Text

Revisions to Technical Requirements Manual and Technical Specification Bases
	ML101470158
Person / Time
Site:	Sequoyah
Issue date:	05/24/2010
From:	Krich R; Tennessee Valley Authority
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML101470158 (135)
	v • d • e

Tennessee Valley Authority 1101 Market Street, LP 3R Chattanooga, Tennessee 37402-2801 R. M. Krich Vice President Nuclear Licensing May 24, 2010 10 CFR 50.4 10 CFR 50.71(e)

ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Sequoyah Nuclear Plant, Units 1 and 2 Facility Operating License Nos. DPR-77 and DPR-79 NRC Docket Nos. 50-327 and 50-328

Subject:

Revisions to the Sequoyah Nuclear Plant Technical Requirements Manual and Sequoyah Nuclear Plant, Units I and 2, Technical Specification Bases

References:

1) NRC Letter to TVA, "Issuance of Exemption to 10 CFR 71(e)(4) for the Sequoyah Nuclear Plant, Units 1 and 2 (TAC Nos. MA0646 and MA0647)," dated March 9, 1998

2) TVA Letter to NRC, "SQN - Revisions to the Technical Requirements Manual (TRM) and Technical Specification (TS) Bases (Unit 1 Revisions 31, 32, and 33; Unit 2 Revisions 30, 31, and 32)," dated December 1, 2008 Pursuant to 10 CFR 50.71(e) and the Reference 1 letter, updates to the Sequoyah Nuclear Plant (SQN) Updated Final Safety Analysis Report (UFSAR) for both Units 1 and 2 are to be submitted after each Unit 2 refueling outage, not to exceed 24 months between successive revisions. The SQN Technical Requirements Manual (TRM) is incorporated by reference into the SQN UFSAR. SQN Technical Specification (TS) 6.8.4.j, "Technical Specification (TS) Bases Control Program," requires changes to the SQN TS Bases to be submitted in accordance with 10 CFR 50.71(e). The previous revisions of the SQN TRM and TS Bases were submitted on December 1, 2008 (Reference 2). The last Unit 2 refueling outage ended on November 24, 2009. As such, TRM and TS Bases revisions issued since December 1, 2008 are required to be submitted on May 24, 2010.

The enclosure to this letter provides revisions that have been incorporated into the SQN TRM and TS Bases since the submittal of the previous revisions provided by the Reference 2 letter. The enclosure to this letter also provides a description of these TRM and TS Bases revisions.

printed on recycled paper

U.S. Nuclear Regulatory Commission Page 2 May 24, 2010 There are no commitments contained in this letter. If you have any questions, please contact Rod Cook at (423) 751-2834.

I certify that I am duly authorized by TVA, and that, to the best of my knowledge and belief, the information contained herein accurately presents changes made since the previous submittal, necessary to reflect information and analyses submitted to the Commission or prepared pursuant to Commission requirements.

Respectively, R. M. Krich

Enclosure:

Description of Revisions for the Sequoyah Nuclear Plant (SQN) Technical Requirements Manual and SQN, Units 1 and 2, Technical Specification Bases Enclosure cc (Enclosure):

Regional Administrator - Region II NRC Senior Resident Inspector - Sequoyah Nuclear Plant

ENCLOSURE DESCRIPTION OF REVISIONS FOR THE SEQUOYAH NUCLEAR PLANT (SQN)

TECHNICAL REQUIREMENTS MANUAL AND SQN, UNITS I AND 2, TECHNICAL SPECIFICATION BASES A revision to the Sequoyah Nuclear Plant (SQN) Technical Requirements Manual (TRM) was approved on May 18, 2009. This revision was associated with SQN, Units 1 and 2, Technical Specification (TS) Change 08-02 which eliminated the cumulative time limit for when the containment purge and vent valves were operated, as well as aligned several TSs with NUREG-1431, Revision 3. The revision provided a consistent TRM containment integrity definition with that of the TS amended definition.

A revision to the SQN, Units 1 and 2, TS Bases was approved on October 28, 2008.

The revisions were associated with SQN, Units 1 and 2, Amendment Nos. 321 and 318 for TS Change 07-02, "Units 1 And 2 - Technical Specifications (TS) Change 07-02

'Application To Revise Technical Specifications (TSs) Regarding Control Room Envelope Habitability In Accordance With Technical Specification Task Force (TSTF)-

448, Revision 3, Using The Consolidated Line Item Improvement Process"'. The revisions included the replacement of the limited control room emergency ventilation system (CREVS) bases description with the expanded format found in NUREG-1431, "Standard Technical Specifications - Westinghouse Plants: Specifications."

On December 4, 2008, a revision to the SQN, Units 1 and 2, TS Bases was approved, in association with an exigent TS change request, TS 08-07, "License Amendment Request (LAR) TS-08-07 to Revise Reactor Coolant System Leakage Detection Systems." This revision modified the description of the reactor coolant system leakage detection instrumentation, including the limiting capability of the atmospheric gaseous radioactive monitor no longer required by TSs.

A revision to the SQN, Units 1 and 2, TS Bases was approved on April 13, 2009. This revision was associated with SQN, Units 1 and 2, Amendment Nos. 323 and 315 for TS Change 08-02, "Containment Purge Time Limit and Consolidation of Containment Isolation Valve Specifications." This revision aligned several bases sections with the extensive amendment of the TSs for systems, structures, and components such as secondary containment bypass leakage, containment ventilation system, containment isolation valves, and containment building penetrations. The change implemented an expanded bases for the containment isolation valves similar to the format of NUREG-1431.

The SQN, Units 1 and 2, TS Bases were revised on July 3, 2009. The revision was associated with SQN, Units 1 and 2, Amendment Nos. 324 and 316 for TS Change 08-04, "Removal of Main Steam Valve Isolation Times." The TS Bases revision, as discussed in the amendment approval, relocated the acceptance time limit for main steam isolation valve closure actuation to the appropriate Bases section.

A TS Bases revision was approved on October 23, 2009, for Unit 2. This revision was associated with SQN, Unit 2, Amendment No. 318, TS change 09-02, "W* Alternate Repair Criteria (ARC) For Steam Generator (SG) Tubes Cold Leg," which allowed the implementation of SG ARC for axial indications in the Westinghouse Electric Company

explosive tube expansion region below the top of the tubesheet and specified the W*

distance for the SG cold-legs. The revision included the changes of various portions of the steam generator safety analysis Bases description.

A revision of the SQN, Units 1 and 2, TS Bases was approved on March 29, 2010. The revision provided expanded bases, similar in part to the format and'information of NUREG-1431, for limiting condition of operations regarding emergency core cooling systems (ECCSs). Specifically, expanded bases were provided for the ECCS description during unit operation and unit shutdown. The revision was associated with Amendment Nos. 326 and 319 for SQN, Units 1 and 2, respectively, under TS change 07-05, "Emergency Core Cooling System (ECCS)."

Attachments:

1. Sequoyah Nuclear Plant Technical Requirements Manual - Changed Pages

2. Sequoyah Nuclear Plant, Unit 1, Technical Specification Bases - Changed Pages

3. Sequoyah Nuclear Plant, Unit 2, Technical Specification Bases - Changed Pages

ATTACHMENT I SEQUOYAH NUCLEAR PLANT TECHNICAL REQUIREMENTS MANUAL CHANGED PAGES TRM Affected Pages EPL - 1 EPL - 8 1-2

SEQUOYAH NUCLEAR PLANT, UNITS 1 AND 2 TECHNICAL REQUIREMENTS MANUAL EFFECTIVE PAGE LISTING Paae Revision Index Page I 09/28/03 Index Page II 02/02/98 Index Page III 01/20/06 Index Page IV 01/20/06 Index Page V 01/20/06 Index Page VI 01/20/06 Index Page VII 02/02/98 Index Page VIII 02/02/98 1-1 02/02/98 1-2 05/18/09 1-3 09/28/03 1-4 07/19/02 1-5 07/25/02 1-6 02/02/98 1-7 02/02/98 1-8 02/02/98 3/4 0-1 05/27/05 3/4 0-2 05/27/05 3/4 0-3 07/25/06 3/4 0-4 07/25/06 3/4 1-1 01/04/01 3/4 1-2 10/12/05 EPL-1 May 18, 2009

SEQUOYAH NUCLEAR PLANT, UNITS 1 AND 2 TECHNICAL REQUIREMENTS MANUAL REVISION LISTING Revision Date Initial Issue, Revision 0 02/02/98 Revision 1 10/01/98 Revision 2 02/12/99 Revision 3 03/18/99 Revision 4 09/14/99 Revision 5 10/24/99 Revision 6 09/29/99 Revision 7 12/09/99 Revision 8 03/23/00 Revision 9 06/02/00 Revision 10 06/13/00 Revision 11 06/15/00 Revision 12 11/09/00 Revision 13 01/04/01 Revision 14 04/05/01 Revision 15 07/11/01 Revision 16 04/05/02 Revision 17 03/27/02 Revision 18 07/19/02 Revision 19 07/25/02 Revision 20 10/11/02 Revision 21 03/06/03 Revision 22 08/11/03 Revision 23 09/14/03 Revision 24 09/28/03 Revision 25 10/31/03 Revision 26 09/26/03 Revision 27 09/26/03 Revision 28 05/15/04 Revision 29 10/13/04 Revision 30 10/13/04 Revision 31 04/22/05 Revision 32 05/27/05 Revision 33 06/20/05 Revision 34 06/24/05 Revision 35 10/12/05 Revision 36 10/19/05 Revision 37 01/20/06 Revision 38 03/08/06 Revision 39 03/17/06 Revision 40 04/26/06 Revision 41 07/25/06 Revision 42 09/15/06 Revision 43 10/17/06 Revision 44 11/14/06 Revision 45 05/18/09 EPL-8 May 18, 2009

CONTAINMENT INTEGRITY 1.7 CONTAINMENT INTEGRITY shall exist when:

a. All penetrations required to be closed during accident conditions are either:

1) Capable of being closed by an OPERABLE containment automatic isolation valve system, or

2) Closed by manual valves, blind flanges, or deactivated automatic valves secured in their closed positions, except for valves that are open under administrative control as permitted by Technical Specification 3.6.3.

b. All equipment hatches are closed and sealed.

c. Each air lock is in compliance with the requirements of Technical Specification 3.6.1.3,

d. The containment leakage rates are within the limits of Technical Specification 4.6.1.1 .c,

e. The sealing mechanism associated with each penetration (e.g., welds, bellows, or O-rings) is OPERABLE, and

f. Secondary containment bypass leakage is within the limits of Technical Specification 3.6.3.

CONTROLLED LEAKAGE 1.8 This definition has been deleted.

CORE ALTERATION 1.9 CORE ALTERATION shall be the movement of any fuel, sources, reactivity control components, or other components affecting reactivity within the reactor vessel with the head removed and fuel in the vessel. Suspension of CORE ALTERATIONS shall not preclude completion of movement of a component to a safe position.

CORE OPERATING LIMITS REPORT 1.10 The CORE OPERATING LIMITS REPORT (COLR) is the unit-specific document that provides core operating limits for the current operating reload cycle. These cycle-specific core operating limits shall be determined for each reload cycle in accordance with Technical Specification 6.9.1.14. Unit operation within these operating limits is addressed in individual specifications.

DOSE EQUIVALENT 1-131 1.11 DOSE EQUIVALENT 1-131 shall be that concentration of I- 131 (microcurie/ gram) which alone would produce the same thyroid dose as the quantity and isotopic mixture of 1-131, 1-132, 1-133, 1-134, and 1-135 actually present. The thyroid dose conversion factors used for this calculation shall be those listed in Table III of TID-14844, "Calculation of Distance Factors for Power and Test Reactor Sites."

SEQUOYAH - UNITS 1 AND 2 1-2 May 18, 2009 TECHNICAL REQUIREMENTS Revision Nos. 19, 45

ATTACHMENT 2 SEQUOYAH NUCLEAR PLANT, UNIT I TECHNICAL SPECIFICATION BASES CHANGED PAGES TS Bases Affected Pages EPL - 18 EPL - 20 EPL -21 EPL - 32 EPL - 33 B 3/4 4-4b through B 3/4 4-4c B 3/4 4-4e through B 3/4 4-4f B 3/4 5-1 through B 3/4 5-19 B 3/4 6-1 through B 3/4 6-21 B 3/4 7-3 B 3/4 7-4c through B3/4 7-4m

SEQUOYAH NUCLEAR PLANT, UNIT 1 TECHNICAL SPECIFICATIONS EFFECTIVE PAGE LISTING Page Revision B3/4 3-3 12/28/05 B3/4 3-3a 07/09/92 B3/4 3-4 08/12/97 B3/4 3-5 through B3/4 3-9 09/14/06 B3/4 4-1 03/09/05 B3/4 4-2 06/16/06 B3/4 4-2a 02/23/06 B3/4 4-3 02/23/06 B3/4 4-3a 05/18/06 B3/4 4-3b 02/23/06 B3/4 4-3c through B3/4 4-3d 05/18/06 B3/4 4-4 02/23/06 B3/4 4-4a 02/23/06 B3/4 4-4b 12/04/08 B3/4 4-4c 12/04/08 B3/4 4-4d 04/11/05 B3/4 4-4e 12/04/08 B3/4 4-4f 12/04/08 B3/4 4-4g 05/18/06 B3/4 4-4h 05/18/06 B3/4 4-4i 02/23/06 83/4 4-4j 02/23/06 B3/4 4-4k 02/23/06 B3/4 4-41 02/23/06 B3/4 4-4m 08/04/00 B3/4 4-4n 08/04/00 EPL-18 December 04, 2008

SEQUOYAH NUCLEAR PLANT, UNIT 1 TECHNICAL SPECIFICATIONS EFFECTIVE PAGE LISTING Paqe Revision B3/4 4-23 11/09/04 B3/4 5-1 03/25/10 83/4 5-2 03/25/10 B3/4 5-3 03/25/10 B3/4 5-4 03/25/10 B3/4 5-5 03/25/10 B3/4 5-6 03/25/10 B3/4 5-7 03/25/10 B3/4 5-8 through B3/4 5-19 03/25/10 B3/4 6-1 through 83/4 6-6 04/13/09 B3/4 6-7 through B3/4 6-12 04/13/09 B3/4 6-13 through B3/4 6-18 04/13/09 B3/4 6-19 through B3/4 6-20 04/13/09 B3/4 6-21 04/13/09 B3/4 7-1 04/30/02 B3/4 7-2 08/14/01 B3/4 7-2a 11/17/95 EPL-20 March 25, 2010

SEQUOYAH NUCLEAR PLANT, UNIT 1 TECHNICAL SPECIFICATIONS EFFECTIVE PAGE LISTING Page Revision B3/4 7-2b 04/11/05 B3/4 7-3 06/12/09 B3/4 7-3a 06/08/98 B3/4 7-4 09/28/07 B3/4 7-4a 09/28/07 83/4 7-4b 09/28/07 83/4 7-4c thru B3/4 7-4m 10/28/08 B3/4 7-5 08/18/05 B3/4 7-6 (DELETED) 08/28/98 B3/4 7-7 12/28/05 B3/4 7-8 08/12/97 83/4 7-9 12/19/00 83/4 7-10 12/19/00 B3/4 7-11 12/19/00 83/4 7-12 12/19/00 B3/4 7-13 12/19/00 83/4 7-14 12/19/00 B3/4 7-15 12/19/00 83/4 7-16 01/31/05 83/4 7-17 02/27/02 83/4 7-18 02/27/02 83/4 8-1 02/11/03 B3/4 8-1a 04/11/05

Original pages are not dated (2/29/80).

EPL-21 June 12, 2009

SEQUOYAH NUCLEAR PLANT, UNIT 1 TECHNICAL SPECIFICATIONS AMENDMENT LISTING Amendments Revisions Amendment 288 issued by NRC 10/28/03 (R292)

Bases Revision 12/22/03 (BR-24)

Bases Revision 04/19/04 (BR-25)

Amendment 290 issued by NRC 04/21/04 (R294)

Amendment 291 issued by NRC 06/18/04 (R295)

Amendment 292 issued by NRC 05/21/04 (R296)

Amendment 293 issued by NRC 07/08/04 (R297)

Amendment 294 issued by NRC 09/15/04 (R298)

Amendment 295 issued by NRC 09/20/04 (R299)

Amendment 296 issued by NRC 09/20/04 (R300)

License Condition Issued by NRC 10/28/04 Amendment 297 issued by NRC 11/09/04 (R301)

Bases Revision 10/13/04 (BR-26)

Amendment 298 issued by NRC 01/31/05 (R302)

Bases Revision 02/25/05 (BR-27)

Bases Revision 03/04/05 (BR-28)

Amendment 299 issued by NRC 03/09/05 (R303)

Amendment 300 issued by NRC 04/05/05 (R304)

Amendment 301 issued by NRC 04/11/05 (R305)

Amendment 302 issued by NRC 05/24/05 (R306)

Amendment 303 issued by NRC 08/18/05 (R307)

Amendment 304 issued by NRC 09/02/05 (R308)

Amendment 305 issued by NRC 12/28/05 (R309)

Amendment 306 issued by NRC 02/23/06 (R310)

Amendment 307 issued by NRC 04/06/06 (R31 1)

Bases Revision 05/18/06 (BR-29)

Amendment 308 issued by NRC 06/16/06 (R312)

Amendment 309 issued by NRC 08/02/06 (R313)

Amendment 310 issued by NRC 09/13/06 (R314)

Amendment 311 issued by NRC 09/14/06 (R315)

Amendment 312 issued by NRC 10/04/06 (R316)

Amendment 313 issued by NRC 11/07/06 (R317)

Amendment 314 issued by NRC 11/16/06 (R318)

Amendment 315 issued by NRC 12/11/06 (R319)

License Condition Issued by NRC 02/08/07 Bases Revision 03/07/07 (BR-30)

License Condition Issued by NRC 08/09/07 (B.5.b)

Amendment 316 issued by NRC 09/20/07 (R320)

Amendment 317 issued by NRC 09/28/07 (R321)

Bases Revision 12/12/07 (BR-31)

Amendment 318 issued by NRC 04/02/08 (R322)

Bases Revision 08/29/08 (BR-32)

Amendment 319 issued by NRC 08/29/08 (R323)

Bases Revision 08/28/08 (BR-33)

Amendment 320 issued by NRC 09/24/08 Amendment 321 issued by NRC 10/28/08 Amendment 322 issued by NRC 12/04/08 Amendment 323 issued by NRC 04/13/09 Amendment 324 issued by NRC 06/12/09 Bases Revision 06/12/09 (BR-34)

Amendment 325 issued by NRC 08/14/09 Amendment 326 issued by NRC 01/28/10 Amendment 327 issued by NRC 02/02/10 EPL-32 February 2, 2010-A

SEQUOYAH NUCLEAR PLANT, UNIT 1 TECHNICAL SPECIFICATIONS AMENDMENT LISTING Amendments Revisions Bases Revision 03/25/10 (BR-35)

EPL-33 March 25, 2010

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of reactor coolant system (RCS) leakage. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all UNIDENTIFIED LEAKAGE.

Industry practice has shown that water flow changes of 0.5 to 1.0 gpm can be readily detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump. The containment pocket sump used to collect UNIDENTIFIED LEAKAGE is instrumented to alarm for increases of 1.0 gpm in the normal flow rates into the sump within one hour. This sensitivity is acceptable for detecting increases in UNIDENTIFIED LEAKAGE.

The environmental conditions during power operations and the physical configuration of lower containment will obstruct the total RCS leakage (including steam) from directly entering the Pocket Sump and subsequently, will lengthen the sump's level response time. Therefore, reactor coolant system pressure boundary leakage detection by the Pocket Sump will typically occur following other means of leakage detection.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. Instrument sensitivity of 10.9 1 Ci/cc radioactivity for particulate monitoring is practical for this leakage detection system. A radioactivity detection system is included for monitoring particulate activity because of its sensitivity and rapid response to RCS leakage.

An atmospheric gaseous radioactivity monitor will provide a positive indication of leakage in the event that high levels of reactor coolant gaseous activity exist due to fuel cladding defects. The effectiveness of the atmospheric gaseous radioactivity monitors depends primarily on the activity of the reactor coolant and also, in part, on the containment volume and the background activity level. Shortly after startup and also during steady state operation with low levels of fuel defects, the level of radioactivity in the reactor coolant may be too low for the containment atmosphere gaseous radiation monitors to detect a reactor coolant leak of one gpm within one hour. Atmospheric gaseous radioactivity monitors are not required by this LCO.

An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS leakage.

December 04, 2008 SEQUOYAH - UNIT 1 B 3/4 4-4b Amendment Nos. 259, 322

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump.

Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

Air temperature and pressure monitoring methods may also be used to infer UNIDENTIFIED LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.

APPLICABLE The need to evaluate the severity of an alarm or an SAFETY ANALYSES indication is important to the operators, and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the FSAR (Ref. 3).

Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.,

The safety significance of RCS leakage varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS leakage into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIED LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public. Exclusions to the requirements of General Design Criteria 4, for the dynamic effects of the RCS piping, have been utilized based on the leak detection capability to identify leaks before a pipe break would occur.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

LCO One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires ;

instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS leakage indicates possible RCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are available. Thus, one containment pocket sump monitor, in combination with a particulate radioactivity monitor, provides an acceptable minimum.

December 04, 2008 SEQUOYAH - UNIT 1 B 3/4 4-4c Amendment Nos. 259, 322

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES Action b:

With the particulate containment atmosphere radioactivity monitoring instrumentation channel inoperable, alternative action is required. Either-grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with Surveillance 4.4.6.2.1, must be performed to provide alternate periodic information.

With a sample obtained and analyzed or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the reactor may be operated for up to 30 days to allow restoration of the containment atmosphere radioactivity monitors.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect leakage. A footnote is added allowing that SR 4.4.6.2.1 is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishing steady state operation (stable pressure, temperature, power level, pressurizer and makeup tank levels, makeup, letdown, and RCP seal injection and return flows). The 12-hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. The 30 day Completion Time recognizes at least one other form of leakage detection is available.

If the requirements of Action b cannot be met, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Action c:

With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown to a MODE in which the requirement does not apply is required. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

December 04, 2008 SEQUOYAH - UNIT 1 B 3/4 4-4e Amendment Nos. 259, 301, 322

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES SURVEILLANCE Surveillance 4.4.6.1.a REQUIREMENTS This surveillance requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives reasonable confidence that the channel is operating properly. The frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

This surveillance requires the performance of a CHANNEL CALIBRATION for the required containment atmosphere radioactivity monitor. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The frequency of 18 months is a typical refueling cycle and considers channel reliability. Operating experience has proven that this frequency is acceptable.

This surveillance requires the performance of a CHANNEL FUNCTIONAL TEST on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string.

The frequency of 92 days considers instrument reliability, and operating experience has shown that it is proper for detecting degradation.

The surveillance frequencies for these tests are specified in Table 4.3-3.

Surveillance 4.4.6.1.b This surveillance requires the performance of a CHANNEL CALIBRATION for the required containment pocket sump monitors. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The frequency of 18 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A, Section IV, GDC 30.

2. Regulatory Guide 1.45, May 1973.

3. FSAR, Sections 5.2.7 "RCBP Leakage Detection Systems" and 12.2.4 "Airborne Radioactivity Monitoring."

December 04, 2008 SEQUOYAH - UNIT 1 B 3/4 4-4f Amendment Nos. 259, 322

3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each cold leg injection accumulator ensures that a sufficient volume of borated water will be immediately forced into the reactor core in the event that the RCS pressure falls below the specified pressure of the accumulators. For the cold leg injection accumulators, this condition occurs in the event of a large or small rupture.

The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met. The limits in the specification for accumulator nitrogen cover pressure and volume are operating limits and include instrument uncertainty. The analysis limits bound the operational limits with instrument uncertainty applied. The minimum boron concentration ensures that the reactor core will remain subcritical during the post-LOCA (loss of coolant accident) recirculation phase based upon the cold leg accumulators' contribution to the post-LOCA sump mixture concentration.

The accumulator power operated isolation valves are considered to be "operating bypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protective function be removed automatically whenever permissive conditions are not met. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required.

The limits for operation with an accumulator inoperable for any reason except boron, concentration not within limits minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. Under these conditions, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed to restore an inoperable accumulator to OPERABLE status is justified in Westinghouse Commercial Atomic Power (WCAP)-1 5049-A, Revision 1, dated April 1999. For an accumulator inoperable due to boron concentration not within limits, the limits for operation allow 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to return boron concentration to within limits. This is based on the availability of ECCS water not being affected and an insignificant effect on core subcriticality during reflood because boiling of ECCS water in the core concentrates boron in the saturated liquid.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-1 Amendment No. 140, 155, 192, 262, 291,299

ECCS - Operating B 3/4.5.2 B 3/4.5 EMERGENCY CORE COOLING SYSTEM (ECCS)

B 3/4.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA), coolant leakage greater than'the capability of the normal charging system,

b. Rod ejection accident,

c. Loss of secondary coolant event, including uncontrolled steam release or loss of feedwater, and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation. After approximately 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of separate subsystems: centrifugal charging (high head), safety injection (SI) (intermediate head), and residual heat removal (RHR) (low head). Each subsystem consists of two redundant, 100 percent capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this limiting condition for operation (LCO).

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-2

ECCS - Operating B 3/4.5.2 BASES BACKGROUND (continued)

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the centrifugal charging pumps, the RHR pumps, heat exchangers, and the SI pumps.

Each of the three subsystems consists of two 100 percent capacity trains that are interconnected and redundant such that either train is capable of supplying 100 percent of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100 percent flow to the core.

During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Separate piping supplies each subsystem and each train within the subsystem. The discharge from the centrifugal charging pumps combines prior to entering the boron injection tank (BIT) and then divides again into four supply lines, each of which feeds the injection line to one RCS cold leg. The discharge from the SI and RHR pumps divides and feeds an injection line to each of the RCS cold legs. Control valves are set to balance the flow to the RCS. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs.

For LOCAs that are too small to depressurize the RCS below the shutoff head of the SI pumps, the centrifugal charging pumps supply water until the RCS pressure decreases below the SI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.

During the recirculation phase of LOCA recovery, RHR pump suction is transferred to the containment sump. The RHR pumps then supply the other ECCS pumps.

Initially, recirculation is through the same paths as the injection phase.

Subsequently, recirculation alternates injection between the hot and cold legs.

The centrifugal charging subsystem of the ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-3

ECCS - Operating B 3/4.5.2 BASES BACKGROUND (continued)

During low temperature conditions in the RCS, limitations are placed on the maximum number of ECCS pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)

System," for the basis of these requirements.

The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1.1, "Accumulators," and LCO 3.5.5, "Refueling Water Storage Tank (RWST)," provide the cooling water necessary to meet General Design Criteria (GDC) 35 (Reference 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ECCS, established by 10 CFR 50.46 (Ref. 2), will be met following a LOCA:

ANALYSES

a. Maximum fuel element cladding temperature is < 2200 0 F,

b. Maximum cladding oxidation is < 0.17 times the total cladding thickness before oxidation,

c. Maximum hydrogen generation from a zirconium water reaction is

< 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react,

d. Core is maintained in a coolable geometry, and

e. Adequate long-term core cooling capability is maintained.

The LCO also limits the potential for a post-trip return to power following an MSLB event and ensures that containment temperature limits are met.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-4

ECCS - Operating B 3/4.5.2 BASES APPLICABLE SAFETY ANALYSES (continued)

Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The centrifugal charging pumps and SI pumps are credited in a small break LOCA event. This event establishes the flow and discharge head at the design point for the centrifugal charging pumps. The SGTR and MSLB events also credit the centrifugal charging pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:

a. A large break LOCA event, with loss of offsite power and a single failure disabling one ECCS train, and

b. A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.

During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS train will deliver sufficient water to match boil off rates soon enough to minimize the consequences of the core being uncovered followinga large LOCA. It also ensures that the centrifugal charging and SI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the centrifugal charging pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-5

ECCS - Operating B 3/4.5.2 BASES LCO (continued)

In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging subsystem, an SI subsystem, and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.

As indicated in Note 1, the SI flow paths may be isolated for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 4.4.6.3. The flow path is readily restorable from the control room.

As indicated in Note 2, operation in MODE 3 with ECCS trains made incapable of injecting in order to facilitate entry into or exit from the Applicability of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," is necessary for plants with an LTOP arming temperature at or near the MODE 3 boundary temperature of 3500F. LCO 3.4.12 requires that certain pumps be rendered incapable of injecting at and below the LTOP arming temperature. When this temperature is at or near the MODE 3 boundary temperature, time is needed to make pumps incapable of injecting prior to entering the LTOP Applicability, and provide time to restore the inoperable pumps to OPERABLE status on exiting the LTOP Applicability.

APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The centrifugal charging pump performance is based on a small break LOCA, which establishes the pump performance curve and has less dependence on power. The SI pump performance requirements are based on a small break LOCA. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-6

ECCS - Operating B 3/4.5.2 BASES APPLICABILITY (continued)

This LCO is only applicable in MODE 3 and above. Below MODE"3, the SI signal setpoint is manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS -

Shutdown."

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.1.4, "RCS Cold Shutdown." MODE 6 core cooling requirements are addressed by LCO 3.9.8.1, "Residual Heat Removal and Coolant Circulation, All Water Levels" and LCO 3.9.8.2, "Residual Heat Removal and Coolant Circulation, Low Water Level."

ACTIONS Action a.

With one or more trains inoperable and at least 100 percent of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72-hour restoration time is based on an NRC reliability evaluation (Ref. 5) and is a reasonable time for repair of many ECCS components.

An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a-train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 5) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-7

ECCS - Operating B 3/4.5.2 BASES ACTIONS (continued)

Reference 6 describes situations in which one component, such as an RHR crossover valve, can disable both ECCS trains. With one or more component(s) inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be immediately entered.

If the inoperable trains cannot be returned to OPERABLE status within the associated action time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The shutdown times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Action b.

Action (a) is applicable with one or more trains inoperable. The allowed outage time is based on the assumption that at least 100 percent of the ECCS flow equivalent to a single OPERABLE ECCS train is available.

With less than 100 percent of the ECCS flow equivalent to a single OPERABLE ECCS train available, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 4.5.2.a REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of power or by key locking the control in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned. These valves are of the type, described in Reference 6, that can disable the function of both ECCS trains and invalidate the accident analyses. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-8

ECCS - Operating B 3/4.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 4.5.2.b With the exception of the operating centrifugal charging pump, the ECCS pumps are normally in a standby, nonoperating mode. As such, flow path piping has the potential to develop voids and pockets of entrained gases.

Maintaining the piping from the ECCS pumps to the RCS full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 31 day frequency takes into consideration the gradual nature of gas accumulation in the ECCS piping and the procedural controls governing system operation.

Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

SR 4.5.2.c Deleted SR 4.5.2.d Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month frequency is based on the need to perform this surveillance under the conditions that apply during a plant outage, on the need to have access to the location, and because of the potential for an unplanned transient if the surveillance were performed with the reactor at power. This frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-9

ECCS - Operating B 3/4.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 4.5.2.e These surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated SI signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned plant transients if the surveillances were performed with the reactor at power. The 18 month frequency is acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program of Specification 4.0.5.

SR 4.5.2.f Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code). This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis. Surveillance test requirements are specified in the Inservice Testing Program of Specification 4.0.5. The Inservice Test Program provides the activities and frequencies necessary to satisfy the requirements.

SR 4.5.2.q Realignment of valves in the flow path on an SI signal is necessary for proper ECCS performance. These valves have stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. This surveillance is not required for plants with flow limiting orifices. The 18 month frequency is based on the same reasons as those stated in SR 4.5.2.d and SR 4.5.2.e.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-10

ECCS - Operating B 3/4.5.2 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 35.

2. 10 CFR 50.46.

3. FSAR, Section 6.3.

4. FSAR, Chapter 15, "Accident Analysis."

5. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6. IE Information Notice No. 87-01.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-11

ECCS - Shutdown 6 3/4.5.3 B 3/4.5 EMERGENCY CORE COOLING SYSTEM (ECCS)

B 3/4.5.3 ECCS - Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, "ECCS - Operating," is applicable to these Bases, with the following modifications. In MODE 4, the required ECCS train consists of two separate subsystems: centrifugal charging (high head) and residual heat removal (RHR) (low head).

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS) following the accidents described-in Bases 3.5.2.

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 also applies to SAFETY this Bases section.

ANALYSES Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA),

the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation. The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of a centrifugal charging subsystem and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot and cold legs.

March 25, 2010 SEQUOYAH - UNIT I B 3/4 5-12

ECCS - Shutdown B 3/4.5.3 BASES LCO (continued)

This LCO is modified by a Note that allows an RHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.

In MODE 4 with RCS temperature below 3500F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.1.4, "Reactor Coolant System Cold Shutdown." MODE 6 core cooling requirements are addressed by LCO 3.9.8.1 "Residual Heat Removal and Coolant Circulation - All Water Levels," and LCO 3.9.8.2 "Residual Heat Removal and Coolant Circulation - Low Water Level."

ACTIONS A Note prohibits the application of LCO 3.0.4b to an inoperable ECCS high head subsystem when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS high head subsystem and the provisions of LCO 3.0.4b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A second Note allows the required ECCS RHR subsystem to be inoperable because of surveillance testing of RCS pressure isolation valve leakage (FCV-74-1 and FCV-74-2). This allows testing while RCS pressure is high enough to obtain valid leakage data and following valve closure for RHR decay heat removal path. The condition requiring alternate heat removal methods ensures that the RCS heatup rate can be controlled to prevent MODE 3 entry and thereby ensure that the reduced ECCS operational requirements are maintained. The condition requiring manual realignment capability, FCV-74-1 and FCV-74-2 can be opened from the main control room ensures that in the unlikely event of a DBA during the one hour of surveillance testing, the RHR subsystem can be placed in ECCS recirculation mode when required to mitigate the event.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-13

ECCS - Shutdown B 3/4.5.3 BASES ACTIONS (continued)

Action a.

With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The action time of immediately to initiate actions that~would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators. The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.

With both RHR pumps and heat exchangers inoperable, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.

Action b.

With no ECCS high head subsystem OPERABLE, due to the inoperability of the centrifugal charging pump or flow path from the RWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring SI. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months action time to restore at least one ECCS high head subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.

When Action b cannot be completed within the required action time, within one hour, a controlled shutdown should be initiated. Twenty four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems or operators.

SURVEILLANCE SR 4.5.3 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-14

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5,4 BORON INJECTION SYSTEM This specification was deleted.

3/4.5.5 REFUELING WATER STORAGE TANK The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ýensure that 1) sufficient water is available within containment to permit recirculation cooling flow to the core, and 2) the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes with all control rods inserted except for the most reactive control assembly. These assumptions are consistent with the LOCA analyses.

Additionally, the OPERABILITY of the RWST as part of the ECCS ensures that sufficient negative reactivity is injected into the core to counteract any positive increase ih reactivity caused by RCS cooldown.

The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics.

The limits on contained water volume and boron concentration of the RWST also ensure a pH value of between 7.5 and 9.5 for the solution recirculated within containment after a LOCA. This pH band minimizes the evolution of iodine and minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-15 Amendment No. 140, 301

EMERGENCY CORE COOLING SYSTEM BASES 3/4.5.6 SEAL INJECTION FLOW BACKGROUND The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the centrifugal charging pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during safety injection.

APPLICABLE All ECCS subsystems are taken credit for in the large break loss of SAFETY ANALYSES coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis establishes the minimum flow for the ECCS pumps. The centrifugal charging pumps are also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head at the design point for the centrifugal charging pumps. The steam generator tube rupture and main steam line break event analyses also credit the centrifugal charging pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also ensures that the centrifugal charging pumps will deliver sufficient water for a small LOCA and sufficient boron to maintain the core subcritical. For smaller LOCAs, the charging pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory. Seal injection flow satisfies Criterion 2 of the NRC Policy Statement.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-16 Amendment No. 259

EMERGENCY CORE COOLING SYSTEM BASES LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient centrifugal charging pump injection flow is directed to the RCS via the injection points (Ref. 2).

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known. The flow line resistance is established by adjusting the RCP seal injection needle valves to provide a total seal injection flow in the acceptable region of Technical Specification Figure 3.5.6-1. The centrifugal charging pump discharge header pressure remains essentially constant through all the applicable MODES of this LCO. A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure.

The valve settings established at the prescribed centrifugal charging pump discharge header pressure result in a conservative valve position should RCS pressure decrease. The flow limits established by Technical Specification Figure 3.5.6-1 are consistent with the accident analysis.

The limits on seal injection flow must be met to render the ECCS OPERABLE. If these conditions are not met, the ECCS flow will not be as assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-17 Amendment No. 259

EMERGENCY CORE COOLING SYSTEM BASES ACTION With the seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced. Under this condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis. The completion time minimizes the potential exposure of the plant to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limits. This time is conservative with respect to the completion times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

When the actions cannot be completed within the required completion time, a controlled shutdown must be initiated. The completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for reaching MODE 3 from MODE 1 is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge plant safety systems or operators. Continuing the plant shutdown from MODE 3, an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4, where this LCO is no longer applicable.

SURVEILLANCE Surveillance 4.5.6 REQUIREMENTS Verification every 31 days that the manual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained. The differential pressure that is above the reference minimum value is established between the charging header (PT 62-92) and the RCS, and total seal injection flow is verified to be within the limits determined in accordance with the ECCS safety analysis (Ref. 3). The seal water injection flow limits are shown in Technical Specification Figure 3.5.6-1. The frequency of 31 days is based on engineering judgment and is consistent with other ECCS valve surveillance frequencies. The frequency has proven to be acceptable through operating experience.

The requirements for charging flow vary widely according to plant status and configuration. When charging flow is adjusted, the positions of the air-operated valves, which control charging flow, are adjusted to balance the flows through the charging header and through the seal injection header to ensure that the seal injection flow to the RCPs is maintained between 8 and 13 gpm per pump. The reference minimum differential pressure across the seal injection needle valves ensures that regardless of the varied settings of the charging flow control valves that are required to support optimum charging flow, a reference test condition can be established to ensure that flows across the needle valves are within the safety analysis. The values in the safety analysis for this reference set of conditions are calculated based on conditions during power operation and they are correlated to the minimum ECCS flow to be maintained under the most limiting accident conditions.

March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-18 Amendment No. 259

EMERGENCY CORE COOLING SYSTEM BASES As noted, the surveillance is not required to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the RCS pressure has stabilized within a +/- 20 psig range of normal operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly. The exception is limited to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to ensure that the surveillance is timely. Performance of this surveillance within the 4-hour allowance is required to maintain compliance with the provisions of Specification 4.0.3.

System" and Chapter 15.0

1. ESAR, Chapter 6.3 'Emergency Core Cooling REFERENCES 1. FSAR, Chapter 6.3 "Emergency Core Cooling System" and Chapter 15.0 "Accident Analysis."

2. 10 CFR 50.46.

3. Westinghouse Electric Company Calculation CN-FSE-99-48 March 25, 2010 SEQUOYAH - UNIT 1 B 3/4 5-19 Amendment No. 259

3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT The safety design basis for primary containment is that the containment must withstand the pressures and temperatures of the limiting design basis accident (DBA) without exceeding the design leakage rates.

The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (REA). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. This leakage rate limitation will limit the site boundary radiation doses to-within the limits of 10 CFR 100 during accident conditions. The containment was designed with an allowable leakage rate of 0.25 percent of containment air weight per day. This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in the Containment Leakage Rate Test Program, as La: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the limiting DBA. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing.

Primary containment INTEGRITY or operability is maintained by limiting leakage to within the acceptance criteria of the Containment Leakage Rate Test Program.

3/4.6.1.2 SECONDARY CONTAINMENT BYPASS LEAKAGE This specification has been relocated.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-1 Amendment No. 102, 127, 176, 217, 323

3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS The limitations on closure and leak rate for the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and containment leak rate. Surveillance testing of the air lock seals provide assurance that the overall air lock leakage will not become excessive due to seal damage during the intervals between air lock leakage tests.

3/4.6.1.4 INTERNAL PRESSURE The limitations on containment internal pressure ensure that 1) the containment structure is prevented from exceeding its design negative pressure differential with respect to the annulus atmosphere of 0.5 psig and 2) the containment peak pressure does not exceed the maximum allowable internal pressure of 12 psig during LOCA conditions.

3/4.6.1.5 AIR TEMPERATURE The limitations on containment average air temperature ensure that 1) the containment air mass is limited to an initial mass sufficiently low to prevent exceeding the maximum allowable internal pressure during LOCA conditions and 2) the ambient air temperature does not exceed that temperature allowable for the continuous duty rating specified for equipment and instrumentation located within containment.

The containment pressure transient is sensitive to the initially contained air mass during a LOCA.

The contained air mass increases with decreasing temperature. The lower temperature limits of .100F for the lower compartment, 85 0 F for the upper compartment, and 60°F when less than or equal to 5% of RATED THERMAL POWER will limit the peak pressure to an acceptable value. The upper temperature limit influences the peak accident temperature slightly during a LOCA; however, this limit is based primarily upon equipment protection and anticipated operating conditions. Both the upper and lower temperature limits are consistent with the parameters used in the accident analyses.

3/4.6.1.6 CONTAINMENT VESSEL STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment steel vessel will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to ensure that the vessel will withstand the maximum pressure of 12 psig in the event of a LOCA.

Periodic visual inspections in accordance with the Containment Leakage Rate Test Program are sufficient to demonstrate this capability.

3/4.6.1.7 SHIELD BUILDING STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment shield building will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to provide 1) protection for the steel vessel from external missiles, 2) radiation shielding in the event of a LOCA, and 3) and annulus surrounding the steel vessel that can be maintained at a negative pressure during accident conditions.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-2 Amendment No. 102, 127, 176, 203, 217, 323

CONTAINMENT SYSTEMS BASES 3/4.6.1.8 EMERGENCY GAS TREATMENT SYSTEM (EGTS)

The OPERABILITY of the EGTS cleanup subsystem ensures that during LOCA conditions, containment vessel leakage into the annulus will be filtered through the HEPA filters and charcoal adsorber trains prior to discharge to the atmosphere. This requirement is necessary to meet the assumptions used in the accident analyses and limit the site boundary radiation doses to within the limits of 10 CFR 100 during LOCA conditions. Cumulative operation of the system with the heaters on for 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months over a 31 day period is sufficient to reduce the buildup of moisture on the absorbers and HEPA filters. ANSI N510-1975 will be used as a procedural guide for surveillance testing.

3/4.6.1.9 CONTAINMENT VENTILATION SYSTEM This specification has been relocated.

3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 CONTAINMENT SPRAY SUBSYSTEMS The OPERABILITY of the containment spray subsystems ensures that containment depressurization and cooling capability will be available in the event of a LOCA. The pressure reduction and resultant lower containment leakage rate are consistent with the assumptions used in the accident analyses.

3/4.6.2.2 CONTAINMENT COOLING FANS The OPERABILITY of the lower containment vent coolers ensures that adequate heat removal capacity is available to provide long-term cooling following a non-LOCA event. Postaccident use of these coolers ensures containment temperatures remain within environmental qualification limits for all .safety-related equipment required to remain functional.

April 13, 2009 SEQUOYAH - UNIT I B 3/4 6-3 Amendment No. 67, 114, 150, 159, 203, 323

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on a containment isolation signal or which are normally closed. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed, position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration or an approved exemption is provided so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system.

These barriers (typically containment isolation valves) make up the Containment Isolation System.

Automatic isolation signals are produced during accident conditions.

Containment Phase "A" isolation occurs upon receipt of a safety injection signal.

The Phase "A" isolation signal isolates nonessential process lines in order to minimize leakage of fission product radioactivity. Containment Phase "B" isolation occurs upon receipt of a containment pressure High-High signal and isolates the remaining process lines, except systems required for accident mitigation. In addition to the isolation signals listed above, the purge and exhaust valves receive an isolation signal on a containment high radiation condition. As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated from the environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a Design Basis Accident (DBA).

The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analyses.

Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.

Reactor Building Purge Ventilation (RBPV) System The RBPV System in part operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of noble gases within containment prior to and during personnel access.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-4 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued)

The RBPV System provides for mechanical ventilation of the primary containment, the instrument room located within the containment, and the annulus secondary containment located between primary containment and the Shield Building.

The RBPV System includes one supply duct penetration through the Shield Building wall into the annulus area. There are four purge air supply penetrations through the containment vessel, two to the upper compartment and two to the lower containment. Two normally closed 24-inch purge supply isolation valves at each penetration through the containment vessel provide containment isolation.

The RBPV System includes one exhaust duct penetration through the Shield Building wall from the annulus area. There are three purge air exhaust penetrations through the containment vessel, two from the upper compartment and one from the lower containment. There is one pressure relief penetration through the containment vessel. Two normally closed 24-inch purge exhaust isolation valves at each penetration through the containment vessel provide containment isolation. Two normally closed 8-inch pressure relief isolation valves through the containment vessel provide containment isolation.

The RBPV System includes one supply and one exhaust duct penetration through the Shield Building wall and one supply and one exhaust duct penetration through the containment vessel wall for ventilation of the instrument room inside containment. Two normally closed 12-inch purge isolation valves at each supply and exhaust penetration through the containment vessel provide containment isolation.

Since the valves used in the RBPV System are designed to meet the requirements for automatic containment isolation valves, these valves may be opened as needed in MODES 1, 2, 3, and 4.

APPLICABLE The containment isolation valve LCO was derived from the assumptions SAFETY related to minimizing the loss of reactor coolant inventory and ANALYSES establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.

The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref. 1). In the analyses for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized. The bounding safety analyses for offsite releases assumes that one pair of containment purge system lines are open at event initiation. The open purge system lines include of one set of supply valves (i.e., inboard and outboard) and one set of exhaust valves (i.e., inboard and outboard).

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-5 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES APPLICABLE SAFETY ANALYSES (continued)

The DBA analysis assumes that, within 85 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, La. The containment isolation total response time of 85 seconds includes signal delay, diesel generator startup (for loss of offsite power), and containment isolation valve stroke times.

The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in,the original design of the containment purge valves.

Two valves (i.e., one set) in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. The inboard and outboard isolation valves on each line are provided with diverse power sources, pneumatically operated to open and spring closed, respectively. This arrangement was designed to preclude common mode failures from disabling both valves on a purge line.

Additional valves have been identified as barrier valves, which in addition to the containment isolation valves discussed above, are a part of the accident monitoring instrumentation in Technical Specification 3/4.3.3.7 and are designated as Category 1 in accordance with Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant Conditions During and Following an Accident," December 1980.

The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Containment isolation valves form a part of the containment boundary. The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The containment isolation purge valves have blocks installed to prevent full opening.

Blocked purge valves also actuate on an automatic signal. The valves covered by this LCO are listed along with their associated stroke times in the FSAR (Ref. 2).

The normally closed isolation valves are considered OPERABLE when manual valves are closed, blind flanges are in place, and closed systems are intact.

These passive isolation valves/devices are those listed in Reference 2.

Purge valves with resilient seals and secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING must meet additional leakage rate requirements. The other containment isolation valve leakage rates are addressed by LCO 3.6.1, "Primary Containment," as Type C testing.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-6 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES LCO (continued) This LCO provides assurance that the containment isolation valves and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents.

The LCO is modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room, providing instruction to the operator to close these valves in an accident situation, and assuring that the environmental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment. For valves with controls located in the control room, these conditions can be satisfied by including a specific reference to closing the particular valves in the emergency procedures, since communication and environmental factors are not affected because of the location of the valve controls. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.

A second Note directs entry into the applicable required Actions of LCO 3.6.1.1, in the event the isolation valve leakage results in exceeding the overall containment leakage rate.

The third Note applies an operating restriction on the containment purge isolation valve(s). No more than one pair of containment purge lines (one set of supply valves and one set of exhaust valves) may be opened; otherwise, the containment purge valves are considered inoperable.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.4, "Containment Building Penetrations."

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-7 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES ACTIONS a.

In the event one containment isolation valve in one or more penetration flow paths is inoperable, except for containment vacuum relief isolation valve(s), and purge valve or secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage not within limit, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and deactivated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with this required Action, the device used to isolate the penetration should be the closest available one to containment. This required Action must be completed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time and that have been isolated in accordance with this required Action, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This required Action does not require any testing or device manipulation.

Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. A Frequency of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Required Action a. is modified by three Notes. One of the Notes applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position, is small. The third Note provides clarification that use of a check valve with flow through the valve secured is only applicable to penetration flow paths with two containment isolation valves.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-8 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) b.

With more than one pair of containment purge lines open or with two containment isolation valves in one or more penetration flow paths inoperable, except for containment vacuum relief isolation valve(s), and purge valve or shield building bypass leakage not within limit, the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion-time is consistent with the Actions of LCO 3.6.1. In the event the affected penetration is isolated in accordance with this required Action, the affected penetration must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. A Frequency of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low.

Required Action b. is modified by two Notes. One of the Notes applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position is small.

C.

With one or more containment vacuum relief isolation valve(s) inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated.

Note that due to competing requirements and dual functions associated with the containment vacuum relief isolation valves (FCV-30-46, -47, and -48), the air supply and solenoid arrangement is designed such that upon the unavailability of Train A essential control air, the containment vacuum relief isolation valves are incapable of automatic closure and are therefore considered inoperable for the containment isolation function without operator action.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-9 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) The containment vacuum relief valves (30-571, -572, and -573) are qualified to perform a containment isolation function. These valves are not powered from any electrical source and no spurious signal or operator action could initiate opening. The valves are spring loaded, swing disk (check) valves with an elastomer seat. The valves are normally closed and are equipped with limit switches that provide fully open and fully closed indication in the main control room (MCR). Based upon the above information, a 72-hour allowed action time is appropriate while actions are taken to return the containment vacuum relief isolation valves to service.

d.

With the secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage rate (SR 4.6.3.8) not within limit, the assumptions of the safety analyses are not met. Therefore, the leakage must be restored to within limit. Restoration can be accomplished by isolating the penetration(s) that caused the limit to be exceeded by use of one closed and deactivated automatic valve, closed manual valve, or blind flange. Whert a penetration is isolated, the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time for secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage is reasonable considering the time required to restore the leakage by isolating the penetration(s) and the relative importance of secondary containment bypass leakage to the overall containment function.

e.

In the event one or more containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within limits, or the affected penetration flow path must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, closed manual valve, or blind flange. A purge valve with resilient seals utilized to satisfy this required Action must have been demonstrated to meet the leakage requirements of SR 4.6.3.6. The specified completion time is reasonable, considering that one containment purge valve remains closed so that a gross breach of containment does not exist.

In accordance with this required Action, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-10 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) the isolation position should an event occur. This required Action does not require any testing or valve manipulation. Rather, it involves verification that those isolation devices outside containment capable of being mispositioned are in the correct position. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

For the containment purge valve with resilient seal that is isolated in accordance with this required Action e., SR 4.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated. Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days was chosen and has been shown to be acceptable based on operating experience.

Required Action e. is modified by two Notes. One of the Notes applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

f.

With one or more penetration flow paths of a closed system design with one containment isolation valve inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated. The closed system must meet the requirements of Ref. 3. The systems meeting the requirement of Ref. 3 include the steam generator blowdown valves, component cooling water system valves to and from the excess letdown heat exchanger, and auxiliary feedwater test valves. The associated penetrations include X-14A, X-14B, X-14C, X-14D, X-35, X-40A, X-40B, X-53, X-102 and X-104. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-11 Amendment No. 323

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) be used to isolate the affected penetration flow path. This required Action must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months completion time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event the affected penetration flow path is isolated in accordance with this required Action, the affected penetration flow path must be verified to be isolated on a periodic basis.

This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. A Frequency of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.

Required Action f. is modified by two Notes. One of the Notes applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.

If the required Actions and associated completion times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 4.6.3.1 REQUIREMENTS This SR ensures that the containment purge isolation valves are closed as required or, ifopen, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is not required to be met when the containment purge isolation valves are open for the reasons stated.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-12 Amendment No. 323

Containment Isolatioh Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)

The valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The number of valves open during Modes 1, 2, 3, and 4, is limited to no more than one pair of containment purge lines, that includes one set of supply valves and one set of exhaust valves. The containment purge isolation valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 4.6.3.5.

SR 4.6.3.2 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. The containment isolation signals involved are Phase A, Phase B, Containment Ventilation Isolation, High Containment Pressure, and Safety Injection. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 4.6.3.3 Verifying that the isolation time of each power operated or automatic containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and Frequency of this SR are in accordance with Specification 4.0.5.

SR 4.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-13 Amendment No. 271, 323

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)

This Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small.

SR 4.6.3.5 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

This Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.

SR 4.6.3.6 For containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B, is required to ensure OPERABILITY. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), a Frequency of once per 3 months is established.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-14 Amendment No. 271, 323

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 4.6.3.7 Verifying that each containment purge valve is blocked to restrict opening to < 50 degrees is required to ensure that the valves can close under DBA conditions within the times assumed in the analyses of References 1 and 2. If a LOCA occurs, the purge valves must close to maintain containment leakage within the values assumed in the accident analysis. At other times when purge valves are required to be capable of closing (e.g., during movement of irradiated fuel assemblies), pressurization concerns are not present, thus the purge valves can be fully open. The 18 month Frequency is appropriate because the blocking devices are typically removed only during a refueling outage.

SR 4.6.3.8 This SR ensures that the combined leakage rate of all secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage is less than or equal to the specified leakage rate. This provides assurance that the assumptions in the safety analysis are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (leakage through the worse of the two isolation valves) unless the penetration is isolated by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. In this case, the leakage rate of the isolated bypass leakage path is assumed to be the actual pathway leakage through the isolation device. If both isolation valves in the penetration are closed, the actual leakage rate is the lesser leakage rate of the two valves. The Frequency is required by the Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria.

Secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage is considered part of La.

REFERENCES 1. UFSAR, Section 15.0, "Accident Analysis."

2. UFSAR, Section 6.2.4, "Containment Isolation Systems" and Table 6.2.4-1, "Containment Penetrations."

3. Standard Review Plan 6.2.4, Revision 2

4. Generic Issue B-20, "Containment Leakage Due to Seal Deterioration."

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-15 Amendment No. 323

CONTAINMENT SYSTEMS BASES 3/4.6.4 COMBUSTIBLE GAS CONTROL The hydrogen mixing systems are provided to ensure adequate mixing of the containment atmosphere following a LOCA. This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.

The operability of at least 66 of 68 ignitors in the hydrogen mitigation system will maintain an effective coverage throughout the containment. This system of ignitors will initiate combustion of any significant amount of hydrogen released after a degraded core accident. This system is to ensure burning in a controlled manner as the hydrogen is released instead of allowing it to be ignited at high concentrations by a random ignition source.

3/4.6.5 ICE CONDENSER The requirements associated with each of the components of the ice condenser ensure that the overall system will be available to provide sufficient pressure suppression capability to limit the containment peak pressure transient to less than 12 psig during LOCA conditions.

3/4.6.5.1 ICE BED The OPERABILITY of the ice bed ensures that the required ice inventory will 1) be distributed evenly through the containment bays, 2) contain sufficient boron to preclude dilution of the containment sump following the LOCA and 3) contain sufficient heat removal capability to condense the reactor system volume released during a LOCA. These conditions are consistent with the assumptions used in the accident analyses.

The minimum weight figure of 1145 pounds of ice per basket contains a 15% conservative allowance for ice loss through sublimation which is a factor of 15 higher than assumed for the ice condenser design. The minimum weight figure of 2,225,880 pounds of ice also contains an additional 1%

conservative allowance to account for systematic error in weighing instruments. In the April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-16 Amendment No. 4, 5, 131,149, 224, 278, 279

CONTAINMENT SYSTEMS BASES event that observed sublimation rates are equal to or lower than design predictions after three years of operation, the minimum ice baskets weight may be adjusted downward. In addition, the number of ice baskets required to be weighed each 9 months may be reduced after 3 years of operation if such~a reduction is supported by observed sublimation data.

The ice baskets contain the ice within the ice condenser. The ice bed is considered to consist of the total volume from the bottom elevation of the ice baskets to the top elevation of the ice baskets. The ice baskets position the ice within the ice bed in an arrangement to promote heat transfer from steam to ice.

This arrangement enhances the ice condenser's primary function of condensing steam and absorbing heat energy released to the containment during a Design Basis Accident.

This Surveillance Requirement (SR), ice bed flow channel, ensures that the air/steam flow channels through the ice bed have not accumulated ice blockage that exceeds 15 percent of the total flow area through the ice bed region. The allowable 15 percent buildup of ice is based on the analysis of subcompartment response to a design basis Loss of Coolant Accident with partial blockage of the ice bed flow channels. The analysis did not perform a detailed flow area modeling, but rather lumped the ice condenser bays into six sections ranging from 2.75 bays to 6.5 bays. Individual bays are acceptable with greater than 15 percent blockage, as long as 15 percent blockage is not exceeded for the analysis section.

To provide a 95 percent confidence that flow blockage does not exceed the allowed 15 percent, visual inspection must be made for at least 54 (33 percent) of the 162 flow channels per ice condenser bay.

The visual inspection of the ice bed flow channels is to inspect the flow area, by looking down from the top of the ice bed, and where view is achievable up from the bottom of the ice bed. Flow channels to be inspected are determined by random sample. As the most restrictive flow passage location is found at a lattice frame elevation, the 15 percent blockage criteria only applies to "flow channels" that comprise the area:

a. between ice baskets, and

b. past lattice frames and wall panels.

Due to a significantly larger flow area in the regions of the upper deck grating and the lower inlet plenum and turning vanes, it would require a gross buildup of ice on these structures to obtain a degradation in air/steam flow. Therefore, these structures are excluded as part of a flow channel for application of the 15 percent blockage criteria. Plant and industry experience have shown that removal of ice from the excluded structures during the refueling outage is sufficient to ensure they remain operable throughout the operating cycle. Thus, removal of any gross ice buildup on the excluded structures is performed following outage maintenance activities.

Operating experience has demonstrated that the ice bed is the region that is the most flow restrictive, because of the normal presence of ice accumulation on lattice frames and wall panels. The flow area through the ice basket support platform is not a more restrictive flow area because it is easily accessible from the lower plenum and is maintained clear of ice accumulation. There is not a mechanistically credible method for ice to accumulate on the ice basket support platform during plant operation. Plant and industry experience have shown that the vertical flow area through the ice basket support platform remains clear of ice accumulation that could produce blockage. Normally only a glaze may develop or exist on the ice basket support platform which is not significant to blockage of flow area. Additionally, outage maintenance practices provide measures to clear the ice basket support platform following maintenance activities of any accumulation of ice that could block flow areas.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-17 Amendment No. 161, 267

CONTAINMENT SYSTEMS BASES Frost buildup or loose ice is not to be considered as flow channel blockage, whereas attached ice is considered blockage of a flow channel. Frost is the solid form of water that is loosely adherent, and can be brushed off with the open hand.

The frequency of 18 months was based on ice storage tests and the allowance built into the required ice mass over and above the mass assumed in the safety analyses. Operating experience has verified that, with the 18-month interval, the weight requirements are maintained with no significant degradation between surveillances.

Verifying the chemical composition of the stored ice ensures that the ice and the resulting melted water, will meet the requirement for borated water for accident analysis. This is accomplished by obtaining at least 24 ice samples. Each sample is taken approximately one foot from the top of the ice of each randomly selected ice basket in each ice condenser bay. The SR is modified by a NOTE that allows the boron concentration and pH value obtained from averaging the individual samples' analysis results to satisfy the requirements of the SR. If either the average boron concentration or the average pH value is outside their prescribed limit, then entry into the LCO ACTION is required. Sodium tetraborate has been proven effective in maintaining the boron content for long storage periods, and it also enhances the ability of the solution to remove and retain fission product iodine. The high pH is required to enhance the effectiveness of the ice and the melted ice in removing iodine from the containment atmosphere. This pH range also minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to ECCS and Containment Spray System fluids in the recirculation mode of operation. The frequency of 54 months is intended to be consistent with the expected length of three fuel cycles, and was developed considering these facts:

a. Long-term ice storage tests have determined that the chemical composition of the stored ice is extremely stable;

b. There are no normal operating mechanisms that decrease the boron concentration of the stored ice, and pH remains within a 9.0-9.5 range when boron concentrations are above approximately 1200 ppm.

c. Operating experience has demonstrated that meeting the boron concentration and pH requirements has never been a problem; and

d. Someone would have to enter the containment to take the sample, and, if the unit is at ppwer, that person would receive a radiation dose.

The SR is modified by a NOTE that allows the chemical analysis to be performed on either the liquid or resulting ice of each sodium tetraborate solution prepared. If ice is obtained from off site sources, then chemical analysis data must be obtained for the ice supplied.

3/4.6.5.2 ICE BED TEMPERATURE MONITORING SYSTEM This specification is deleted.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-18 Amendment No. 161, 267, 269, 277

CONTAINMENT SYSTEMS BASES 3/4.6.5.3 ICE CONDENSER DOORS The OPERABILITY of the ice condenser doors ensures that these doors will open because of the differential pressure between upper and lower containment resulting from the blowdown of reactor coolant during a LOCA and that the blow-down will be diverted through the ice condenser bays for heat removal and thus containment pressure control. The requirement that the doors be maintained closed during normal operation ensures that excessive sublimation of the ice will not occur because of warm air intrusion from the lower containment.

If an ice condenser inlet door is physically restrained from opening, the system function is degraded, and immediate action must be taken to restore the opening capability of the inlet door. Being physically restrained from opening is defined as those conditions in which an inlet door is physically blocked from opening by installation of a blocking device or by an obstruction from temporary or permanently installed equipment or is otherwise inhibited from opening such as may result from ice, frost, debris, or increased inlet door opening torque beyond the values specified in Surveillance Requirement 4.6.5.3.1.

Note: entry into Limiting Condition for Operation Action Statement 3.6.5.3.b is not required due to personnel standing on or opening an intermediate deck or upper deck door for short durations to perform required surveillances, minor maintenance such as ice removal, or routine tasks such as system walkdowns.

3/4.6.5.4 INLET DOOR POSITION MONITORING SYSTEM This specification is deleted.

3/4,6.5.5 DIVIDER BARRIER PERSONNEL ACCESS DOORS AND EQUIPMENT HATCHES The requirements for the divider barrier personnel access doors and equipment hatches being closed and OPERABLE ensure that a minimum bypass steam flow will occur from the lower to the upper containment compartments during a LOCA. This condition ensures a diversion of the steam through the ice condenser bays that is consistent with the LOCA analyses.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-19 Amendment No. 161, 267, 269, 277

CONTAINMENT SYSTEMS BASES 3/4.6.5.6 CONTAINMENT AIR RETURN FANS The OPERABILITY of the containment air return fans ensures that following a LOCA 1) the containment atmosphere is circulated for cooling by the spray system and 2) the accumulation of hydrogen in localized portions of the containment structure is minimized.

3/4.6.5.7 and 3/4.6.5.8 FLOOR AND REFUELING CANAL DRAINS The OPERABILITY of the ice condenser floor and refueling canal drains ensures that following a LOCA, the water from the melted ice and containment spray system has access for drainage back to the containment lower compartment and subsequently to the sump. This condition ensures the availability of the water for long term cooling of the reactor during the post accident phase.

3/4.6.5.9 DIVIDER BARRIER SEAL The requirement for the divider barrier seal to be OPERABLE ensures that a minimum bypass steam flow will occur from the lower to the upper containment compartments during a LOCA. This condition ensures a diversion of steam through the ice condenser bays that is consistent with the LOCA analyses.

This LCO establishes the minimum equipment requirements to ensure that the Divider Barrier Seal performs its safety function to minimize bypassing of the ice condenser by the hot steam and air mixture released into the lower compartment during a Design Basis Accident (DBA). This ensures that most of the gases pass through the ice bed, which condenses the steam and limits pressure and temperature during the accident transient. Limiting the pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.

Divider barrier integrity ensures that the high energy fluids released during a DBA would be directed through the ice condenser and that the ice condenser would function as designed if called upon to act as a passive heat sink following a DBA. The limiting DBAs considered relative to containment temperature and pressure are the loss-of-coolant accident (LOCA) and the main steam line break (MSLB). The total allowable Divider Barrier leakage flow area is approximately 5 square feet (includes divider barrier seal). A bypass leakage of 5 square feet, or less, will have no affect upon the ability of the Ice Condenser to perform its design function. (Ref. FSAR Sections 3.8.3 and 6.2.1.)

Conducting periodic physical property tests on the Divider Barrier Seal test coupons provides assurance that the seal material has not degraded in the containment environment, includingeffects of radiation, age and chemical attack.

The visual inspection of the Divider barrier Seal around the perimeter provides assurance that the seal is properly secured in place and no visual evidence of deterioration due to holes, ruptures, chemical attack, abrasion, radiation damage, or changes in physical appearances due to time related exposure to the containment environment.

April 13, 2009, SEQUOYAH - UNIT 1 B 3/4 6-20 Amendment No. 197

CONTAINMENT SYSTEMS BASES 3/4.6.6 VACUUM RELIEF VALVES The OPERABILITY of three primary containment vacuum relief lines ensures that the containment internal pressure does not become more negative than 0.1 psid. This condition is necessary to prevent exceeding the containment design limit for internal vacuum of 0.5 psid. A vacuum relief line consists of a self-actuating vacuum relief valve, a pneumatically operated isolation valve, associated piping, and instrumentation and controls.

April 13, 2009 SEQUOYAH - UNIT 1 B 3/4 6-21 Amendment No. 197

PLANT SYSTEMS BASES 3/4.7.1.4 ACTIVITY The limitations on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small fraction of 10 CFR Part 100 limits in the event of a steam line rupture. This dose also includes the effects of a coincident 1.0 GPM primary to secondary tube leak in the steam generator of the affected steam line. These values are consistent with the assumptions used in the accident analyses.

3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES The OPERABILITY of the main steam line isolation valves ensures that no more than one steam generator will blowdown in the event of a steam line rupture. This restriction is required to 1) minimize the positive reactivity effects of the Reactor Coolant System cooldown associated with the blowdown, and 2) limit the pressure rise within containment in the event the steam line rupture occurs within containment.

The OPERABILITY of the main steam isolation valves within the closure time of 5 seconds is consistent with the assumptions used in the accident analyses. Surveillance Requirement 4.7.1.5.1 verifies the closure time is in accordance with the Inservice Testing Program.

3/4.7.1.6 MAIN FEEDWATER ISOLATION, REGULATING, AND BYPASS VALVES Isolation of the main feedwater (MFW) system is provided when required to mitigate the consequences of a steam line break, feedwater line break, excessive feedwater flow, and loss of normal feedwater (and station blackout) accident. Redundant isolation capability is provided on each feedwater line consisting of the feedwater isolation valve (MFIV) and the main feedwater regulating valve (MFRV) and its associated bypass valve. The safety function of these valves is fulfilled when closed or isolated by a closed manual isolation valve. Therefore, the feedwater isolation function may be considered OPERABLE if its respective valves are OPERABLE, if they are maintained in a closed and deactivated position, or if isolated by a closed manual valve. The 72-hour completion time to either restore, close, or isolate an inoperable valve takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring that would require isolation of the MFW flow paths during this time period. The 8-hour completion time for two inoperable valves in one flow path takes into account the potential for no redundant system to perform the required safety function and a reasonable duration to close or isolate the flow path. Although the steam generator can be isolated with the failure of two valves in parallel, the double failure could be an indication of a common mode failure and should be treated the same as the loss of the isolation function. The 7-day frequency to verify that an inoperable valve is closed or isolated is reasonable based on valve status indications available in the control room, and other administrative controls to ensure the valves are closed or isolated.

3/4.7.2 STEAM GENERATOR PRESSURE/TEMPERATURE LIMITATION This specification is deleted.

June 12, 2009 SEQUOYAH - UNIT 1 B 3/4 7-3 Amendment No. 232, 305, 324

PLANT SYSTEMS BASES 3/4.7.6 FLOOD PROTECTION This specification is deleted.

October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4c Amendment No. 8, 79, 247, 256, 273, 317

CREVS B 3/4.7.7 B 3/4.7 PLANT SYSTEMS B 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM BASES BACKGROUND The CREVS provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.

The CREVS consists of two independent, redundant trains that recirculate and filter the air in the control room envelope (CRE) and a CRE boundary that limits the inleakage of unfiltered air. Each CREVS train consists of a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan.

Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

The CREVS is an emergency system, parts of which may also operate during normal unit operations in the standby mode of operation. Actuation of the CREVS places the system in the emergency radiation state mode of operation. Actuation of the system to the emergency radiation state of the emergency mode of operation, closes the unfiltered outside air intake and unfiltered exhaust dampers, and aligns the system for recirculation of the air October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4d Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES BACKGROUND (continued) within the CRE through the redundant trains of HEPA and the charcoal filters. The emergency radiation state also initiates pressurization and filtered ventilation of the air supply to the CRE.

Outside air is filtered and added to the air being recirculated from the CRE.

Pressurization of the CRE minimizes infiltration of unfiltered air through the CRE boundary from all the surrounding areas adjacent to the CRE boundary. The air entering the CRE is continuously monitored by radiation detectors. One detector output above the setpoint will cause actuation of the emergency radiation state.

A single CREVS train operating at a flow rate of 4000 cfm plus or minus 10 percent will pressurize the main control room to 0.125 inch water gauge relative to outside atmosphere. The CRE will be maintained at a slightly positive pressure relative to external areas adjacent to the CRE boundary.

The CREVS operation in maintaining the CRE habitable is discussed in the Updated Final Safety Analysis Report (UFSAR), Sections 6.4 and 9.4 (Ref. 1 and 2).

Redundant supply and recirculation trains provide the required filtration should an excessive pressure drop develop across the other filter train.

Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. The CREVS is designed in accordance with Seismic Category I requirements.

The CREVS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a DBA without exceeding a 5 rem whole body dose or its equivalent to any part of the body.

APPLICABLE The CREVS components are arranged in redundant, safety related SAFETY ventilation trains. The location of components and ducting within ANALYSES the CRE ensures an adequate supply of filtered air to all areas requiring access. The CREVS provides airborne radiological October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4e Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES APPLICABLE SAFETY ANALYSIS (continued) protection for the CRE occupants, as demonstrated by the CRE occupant dose analyses for the most limiting DBA fission product release presented in the UFSAR, Chapter 15 (Ref. 3).

The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 4 and 5). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 2 and 4).

The worst case single active failure of a component of the CREVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

The CREVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant CREVS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem whole body or its equivalent to any part of the body to the CRE occupants in the event of a large radioactive release.

Each CREVS train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.

A CREVS train is OPERABLE when the associated:

a. Fan is OPERABLE,

b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions, and

c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

October'28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4f Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES LCO (continued)

In order for the CREVS trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies, the CREVS must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.

During movement of irradiated fuel assemblies, the CREVS must be OPERABLE to cope with the release from a fuel handling accident.

ACTIONS a. (MODES 1, 2, 3, and 4)

When one CREVS train is inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this condition, the remaining OPERABLE CREVS train is-adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREVS train could result in loss of CREVS function. The 7 day completion time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4g Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES ACTIONS (continued)

In MODE 1, 2, 3, or 4, ifthe inoperable CREVS train cannot be restored to OPERABLE status within the required completion time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

b. (MODES 1, 2. 3, and 4)

If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem whole body or its equivalent to any part of the body), the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day completion time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4h Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES ACTIONS (continued) have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day completion time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

In MODE 1, 2, 3, or 4, if the inoperable CRE boundary cannot be restored to OPERABLE status within the required completion time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

c. (MODES 1, 2, 3, and 4)

When both CREVS train are inoperable, for actions taken as a result of a tornado warning, action must be taken to restore at least one train of CREVS to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, the shutdown of the operating unit would not be reasonable in consideration that the actions that created the inoperable condition was for the protection of the operating unit and would not be expected to last for a significant duration. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months completion time is reasonable based on the low probability of a DBA occurring during this time period, and high probability that the CREVS trains can be returned to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months following the tornado warning.

In MODE 1, 2, 3, or 4, if at least one inoperable CREVS train cannot be restored to OPERABLE status within the required completion time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4i Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES ACTIONS (continued)

d. (MODES 1, 2. 3. and 4)

If both CREVS trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary or tornado (i.e., Action b. or c.),

the CREVS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses. Therefore, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

a. (MODES 5 and 6, and during movement of irradiated fuel assemblies)

In MODE 5 or 6, or during movement of irradiated fuel assemblies, if the inoperable CREVS train cannot be restored to OPERABLE status within the required completion time, action must be taken to immediately place the OPERABLE CREVS train in the recirculation mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected.

An alternative to placing the operable CREVS train in service is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

b. (MODES 5 and 6, and during movement of irradiated fuel assemblies)

In MODE 5 or 6, or during movement of irradiated fuel assemblies, with two CREVS trains inoperable or with one or more CREVS trains inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4i J

Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES ACTIONS (continued) of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

SURVEILLANCE SR 4.7.7.b.

REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides an adequate check of this system. Systems without heaters need only be operated for >15 minutes to demonstrate the function of the system. The 31 day frequency on a STAGGERED TEST BASIS is based on the reliability of the equipment and the two train redundancy.

SR 4.7.7.c., d., e.l.. f., and ,.

These SRs verify that the required CREVS filter testing is performed.

These SRs include testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test frequencies and conditions that require testing are included in each SR to ensure the functionality of the filters on a periodic basis and in response to plant conditions that may have affected the filtration capability.

SR 4.7.7.e.2.

This SR verifies that each CREVS train starts and operates on an actual or simulated actuation signal. The frequency of 18 months is based on industry operating experience and is consistent with the typical refueling cycle.

SR 4.7.7.h.

This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4k Amendment No. 321

CREVS B 3/4.7.7 PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS (continued)

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Action b. (MODES 1, 2, 3, and 4) must be entered. This action allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.

Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 6) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 7). These compensatory measures may also be used as mitigating actions as required by Action b. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 8). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions.

Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

REFERENCES 1. UFSAR, Section 6.4.

2. UFSAR, Chapter 9.4.

3. UFSAR, Section 15.

4. UFSAR, Section 2.2.

5. UFSAR, Section 8.3.1.2.3.

6. Regulatory Guide 1.196.

October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-41 Amendment No. 321

.CREVS B 3/4.7.7 PLANT SYSTEMS BASES REFERENCES (continued)

7. NEI 99-03, "Control Room Habitability Assessment," June 2001.

8. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).

October 28, 2008 SEQUOYAH - UNIT 1 B 3/4 7-4m Amendment No. 321

ATTACHMENT 3 SEQUOYAH NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATION BASES CHANGED PAGES TS Bases Effected Pages EPL - 17 EPL - 19 EPL - 20 EPL - 31 B 3/4 4-3d through B 3/4 4-3g B 3/4 4-4 through B 3/4 4-4a B 3/4 4-4c through B 3/4 4-4d B 3/4 5-1 through B 3/4 5-19 B 3/4 6-1 through B 3/4 6-21 B 3/4 7-3 B 3/4 7-4c through B 3/4 7-4m

SEQUOYAH NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS EFFECTIVE PAGE LISTING Page Revision B3/4 4-3a 05/22/07 B3/4 4-3b 05/22/07 B3/4 4-3c 03/24/08 B3/4 4-3d 10/19/09 B3/4 4-3e 10/19/09 B3/4 4-3f 10/19/09 B3/4 4-3g 10/19/09 B3/4 4-3h 05/22/07 B3/4 4-3i 05/22/07 B3/4 4-3j 05/22/07 B3/4 4-3k 05/22/07 B3/4 4-4 12/04/08 B3/4 4-4a 12/04/08 B3/4 4-4b 04/11/05 B3/4 4-4c 12/04/08 B3/4 4-4d 12/04/08 B3/4 4-4e 05/22/07 B3/4 4-4f 05/22/07 B3/4 4-4g 05/22/07 B3/4 4-4h 05/22/07 83/4 4-4i 05/22/07 B3/4 4-4j 05/22/07 B3/4 4-4k 08/04/00 B3/4 4-41 08/04/00 EPL-17 October 19, 2009

SEQUOYAH NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS EFFECTIVE PAGE LISTING Page Revision B3/4 5-1 03/25/10 B3/4 5-2 03/25/10 B3/4 5-3 03/25/10 B3/4 5-4 03/25/10 B3/4 5-5 03/25/10 83/4 5-6 03/25/10 B3/4 5-7 03/25/10 B3/4 5-8 through B3/4 5-19 03/25/10 B3/4 6-1 through B3/4 6-6 04/13/09 83/4 6-7 through B3/4 6-12 04/13/09 B3/4 6-13 through 83/4 6-18 04/13/09 83/4 6-19 through B3/4 6-20 04/13/09 B3/4 6-21 04/13/09 B3/4 7-1 04/30/02 83/4 7-2 08/14/01 B3/4 7-2a 11/17/95 B3/4 7-2b 04/11/05 B3/4 7-3 06/12/09 EPL-19 March 25, 2010

SEQUOYAH NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS EFFECTIVE PAGE LISTING Page Revision B3/4 7-3a 06/08/98 B3/4 7-4 09/28/07 B3/4 7-4a 09/28/07 B3/4 7-4b 09/28/07 83/4 7-4c thru B3/4 7-4m 10/28/08 B3/4 7-5 08/18/05 B3/4 7-6 (DELETED) 08/28/98 B3/4 7-6a 12/28/05 B3/4 7-7 through B3/4 7-8 (DELETED) 08/12/97 83/4 7-9 12/19/00 83/4 7-10 12/19/00 B3/4 7-11 12/19/00 83/4 7-12 12/19/00 83/4 7-13 12/19/00 83/4 7-14 12/19/00 B3/4 7-15 12/19/00 B3/4 7-16 01/31/05 B3/4 7-17 02/27/02 83/4 7-18 02/27/02 B3/4 8-1 02/11/03 83/4 8-1a 04/11/05 B3/4 8-1 b 12/22/03 B3/4 8-2 10/02/00 B3/4 8-2a 06/28/01 EPL-20 October 28, 2008

SEQUOYAH NUCLEAR PLANT, UNIT 2 TECHNICAL SPECIFICATIONS AMENDMENT LISTING Amendments Date and Revision Amendment 288 Issued by NRC 03/09/05 (R288)

Amendment 289 Issued by NRC 04/05/05 (R289)

Amendment 290 Issued by NRC 04/11/05 (R290)

Amendment 291 Issued by NRC 05/03/05 (R291)

Amendment 292 Issued by NRC 05/24/05 (R292)

Amendment 293 Issued by NRC 08/18/05 (R293)

Amendment 294 Issued by NRC 09/02/05 (R294)

Bases Revision 09/11/03 (BR-28)

Amendment 295 Issued by NRC 12/28/05 (R295)

Amendment 296 Issued by NRC 04/06/06 (R296)

Amendment 297 Issued by NRC 06/16/06 (R297)

Amendment 298 Issued by NRC 08/02/06 (R298)

Amendment 299 Issued by NRC 09/13/06 (R299)

Amendment 300 Issued by NRC 09/14/06 (R300)

Amendment 301 Issued by NRC 10/04/06 (R301)

Amendment 302 Issued by NRC 11/07/06 (R302)

Amendment 303 Issued by NRC 11/16/06 (R303)

Amendment 304 Issued by NRC 12/11/06 (R304)

License Condition Issued by NRC 02/08/07 Bases Revision 03/07/07 (BR-29)

Amendment 305 Issued by NRC 05/22/07 (R305)

EPL Revised 05/22/07 License Condition Issued by NRC 08/09/07 (B.5.b)

Amendment 306 Issued by NRC 09/20/07 (R306)

Amendment 307 Issued by NRC 09/28/07 (R307)

Amendment 308 Issued by NRC 10/11/07 (R308)

Bases Revision 12/12/07 (BR-30)

Amendment 309 Issued by NRC 03/24/08 (R309)

Amendment 310 Issued by NRC 04/02/08 (R310)

Amendment 311 Issued by NRC 04/04/08 (R31 1)

Amendment 312 Issued by NRC 08/29/08 (R312)

Bases Revision 08/29/08 (BR-31)

Bases Revision 08/28/08 (BR-32)

Amendment 313 Issued by NRC 10/28/08 Amendment 314 Issued by NRC 12/04/08 Amendment 315 Issued by NRC 04/13/09 Amendment 316 Issued by NRC 06/12/09 Bases Revision 06/12/09 (BR-33)

Amendment 317 Issued by NRC 08/14/09 Amendment 318 Issued by NRC 10/19/09 Bases Revision 10/19/09 (BR-34)

Amendment 319 Issued by NRC 01/28/10 Amendment 320 Issued by NRC 02/02/10 Bases Revision 03/25/10 (BR-35)

EPL-31 March 25, 2010

Reactor Coolant System B 3/4.4.5 REACTOR COOLANT SYSTEM BASES APPLICABLE SAFETY ANSLYSIS (continued) including a complete circumferential separation of the tube, is acceptable.

As applied at Sequoyah Nuclear Plant Unit 2, the W* methodology is used to define the required tube inspection depth into the hot-leg and cold-leg tubesheet, and is not used to permit degradation in the W* distance to remain in service. Thus while primary to secondary leakage in the W* distance need not be postulated, primary to secondary leakage from potential degradation below the W* distance will be assumed for every inservice tube in the bounding SG.

c) Calculation of Operational Assessment (OA) Accident Induced Leakage The postulated leakage during a Steam Line Break (SLB) shall be equal to the following equation:

Postulated SLB OA Leakage = ARC GL 95-05 + Assumed Leakage 0"-8<--TTS +

Assumed Leakage 8.-12" <TTS + Assumed Leakage >12' <-TTS + All other sources of accident induced primary to secondary leakage.

Where: ARC GL 95-05 is the SLB OA leakage for predominantly axially oriented outside diameter stress corrosion cracking indications as determined from the methodology described in GL 95-05 as revised by Technical Specification Change 06-06.

Assumed Leakage 0.-8" <TTS is the postulated OA leakage for undetected indications in SG tubes left in service between 0 and 8 inches below the TTS for both the hot-leg and cold-leg tubesheet.

Assumed Leakage 8"-12. <TTS is the conservatively assumed OA leakage from the total of identified and postulated unidentified indications in SG tubes left in service between 8 and 12 inches below the TTS for both the hot-leg and cold-leg tubesheet. This is 0.0045 gpm multiplied by the number of indications. Postulated unidentified indications will be conservatively assumed to be in one SG. The highest number of identified indications left in service between 8 and 12 inches below TTS in any one SG will be included in this term.

Assumed Leakage >12-<TTs is the conservatively assumed OA leakage for the bounding SG tubes left in service below 12 inches below the TTS for both the hot-leg and cold-leg tubesheet. This is 0.00009 gpm multiplied by the number of tubes left in service in the least plugged SG. When no October 19, 2009 SEQUOYAH - UNIT 2 B 3/4 4-3d Amendment No. 181, 211, 213, 243, 267, 291,305, 309, 318

Reactor Coolant System B 3/4.4.5 REACTOR COOLANT SYSTEM BASES PWSCC tube indications are identified in the cold-leg tubesheet region the cold-leg OA leakage is 0.0 gpm.

All other sources of accident induced primary to secondary leakage is the primary to secondary accident induced OA leakage from all other" degradation mechanisms other than the voltage based axial ODSCC at tube support plates repair criteria and W* leakage calculations as determined by the Operational Assessment.

d) Calculation of Condition Monitoring (CM) Accident Induced Leakage The postulated leakage during a SLB shall be equal to the following equation and is performed for each steam generator:

Postulated SLB CM Leakage = ARC GL 95-05 + Assumed Leakage o0-8" cTTs +

Assumed Leakage 8,-12" <TTS + Assumed Leakage >12. <T-i-S + All other sources of accident induced primary to secondary leakage.

Where: ARC GL 95-05 is the SLB CM leakage for predominantly axially oriented outside diameter stress corrosion cracking indications as determined from the methodology described in GL 95-05 as revised by Technical Specification Change 06-06.

Assumed Leakage 0"-8" <TTS is the postulated CM leakage for indications detected in SG tubes between 0 and 8 inches below the TTS for both the hot-leg and cold-leg tubesheet.

Assumed Leakage 8-12" <TTS is the conservatively assumed CM leakage from the total of identified and postulated unidentified indications in SG tubes left in service between 8 and 12 inches below the TTS for both the hot-leg and cold-leg tubesheet. This is 0.0045 gpm multiplied by the number of indications.

Assumed Leakage >12- <TTS is the conservatively assumed CM leakage for the bounding SG tubes in service 12 inches below the TTS for both the hot-leg and cold-leg tubesheet. This is 0.00009 gpm multiplied by the number of tubes left in service in the SG. When no PWSCC tube indications are identified in the cold-leg tubesheet region the cold-leg CM leakage is 0.0 gpm.

All other sources of accident induced primary to secondary leakage is the primary to secondary accident induced CM leakage from all other degradation mechanisms other than the voltage based axial ODSCC at tube support plates repair criteria and W* leakage calculations as determined by Condition Monitoring.

October 19, 2009 SEQUOYAH - UNIT 2 B 3/4 4-3e Amendment No. 181, 211, 2.13, 243, 267, 291,305, 309, 318

Reactor Coolant System B 3/4.4.5 REACTOR COOLANT SYSTEM BASES APPLICABLE SAFETY ANSLYSIS (continued)

The aggregate calculated accident induced primary to secondary SLB leakage from the application of all approved ARC (W* and voltage-based axial ODSCC at TSP) shall be reported to the NRC in accordance with Technical Specification 6.9.1.16.4. The combined calculated leak rate from all ARC and all other sources of accident induced leakage must be less than the accident induced primary to secondary leakage rate assumed in the SLB accident analyses.

LCO The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the repair criteria be plugged in accordance with the Steam Generator Program.

During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging. If a tube was determined to satisfy the repair criteria but was not plugged, the tube may still have tube integrity.

In the context of this specification, a SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet.

The tube-to-tubesheet weld is not considered part of the tube.

A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 6.8.4.k "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.

There are three SG performance criteria: structural integrity, accident induced leakage, and operational leakage. Failure to meet any one of these criteria is considered failure to meet the LCO.

The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile October 19, 2009 SEQUOYAH - UNIT 2 B 3/4 4-3f Amendment No. 181, 211, 213, 243, 267,291,305

Reactor Coolant System B 3/4.4.5 REACTOR COOLANT SYSTEM BASES LCO (continued)

(plastic) tearing of the tube material at the ends of the degradation."

Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis.

The division between primary and secondary classifications will be based on detailed analysis and/or testing.

Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all American Society of Mechanical Engineers (ASME) Code,Section III, Service Level A (normal operating conditions), and Service Level B (upset or abnormal conditions) transients included in the design specification. This includes safety factors and applicable design basis loads based on ASME Code, Section Ill, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).

The accident induced leakage performance criterion ensures that the primary to secondary leakage caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analyses assumptions are discussed in the Applicability Safety Analyses section. The accident induced leakage rate includes any primary to secondary leakage existing prior to the accident in addition to primary to secondary leakage induced during the accident.

The operational leakage performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational leakage is contained in LCO 3.4.6.2, "Operational Leakage,"

and limits primary to secondary leakage through any one SG to 150.

gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a loss-of-coolant accident (LOCA) or a MSLB. If this' amount of leakage is due to more than one crack, the cracks are very small, and the above assumption is conservative.

October 19, 2009 SEQUOYAH - UNIT 2 B 3/4 4-3g Amendment No. 181, 211, 213, 243, 267, 291,305

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKAGE DETECTION INSTRUMENTATION BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of reactor coolant system (RCS) leakage. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all UNIDENTIFIED LEAKAGE.

Industry practice has shown that water flow changes of 0.5 to 1.0 gpm can be readily detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump. The containment pocket sump used to collect UNIDENTIFIED LEAKAGE is instrumented to alarm for increases of 1.0 gpm in the normal flow rates into the sump within one hour.

This sensitivity is acceptable for detecting increases in UNIDENTIFIED LEAKAGE.

The environmental conditions during power operations and the physical configuration of lower containment will obstruct the total RCS leakage (including steam) from directly entering the Pocket Sump and subsequently, will lengthen the sump's level response time. Therefore, reactor coolant system pressure boundary leakage detection by the Pocket Sump will typically occur following other means of leakage detection.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. Instrument sensitivity of 10'9 pCi/cc radioactivity for particulate monitoring is practical for this leakage detection system. A radioactivity detection system is included for monitoring particulate activity because of its sensitivity and rapid response to RCS leakage.

An atmospheric gaseous radioactivity monitor will provide a positive indication of leakage in the event that high levels of reactor coolant gaseous activity exist due to fuel cladding defects. The effectiveness of the atmospheric gaseous radioactivity monitors depends primarily on the activity of the reactor coolant and also, in part, on the containment volume and the background activity level. Shortly after startup and also during steady state operation with low levels of fuel defects, the level of radioactivity in the reactor coolant may be too low for the containment atmosphere gaseous radiation monitors to detect a reactor coolant leak of one gpm within one hour. Atmospheric gaseous radioactivity monitors are not required by this LCO.

An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS leakage.

December 04, 2008 SEQUOYAH - UNIT 2 B 3/4 4-4 Amendment Nos. 250, 314

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump.

Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

Air temperature and pressure monitoring methods may also be used to infer UNIDENTIFIED LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required. by this LCO.

APPLICABLE The need to evaluate the severity of an alarm or an indication is important SAFETY ANALYSES to the operators, and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the FSAR (Ref. 3). Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.

The safety significance of RCS leakage varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS leakage into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIED LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public. Exclusions to the requirements of General Design Criteria 4, for the dynamic effects of the RCS piping, have been utilized based on the leak detection capability to identify leaks before a pipe break would occur.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

LCO One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS leakage indicates possible RCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are available. Thus, one containment pocket sump monitor, in combination with a particulate radioactivity monitor, provides an acceptable minimum.

December 04, 2008 SEQUOYAH - UNIT 2 B 3/4 4-4a Amendment Nos. 250, 314

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES Action b:

With the particulate containment atmosphere radioactivity monitoring instrumentation channel inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with Surveillance 4.4.6.2.1, must be performed to provide alternate periodic information.

With a sample obtained and analyzed or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the reactor may be operated for up to 30 days to allow restoration of the containment atmosphere radioactivity monitors.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect leakage. A footnote is added allowing that SR 4.4.6.2.1 is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishing steady state operation (stable pressure, temperature, power level, pressurizer and makeup tank levels, makeup, letdown, and RCP seal injection and return flows). The 12-hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. The 30 day Completion Time recognizes at least one other form of leakage detection is available.

If the requirements of Action b cannot be met, the plant must be broughtto a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Action c:

With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown to a MODE in which the requirement does not apply is required. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

December 04, 2008 SEQUOYAH - UNIT 2 B 3/4 4-4c Amendment Nos. 250, 290, 314

RCS Leakage Detection Instrumentation B 3/4.4.6 REACTOR COOLANT SYSTEM BASES SURVEILLANCE Surveillance 4.4.6.1.a REQUIREMENTS This surveillance requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives reasonable confidence that the channel is operating properly. The frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

This surveillance requires the performance of a CHANNEL CALIBRATION for the required containment atmosphere radioactivity monitor. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The frequency of 18 months is a typical refueling cycle and considers channel reliability. Operating experience has proven that this frequency is acceptable.

This surveillance requires the performance of a CHANNEL FUNCTIONAL TEST on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The frequency of 92 days considers instrument reliability, and operating experience has shown that it is proper for detecting degradation.

The surveillance frequencies for these tests are specified in Table 4.3-3.

Surveillance 4.4.6.1.b This surveillance requires the performance of a CHANNEL CALIBRATION for the required containment pocket sump monitors. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The frequency of 18 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A, Section IV, GDC 30.

2. Regulatory Guide 1.45, May 1973.

3. FSAR, Sections 5.2.7 "RCBP Leakage Detection Systems" and 12.2.4.

"Airborne Radioactivity Monitoring."

December 04, 2008 SEQUOYAH - UNIT 2 B 3/4 4-4d Amendment Nos. 250, 314

3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each cold leg injection accumulator ensures that a sufficient volume of borated water will be immediately forced into the reactor core in the event the RCS pressure falls below the pressure of the accumulators. For the cold leg injection accumulators this condition occurs in the event of a large or small rupture.

The limits on accumulator volume, boron concentration, and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met. The limits in the specification for accumulator nitrogen cover pressure and volume are operating limits and include instrument uncertainty. The analysis limits bound the operational limits with instrument uncertainty applied. The minimum boron concentration ensures that the reactor core will. remain subcritical during the post-LOCA (loss of coolant accident) recirculation phase based upon the cold accumulators' contribution to the post-LOCA sump mixture concentration.

The accumulator power operated isolation valves are considered to be "operating bypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protective function be removed automatically whenever permissive conditions are not met. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required.

The limits for operation with an accumulator inoperable for any reason except boron concentration not within limits minimizes the time exposure of the plant to a LOCA event.--

occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. Under these conditions, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed to restore an inoperable accumulator to OPERABLE status is justified in Westinghouse Commercial Atomic Power (WCAP)-1 5049-A, Revision 1, dated April 1999. For an accumulator inoperable due to boron concentration not within limits, the limits for operation allow 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to return boron concentration to within limits. This is based on the availability of ECCS water not being affected and an insignificant effect on core subcriticality during reflood because boiling of ECCS water in the core concentrates boron in the saturated liquid.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-1 Amendment No. 131, 184, 253, 281,288

ECCS - Operating B 3/4.5.2 B 3/4.5 EMERGENCY CORE COOLING SYSTEM (ECCS)

B 3/4.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system,

b. Rod ejection accident,

c. Loss of secondary coolant event, including uncontrolled steam release or loss of feedwater, and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation. After approximately 5.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of separate subsystems: centrifugal charging (high head), safety injection (SI) (intermediate head), and residual heat removal (RHR) (low head). Each subsystem consists of two redundant, 100 percent capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this limiting condition for operation (LCO).

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-2

ECCS - Operating B 3/4.5.2 BASES BACKGROUND (continued)

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the centrifugal charging pumps, the RHR pumps, heat exchangers, and the SI pumps. Each of the three subsystems consists of two 100 percent capacity trains that are interconnected and redundant such that either train is capable of supplying 100 percent of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100 percent flow I

to the core.

During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Separate piping supplies each subsystem and each train within the subsystem. The discharge from the centrifugal charging pumps combines prior to entering the boron injection tank (BIT) and then divides again into four supply lines, each of which feeds the injection line to one RCS cold leg. The discharge from the SI and RHR pumps divides and feeds an injection line to each of the RCS cold legs.

Control valves are set to balance the flow to the RCS. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs.

For LOCAs that are too small to depressurize the RCS below the shutoff head of the SI pumps, the centrifugal charging pumps supply water until the RCS pressure decreases below the SI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.

During the recirculation phase of LOCA recovery, RHR pump suction is transferred to the containment sump. The RHR pumps then supply the other ECCS pumps. Initially, recirculation is through the same paths as the injection phase. Subsequently, recirculation alternates injection between the hot and cold legs.

The centrifugal charging subsystem of the ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.

Marcth 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-3

ECCS - Operating B 3/4.5.2 BASES BACKGROUND (continued)

During low temperature conditions in the RCS, limitations are placed on the maximum number of ECCS pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)

System," for the basis of these requirements.

The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1.1, "Accumulators," and LCO 3.5.5, "Refueling Water Storage Tank (RWST)," provide the cooling water necessary to meet General Design Criteria (GDC) 35 (Reference 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ECCS, established by 10 CFR 50.46 (Ref. 2), will be met following a ANALYSES LOCA:

a. Maximum fuel element cladding temperature is < 2200 0 F,

b. Maximum cladding oxidation is < 0.17 times the total cladding thickness before oxidation,

c. Maximum hydrogen generation from a zirconium water reaction is

< 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react,

d. Core is maintained in a coolable geometry, and

e. Adequate long-term core cooling capability is maintained.

The LCO also limits the potential for a post-trip return to power following an MSLB event and ensures that containment temperature limits are met.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-4

ECCS - Operating B 3/4.5.2 BASES APPLICABLE SAFETY ANALYSES (continued)

Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The centrifugal charging pumps and SI pumps are credited in a small break LOCA event. This event establishes the flow and discharge head at the design point for the centrifugal charging pumps. The SGTR and MSLB events also credit the centrifugal charging pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:

a. A large break LOCA event, with loss of offsite power and a single failure disabling one ECCS train, and

b. A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.

During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS train will deliver sufficient water to match boil off rates soon enough to minimize the consequences of the core being uncovered following a large LOCA. It also ensures that the centrifugal charging and SI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the centrifugal charging pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-5

ECCS - Operating B 3/4.5.2 BASES LCO (continued)

In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging subsystem, an SI subsystem, and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to thefcontainment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.

As indicated in Note 1, the SI flow paths may be isolated for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 4.4.6.3. The flow path is readily restorable from the control room.

As indicated in Note 2, operation in MODE 3 with ECCS trains made incapable of injecting in order to facilitate entry into or exit from the Applicability of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," is necessary for plants with an LTOP arming temperature at or near the MODE 3 boundary temperature of 3500 F. LCO 3.4.12 requires that certain pumps be rendered incapable of injecting at and below the LTOP arming temperature. When this temperature is at or near the MODE 3 boundary temperature, time is needed to make pumps incapable of injecting prior to entering the LTOP Applicability, and provide time to restore the inoperable pumps to OPERABLE status on exiting the LTOP Applicability.

APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The centrifugal charging pump performance is based on a small break LOCA, which establishes the pump performance curve and has less dependence on power. The SI pump performance requirements are based on a small break LOCA. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-6

ECCS - Operating B 3/4.5.2 BASES APPLICABILITY (continued)

This LCO is only applicable in MODE 3 and above. Below MODE 3, the SI signal setpoint is manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS -

Shutdown."

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.1.4, "RCS Cold Shutdown." MODE 6 core cooling requirements are addressed by LCO 3.9.8.1, "Residual Heat Removal and Coolant Circulation, All Water Levels" and LCO 3.9.8.2, "Residual Heat Removal and Coolant Circulation, Low Water Level."

ACTIONS Action a.

With one or more trains inoperable and at least 100 percent of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72-hour restoration time is based on an NRC reliability evaluation (Ref. 5) and is a reasonable time for repair of many ECCS components.

An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of.-an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 5) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-7

ECCS - Operating B 3/4.5.2 BASES ACTIONS (continued)

Reference 6 describes situations in which one component, such a.$ an RHR crossover valve, can disable both ECCS trains. With one or more component(s) inoperable such that 100 percent of the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be immediately entered.

If the inoperable trains cannot be returned to OPERABLE status within the associated action time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The shutdown times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Action b.

Action (a) is applicable with one or more trains inoperable. The allowed outage time is based on the assumption that at least 100 percent of the ECCS flow equivalent to a single OPERABLE ECCS train is available.

With less than 100 percent of the ECCS flow equivalent to a single OPERABLE ECCS train available, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 4.5.2.a REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of power or by key locking the control in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned. These valves are of the type, described in Reference 6, that can disable the function of both ECCS trains and invalidate the accident analyses. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-8

ECCS - Operating B 3/4.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 4.5.2.b With the exception of the operating centrifugal charging pump, the ECCS pumps are normally in a standby, nonoperating mode. As such, flow path piping has the potential to develop voids and pockets of entrained gases.

Maintaining the piping from the ECCS pumps to the RCS full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen;.:or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 31 day frequency takes into consideration the gradual nature of gas accumulation in the ECCS piping and the procedural controls governing system operation.

Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single train. This frequency has been shown to be acceptable through operating experience.

SR 4.5.2.c Deleted SR 4.5.2.d Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month frequency is based on the need to perform this surveillance under the conditions that apply during a plant outage, on the need to have access to the location, and because of the potential for an unplanned transient if the surveillance were performed with the reactor at power. This frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-9

ECCS - Operating B 3/4.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 4.5.2.e These surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated S! signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month frequency is based on the need to perform these surveillances under the conditions that apply during a plant outage and the potential for unplanned plant transients if the surveillances were performed with the reactor at power. The 18 month frequency is acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program of Specification 4.0.5.

SR 4.5.2.f Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code). This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis. Surveillance test requirements are specified in the Inservice Testing Program of Specification 4.0.5. The Inservice Test Program provides the activities and frequencies necessary to satisfy the requirements.

SR 4.5.2.q Realignment of valves in the flow path on an SI signal is necessary for proper ECCS performance. These valves have stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. This surveillance is not required for plants with flow limiting orifices. The 18 month frequency is based on the same reasons as those stated in SR 4.5.2.d and SR 4.5.2.e.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-10

ECCS - Operating B 3/4.5.2 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 35.

2. 10 CFR 50.46.

3. FSAR, Section 6.3.

4. FSAR, Chapter 15, "Accident Analysis."

5. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6. IE Information Notice No. 87-01.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-11

ECCS - Shutdown B 3/4.5.3 B 3/4.5 EMERGENCY CORE COOLING SYSTEM (ECCS)

B 3/4.5.3 ECCS - Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, "ECCS - Operating," is applicable to these Bases, with the following modifications. In MODE 4, the required ECCS train consists of two separate subsystems:

centrifugal charging (high head) and residual heat removal (RHR) (low head).

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 also applies to SAFETY this Bases section.

ANALYSES Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation. The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of a centrifugal charging subsystem and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot and cold legs.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-12

ECCS - Shutdown B 3/4.5.3 BASES LCO (continued) This LCO is modified by a Note that allows an RHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.

In MODE 4 with RCS temperature below 350°F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.1.4, "Reactor Coolant System Cold Shutdown." MODE 6 core cooling requirements are addressed by LCO 3.9.8.1 "Residual Heat Removal and Coolant Circulation - All Water Levels," and LCO 3.9.8.2 "Residual Heat Removal and Coolant Circulation - Low Water Level."

ACTIONS A Note prohibits the application of LCO 3.0.4b to an inoperable ECCS high head subsystem when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS high head subsystem and the provisions of LCO 3.0.4b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A second Note allows the required ECCS RHR subsystem to be inoperable because of surveillance testing of RCS pressure isolation valve leakage (FCV-74-1 and FCV-74-2). This allows testing while RCS pressure is high enough to obtain valid leakage data and following valve closure for RHR decay heat removal path. The condition requiring alternate heat removal methods ensures that the RCS heatup rate can be controlled to prevent MODE 3 entry and thereby ensure that the reduced ECCS operational requirements are maintained. The condition requiring manual realignment capability, FCV-74-1 and FCV-74-2 can be opened from the main control room ensures that in the unlikely event of a design basis accident during the one hour of surveillance testing, the RHR subsystem can be placed in ECCS recirculation mode when required to mitigate the event.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-13

ECCS - Shutdown B 3/4.5.3 BASES ACTIONS (continued)

Action a.

With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The action time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators. The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.

With both RHR pumps and heat exchangers inoperable, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.

Action b.

With no ECCS high head subsystem OPERABLE, due to the inoperability of the centrifugal charging pump or flow path from the RWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring SI. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months action time to restore at least one ECCS.high head subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.

When Action b cannot be completed within the required action time, within one hour, a controlled shutdown should be initiated. Twenty four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems or operators.

SURVEILLANCE SR 4.5.3 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-14

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.4 BORON INJECTION SYSTEM This Specification was deleted.

3/4.5.5 REFUELING WATER STORAGE TANK The OPERABILITY of the refueling waterstorage tank (RWST), as part of the ECCS, ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. The limits on RWST minimum volume and boron concentration ensure that 1) sufficient water is available within containment to permit-recirculation-cooling flow to the core, and 2) the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes with all control rods inserted except for the most reactive control assembly. These assumptions are consistent with the LOCA analyses. Additionally, the OPERABILITY of the RWST, as part of the ECCS, ensures that sufficient negative reactivity is injected into the core to counteract any positive increase in reactivity caused by RCS cooldown.

The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics.

The limits on contained water volume and boron concentration of the RWST also ensure a pH value of between 7.5 and 9.5 for the solution recirculated within containment after a LOCA. This pH band minimizes the evolution of iodine and minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-15 Amendment No. 131, 288, 290

EMERGENCY CORE COOLING SYSTEM BASES 3/4.5.6 SEAL INJECTION FLOW BACKGROUND The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the centrifugal charging pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during safety injection.

APPLICABLE All ECCS subsystems are taken credit for in the large break loss SAFETY ANALYSES of coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis establishes the minimum flow for the ECCS pumps. The centrifugal charging pumps are also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head at the design point for the centrifugal charging pumps. The steam generator tube rupture and main steam line break event analyses also credit the centrifugal charging pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also ensures that the centrifugal charging pumps will deliver sufficient water for a small LOCA and sufficient boron to maintain the core subcritical. For smaller LOCAs, the charging pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.

Seal injection flow satisfies Criterion 2 of the NRC Policy Statement.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-16 Amendment No. 131, 250

EMERGENCY CORE COOLING SYSTEM BASES LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient centrifugal charging pump injection flow is directed to the RCS via the injection points (Ref. 2).

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known. The flow line resistance is established by adjusting the RCP seal injection needle valves to provide a total seal injection flow in the acceptable region of Technical Specification Figure 3.5.6-1. The centrifugal charging pump discharge header pressure remains essentially constant through all the applicable MODES of this LCO. A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure. The valve settings established at the prescribed centrifugal charging pump discharge header pressure result in a conservative valve position should RCS pressure decrease. The flow limits established by Technical Specification Figure 3.5.6-1 are consistent with the accident analysis.

The limits on seal injection flow must be met to render the ECCS OPERABLE. If these conditions are not met, the ECCS flow will not be as assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-17 Amendment No."250

EMERGENCY CORE COOLING SYSTEM BASES ACTION With the seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced. Under this condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis. The completion time minimizes the potential exposure of the plant to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limits. This time is conservative with respect to the completion times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

When the actions cannot be completed within the required completion time, a controlled shutdown must be initiated. The completion time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for reaching MODE 3 from MODE 1 is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge plant safety systems or operators. Continuing the plant shutdown from MODE 3, an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4, where this LCO is no longer applicable.

SURVEILLANCE Surveillance 4.5.6 REQUIREMENTS Verification every 31 days that the manual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained. The differential pressure that is above the reference minimum value is established between the charging header (PT 62-92) and the RCS, and total seal injection flow is verified to be within the limits determined in accordance with the ECCS safety analysis (Ref. 3). The seal water injection flow limits are shown in Technical Specification Figure 3.5.6-1. The frequency of 31 days is based on engineering judgment and is consistent with other ECCS valve surveillance frequencies. The frequency has proven to be acceptable through operating experience.

The requirements for charging flow vary widely according to plant status and configuration. When charging flow is adjusted, the positions of the air-operated valves, which control charging flow, March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-18 Amendment No. 250

EMERGENCY CORE COOLING SYSTEM BASES are adjusted to balance the flows through the charging header and through the seal injection header to ensure that the seal injection flow to the RCPs is maintained between 8 and 13 gpm per pump. The reference minimum differential pressure across the seal injection needle valves ensures that regardless of the varied settings of the charging flow control valves that are required to support optimum charging flow, a reference test condition can be established to.ensure that flows across the needle valves are within the safety analysis. The values in the safety analysis for this reference set of conditions are calculated based on conditions during power operation and they are correlated to the minimum ECCS flow to be maintained under the most limiting accident conditions.

As noted, the surveillance is not required to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the RCS pressure has stabilized within a +/- 20 psig range of normal operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly. The exception is limited to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to..

ensure that the surveillance is timely. Performance of this surveillance within the 4-hour allowance is required to maintain compliance with the provisions of Specification 4.0.3.

REFERENCES 1. FSAR, Chapter 6.3 "Emergency Core Cooling System" and Chapter 15.0 "Accident Analysis."

2. 10 CFR 50.46.

3. Westinghouse Electric Company Calculation CN-FSE-99-48 March 25, 2010 SEQUOYAH - UNIT 2 B 3/4 5-19 Amendment No. 250

3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT The safety design basis for primary containment is that the containment must withstand the pressures and temperatures of the limiting design basis accident (DBA) without exceeding the design leakage rates.

The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (REA). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. This leakage rate limitation will limit the site boundary radiation doses to within the limits of 10 CFR 100 during accident conditions. The containment was designed with an allowable leakage rate of 0.25 percent of containment air weight per day. This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in the Containment Leakage Rate Test Program, as L,: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the limiting DBA. The allowed leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing.

Primary containment INTEGRITY or operability is maintained by limiting leakage to within the acceptance criteria of the Containment Leakage Rate Test Program.

3/4.6.1.2 SECONDARY CONTAINMENT BYPASS LEAKAGE This specification has been relocated.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-1 Amendment Nos. 91, 139, 167. 207, 315

3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1.3 CONTAINMENT AIR LOCKS The limitations on closure and leak rate for the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and containment leak rate. Surveillance testing of the air lock seals provide assurance that the overall air lock leakage will not become excessive due to seal damage during the intervals between air lock leakage tests.

3/4.6.1.4 INTERNAL PRESSURE The limitations on containment internal pressure ensure that 1) the containment structure is prevented from exceeding its design negative pressure differential with respect to the annulus atmosphere of 0.5 psig and 2) the containment peak pressure does not exceed the maximum allowable internal pressure of 12 psig during LOCA conditions.

3/4.6.1.5 AIR TEMPERATURE The limitations on containment average air temperature ensure that 1) the containment air mass is limited to an initial mass sufficiently low to prevent exceeding the maximum allowable internal pressure during LOCA conditions and 2) the ambient air temperature does not exceed that temperature allowable for the continuous duty rating specified for equipment and instrumentation located within containment.

The containment pressure transient is sensitive to the initially contained air mass during a LOCA.

The contained air mass increases with decreasing temperature. The lower temperature limits of 100°F for the lower compartment, 85 0 F for the upper compartment, and 60°F when less than or equal to 5% of RATED THERMAL POWER will limit the peak pressure to an acceptable value. The upper temperature limit influences the peak accident temperature slightly during a LOCA; however, this limit is based primarily upon equipment protection and anticipated operating conditions. Both the upper and lower temperature limits are consistent with the parameters used in the accident analyses.

3/4.6.1.6 CONTAINMENT VESSEL STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment steel vessel will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to ensure that the vessel will withstand the maximum pressure of 12 psig in the event of a LOCA. Periodic visual inspections in accordance with the Containment Leakage Rate Test Program are sufficient.-to demonstrate this capability.

3/4.6.1.7 SHIELD BUILDING STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment shield building will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to provide 1) protection for the steel vessel from external missiles, 2) radiation shielding in the event of a LOCA, and 3) an annulus surrounding the steel vessel that can be maintained at a negative pressure during accident conditions.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-2 Amendment No. 91, 139, 167, 193, 207, 315

CONTAINMENT SYSTEMS BASES 3/4.6.1.8 EMERGENCY GAS TREATMENT SYSTEM (EGTS)

The OPERABILITY of the EGTS cleanup subsystem ensures that during LOCA conditions, containment vessel leakage into the annulus will be filtered through the HEPA filters and charcoal adsorber trains prior to discharge to the atmosphere. This requirement is necessary to meet the assumptions used in the accident analyses and limit the site boundary radiation doses to within the limits of 10 CFR 100 during LOCA conditions. Cumulative operation of the system with the heaters on for 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months over a 31 day period is sufficient to reduce the buildup of moisture on the absorbers and HEPA filters. ANSI N510-1975 will be used as a procedural guide for surveillance testing.

3/4.6.1.9 CONTAINMENT VENTILATION SYSTEM This specification has been relocated 3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 CONTAINMENT SPRAY SUBSYSTEMS The OPERABILITY of the containment spray subsystems ensures that containment depressurization and cooling capability will be available in the event of a LOCA. The pressure reduction and resultant lower containment leakage rate are consistent with the assumptions used in the accident analyses.

3/4.6.2.2 CONTAINMENT COOLING FANS The OPERABILITY of the lower containment vent coolers ensures that adequate heat removal capacity is available to provide long-term cooling following a non-LOCA event. Postaccident use of these coolers ensures containment temperatures remain within environmental qualification limits for all safety-related equipment required to remain functional.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-3 Amendment No. 59, 140, 149, 193, 315

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on a containment isolation signal or which are normally closed. These isolation devices are either passive or active (automatic). Manual valves, de-activ;ated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration or an approved exemption is provided so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System.

Automatic isolation signals are produced during accident conditions.

Containment Phase "A"isolation occurs upon receipt of a safety injection signal.

The Phase "A" isolation signal isolates nonessential process lines in order to minimize leakage of fission product radioactivity. Containment Phase "B" isolation occurs upon receipt of a containment pressure High-High signal and isolates the remaining process lines, except systems required for accident mitigation. In addition to the isolation signals listed above, the purge and exhaust valves receive an isolation signal on a containment high radiation condition. As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated from the environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a Design Basis Accident (DBA).

The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analyses.

Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.

Reactor Building Purge Ventilation (RBPV) System The RBPV System in part operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of noble gases within containment prior to and during personnel access.

The RBPV System provides for mechanical ventilation of the primary containment, the instrument room located within the containment, and the annulus secondary containment located between primary containment and the Shield Building.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-4 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued)

The RBPV System includes one supply duct penetration through the Shield Building wall into the annulus area. There are four purge air supply penetrations through the containment vessel, two to the upper compartment and two to the lower containment. Two normally closed 24-inch purge supply isolation valves at each penetration through the containment vessel provide containment isolation.

The RBPV System includes one exhaust duct penetration through the Shield Building wall from the annulus area. There are three purge air exhaust penetrations through the containment vessel, two from the upper compartment and one from the lower containment. There is one pressure relief penetration through the containment vessel. Two normally closed 24-inch purge exhaust isolation valves at each penetration through the containment vessel provide containment isolation. Two normally closed 8-inch pressure relief isolation valves through the containment vessel provide containment isolation.

The RBPV System includes one supply and one exhaust duct penetration through the Shield Building wall and one supply and one exhaust duct penetration through the containment vessel wall for ventilation of the instrument room inside containment. Two normally closed 12-inch purge isolation valves at each supply and exhaust penetration through the containment vessel provide containment isolation.

Since the valves used in the RBPV System are designed to meet the requirements for automatic containment isolation valves, these valves may be opened as needed in MODES 1, 2, 3, and 4.

APPLICABLE The containment isolation valve LCO was derived from the assumptions SAFETY related to minimizing the loss of reactor coolant inventory and ANALYSES establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.

The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref. 1). In the analyses for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized. The bounding safety analyses for offsite releases assumes that one pair of containment purge system lines are open at event initiation. The open purge system lines include of one set of supply valves (i.e., inboard and outboard) and one set of exhaust valves (i.e., inboard and outboard).

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-5 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES APPLICABLE SAFETY ANALYSES (continued)

The DBA analysis assumes that, within 85 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, La. The containment isolation total response time of 85 seconds includes signal delay, diesel generator startup (for loss of offsite power), and containment isolation valve stroke times.

The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the original design of the containment purge valves.

Two valves (i.e., one set) in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even ifa single failure occurred. The inboard and outboard isolation valves on each line are provided with diverse power sources, pneumatically operated to open and spring closed, respectively. This arrangement was designed to preclude common mode failures from disabling both valves on a purge line.

Additional valves have been identified as barrier valves, which in addition to the containment isolation valves discussed above, are a part of the accident monitoring instrumentation in Technical Specification 3/4.3.3.7 and are designated as Category 1 in accordance with Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant Conditions During and Following an Accident," December 1980.

The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Containment isolation valves form a part of the containment boundary. The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The containment isolation purge valves have blocks installed to prevent full opening.

Blocked purge valves also actuate on an automatic signal. The valves covered by this LCO are listed along with their associated stroke times in the FSAR (Ref. 2).

The normally closed isolation valves are considered OPERABLE when manual valves are closed, and blind flanges are in place, and closed systems are intact.

These passive isolation valves/devices are those listed in Reference 2.

Purge valves with resilient seals and secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING must meet additional leakage rate requirements. The other containment isolation valve leakage rates are addressed by LCO 3.6.1, "Primary Containment," as Type C testing.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-6 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES LCO (continued) This LCO provides assurance that the containment isolation valves and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents.

The LCO is modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room, providing instruction to the operator to close these valves in an accident situation, and assuring thatthe environmental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment. For valves with controls located in the control room, these conditions can be satisfied by including a specific reference to closing the particular valves in the emergency procedures, since communication and environmental factors are not affected because of the location of the valve controls. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.

A second Note directs entry into the applicable required Actions of LCO 3.6.1.1, in the event the isolation valve leakage results in exceeding the overall containment leakage rate.

The third Note applies an operating restriction on the containment purge isolation valve(s). No more than one pair of containment purge lines (one set of supply valves and one set of exhaust valves) may be opened; otherwise, the containment purge valves are considered inoperable.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.4, "Containment Building Penetrations."

April.13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-7 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES ACTIONS a.

In the event one containment isolation valve in one or more penetration flow paths is inoperable, except for containment vacuum relief isolation valve(s), and purge valve or secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage not within limit, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and deactivated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with this required Action, the device used to isolate the penetration should be the closest available one to containment. This required Action must be completed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABL"L status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time and that have been isolated in accordance with this required Action, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This required Action does not require any testing or device manipulation.

Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. A Frequency of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Required Action a. is modified by three Notes. One of the Notes applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position, is small. The third Note provides clarification that use of a check valve with flow through the valve secured is only applicable to penetration flow paths with two containment isolation valves.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-8 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) b.

With more than one pair of containment purge lines open or with two containment isolation valves in one or more penetration flow paths inoperable, except for containment vacuum relief isolation valve(s), and purge valve or shield building bypass leakage not within limit, the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time is consistent with the Actions of LCO 3.6.1. In the event the affected penetration is isolated in accordance with this required Action, the affected penetration must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. A Frequency of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low.

Required Action b. is modified by two Notes. One of the Notes applies to isolation devices located in high-radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position is small.

C.

With one or more containment vacuum relief isolation valve(s) inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated.

Note that due to competing requirements and dual functions associated with the containment vacuum relief isolation valves (FCV-30-46, -47, and -48), the air supply and solenoid arrangement is designed such that upon the unavailability of Train A essential control air, the containment vacuum relief isolation valves are incapable of automatic closure and are therefore considered inoperable for the containment isolation function without operator action.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-9 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) The containment vacuum relief valves (30-571, -572, and -573) are qualified to perform a containment isolation function. These valves are not powered from any electrical source and no spurious signal or operator action could initiate opening.

The valves are spring loaded, swing disk (check) valves with an elastomer seat.

The valves are normally closed and are equipped with limit switches that provide fully open and fully closed indication in the main control room (MCR). Based upon the above information, a 72-hour allowed action time is appropriate while actions are taken to return the containment vacuum relief isolation valves to service.

d.

With the secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage rate (SR 4.6.3.8) not within limit, the assumptions of the safety analyses arenot met. Therefore, the leakage must be restored to within limit. Restoration can be accomplished by isolating the penetration(s) that caused the limit to be exceeded by use of one closed and deactivated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months completion time for secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage is reasonable considering the time required to restore the leakage by isolating the penetration(s) and the relative importance of secondary containment bypass leakage to the overall containment function.

e.

In the event one or more containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within limits, or the affected penetration flow path must be isolated.

The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers.'hat meet this criterion are a closed and de-activated automatic valve, closed manual valve, or blind flange. A purge valve with resilient seals utilized to satisfy this required Action must have been demonstrated to meet the leakage requirements of SR 4.6.3.6. The specified completion time is reasonable, considering that one containment purge valve remains closed so that a gross breach of containment does not exist.

In accordance with this required Action, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-10 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) the isolation position should an event occur. This required Action does not require any testing or valve manipulation. Rather, it involves verification that those isolation devices outside containment capable of being mispositioned are in the correct position. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

For the containment purge valve with resilient seal that is isolated in accordance with this required Action e., SR 4.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated. Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days was chosen and has been shown to be acceptable based on operating experience.

Required Action e. is modified by two Notes. One of the Notes applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

f.

With one or more penetration flow paths of a closed system design with one containment isolation valve inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated. The closed system must meet the requirements of Ref. 3. The systems meeting the requirement of Ref. 3 include the steam generator blowdown valves, component cooling water system valves to and from the excess letdown heat exchanger, and auxiliary feedwater test valves. The associated penetrations include X-14A, X-14B, X-14C, X-14D, X-35, X-40A, X-40B, X-53, X-102 and X-104. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not April 13, 2009 SEQUOYAH Wm ..............

- UNIT 2 B 3/4 6-11 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) be used to isolate the affected penetration flow path. This required Action must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months completion time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event the affected penetration flow path is isolated in accordance with this required Action, the affected penetration flow path must be verified to be isolated on a periodic basis.

This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. A Frequency of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.

Required Action f. is modified by two Notes. One of the Notes applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. The second Note applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.

If the required Actions and associated completion times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 4.6.3.1 REQUIREMENTS This SR ensures that the containment purge isolation valves are closed as required or, ifopen, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is not required to be met when the containment purge isolation valves are open for the reasons stated.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-12 Amendment No. 315

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)

The valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The number of valves open during Modes 1, 2, 3, and 4, is limited to no more than one pair of containment purge lines, that includes one set of supply valves and one set of exhaust valves. The containment purge isolation valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 4.6.3.5.

SR 4.6.3.2 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. The containment isolation signals involved are Phase A, Phase B, Containment Ventilation Isolation, High Containment Pressure, and Safety Injection. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 4.6.3.3 Verifying that the isolation time of each power operated or automatic containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and Frequency of this SR are in accordance with Specification 4.0.5.

SR 4.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-13 Amendment No. 260, 315

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)

This Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, issmall.

SR 4.6.3.5 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required, to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those containment isolation valves outside containment and capable of being .

mispositioned are in the correct position. Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

This Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.

SR 4.6.3.6 For containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B, is required to ensure OPERABILITY. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this...

penetration leak tight (due to the direct path between containment and the environment), a Frequency of once per 3 months is established.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-14 Amendment No. 260, 315

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 4.6.3.7 Verifying that each containment purge valve is blocked to restrict opening to < 50 degrees is required to ensure that the valves can close under DBA conditions within the times assumed in the analyses of References 1 and 2. If a LOCA occurs, the purge valves must close to maintain containment leakage within the values assumed in the accident analysis. At other times when purge valves are required to be capable of closing (e.g., during movement of irradiated fuel assemblies), pressurization concerns are not present, thus the purge valves can be fully open. The 18 month Frequency is appropriate because the blocking devices are typically removed only during a refueling outage.

SR 4.6.3.8 This SR ensures that the combined leakage rate of all secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage is less than or equal to the specified leakage rate. This provides assurance that the assumptions in the safety analysis are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (leakage through the worse of the two isolation valves) unless the penetration is isolated by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. In this case, the leakage rate of the isolated bypass leakage path is assumed to be the actual pathway leakage through the isolation device. If both isolation valves in the penetration are closed, the actual leakage rate is the lesser leakage rate of the two valves. The Frequency is required by the Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria.

Secondary containment BYPASS LEAKAGE PATHS TO THE AUXILIARY BUILDING leakage is considered part of La.

REFERENCES 1. UFSAR, Section 15.0, "Accident Analysis."

2. UFSAR, Section 6.2.4, "Containment Isolation Systems" and Table 6.2.4-1, "Containment Penetrations."

3. Standard Review Plan 6.2.4, Revision 2

4. Generic Issue B-20, "Containment Leakage Due to Seal Deterioration."

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-15 Amendment No. 315

CONTAINMENT SYSTEMS BASES 3/4.6.4 COMBUSTIBLE GAS CONTROL The hydrogen mixing systems are provided to ensure adequate mixing of the containment atmosphere following a LOCA. This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.

The operability of at least 66 of 68 igniters in the hydrogen control distributed ignition system will maintain an effective coverage throughout the containment. This system of ignitors will initiate combustion of any significant amount of hydrogen released after a degraded core accident. This system is to ensure burning in a controlled manner as the hydrogen is released instead of allowing it to be ignited at high concentrations by a random ignition source.

3/4.6.5 ICE CONDENSER The requirements associated with each of the components of the ice condenser ensure that the overall system will be available to provide sufficient pressure suppression capability to limit the containment peak pressure transient to less than 12 psigduring LOCA conditions.

3/4.6.5.1 ICE BED The OPERABILITY of the ice bed ensures that the required ice inventory will 1) be distributed evenly through the containment bays, 2) contain sufficient boron to preclude dilution of the containment sump following the LOCA and 3) contain sufficient heat removal capability to condense the reactor system volume released during a LOCA. These conditions are consistent with the assumptions used in the accident analyses.

The minimum weight figure of 1145 pounds of ice per basket contains a 15% conservative allowance for ice loss through sublimation which is a factor of 15 higher than assumed for the ice.'-*

condenser design. The minimum weight figure of 2,225,880 pounds of ice also contains an additional 1%

conservative allowance to account for systematic error in weighing instruments. In the April 13, 2009 SEQUOYAH - UNIT 2 B 314 6-16 Amendment No. 21, 118, 135, 215, 269, 270

CONTAINMENT SYSTEMS BASES event that observed sublimation rates are equal to or lower than design predictions after three years of operation, the minimum ice baskets weight may be adjusted downward.

In addition, the number of ice baskets required to be weighed each 9 months may be reduced after 3 years of operation if such a reduction is supported by observed sublimation data.

The ice baskets contain the ice within the ice condenser. The ice bed is considered to consist of the total volume from the bottom elevation of the ice baskets to the top elevation of the ice baskets. The ice baskets position the ice within the ice bed in an arrangement to promote heat transfer from steam to ice.

This arrangement enhances the ice condenser's primary function of condensing steam and absorbing heat energy released to the containment during a Design Basis Accident.

This Surveillance Requirement (SR), ice bed flow channel, ensures that the air/steam flow channels through the ice bed have not accumulated ice blockage that exceeds 15 percent of the total flow area through the ice bed region. The allowable 15 percent buildup of ice is based on the analysis of subcompartment response to a design basis Loss of Coolant Accident with partial blockage of the ice bed flow channels. The analysis did not perform a detailed flow area modeling, but rather lumped the ice condenser bays into six sections ranging from 2.75 bays to 6.5 bays. Individual bays are acceptable with greater than 15 percent blockage, as long as 15 percent blockage is not-exceeded for the analysis section.

To provide a 95 percent confidence that flow blockage does not exceed the allowed 15 percent, visual inspection must be made for at least 54 (33 percent) of the 162 flow channels per ice condenser bay.

The visual inspection of the ice bed flow channels is to inspect the flow area, by looking down from the top of the ice bed, and where view is achievable up from the bottom of the ice bed. Flow channels to be inspected are determined by random sample. As the most restrictive flow passage location is found at a lattice frame elevation, the 15 percent blockage criteria only applies to "flow channels" that comprise the area:

a. between ice baskets, and

b. past lattice frames and wall panels.

Due to a significantly larger flow area in the regions of the upper deck grating and the lower inlet plenum and turning vanes, it would require a gross buildup of ice on these structures to obtain a degradation in air/steam flow. Therefore, these structures are excluded as part of a flow channel for application of the 15 percent blockage criteria. Plant and industry experience have shown that removal of ice from the excluded structures during the refueling outage is sufficient to ensure they remain operable throughout the operating cycle. Thus, removal of any gross ice buildup on the excluded structures is performed following outage maintenance activities.

Operating experience has demonstrated that the ice bed is the region that is the most flow restrictive, because of the normal presence of ice accumulation on lattice frames and wall panels. The flow area through the ice basket support platform is not a more restrictive flow area because it is easily accessible from the lower plenum and is maintained clear of ice accumulation. There is not a mechanistically credible method for ice to accumulate on the ice basket support platform during plant operation. Plant and industry experience have shown that the vertical flow area through the ice basket support platform remains clear of ice accumulation that could produce blockage. Normally only a glaze may develop or exist on the ice basket support platform which is not significant to blockage of flow area. Additionally, outage maintenance practices provide measures to clear the ice basket support platform following maintenance activities of any accumulation of ice that could block flow areas.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-17 Amendment No. 151, 258

CONTAINMENT SYSTEMS BASES Frost buildup or loose ice is not to be considered as flow channel blockage, whereas attached ice is considered blockage of a flow channel. Frost is the solid form of water that is loosely adherent, afd can be brushed off with the open hand.

The frequency of 18 months was based on ice storage tests and the allowance built into the required ice mass over and above the mass assumed in the safety analyses. Operating experience has verified that, with the 18-month interval, the weight requirements are maintained with no significant degradation between surveillances.

Verifying the chemical composition of the stored ice ensures that the ice and the resulting melted water will meet the requirement for borated water for accident analysis. This is accomplished by obtaining at least 24 ice samples. Each sample is taken approximately one foot from the top of the ice of each randomly selected ice basket in each ice condenser bay. The SR is modified by a NOTE that allows the boron concentration and pH value obtained from averaging the individual samples' analysis results to satisfy the requirements of the SR. If either the average boron concentration or the average pH value is outside their prescribed limit, then entry into the LCO ACTION is required. Sodium tetraborate has been proven effective in maintaining the boron content for long storage periods, and it also enhances the ability of the solution to remove and retain fission product iodine. The high pH is required to enhance the effectiveness of the ice and the melted ice in removing iodine from the containment atmosphere. This pH range also minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to ECCS and Containment Spray System fluids in the recirculation mode of operation. The frequency of 54 months is intended to be consistent with the expected length of three fuel cycles, and was developed considering these facts:

a. Long-term ice storage tests have determined that the chemical composition of the stored ice is extremely stable;

b. There are no normal operating mechanisms that decrease the boron concentration of the stored ice, and pH remains within a 9.0-9.5 range when boron concentrations are above approximately 1200 ppm.

c. Operating experience has demonstrated that meeting the boron concentration and pH requirements has never been a problem; and

d. Someone would have to enter the containment to take the sample, and, if the unit is at power, that person would receive a radiation dose.

The SR is modified by a NOTE that allows the chemical analysis to be performed on either the liquid or resulting ice of each sodium tetraborate solution prepared. If ice is obtained from off site sources, then chemical analysis data must be obtained for the ice supplied.

3/4.6.5.2 ICE BED TEMPERATURE MONITORING SYSTEM This specification is deleted.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-18 Amendment No. 151, 258, 259, 268

CONTAINMENT SYSTEMS BASES 3/4.6.5.3 ICE CONDENSER DOORS The OPERABILITY of the ice condenser doors ensures that these doors will open because of the differential pressure between upper and lower containment resulting from the blowdown of reactor coolant during a LOCA and that the blow-down will be diverted through the ice condenser bays for heat removal and thus containment pressure control. The requirement that the doors be maintained closed during normal operation ensures that excessive sublimation of the ice will not occur because of warm air intrusion from the lower containment.

If an ice condenser inlet door is physically restrained from opening, the system function is degraded, and immediate action must be taken to restore the opening capability of the inlet door." Being physically restrained from opening is defined as those conditions in which an inlet door is physically blocked from opening by installation of a blocking device or by an obstruction from temporary or permanently installed equipment or is otherwise inhibited from opening such as may result from ice, frost, debris, or increased inlet door opening torque beyond the values specified in-Surveillance Requirement 4.6.5.3.1.

Note: entry into Limiting Condition for Operation Action Statement 3.6.5.3.b is not required due to personnel standing on or opening an intermediate deck or upper deck door for short durations to perform required surveillances, minor maintenance such as ice removal, or routine tasks such as system walkdowns.

3/4*6 54 INLET DOOR POSITION MONITORING SYSTEM This specification is deleted.

3/4,6.5.5 DIVIDER BARRIER PERSONNEL ACCESS DOORS AND EQUIPMENT HATCHES The requirements for the divider barrier personnel access doors and equipment hatches being closed and OPERABLE ensure that a minimum bypass steam flow will occur from the lower to the upper containment compartments during a LOCA. This condition ensures a diversion of the steam through the ice condenser bays that is consistent with the LOCA analyses.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-19 Amendment No. 151, 258, 268.

CONTAINMENT SYSTEMS BASES 3/4.6.5.6 CONTAINMENT AIR RETURN FANS The OPERABILITY of the containment air return fans ensures that following a LOCA 1) the containment atmosphere is circulated for cooling by the spray system and 2) the accumulation of hydrogen in localized portions of the containment structure is minimized.

3/4.6.5.7 and 3/4.6.5.8. FLOOR AND REFUELING CANAL DRAINS The OPERABILITY of the ice condenser floor and refueling canal drains ensures that following a LOCA, the water from the melted ice and containment spray system has access for drainage back to the containment lower compartment and subsequently to the sump. This condition ensures the availability of the water for long term cooling of the reactor during the post accident phase.

3/4.6.5.9 DIVIDER BARRIER SEAL The requirement for the divider barrier seal to be OPERABLE ensures that a minimum bypass steam flow will occur from the lower to the upper containment compartments during a LOCA. This condition ensures a diversion of steam through the ice condenser bays that is consistent with the LOCA analyses.

This LCO establishes the minimum equipment requirements to ensure that the Divider Barrier Seal performs its safety function to minimize bypassing of the ice condenser by the hot steam and air mixture released into the lower compartment during a Design Basis Accident (DBA). This ensures that most of the gases pass through the ice bed, which condenses the steam and limits pressure and temperature during the accident transient. Limiting the pressure and temperature reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.

Divider barrier integrity ensures that the high energy fluids released during a DBA would be directed through the ice condenser and that the ice condenser would function as designed if called upon to act as a passive heat sink following a DBA. The limiting DBAs considered relative to containment temperature and pressure are the loss-of-coolant accident (LOCA) and the main steam line break (MSLB). The total allowable Divider Barrier leakage flow area is approximately 5 square feet (includes divider barrier seal).

A bypass leakage of 5 square feet, or less, will have no affect upon the ability of the Ice Condenser to perform its design function. (Ref. FSAR Sections 3.8.3 and 6.2.1.)

Conducting periodic physical property tests on the Divider Barrier Seal test coupons provides assurance that the seal material has not degraded in the containment environment, including effects of radiation, age and chemical attack.

The visual inspection of the Divider barrier Seal around the perimeter provides assurance that the seal is properly secured in place and no visual evidence of deterioration due to holes, ruptures, chemical attack, abrasion, radiation damage, or changes in physical appearances due to time related exposure to the containment environment.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-20 Amendment No. 188

CONTAINMENT SYSTEMS BASES 3/4.6.6 VACUUM RELIEF VALVES The OPERABILITY of three primary containment vacuum relief lines ensures that the containment internal pressure does not become more negative than 0.1 psid. This condition is necessary to prevent exceeding the containment design limit for internal vacuum of 0.5 psid. A vacuum relief line consists of a self-actuating vacuum relief valve, a pneumatically operated isolation valve, associated piping, and instrumentation and controls.

April 13, 2009 SEQUOYAH - UNIT 2 B 3/4 6-21 Amendment No. 188

PLANT SYSTEMS BASES The limitations on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small fraction of 10 CFR Part 100 limits in the event of a steam line rupture. This dose also includes the effects of a coincident 1.0 GPM primary to secondary tube leak in the steam generator of the affected steam line. These values are consistent with the assumptions used in the accident analyses.

3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES The OPERABILITY of the main steam line isolation valves ensures that no more than one steam generator will blowdown in the event of a steam line rupture. This restriction is required to 1) minimize the positive reactivity effects of the Reactor Coolant System cooldown associated with the blowdown, and 2) limit the pressure rise within containment in the event the steam line rupture occurs within containment.

The OPERABILITY of the main steam isolation valves within the closure time of 5 seconds is consistent with the assumptions used in the accident analyses. Surveillance Requirement 4.7.1.5.1 verifies the closure time is in accordance with the Inservice Testing Program.

3/4.7.1.6 MAIN FEEDWATER ISOLATION, REGULATING, AND BYPASS VALVES Isolation of the main feedwater (MFW) system is provided when required to mitigate the consequences of a steam line break, feedwater line break, excessive feedwater flow, and loss of normal feedwater (and station blackout) accident. Redundant isolation capability is provided on each feedwater line consisting of the feedwater isolation valve (MFIV) and the main feedwater regulating valve (MFRV) and its associated bypass valve. The safety function of these valves is fulfilled when closed or isolated by a closed manual isolation valve. Therefore, the feedwater isolation function may be considered OPERABLE if its respective valves are OPERABLE, if they are maintained in a closed and deactivated position, or if isolated by a closed manual valve. The 72-hour completion time to either restore, close, or isolate an inoperable valve takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring that would require isolation of the MFW flow paths during this time period. The 8-hour completion time for two inoperable valves in one flow path takes into account the potential for no redundant system to perform the required safety function and a reasonable duration to close or isolate the flow path. Although the steam generator can be isolated with the failure of two valves in parallel, the double failure could be an indication of a common mode failure and should be treated the same as the loss of the isolation function. The 7-day frequency to verify that an inoperable valve is closed or isolated is reasonable based on valve status indications available in the control room, and other administrative controls to ensure the valves are closed or isolated.

3/4.7.2 STEAM GENERATOR PRESSURE/TEMPERATURE LIMITATION This specification is deleted.

June 12, 2009 SEQUOYAH - UNIT 2 B 3/4 7-3 Amendment No. 222, 295, 316

PLANT SYSTEMS BASES 3/4.7.6 FLOOD PROTECTION This specification is deleted.

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4c Amendment No. 70, 238, 247, 262

B 3/4.7 PLANT SYSTEMS B 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM BASES BACKGROUND The CREVS provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, h azardous chemicals, or smoke.

The CREVS consists of two independent, redundant trains that recirculate and filter the air in the control room envelope (CRE) and a CRE boundary that limits the inleakage of unfiltered air. Each CREVS train consists of a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions.

The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

The CREVS is an emergency system, parts of which may also operate during normal unit operations in the standby mode of operation. Actuation of the CREVS places the system in the emergency radiation state mode of operation. Actuation of the system to the emergency radiation state of the emergency mode of operation, closes the unfiltered outside air intake and unfiltered exhaust dampers, and aligns the system for recirculation of the air October 28, 2008 I SEQUOYAH - UNIT 2 B 3/4 7-4d Amendment No. 313

PLANT SYSTEMS BASES BACKGROUND (continued) within the CRE through the redundant trains of HEPA and the charcoal filters.

The emergency radiation state also initiates pressurization and filtered ventilation of the air supply to the CRE.

Outside air is filtered and added to the air being recirculated from the CRE.

Pressurization of the CRE minimizes infiltration of unfiltered air through the CRE boundary from all the surrounding areas adjacent to the CRE boundary.

The air entering the CRE is continuously monitored by radiation detectors.

One detector output above the setpoint will cause actuation of the emergency radiation state.

A single CREVS train operating at a flow rate of 4000 cfm plus or minus 10 percent will pressurize the main control room to 0.125 inch water gauge relative to outside atmosphere. The CRE will be maintained at a slightly positive pressure relative to external areas adjacent to the CRE boundary.

The CREVS operation in maintaining the CRE habitable is discussed in the Updated Final Safety Analysis Report (UFSAR), Sections 6.4 and 9.4 (Ref. 1 and 2).

Redundant supply and recirculation trains provide the required filtration should an excessive pressure drop develop across the other filter train. )Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. The CREVS is designed in accordance with Seismic Category I requirements.

The CREVS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a DBA without exceeding a 5 rem whole body dose or its equivalent to any part of the body.

APPLICABLE The CREVS components are arranged in redundant, safety related SAFETY ventilation trains. The location of components and ducting within ANALYSES the CRE ensures an adequate supply of filtered air to all areas requiring access. The CREVS provides airborne radiological October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4e Amendment No. 313

PLANT SYSTEMS BASES APPLICABLE SAFETY ANALYSIS (continued) protection for the CRE occupants, as demonstrated by the CRE occupant dose analyses for the most limiting DBA fission product release presented in the UFSAR, Chapter 15 (Ref. 3).

The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 4 and 5). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 2 and 4).

The worst case single active failure of a component of the CREVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

The CREVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant CREVS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem whole body or its equivalent to any part of the body to the CRE occupants in the event of a large radioactive release.

Each CREVS train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. A CREVS train is OPERABLE when the associated:

a. Fan is OPERABLE,

b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions, and

c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4f Amendment No. 313

PLANT SYSTEMS BASES LCO (continued)

In order for the CREVS trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licepsing basis consequence analyses for DBAs.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies, the CREVS must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.

During movement of irradiated fuel assemblies, the CREVS must be OPERABLE to cope with the release from a fuel handling accident.

ACTIONS a. (MODES 1, 2, 3, and 4)

When one CREVS train is inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this condition, the remaining OPERABLE CREVS train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREVS train could result in loss of CREVS function. The 7 day completion time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4g Amendment No. 313

PLANT SYSTEMS BASES ACTIONS (continued)

In MODE 1, 2, 3, or 4, if the inoperable CREVS train cannot be restored to OPERABLE status within the required completion time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

b. (MODES 1, 2, 3, and 4)

If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem whole body or its equivalent to any part of the body), the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day completion time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4h Amendment No. 313

PLANT SYSTEMS BASES ACTIONS (continued) condition in the event of a DBA. In addition, the 90 day completion time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

In MODE 1, 2, 3, or 4, if the inoperable CRE boundary cannot be restored to OPERABLE status within the required completion time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

c. (MODES 1, 2, 3, and 4)

When both CREVS train are inoperable, for actions taken as a result of a tornado warning, action must be taken to restore at least one trainqof CREVS to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, the shutdown of the operating unit would not be reasonable in consideration that the actions that created the inoperable condition was for the protection of the operating unit and would not be expected to last for a significant duration. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months completion time is reasonable based on the low probability of a DBA occurring during this time period, and high probability that the CREVS trains can be returned to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months following the tornado warning.

In MODE 1, 2, 3, or 4, if at least one inoperable CREVS train cannot be restored to OPERABLE status within the required completion time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4i Amendment No. 313

PLANT SYSTEMS BASES ACTIONS (continued)

d. (MODES 1, 2, 3, and 4)

If both CREVS trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary or tornado (i.e., Action b. or c.),..the CREVS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses. Therefore, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

a. (MODES 5 and 6, and during movement of irradiated fuel assemblies)

In MODE 5 or 6, or during movement of irradiated fuel assemblies, if the inoperable CREVS train cannot be restored to OPERABLE status within the required completion time, action must be taken to immediately place the OPERABLE CREVS train in the recirculation mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected.

An alternative to placing the operable CREVS train in service is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

b. (MODES 5 and 6, and during movement of irradiated fuel assemblies)

In MODE 5 or 6, or during movement of irradiated fuel assemblies, with two CREVS trains inoperable or with one or more CREVS trains inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4j Amendment No. 313

PLANT SYSTEMS BASES ACTIONS (continued) of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

SURVEILLANCE SR 4.7.7.b.

REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides an adequate check of this system. Systems without heaters need only be operated for

>15 minutes to demonstrate the function of the system. The 31 day frequency on a STAGGERED TEST BASIS is based on the reliability of the equipment and the two train redundancy.

SR 4.7.7.c., d., e.1. f., and q.

These SRs verify that the required CREVS filter testing is performed. These SRs include testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test frequencies and conditions that require testing are included in each SR to ensure the functionality of the filters on a periodic basis and in response to plant conditions that may have affected the filtration capability.

SR 4.7.7.e.2.

This SR verifies that each CREVS train starts and operates on an actual or simulated actuation signal. The frequency of 18 months is based on industry operating experience and is consistent with the typical refueling cycle.

SR 4.7.7.h.

This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4k Amendment No. 313

PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS (continued)

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences.

When unfiltered air inleakage is greater than the assumed flow rate, Action b.

(MODES 1, 2, 3, and 4) must be entered. This action allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 6) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 7). These compensatory measures may also be used as mitigating actions as required by Action b. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 8). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

REFERENCES 1. UFSAR, Section 6.4.

2. UFSAR, Chapter 9.4.

3. UFSAR, Section 15.

4. UFSAR, Section 2.2.

5. UFSAR, Section 8.3.1.2.3.

6. Regulatory Guide 1.196.

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-41 Amendment No. 313

PLANT SYSTEMS BASES REFERENCES (continued)

7. NEI 99-03, "Control Room Habitability Assessment," June 2001.

8. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).

October 28, 2008 SEQUOYAH - UNIT 2 B 3/4 7-4m Amendment No. 313

ML101470158

Contents

Text

Subject:

References:

Enclosure:

Navigation menu

ML101470158

Text

Subject:

References:

Enclosure:

Navigation menu

Search