS and RHR trains operating. One CCS train is sufficient to remove decay heat during subsequent operations with Tcold < 200°F. This assumes a maximum ERCW temperature of 85°F occurring simultaneously with the maximum heat loads on the system.

The CCS satisfies Criterion 3 of the NRC Policy Statement.

LCO The CCS trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCS train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCS must be OPERABLE.

At least one CCS train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.

A CCS train is considered OPERABLE when:

a. The pump and associated surge tank are OPERABLE; and

b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.

(continued)

Watts Bar - Unit 2 B 3.7-38 (developmental) A

CCS B 3.7.7 BASES LCO The isolation of CCS from other components or systems not required for (continued) safety may render those components or systems inoperable but does not affect the OPERABILITY of the CCS.

APPLICABILITY In MODES 1, 2, 3, and 4, the CCS is a normally operating system, which must be prepared to perform its post accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger.

In MODE 5 or 6, the OPERABILITY requirements of the CCS are determined by the systems it supports.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4,"

be entered if an inoperable CCS train results in an inoperable RHR loop.

This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

If one CCS train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE CCS train is adequate to perform the heat removal function.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.

B.1 and B.2 If the CCS train cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

Watts Bar - Unit 2 B 3.7-39 (developmental) A

CCS B 3.7.7 BASES (continued)

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR verifies that the C-S pump is powered from the normal power source when it is aligned for OPERABLE status. Verification of the correct power alignment ensures that the two CCS trains remain independent. The 7 day Frequency is based on engineering judgment, is consistent with procedural controls governing breaker operation, and ensures correct breaker position.

SR 3.7.7.2 This SR is modified by a Note indicating that the isolation of the CCS flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCS.

Verifying the correct alignment for manual, power operated, and automatic valves in the CCS flow path provides assurance that the proper flow paths exist for CCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

(continued)

Watts Bar - Unit 2 B 3.7-40 (developmental) A

CCS B 3.7.7 BASES SURVEILLANCE SR 3.7.7.3 REQUIREMENTS (continued) This SR verifies proper automatic operation of the CCS valves on an actual or simulated actuation signal. The CCS is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative control. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.7.7.4 This SR verifies proper automatic operation of the CCS pumps on an actual or simulated actuation signal. The CCS is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. Watts Bar FSAR, Section 9.2.2, "Component Cooling System."

2. Watts Bar Component Cooling System Description, N3-70-4002.

Watts Bar - Unit 2 B 3.7-41 (developmental) A

ERCW B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Essential Raw Cooling Water (ERCW) System BASES BACKGROUND The ERCW provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the ERCW System also provides this function for various safety related and non-safety related components. The safety related function is covered by this LCO.

The shared ERCW system consists of eight 50% ERCW pumps, four traveling water screens, four screen wash pumps, four strainers, associated piping, valves, and instrumentation.

Water for the ERCW system enters two separate sump areas of the pumping station through four traveling water screens, two for each sump.

Four ERCW pumping units, all on the same plant train, take suction from one of the sumps, and four more on the opposite plant train take suction from the other sump. One set of pumps and associated equipment is designated Train A, and the other Train B. These trains are redundant and are normally maintained separate and independent of each other.

Each set of four pumps discharges into a common manifold, from which two separate headers (1A and 2A for Train A, and 1B and 2B for Train B) each with its own automatic backwashing strainer, supply water to the various system users. Two pumps per train are adequate to supply worst case conditions. Two pumps per train are aligned to receive power from different diesel generators. Operator designated pumps and valves are remote and manually aligned, except in the unlikely event of a loss-of-coolant accident (LOCA). The pumps are automatically started upon receipt of a safety injection (SI) signal, and some essential valves are aligned to their post-accident positions. Some manual realignments of motor-operated valves (MOVs) are necessary. The ERCW System also provides emergency makeup to the Component Cooling System (CCS) and is the backup water supply to the Auxiliary Feedwater System.

Additional information about the design and operation of the ERCW, along with a list of the components served, is presented in the FSAR, Section 9.2.1 (Ref. 1). The principal safety related function of the ERCW System is the removal of decay heat from the reactor via the CCS.

(continued)

Watts Bar - Unit 2 B 3.7-42 (developmental) A

ERCW B 3.7.8 BASES (continued)

APPLICABLE The design basis of the ERCW System is for one ERCW train, in SAFETY conjunction with the CCS and a 100% capacity Containment Spray ANALYSES System and Residual Heat Removal (RHR), to remove core decay heat following a design basis LOCA as discussed in the FSAR, Section 9.2.1 (Ref. 1). This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System by the ECCS pumps. The ERCW System is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.

The ERCW System, in conjunction with the CCS, also cools the unit from RHR, as discussed in the FSAR, Section 5.5.7, (Ref. 2) entry conditions to MODE 5 during normal and post accident operations. The time required for this evolution is a function of the number of CCS and RHR System trains that are operating. One ERCW train is sufficient to remove decay heat during subsequent operations in MODES 5 and 6. This assumes a maximum ERCW temperature of 85°F occurring simultaneously with maximum heat loads on the system.

The ERCW System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two ERCW trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming that the worst case single active failure occurs coincident with the loss of offsite power.

An ERCW train is considered OPERABLE during MODES 1, 2, 3, and 4 when:

a. Two pumps, aligned to separate shutdown boards, are OPERABLE; and

b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.

(continued)

Watts Bar - Unit 2 B 3.7-43 (developmental) A

ERCW B 3.7.8 BASES (continued)

APPLICABILITY In MODES 1, 2, 3, and 4, the ERCW System is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the ERCW System and required to be OPERABLE in these MODES.

In MODES 5 and 6, the OPERABILITY requirements of the ERCW System are determined by the systems it supports.

ACTIONS A.1 If one ERCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE ERCW train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE ERCW train could result in loss of ERCW System function. Required Action A.1 is modified by two Notes.

The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating," should be entered if an inoperable ERCW train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," should be entered if an inoperable ERCW train results in an inoperable decay heat removal train. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

B.1 and B.2 If the ERCW train cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

Watts Bar - Unit 2 B 3.7-44 (developmental) A

ERCW B 3.7.8 BASES (continued)

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the ERCW flow to individual components may render those components inoperable, but does not affect the OPERABILITY of the ERCW System.

Verifying the correct alignment for manual, power operated, and automatic valves in the ERCW System flow path provides assurance that the proper flow paths exist for ERCW System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.8.2 This SR verifies proper automatic operation of the ERCW System valves on an actual or simulated actuation signal. The ERCW System is a normally operating system that cannot be fully actuated as part of normal testing. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative control. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

(continued)

Watts Bar - Unit 2 B 3.7-45 (developmental) A

ERCW B 3.7.8 BASES SURVEILLANCE SR 3.7.8.3 REQUIREMENTS (continued) This SR verifies proper automatic operation of the ERCW pumps on an actual or simulated actuation signal. The ERCW System is a normally operating system that cannot be fully actuated as part of normal testing during normal operation. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. Watts Bar FSAR, Section 9.2.1, "Essential Raw Cooling Water."

2. Watts Bar FSAR, Section 5.5.7, "Residual Heat Removal System."

Watts Bar - Unit 2 B 3.7-46 (developmental) A

UHS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Ultimate Heat Sink (UHS)

BASES BACKGROUND The UHS provides a heat sink for processing and operating heat from safety related components during a transient or accident, as well as during normal operation. This is done by utilizing the Essential Raw Cooling Water (ERCW) System and the Component Cooling System (CCS).

The UHS is defined as the Tennessee River, including the TVA controlled dams upstream of the intake structure, Chickamauga Dam (the nearest downstream dam), and the plant intake channel, not including the intake structure, as discussed in FSAR Section 9.2.5 (Ref. 1). The maximum UHS temperature of 85°F ensures adequate heat load removal capacity for a minimum of 30 days after reactor shutdown or a shutdown following an accident, including a Loss of Coolant Accident (LOCA).

Additional information on the design and operation of the system, along with a list of components served, can be found in Reference 1.

APPLICABLE The UHS is the sink for heat removed from the reactor core following all SAFETY accidents and anticipated operational occurrences in which the unit is ANALYSES cooled down and placed on residual heat removal (RHR) operation. Its maximum post accident heat load occurs approximately 20 minutes after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment cooling systems and RHR are required to remove the core decay heat.

The operating limits are based on conservative heat transfer analyses for the worst case LOCA. Reference 1 provides the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and worst case single active failure. The UHS is designed in accordance with Regulatory Guide 1.27 (Ref. 2), which requires a 30 day supply of cooling water in the UHS.

The UHS satisfies Criterion 3 of the NRC Policy Statement.

(continued)

Watts Bar - Unit 2 B 3.7-47 (developmental) A

UHS B 3.7.9 BASES (continued)

LCO The UHS is required to be OPERABLE and is considered OPERABLE if it contains water at or below the maximum temperature that would allow the ERCW System to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the ERCW System. To meet this condition, the UHS temperature should not exceed 85°F.

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.

In MODE 5 or 6, the OPERABILITY requirements of the UHS are determined by the systems it supports.

ACTIONS A.1 and A.2 If the UHS is inoperable, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.9.1 REQUIREMENTS This SR verifies that the ERCW System is available to cool the CCS to at least its maximum design temperature with the maximum accident or normal design heat loads for 30 days following a Design Basis Accident.

The 24-hour Frequency is based on operating experience related to trending of the parameter variations during the applicable MODES. This SR verifies that the average water temperature of the UHS is 85°F (value does not account for instrument error).

(continued)

Watts Bar - Unit 2 B 3.7-48 (developmental) B

UHS B 3.7.9 BASES (continued)

REFERENCES 1. Watts Bar FSAR, Section 9.2.5, "Ultimate Heat Sink."

2. Regulatory Guide 1.27, "Ultimate Heat Sink for Nuclear Power Plants," Revision 1, March 1974.

Watts Bar - Unit 2 B 3.7-49 (developmental) B

CREVS B 3.7.10 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Emergency Ventilation System (CREVS)

BASES BACKGROUND The CREVS provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.

The CREVS consists of two independent, redundant trains that recirculate and filter the air in the control room envelope (CRE) and a CRE boundary that limits the inleakage of unfiltered air. Each CREVS train consists of a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan.

Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

The CREVS is an emergency system, parts of which also operate during normal unit operations.

Actuation of the CREVS occurs automatically upon receipt of a safety injection signal in either unit or upon indication of high radiation in the outside air supply. Actuation of the system to the emergency mode of operation, closes the unfiltered outside air intake and unfiltered exhaust dampers, and aligns the system for recirculation of the air within the CRE through the redundant trains of air handling units, with a portion of the stream of air directed through HEPA and the charcoal filters. The (continued)

Watts Bar - Unit 2 B 3.7-50 (developmental) A

CREVS B 3.7.10 BASES BACKGROUND emergency mode also initiates pressurization and filtered ventilation of (continued) the air supply to the CRE. Pressurization of the CRE prevents infiltration of unfiltered air from the surrounding areas of the building.

A single CREVS train operating at a flow rate of 4000 cubic feet per minute plus or minus 10 percent (includes less than or equal to 711 cubic feet per minute pressurization flow) will pressurize the CRE to a minimum 0.125 inches water gauge relative to external areas adjacent to the CRE boundary. The CREVS operation in maintaining the CRE habitable is discussed in the FSAR, Section 6.4 (Ref. 1).

Redundant supply and recirculation trains provide the required filtration should an excessive pressure drop develop across the other filter train.

Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. A portion of the CREVS supply air ducting serving the main control room consists of round flexible ducting, triangular ducting constructed of duct board, and connecting metallic flow channels called air bars. These components are qualified to Seismic Category 1(L) requirements, which will ensure 1) the ducting will remain in place, 2) the physical configuration will be maintained such that flow will not be impeded, and 3) the ducting pressure boundary will not be lost during or subsequent to a SSE (Ref. 3). The remaining portions of CREVS are designed in accordance with Seismic Category I requirements (Ref. 4).

The CREVS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a Design Basis Accident (DBA) without exceeding a 5 rem whole body dose or its equivalent to any part of the body.

APPLICABLE The CREVS components are arranged in redundant, safety related SAFETY ventilation trains. The location of components and ducting within the CRE ANALYSES ensures an adequate supply of filtered air to all areas requiring access.

The CREVS provides airborne radiological protection for the CRE occupants, as demonstrated by the CRE occupant dose analyses for the most limiting design basis loss of coolant accident, fission product release presented in the FSAR, Section 15.5.3 (Ref. 5).

The CREVS provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 1 and 2). The evaluation of (continued)

Watts Bar - Unit 2 B 3.7-51 (developmental) A

CREVS B 3.7.10 BASES (continued)

APPLICABLE a smoke challenge demonstrates that it will not result in the inability of the SAFETY CRE occupants to control the reactor either from the control room or from ANALYSES the remote shutdown panels (Ref. 1 and 2).

(continued)

The worst case single active failure of a component of the CREVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

The CREVS satisfies Criterion 3 of the NRC Policy Statement.

LCO Two independent and redundant CREVS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem whole body or its equivalent to any part of the body to the CRE occupants in the event of a large radioactive release.

Each CREVS train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.

A CREVS train is OPERABLE when the associated:

a. Fan is OPERABLE;

b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions; and

c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CREVS trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is (continued)

Watts Bar - Unit 2 B 3.7-52 (developmental) A

CREVS B 3.7.10 BASES (continued)

LCO performed by the person(s) entering or exiting the area. For other (continued) openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6 and during movement of irradiated fuel assemblies, the CREVS must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.

In MODES 5 and 6, the CREVS is required to cope with the release from the rupture of a waste gas decay tank.

During movement of irradiated fuel assemblies, the CREVS must be OPERABLE to cope with the release from a fuel handling accident.

ACTIONS A.1 When one CREVS train is inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREVS train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREVS train could result in loss of CREVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

B.1, B.2 and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem whole body or its equivalent to any part of the body), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

(continued)

Watts Bar - Unit 2 B 3.7-53 (developmental) A

CREVS B 3.7.10 BASES ACTIONS B.1, B.2 and B.3 (continued)

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

C.1 and C.2 In MODE 1, 2, 3, or 4, if the inoperable CREVS train or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the plant must be placed in a MODE that minimizes accident risk.

To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 and D.2 In MODE 5 or 6, or during movement of irradiated fuel assemblies, if the inoperable CREVS train cannot be restored to OPERABLE status within the required Completion Time, action must be taken to immediately place the OPERABLE CREVS train in the emergency mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected.

(continued)

Watts Bar - Unit 2 B 3.7-54 (developmental) A

CREVS B 3.7.10 BASES ACTIONS D.1 and D.2 (continued)

An alternative to Required Action D.1 is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

E.1 If both CREVS trains are inoperable in MODE 1, 2, 3, or 4, due to actions taken as a result of a tornado, the CREVS may not be capable of performing the intended function because of loss of pressurizing air to the control room. At least one train must be restored to OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> restoration time is considered reasonable considering the low probability of occurrence of a design basis accident concurrent with a tornado warning.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 In MODE 5 or 6, or during movement of irradiated fuel assemblies with two CREVS trains inoperable or with one or more CREVS trains inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

G.1 If both CREVS trains are inoperable in MODE 1, 2, 3, or 4, for reasons other than Condition B or Condition E the CREVS may not be capable of performing the intended function and the plant is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

(continued)

Watts Bar - Unit 2 B 3.7-55 (developmental) A

CREVS B 3.7.10 BASES SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides an adequate check of this system. The systems need only be operated for 15 minutes to demonstrate the function of the system. The 31-day Frequency is based on the reliability of the equipment and the two train redundancy.

SR 3.7.10.2 This SR verifies that the required CREVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The CREVS filter tests are in accordance with Regulatory Guide 1.52 (Ref. 6).

The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.10.3 This SR verifies that each CREVS train starts and operates on an actual or simulated actuation signal. The Frequency of 18 months is based on industry operating experience and is consistent with the typical refueling cycle.

(continued)

Watts Bar - Unit 2 B 3.7-56 (developmental) A

CREVS B 3.7.10 BASES SURVEILLANCE SR 3.7.10.4 REQUIREMENTS (continued) This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered.

Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3 (Ref. 7), which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 8). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 9).

Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

REFERENCES 1. Watts Bar FSAR, Section 6.4, "Habitability Systems."

2. Watts Bar FSAR, Section 9.4, "Air Conditioning, Heating, Cooling, and Ventilation Systems."

3. Watts Bar FSAR, Section 3.7.3.18, Seismic Qualification of Main Control Room Suspended Ceiling and Air Delivery Components.

4. NRC Safety Evaluation dated February 12, 2004, for License Amendment 50.

5. Watts Bar FSAR, Section 15.5.3, "Environmental Consequences of a Postulated Loss of Coolant Accident."

Watts Bar - Unit 2 B 3.7-57 (developmental) A

CREVS B 3.7.10 BASES REFERENCES 6. Regulatory Guide 1.52, Revision 2, "Design, Testing, and (continued) Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Adsorption Units of Light-Water Cooled Nuclear Power Plants."

7. Regulatory Guide 1.196, Revision 0, Control Room Habitability at Light-Water Nuclear Power Reactors

8. NEI 99-03, "Control Room Habitability Assessment," June 2001.

9. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).

Watts Bar - Unit 2 B 3.7-58 (developmental) A

CREATCS B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Control Room Emergency Air Temperature Control System (CREATCS)

BASES BACKGROUND The CREATCS provides temperature control for the control room following isolation of the control room.

The CREATCS consists of two independent and redundant trains that provide cooling of recirculated control room air. Each train consists of an air handling unit (AHU), water chiller, chilled water pump, and associated piping, ductwork, instrumentation, and controls to provide for control room temperature control. The CREATCS is a subsystem providing air temperature control for the control room.

The CREATCS is an emergency system, parts of which also operate during normal unit operations. A single train will provide the required temperature control to maintain the control room between 60°F and 104°F. The CREATCS operation in maintaining the control room temperature is discussed in the FSAR, Section 9.4.1 (Ref. 1).

APPLICABLE The design basis of the CREATCS is to maintain the control room SAFETY temperature for 30 days of continuous occupancy.

ANALYSES The CREATCS components are arranged in redundant, safety related trains. During emergency operation, the CREATCS maintains the temperature between 60°F and 104°F. A single active failure of a component of the CREATCS, with a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control.

A portion of the CREATCS supply air ducting serving the main control room consists of round flexible ducting, triangular ducting constructed of duct board, and connecting metallic flow channels called air bars. These components are qualified to Seismic Category 1(L) requirements, which will ensure 1) the ducting will remain in place, 2) the physical configuration will be maintained such that flow will not be impeded, and

3) the ducting pressure boundary will not be lost during or subsequent to an SSE (Ref. 2). The remaining portions of CREATCS are designed in accordance with Seismic Category I requirements. The CREATCS is (continued)

Watts Bar - Unit 2 B 3.7-59 (developmental) A

CREATCS B 3.7.11 BASES APPLICABLE capable of removing sensible and latent heat loads from the control room, SAFETY which include consideration of equipment heat loads and personnel ANALYSES occupancy requirements, to ensure equipment OPERABILITY (Ref. 3).

(continued)

The CREATCS satisfies Criterion 3 of the NRC Policy Statement.

LCO Two independent and redundant trains of the CREATCS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disabling the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.

The CREATCS is considered to be OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both trains. These components include the chillers, AHUs, and associated temperature control instrumentation. In addition, the CREATCS must be operable to the extent that air circulation can be maintained.

APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies, the CREATCS must be OPERABLE to ensure that the control room temperature will not exceed equipment operational requirements following isolation of the control room.

In MODE 5 or 6, CREATCS is required during a control room isolation following a waste gas decay tank rupture.

ACTIONS A.1 With one CREATCS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CREATCS train is adequate to maintain the control room temperature within limits. However, the overall reliability is reduced because a single failure in the OPERABLE CREATCS train could result in loss of CREATCS function. The 30 day Completion Time is based on the low probability of an event requiring control room isolation, the consideration that the remaining train can provide the required protection, and that alternate safety or non-safety related cooling means are available.

(continued)

Watts Bar - Unit 2 B 3.7-60 (developmental) A

CREATCS B 3.7.11 BASES ACTIONS B.1 and B.2 (continued)

In MODE 1, 2, 3, or 4, if the inoperable CREATCS train cannot be restored to OPERABLE status within the required Completion Time, the plant must be placed in a MODE that minimizes the risk. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 In MODE 5 or 6, or during movement of irradiated fuel, if the inoperable CREATCS train cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CREATCS train must be placed in operation immediately. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that active failures will be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position.

D.1 In MODE 5 or 6, or during movement of irradiated fuel assemblies, with two CREATCS trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk. This does not preclude the movement of fuel to a safe position.

E.1 If both CREATCS trains are inoperable in MODE 1, 2, 3, or 4, the CREATCS may not be capable of performing its intended function.

Therefore, LCO 3.0.3 must be entered immediately.

(continued)

Watts Bar - Unit 2 B 3.7-61 (developmental) A

CREATCS B 3.7.11 BASES (continued)

SURVEILLANCE SR 3.7.11.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the heat load assumed in the sizing calculations in the control room. This SR consists of a combination of testing and calculations. This is accomplished by verifying that the system has not degraded. The only measurable parameters that could degrade undetected during normal operation are the system air flow and chilled water flow rate. Verification of these two flow rates will provide assurance that the heat removal capacity of the system is still adequate. The 18 month Frequency is appropriate since significant degradation of the CREATCS is slow and is not expected over this time period.

REFERENCES 1. Watts Bar FSAR, Section 9.4.1, "Control Room Area Ventilation System."

2. Watts Bar FSAR, Section 3.7.3.18, Seismic Qualification of Main Control Room Suspended Ceiling and Air Delivery Components.

3. NRC Safety Evaluation dated February 12, 2004, for License Amendment 50.

Watts Bar - Unit 2 B 3.7-62 (developmental) A

ABGTS B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Auxiliary Building Gas Treatment System (ABGTS)

BASES BACKGROUND The ABGTS filters airborne radioactive particulates from the area of the fuel pool following a fuel handling accident and from the area of active Unit 2 ECCS components and Unit 2 penetration rooms following a loss of coolant accident (LOCA).

The ABGTS consists of two independent and redundant trains. Each train consists of a heater, a prefilter, moisture separator, a high efficiency particulate air (HEPA) filter, two activated charcoal adsorber sections for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system.

A second bank of HEPA filters follows the adsorber section to collect carbon fines and provide backup in case the main HEPA filter bank fails.

The downstream HEPA filter is not credited in the analysis. The system initiates filtered ventilation of the Auxiliary Building Secondary Containment Enclosure (ABSCE) exhaust air following receipt of a Phase A containment isolation signal or a high radiation signal from the spent fuel pool area.

The ABGTS is a standby system, not used during normal plant operations. During emergency operations, the ABSCE dampers are realigned and ABGTS fans are started to begin filtration. Air is exhausted from the Unit 2 ECCS pump rooms, Unit 2 penetration rooms, and fuel handling area through the filter trains. The prefilters or moisture separators remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers.

The plant design basis requires that when moving irradiated fuel in the Auxiliary Building and/or Containment with the Containment open to the Auxiliary Building ABSCE spaces, a signal from the spent fuel pool radiation monitors 0-RE-90-102 and -103 will initiate a Containment Ventilation Isolation (CVI) in addition to their normal function. In addition, a signal from the containment purge radiation monitors 1-RE-90-130 and

-131 or other CVI signal will initiate that portion of the ABI normally initiated by the spent fuel pool radiation monitors. Therefore, the containment ventilation instrumentation must remain operable when moving irradiated fuel in the Auxiliary Building if the containment air locks, (continued)

Watts Bar - Unit 2 B 3.7-63 (developmental) A

ABGTS B 3.7.12 BASES BACKGROUND penetrations, equipment hatch, etc. are open to the Auxiliary Building (continued) ABSCE spaces. In addition, the ABGTS must remain operable if these containment penetrations are open to the Auxiliary Building during movement of irradiated fuel inside containment.

The ABGTS is discussed in the FSAR, Sections 6.5.1, 9.4.2, 15.0, and 6.2.3 (Refs. 1, 2, 3, and 4, respectively).

APPLICABLE The ABGTS design basis is established by the consequences of the SAFETY limiting Design Basis Accident (DBA), which is a fuel handling accident.

ANALYSES The analysis of the fuel handling accident, given in Reference 3, assumes that all fuel rods in an assembly are damaged. The analysis of the LOCA assumes that radioactive materials leaked from the Emergency Core Cooling System (ECCS) are filtered and adsorbed by the ABGTS. The DBA analysis of the fuel handling accident assumes that only one train of the ABGTS is functional due to a single failure that disables the other train. The accident analysis accounts for the reduction in airborne radioactive material provided by the one remaining train of this filtration system. The amount of fission products available for release from the ABSCE is determined for a fuel handling accident and for a LOCA. The assumptions and the analysis for a fuel handling accident follow the guidance provided in Regulatory Guide 1.25 (Ref. 5) and NUREG/CR-5009 (Ref. 10). The assumptions and analysis for a LOCA follow the guidance provided in Regulatory Guide 1.4 (Ref. 6).

The ABGTS satisfies Criterion 3 of the NRC Policy Statement.

When moving irradiated fuel inside containment or in the Auxiliary Building with containment air locks or penetrations open to the Auxiliary Building ABSCE spaces, or when moving fuel in the Auxiliary Building with the containment equipment hatch open, the provisions to initiate a CVI from the spent fuel pool radiation monitors and to initiate an ABI (i.e., the portion of an ABI normally initiated by the spent fuel pool radiation monitors) from a CVI, including a CVI initiated by the containment purge monitors, in the event of a fuel handling accident (FHA) must be in place and functioning. The containment equipment hatch cannot be open when moving irradiated fuel inside containment in accordance with Technical Specification 3.9.4.

The ABGTS is required to be operable during movement of irradiated fuel in the Auxiliary Building during any mode and during movement of irradiated fuel in the Reactor Building when the Reactor Building is (continued)

Watts Bar - Unit 2 B 3.7-64 (developmental) B

ABGTS B 3.7.12 BASES APPLICABLE established as part of the ABSCE boundary (see TS 3.3.8, 3.7.12, &

SAFETY 3.9.4). When moving irradiated fuel inside containment, at least one train ANALYSES of the containment purge system must be operating or the containment (continued) must be isolated. When moving irradiated fuel in the Auxiliary Building during times when the containment is open to the Auxiliary Building ABSCE spaces, containment purge can be operated, but operation of the system is not required. However, whether the containment purge system is operated or not in this configuration, all containment ventilation isolation valves and associated instrumentation must remain operable. This requirement is necessary to ensure a CVI can be accomplished from the spent fuel pool radiation monitors in the event of a FHA in the Auxiliary Building.

LCO Two independent and redundant trains of the ABGTS are required to be OPERABLE to ensure that at least one train is available, assuming a single failure that disables the other train, coincident with a loss of offsite power. Total system failure could result in the atmospheric release from the ABSCE exceeding the 10 CFR 100 (Ref. 7) limits in the event of a fuel handling accident or LOCA.

The ABGTS is considered OPERABLE when the individual components necessary to control exposure in the fuel handling building are OPERABLE in both trains. An ABGTS train is considered OPERABLE when its associated:

a. Fan is OPERABLE;

b. HEPA filter and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration function; and

c. Heater, moisture separator, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

APPLICABILITY In MODE 1, 2, 3, or 4, the ABGTS is required to be OPERABLE to provide fission product removal associated with ECCS leaks due to a LOCA and leakage from containment and annulus.

In MODE 5 or 6, the ABGTS is not required to be OPERABLE since the ECCS is not required to be OPERABLE.

(continued)

Watts Bar - Unit 2 B 3.7-65 (developmental) A

ABGTS B 3.7.12 BASES APPLICABILITY During movement of irradiated fuel in the fuel handling area, the ABGTS (continued) is required to be OPERABLE to alleviate the consequences of a fuel handling accident. See additional discussion in the Background and Applicable Safety Analysis sections.

ACTIONS A.1 With one ABGTS train inoperable, action must be taken to restore OPERABLE status within 7 days. During this period, the remaining OPERABLE train is adequate to perform the ABGTS function. The 7-day Completion Time is based on the risk from an event occurring requiring the inoperable ABGTS train, and the remaining ABGTS train providing the required protection.

B.1 and B.2 In MODE 1, 2, 3, or 4, when Required Action A.1 cannot be completed within the associated Completion Time, or when both ABGTS trains are inoperable, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 When Required Action A.1 cannot be completed within the required Completion Time, during movement of irradiated fuel assemblies in the fuel handling area, the OPERABLE ABGTS train must be started immediately or fuel movement suspended. This action ensures that the remaining train is OPERABLE, that no undetected failures preventing system operation will occur, and that any active failure will be readily detected.

If the system is not placed in operation, this action requires suspension of fuel movement, which precludes a fuel accident. This does not preclude the movement of fuel assemblies to a safe position.

(continued)

Watts Bar - Unit 2 B 3.7-66 (developmental) A

ABGTS B 3.7.12 BASES ACTIONS D.1 (continued)

When two trains of the ABGTS are inoperable during movement of irradiated fuel assemblies in the fuel handling area, action must be taken to place the unit in a condition in which the LCO does not apply. Action must be taken immediately to suspend movement of irradiated fuel assemblies in the fuel handling area. This does not preclude the movement of fuel to a safe position.

SURVEILLANCE SR 3.7.12.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environmental and normal operating conditions on this system are not severe, testing each train once every month provides an adequate check on this system.

Monthly heater operation dries out any moisture accumulated in the charcoal from humidity in the ambient air. The system must be operated for 10 continuous hours with the heaters energized. The 31-day Frequency is based on the known reliability of the equipment and the two train redundancy available.

SR 3.7.12.2 This SR verifies that the required ABGTS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The ABGTS filter tests are in accordance with Regulatory Guide 1.52 (Ref. 8).

The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).

Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.12.3 This SR verifies that each ABGTS train starts and operates on an actual or simulated actuation signal. The 18-month Frequency is consistent with Reference 8.

(continued)

Watts Bar - Unit 2 B 3.7-67 (developmental) A

ABGTS B 3.7.12 BASES SURVEILLANCE SR 3.7.12.4 REQUIREMENTS (continued) This SR verifies the integrity of the ABSCE. The ability of the ABSCE to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically tested to verify proper function of the ABGTS. During the post accident mode of operation, the ABGTS is designed to maintain a slight negative pressure in the ABSCE, to prevent unfiltered LEAKAGE. The ABGTS is designed to maintain a negative pressure between -0.25 inches water gauge and -0.5 inches water gauge (value does not account for instrument error) with respect to atmospheric pressure at a nominal flow rate 9300 cfm and 9900 cfm. The Frequency of 18 months is consistent with the guidance provided in NUREG-0800, Section 6.5.1 (Ref. 9).

An 18-month Frequency (on a STAGGERED TEST BASIS) is consistent with Reference 8.

REFERENCES 1. Watts Bar FSAR, Section 6.5.1, "Engineered Safety Feature (ESF)

Filter Systems."

2. Watts Bar FSAR, Section 9.4.2, "Fuel Handling Area Ventilation System."

3. Watts Bar FSAR, Section 15.0, "Accident Analysis."

4. Watts Bar FSAR, Section 6.2.3, "Secondary Containment Functional Design."

5. Regulatory Guide 1.25, March 1972, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors."

6. Regulatory Guide 1.4, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Pressurized Water Reactors."

7. Title 10, Code of Federal Regulations, Part 100.11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance."

8. Regulatory Guide 1.52 (Rev. 2), "Design, Testing and Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmospheric Cleanup System Air Filtration and Adsorption Units of Light-Water Cooled Nuclear Power Plants."

(continued)

Watts Bar - Unit 2 B 3.7-68 (developmental) B

ABGTS B 3.7.12 BASES REFERENCES 9. NUREG-0800, Section 6.5.1, "Standard Review Plan," Rev. 2, "ESF (continued) Atmosphere Cleanup System," July 1981.

10. NUREG/CR-5009, Assessment of the Use of Extended Burnup Fuel in Light Water Power Reactors, U. S. Nuclear Regulatory Commission, February 1988.

Watts Bar - Unit 2 B 3.7-69 (developmental) B

Fuel Storage Pool Water Level B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.

A general description of the fuel storage pool design is given in the FSAR, Section 9.1.2 (Ref. 1). A description of the Spent Fuel Pool Cooling and Cleanup System is given in the FSAR, Section 9.1.3 (Ref. 2). The assumptions of the fuel handling accident are given in the FSAR, Section 15.4.5 (Ref. 3).

APPLICABLE The minimum water level in the fuel storage pool meets the assumptions SAFETY of the fuel handling accident described in Regulatory Guide 1.25 (Ref. 4).

ANALYSES The resultant 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> thyroid dose per person at the exclusion area boundary is a small fraction of the 10 CFR 100 (Ref. 5) limits.

According to Reference 4, there is 23 ft of water between the top of the damaged fuel bundle and the fuel pool surface during a fuel handling accident. With 23 ft of water, the assumptions of Reference 4 can be used directly. In practice, this LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks; however, there may be < 23 ft of water above the top of the fuel bundle and the surface, indicated by the width of the bundle. To offset this small non-conservatism, the analysis assumes that all fuel rods fail, although analysis shows that only the first few rows fail from a hypothetical maximum drop.

The fuel storage pool water level satisfies Criterion 2 of the NRC Policy Statement.

(continued)

Watts Bar - Unit 2 B 3.7-70 (developmental) A

Fuel Storage Pool Water Level B 3.7.13 BASES (continued)

LCO The fuel storage pool water level is required to be 23 ft over the top of irradiated fuel assemblies seated in the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3). As such, it is the minimum required for fuel storage and movement within the fuel storage pool.

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the fuel storage pool, since the potential for a release of fission products exists.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.

When the initial conditions for prevention of an accident cannot be met, steps should be taken to preclude the accident from occurring. When the fuel storage pool water level is lower than the required level, the movement of irradiated fuel assemblies in the fuel storage pool is immediately suspended. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position.

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.7.13.1 REQUIREMENTS This SR verifies sufficient fuel storage pool water is available in the event of a fuel handling accident. The water level in the fuel storage pool must be checked periodically. The 7 day Frequency is appropriate because the volume in the pool is normally stable. Water level changes are controlled by plant procedures and are acceptable based on operating experience.

During refueling operations, the level in the fuel storage pool is in equilibrium with the refueling canal, and the level in the refueling canal is checked daily in accordance with SR 3.9.7.1.

(continued)

Watts Bar - Unit 2 B 3.7-71 (developmental) A

Fuel Storage Pool Water Level B 3.7.13 BASES (continued)

REFERENCES 1. Watts Bar FSAR, Section 9.1.2, "Spent Fuel Storage."

2. Watts Bar FSAR, Section 9.1.3, "Spent Fuel Pool Cooling and Cleanup System."

3. Watts Bar FSAR, Section 15.4.5, "Fuel Handling Accident."

4. Regulatory Guide 1.25, March 1972, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors."

5. Title 10, Code of Federal Regulations, Part 100.11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance."

Watts Bar - Unit 2 B 3.7-72 (developmental) A

Secondary Specific Activity B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from primary to secondary leakage in the steam generator. Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicates current conditions. During transients, I-131 spikes have been observed as well as increased releases of some noble gases. Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.

A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.

This limit is lower than the activity value that might be expected from a 1 gpm leak (LCO 3.4.13, "RCS Operational LEAKAGE") of primary coolant at the limit of 1.0 Ci/gm (LCO 3.4.16, "RCS Specific Activity").

The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes have short half lives, (i.e., < 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />). I-131, with a half life of 8.04 days, concentrates faster than it decays, but does not reach equilibrium because of blowdown and other losses.

With the specified activity limit, the resultant 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> thyroid dose to a person at the exclusion area boundary (EAB) would be about 0.58 rem if the main steam safety valves (MSSVs) open for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following a trip from full power.

Operating a unit at the allowable limits could result in a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> EAB exposure of a small fraction of the 10 CFR 100 (Ref. 1) limits, or the limits established as the NRC staff approved licensing basis.

(continued)

Watts Bar - Unit 2 B 3.7-73 (developmental) A

Secondary Specific Activity B 3.7.14 BASES (continued)

APPLICABLE The accident analysis of the main steam line break (MSLB), as discussed SAFETY in the FSAR, Section 15.0 (Ref. 2) assumes the initial secondary coolant ANALYSES specific activity to have a radioactive isotope concentration of 0.10 Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB do not exceed a small fraction of the unit EAB limits (Ref. 1) for whole body and thyroid dose rates.

With the loss of offsite power, the remaining steam generators are available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs and steam generator atmospheric dump valves (ADVs). The Auxiliary Feedwater System supplies the necessary makeup to the steam generators. Venting continues until the reactor coolant temperature and pressure have decreased sufficiently for the Residual Heat Removal System to complete the cooldown.

In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to discharge steam and any entrained activity through the MSSVs and ADVs during the event. Since no credit is taken in the analysis for activity plateout or retention, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure.

Secondary specific activity limits satisfy Criterion 2 of the NRC Policy Statement.

LCO As indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be 0.10 Ci/gm DOSE EQUIVALENT I-131 to limit the radiological consequences of a Design Basis Accident (DBA) to a small fraction of the required limit (Ref. 1).

Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.

(continued)

Watts Bar - Unit 2 B 3.7-74 (developmental) A

Secondary Specific Activity B 3.7.14 BASES (continued)

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.

ACTIONS A.1 and A.2 DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity cannot be restored to within limits within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.14.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The 31-day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT I-131, and allows for appropriate action to be taken to maintain levels below the LCO limit.

REFERENCES 1. 10 CFR 100.11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance."

2. Watts Bar FSAR, Section 15.0, "Accident Analyses."

Watts Bar - Unit 2 B 3.7-75 (developmental) A

Spent Fuel Assembly Storage B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Spent Fuel Assembly Storage BASES BACKGROUND The spent fuel pool contains flux trap rack modules with 1386 storage positions and are designed to accommodate fuel with enrichment as high as 3.8 weight percent U-235 without restrictions. Storage of fuel assemblies with enrichment between 3.8 and 5.0 weight percent requires either fuel burnup in accordance with paragraph 4.3.1.1 or placement in storage locations which have face adjacent storage cells containing either water or fuel assemblies with accumulated burnup of at least 20.0 MWD/KgU in accordance with Specification 4.3.1.1.

The water in the spent fuel storage pool normally contains soluble boron, which results in large subcriticality margins under actual operating conditions. However, the NRC guidelines, based upon the accident condition in which all soluble poison is assumed to have been lost, specify that the limiting keff of 0.95 be evaluated in the absence of soluble boron. Hence, the design is based on the use of unborated water, which maintains the storage racks in a subcritical condition during normal operation with the racks fully loaded. The double contingency principle discussed in ANSI N-16.1-1975, and the April 1978 NRC letter (Reference 1) allows credit for soluble boron under other abnormal or accident conditions, since only a single accident need be considered at one time. For example, an abnormal scenario could be associated with the improper loading of a relatively high enrichment, low exposure fuel assembly. This could potentially increase the criticality of the storage racks. To mitigate these postulated criticality-related events, boron is dissolved in the pool water. Safe operation of the spent fuel storage design with no movement of assemblies may therefore be achieved by controlling the location of each assembly in accordance with the accompanying LCO. Prior to movement of an assembly in the pool, it is necessary to perform SR 3.9.9.1.

(continued)

Watts Bar - Unit 2 B 3.7-76 (developmental) A

Spent Fuel Assembly Storage B 3.7.15 BASES (continued)

APPLICABLE The hypothetical events can only take place during or as a result of the SAFETY movement of an assembly. For these occurrences, the presence of ANALYSES soluble boron in the spent fuel storage pool, (controlled by LCO 3.9.9, "Spent Fuel Pool Boron Concentration") prevents criticality in the storage rack regions. By closely controlling the movement of each assembly and by checking the location of each assembly after movement, the time period for potential occurrences may be limited to a small fraction of the total operating time. During the remaining time period with no potential for such events, the operation may be under the auspices of the accompanying LCO.

The configuration of fuel assemblies in the fuel storage pool satisfies Criterion 2 of the NRC Policy Statement.

LCO The restrictions on the placement of fuel assemblies within the spent fuel pool in accordance with Specification 4.3.1.1 in the accompanying LCO, ensures the keff will always remain 0.95, assuming the pool to be flooded with unborated water.

APPLICABILITY This LCO applies whenever any fuel assembly is stored in the spent fuel storage pool.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.

If unable to move irradiated fuel assemblies while in Mode 5 or 6, LCO 3.0.3 would not be applicable. If unable to move irradiated fuel assemblies while in Mode 1, 2, 3, or 4, the action is independent of reactor operation. Therefore, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.

When the configuration of fuel assemblies stored in the spent fuel storage pool is not in accordance with Specification 4.3.1.1, the immediate action is to initiate action to make the necessary fuel assembly movements to bring the configuration into compliance with Specification 4.3.1.1.

(continued)

Watts Bar - Unit 2 B 3.7-77 (developmental) A

Spent Fuel Assembly Storage B 3.7.15 BASES (continued)

SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies by administrative means that the initial enrichment and burnup of the fuel assembly is in accordance with Specification 4.3.1.1 in the accompanying LCO.

REFERENCES 1. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978, NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).

Watts Bar - Unit 2 B 3.7-78 (developmental) A