ML13161A090

Cycle Specific Technical Specification Bases Page Updates

ML13161A090
Person / Time
Site:	San Onofre
Issue date:	06/07/2013
From:	St.Onge R Southern California Edison Co
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
Download: ML13161A090 (55)

Text

SOUTHERN CALIFORNIA Richard St. Onge

~EDISON Director, Nuclear Regulatory Mfairs and Emergency Planning An EDISON INTERNATIONAL Company 10CFR 50.71 (e)

June 7, 2013 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, D.C. 20555-0001

. Subject Docket Nos. 50-361 and 50-362 Cycle Specific Technical Specification Bases Page Updates San Onofre Nuclear Generating Station (SONGS), Units 2 and 3

Dear Sir or Madam:

Enclosed is the refueling cycle update to the San Onofre Nuclear Generating Station Units 2 and 3 Technical Specification (TS) Bases. As required by TS 5.4.4, changes to the TS Bases implemented without prior Nuclear Regulatory Commission (NRC) approval are provided to the NRC on a frequency consistent with 10 CFR 50.71(e).

Included in this update are all TS Bases pages that have been revised between February 11, 2011 and January 31, 2013. The enclosed pages show the most recent changes with revision bars in the right hand margin.

There are no commitments contained in this letter or its enclosure.

Should you have any questions, please contact Mr. Mark Morgan, Licensing Lead, at 949-368-6745.

Sincerely, Enclosure cc: A. T. Howell III, Regional Administrator, NRC Region IV R. Hall, NRC Project Manager, SONGS Units 2 and 3 B. Benney, NRC Project Manager, SONGS Units 2 and 3 G. G. Warnick, NRC Senior Resident Inspector, SONGS Units 2 and 3 P.O. Box 128 San Clemente, CA 92674

ENCLOSURE PART 1: SAN ONOFRE UNIT 2 REVISED TS BASES PAGES PART 2: SAN ONOFRE UNIT 3 REVISED TS BASES PAGES 8ases Change Package Numbers 810-006 810-007 810-008 810-009 810-010 810-011 810-012 810-014 810-015 810-018 810-019 810-020 811-002 811-003 812-001 812-002 812-004

PART 1: SAN ONOFRE UNIT 2 REVISED TS BASES PAGES Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABLE Fuel cladding damage does not occur when the core is SAFETY ANALYSES operated outside these LCOs during normal operation.

(continued) However, fuel cladding damage could result, should an accident occur with simultaneous violation of one or more of these LCOs. Changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.

The SDM requirement is ensured by limiting the regulating and shutdown CEA insertion limits, so that the allowable inserted worth of the CEAs is such that sufficient reactivity is available in the CEAs to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth CEA remains fully withdrawn upon trip (Ref. 3).

The most limiting SDM requirements for Mode 1 and 2 conditions at BOC are determined by the requirements of several transients, e.g., Loss of Flow, Seized Rotor, etc.

However, the most limiting SDM requirements for Modes 1 and 2 at EOC come from just one transient, Steam Line Break (SLB). The requirements of the SLB event at EOC for both the full power and no load conditions are significantly larger than those of any other event at that time in the cycle and, also, considerably larger than the most limiting requirements at BOC.

Although the most limiting SDM requirements at EOC are much larger than those at BOC, the available SDMs obtained via the scramming of the CEAs are also substantially larger due to the much lower boron concentration at EOC. To verify that adequate SDMs are available throughout the cycle to satisfy the changing reqUirements, calculations are performed at both BOC and EOC. It has been determined that calculations at these two times in the cycle are sufficient since the differences between available SDMs and the limiting SDM requirements are the smallest at these times in the cycle. The Startup Testing Program demonstrates that the core has the expected shutdown capability.

Consequently, adherence to Leos 3.1.6 and 3.1.7 provides assurance that the available SDMs at any time in the cycle will exceed the limiting SDM requirements at that time in the cycle.

(continued)

SAN ONOFRE--UNIT 2 B 3.1-43 Amendment No. ~200 04/12/11

STE- Low Power Physics Testing B 3.1.12 BASES (continued)

BACKGROUND core are consistent with the design predictions and that the (continued) core can be operated as designed (Ref. 4).

PHYSICS TESTS procedures are written and approved in accordance with establ i shed formats.* The procedures incl ude all information necessary to permit a detailed execution of testing required to ensure that the design intent is met.

PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long term power operation. Examples of PHYSICS TESTS include determination of critical boron concentration, CEA group worths, reactivity coefficients, flux symmetry. and core power distribution.

APPLICABLE It is acceptable to suspend certain LCOs for PHYSICS TESTS SAFETY ANALYSES because additional limits on power level and shutdown capability are maintained during PHYSICS TESTS.

Referenee 5 defines the requirements for initial testing of the facility, including PHYSICS TESTS. Requirements for reload fuel cycle PHYSICS TESTS are defined in ANSI/ANS-19.6.1-1985 (Ref. 4), and WCAP-16011-P-A, Revision 0, Startup Test Activity Reduction Program (Ref. 8).

PHYSICS TESTS for reload fuel cycles are given in Table 1 of ANSI/ANS-19.6.1-1985. and WCAP-16011-P-A, Revision 0, Startup Test Activity Reduction Program (Ref. 8). Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. As long as the linear heat rate (LHR) remains within its limit, fuel design criteria are preserved.

During PHYSICS TESTS, the following LCOs may be suspended:

a. LCO 3.1.1, "SHUTDOWN MARGIN (SDM) -Tavg > 200°FII; and

b. LCO 3.1.4, "Moderator Temperature Coefficient (MTC)II;

c. LCO 3.1.5, "Control Element Assembly (CEA) Alignment";

d. LCO 3.1.6, "Shutdown Control Element Assembly (CEA)

Insertion Limitsll; (continued)

SAN ONOFRE--UNIT 2 B 3.1-65 Amendment No. 127 04/12/11

STE - Low Power Physi cs Test; ng B 3.1.12 BASES (continued)

ACTIONS With less than the minimum required reactivity equivalent available for insertion, restoration of the minimum required reactivity equivalent requirements must be accomplished by increasing the RCS boron concentration. The required Completion Time of 15 minutes for initiating boration allows the operator sufficient time to align the valves and start the boric acid pumps and is consistent with the Completion Time of LCD 3.1.1.

SURVEILLANCE SR 3.1.12.1 REQUIREMENTS Prior demonstration that each CEA to be withdrawn from the core during PHYSICS TESTS is capable of full insertion. when tripped from at least a 50% withdrawn position, ensures that the CEAwill insert on a trip signal. The 7 day Frequency ensures that the CEAs are OPERABLE prior to reducing SDM to less than the limits of LCO 3.1.1.

SR 3.1.12.2

. Verifying that the required shutdown reactivity equivalent of at least the highest estimated CEA worth is available ensures that shutdown capability is preserved. A 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Frequency is suffi ci ent to veri fy the a'ppropri ate acceptance criteria.

REFERENCES 1. 10 CFR 50, Appendix B, Sect; on XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68. Revision 2. August 1978.

4. ANSI/ANS-19.6.1-1985, December 13. 1985.

5. UFSAR. Chapter 14.

6. 10 CFR 50.46.

7. UFSAR. Chapter 15.

8. WCAP-16011-P-A. Revision 0, Startup Test Activity Reduction Program.

SAN ONOFRE--UNIT 2 B 3.1-68 Amendment No. 127 04/12/11

ESFAS Instrumentation B 3.3.5 BASES (continued)

ACTJONS D.l and 0.2 (continued)

Function is in two-out-of-three logic in the bypassed input parameter, but with another channel failed, the ESFAS may be operating with a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected.

To correct the problem, the second channel is placed in trip. This places the ESFAS Function in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, ESFAS actuation will occur.

Action D.2 provides a limit of 7 days for operation with 2 inoperable channels. In the *one-out-of-two configuration, a single channel failure can cause a spurious trip. For RAS and EFAS functions, a spurious trip can lead to undesireable consequences during certain Design Basis Events.

The 7 day time limit provides operational flexibility to perform a required CHANNEL FUNCTIONAL TEST on one channel (which is bypassed) while a second channel is inoperable (and is tri pped) .

The 7 day time limit also maintains acceptable core damage frequency as discussed in NSG 98-007, Time Limit for RAS or EFAS Channel in Trip (Referenc~ 11).

E.;1, E.2.L and E.2.2 Condition E applies to one automatic bypass removal channel inoperable. The only automatic bypass removal on an ESFAS is on the Pressurizer Pressure- Low signal. This bypass remova 1 is shared with the RPS Pressuri zer Pressure - Low bypass removal.

If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status, the associated ESFAS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise. the affected ESFAS channel must be declared inoperable. as in Conditions A and B. and the bypass either removed or the bypass removal channel repaired. The Bases for the Required Actions and required Completion Times are consistent with Conditions A and B.

(continued)

SAN ONOFRE--UNIT 2 B 3.3-100 Amendment No. 197 08/17/11

Res Operational LEAKAGE B 3.4.13 BASES (continued)

SURVEILLANCE SR 3.4.13.1 (continued)

REQUIREMENTS The RCS water inventory balance must be performed with the reactor at steady state operating conditions. The Surveillance is modified by two NOTES. Note 1 states that this SR is not required to be performed in MODES 3 and 4, until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of steady state operation have elapsed.

Steady state operation is required to perform a proper water inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met when steady state is established. For ReS operational LEAKAGE determination by water inventory balance, steady state is defined as stable ReS pressure. temperature. power level, pressurizer and makeup tank levels, makeup and letdown. and RCP controlled bleedoff flows.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. These leakage detection systems are specified in LCD 3.4.15, uRCS Leakage Detection Instrumentation."

Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because primary to secondary LEAKAGE of 150 gallons per day cannot be measured accurately by an ReS water inventory balance.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. A Note under the Frequency column states that this SR ;s required to be performed during steady state operation.

If a transient evolution is occurring 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from the last water inventory balance, then a water inventory balance shall be performed within 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br /> of the last water inventory balance.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-74 Amendment No. ~.204 02/25/11

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

SURVEILLANCE SR 3.4.13.2 REQUIREMENTS (continued) This SR verifies that primary to secondary LEAKAGE is less or equal to 150 gallons per day through anyone SG.

Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCD 3.4.17, USteam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through anyone SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.

The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after establishment of steady state operation. For ReS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP controlled bleedoff flows.

The Surveillance Frequency of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRJ guidelines (Ref. 5),

REFERENCES 1. 10 CFR 50, Appendix A. GDC 30.

2. Regulatory Guide 1.45, May 1973.

3. UFSAR, Section 15.

4. NEl 97-06, "Steam Generator Program Guidelines. u

5. EPR!, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines. u SAN ONOFRE--UNIT 2 B 3.4-75 Amendment No. frr.204 02/25/11

RCS Leakage Detection Instrumentation B 3.4.15 BASES (continued)

BACKGROUND indicator of potential RCS LEAKAGE. A 1°F increase in dew (continued) point is well within the sensitivity range of available instruments.

Since the humidity level is influenced by several factors~ a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump.

Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment.

Containment temperature and pressure fluctuate slightly during plant operation~ but a rise above the normally indicated range of values may indicate ReS LEAKAGE into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and~

for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.

APPLICABLE The need to evaluate the severity of an alarm or an SAFETY ANALYSES indication is important to the operators. and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the UFSAR (Ref. 4).

The safety significance of ReS LEAKAGE varies widely depending on its source, rate. and duration. Therefore.

detecting and monitoring RCS LEAKAGE into the containment area are necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should leakage occur detrimental to the safety of the facility and the public.

ReS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

(continued)

SAN ONOFRE--UNIT 2 B 3.4-83 Amendment No. 127 02/21/11

RCS Leakage Detection Instrumentation B 3.4.15 BASES (continued)

SURVEILLANCE SR 3.4.15.3 and SR 3.4.15.4 (continued)

REQUIREMENTS atmosphere radioactivity monitors. The test ensures that the monitor can perform its function in the desired manner.

The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency of 92 days considers instrument reliability, and operating experience has shown it proper for detecting degradation.

SR 3.4.15.5, SR 3.4.15.6, and SR 3.4.15.7 These SRs require the performance of a CHANNEL CALIBRATION for each of the ReS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 24 months is a typical refueling cycle and considers channel reliability.

Operating experience has shown this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A, Section IV, GDC 30.

2. Regulatory Guide 1.45, U.S. Nuclear Regulatory Commission.

3. Not Used.

4. UFSAR, Section 5.2.5.

SAN ONOFRE--UNIT 2 B 3.4-87 Amendment No. 127 02/21/11

ECCS - Opera t i ng B 3.5.2 BASES (continued)

SURVEILLANCE SR 3.5.2.1 and 3.5.2.2 REQUIREMENTS SR 3.5.2.1 verification of proper valve position ensures that the flow path from the ECeS pumps to the ReS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removing power or by key locking the control in the correct position ensures that the valves cannot be inadvertently misaligned or change position as the result of an active failure. These valves (with the exception of HV-8162 and HV-8163) are of the type described in Reference 5, which can disable the function of both EeCS trains and invalidate the accident analysis. (NOTE: A failure to open LPSI miniflow isolation valve HV-8162 or HV-8163 makes only the corresponding LPSI train inoperable.

Misalignment of one of these two valves could not render both EeeS trains inoperable.) SR 3.5.2.2 verification of the proper positions of the Containment Emergency Sump isolation valves and EeCS pumps/containment spray pumps miniflow valves ensures that EeeS operability and containment integrity are maintained. Securing these valves in position with power available will provide additional assurance that these valves will operate on a RAS. A 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered reasonable ;n view of other administrative controls ensuring that a mispositioned valve is an unlikely possibility.

SR 3.5.2.3 Verifying the correct alignment for manual. power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for EeeS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This Surveillance does not require any testing or valve (continued)

SAN ONOFRE--UNIT 2 B 3.5-18 Amendment No. 127 02/25/11

Containment Dome Air Circulators B 3.6.8 BASES (continued)

APPLICABLE The dome air circulators mix the containment atmosphere to SAFETY ANALYSES provide a uniform hydrogep concentration.

Hydrogen may accumulate in containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant;

b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;

c. Hydrogen in the RCS at the time of the LOCA (i .e.,

hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space); or

d. Corrosion of metals exposed to Containment Spray System and Emergency Core Cooling Systems solutions.

To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 1 are used to maximize the amount of hydrogen calculated.

The dome air circulators satisfy Criterion 3 of the NRC Policy Statement.

LCO Two dome air circulator trains must be OPERABLE. with power to each from an independent, safety related power supply.

Each train consists of two fans with their own motors and controls and is automatically initiated by a CCAS. While each train has two fans, only one OPERABLE fan is required for the train to be OPERABLE, since each fan can provide the necessary flow rate to adequately mix the containment atmosphere.

Operation with at least one dome air circulator train provides the mixing necessary to ensure uniform hydrogen concentration throughout containment.

APPLICABILITY In MODES 1 and 2, the two dome air circulator trains ensure the capability to prevent localized hydrogen concentrations above the flammability limit of 4.1 v/o in containment, assuming a worst case single active failure.

(continued)

SAN ONOFRE--UNIT 2 B 3.6-54 Amendment No. 159 03/21/11

MSSVs B 3.7.1 BASES (continued)

APPLICABLE The design basis for the MSSVs* comes from Reference 2.

SAFETY ANALYSES The MSSVs* purpose is to limit secondary system pressure to

~ 110% of design pressure when passing 100% of design steam flow. This design basis is sufficient to cope with any anticipated operational occurrence (ADO) or accident considered in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the MSSV relieving capacity, and thus RCS pressure, are those characterized as decreased heat removal events, and are presented in the UFSAR, Section 15.2 (Ref. 3). Of these. the full power loss of condenser vacuum (LOCV) event is the limiting ADO. An LOCV isolates the turbine and condenser, and terminates normal feedwater flow to the Steam Generators. Before delivery of auxiliary feedwater to the Steam Generators, RCS pressure reaches

~ 2750 psia. This peak pressure is less than or equal to 110% of the design pressure of 2500 psia. but high enough to actuate the pressurizer safety valves. The maximum relieving rate of the MSSVs during the LOCV event (Reference 3), is within the rated capacity of the MSSVs.

The MSSVs satisfy Criterion 3 of the NRC Policy Statement.

(continued)

SAN ONOFRE--UNIT 2 B 3.7-2 Amendment No. 127 03/21/11

MSIVs B 3.7.2 BASES (continued)

APPLICABLE The design basis of the MSIVs is established by the SAFETY ANALYSES containment analysis for the large steam line break (SLB) inside containment, as discussed in the UFSAR, Section 6.2 (Ref. 2). It is also influenced by the accident analysis of the SLB events presented in the UFSAR, Section 15.1.3 (Ref. 3). The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand).

The limiting case for the containment analysis is the hot zero power SLB inside containment with a loss of offsite power following turbine trip, and failure of the MSIV on the affected steam generator to close. At zero power, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Due to reverse flow, failure of the MSIV to close contributes to the total release of the additional mass and energy in the steam headers, which are downstream of the other MSIV. With the most reactive Single Control Element Assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the borated water injection delivered by the Emergency Core Cooling System. Other failures considered are the failure of an MFIV to close, and failure of an emergency diesel generator to start.

The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside containment at hot zero power ;s the limiting case for a post trip return to power. The analysis included scenarios with offsite power available and with a loss of offsite power following turbine trip.

(continued)

SAN ONOFRE--UNIT 2 B 3.7-8 Amendment No. 127 04/12/11

MSIVs B 3.7.2 BASES (continued)

ACTIONS 0.1 and 0.2 (continued)

If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time. the unit must be placed in a MODE in which the LCD does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is

~ 8.0 seconds. The MSIV closure time is assumed in the accident and containment analyses. The MSIVs should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power.

As the MSIVs are not tested at power, they are exempt from the ASME Code,Section XI (Ref. 5), requirements during operation in MODES 1 and 2.

REFERENCES 1. UFSAR. Section 10.3.

2. UFSAR, Section 6.2.

3. UFSAR, Section 15.1.3.

4. 10CFR 100.11.

5. ASME, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Article IWV-3400.

SAN ONOFRE--UNIT 2 B 3.7-12 Amendment No. 127 04/12/11

MFIVs B 3.7.3 BASES (continued)

LCO Failure to meet the LCO requirements can result in (continued) additional mass and energy being released to containment following an SLB or FWLB inside containment.

If an alarm on high steam generator level is relied on to terminate an excess feedwater flow event, failure to meet the LCO may result in the introduction of water into the main steam lines.

APPLICABILITY The MFIVs must be OPERABLE whenever there is Significant mass and energy in the Reactor Coolant System and steam generators. This ensures that. in the event of an HELB. a single failure cannot result in the blowdown of more than one steam generator.

In MODES 1. 2. and 3. the MFIVs are required to be OPERABLE, except when they are closed and deactivated in order to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When.the val~es are closed and deactivated, they are already performing their safety function. .

In MODES 4. 5. and 6, steam generator energy is low.

Therefore, the MFIVs are normally closed since MFW is not required.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each value.

A.I and A.2 With one or more MFIVs inoperable; action must be taken to close or isolate the inoperable valves within 7 days. When these valves are closed or isolated, they are performing their required safety function (e.g., to isolate the line).,

The 7 day Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event occurring during this time period that would require isolation of the MFW flow path.

(continued)

SAN ONOFRE--UNIT 2 B 3.7-15 Amendment No. 127 08/17/11

AFW System B 3.7.5 BASES (continued)

BACKGROUND (MSIV). Each of the steam feed lines will supply 100% of (continued) the requirements of the turbine driven AFW pump. The turbine driven AFW pump supplies a common header capable of feeding both steam generators, with DC powered control valves actuated to the appropriate steam generator by the Emergency Feedwater Actuation System (EFAS).

The AFW System supplies feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions.

The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the setpoint of the MSSVs. Subsequently, the AFW System supplies sufficient water to cool the unit to SDC entry conditions, and steam is released through the ADVs.

The AFW System actuates automatically on low steam generator level by the EFAS as described in LCD 3.3.5, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation."

The EFAS logic is designed to feed either or both steam generators with low levels, but will isolate the AFW System from a steam generator having a significantly lower steam pressure than the other steam generator. The EFAS automatically actuates the AFW turbine driven pump and associated DC operated valves and controls when required, to ensure an adequate feedwater supply to the steam generators.

DC operated valves are provided for each AFW line to control the AFW flow to each steam generator.

(continued)

SAN ONOFRE--UNIT 2 B 3.7-24 Amendment No. 127 03/21/11

AFW System B 3.7.5 BASES (continued)

BACKGROUND The AFW System is discussed in the UFSAR, Section 10.4.9 (continued) (Ref. 1).

APPLICABLE The AFW System mitigates the consequences of any event with SAFETY ANALYSES a loss of normal feedwater.

The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat, by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest MSSV set pressure plus 3%.

The limiting Design Basis Accidents (DBAs) and transients for the AFW System are as follows:

a. Feedwater Line Break (FWLB); and

b. Loss of normal feedwater.

In addition, the minimum available AFW flow and system characteristics are serious considerations in the analysis of a small break loss of coolant accident.

The AFW System design is such that it can perform its function following an FWLB between the MFW isolation valve and containment, combined with a loss of offsite power following turbine trip, and a single active failure of the (continued)

SAN ONOFRE--UNIT 2 B 3.7-25 Amendment No. 127 03/21/11

CCW Safety Related Makeup System B 3.7.7.1 BASES (continued)

BACKGROUND sufficient time is available after the limiting event (continued) for the operator to initiate manual action emergency makeup is a continuously supervised operation and continuous safety related CCW surge tank level indication is being provided.

Safety related CCW makeup utilizes the PPMU tank located in the Radwaste Building at E1. 9' for each unit as a source of makeup water.

The nominal capacity of each PPMU tank is 300,000 gallons.

203,800 gallons in tank T-056 and 203,719 gallons in tank T-055 are dedicated to the CCW safety related makeup. This amount includes the total tank level instrumentation loop uncertainty (TLU) and the unrecoverable volume. For both tanks, this volume corresponds to the water level at plant elevation 30'-9 -3/4'1 (or 65.5% tank level as indicated in the Control Room). The dedicated volume allows makeup for CCW system leakage (from both CCW trains) of up to 18 gpm for a period of seven days. The minimum water level required in the PPMU tank for the ecw safety related makeup system to be considered OPERABLE is a function of the CCW system total leak rate. The volume above that controlled by the TS is available for the PPMU system use.

A common suction header connects the cew safety related makeup pumps to the PPMU tank at elevation 111-0~. The suction nozzle has a pointing downward elbow attached inside the tank. This is done to increase the tank usable volume and to provide an adequate margin to prevent vortex formation. After transferring the TS volume from the tank, the level of water remaining in the tank is 10~ above the pump suction nozzle inlet.

To enable in-service testing of the CCW makeup pumps, a test loop capable of passing a flow approximately equal to the nominal makeup flow is provided.

The high and low level alarms annunciate in the Radwaste Control Room on Panel 2/3L-5 at 95% (LSH-7133) and 75% tank level (LSL-7133), respectively. The high level alarm also annunciates in the main Control Room.

(continued)

SAN ONOFRE--UNIT 2 B 3.7-43d AMENDMENT NO. 129 02/06/12

CCW Safety Related Makeup System B 3.7.7.1 BASES (continued)

APPLICABLE common for both CCW trains. Such depletion of the inventory SAFETY ANALYSES would take place should relief valves on the CCW surge tank (continued) lift as a result of tank overfilling and water being discharged from the CCW system into the plant vent stack.

Makeup water inventory depletion would impact the CCW safety related makeup system capability to perform its safety function.

Operator action is required outside the control room to mitigate the single active failure of a CCW pump motor control relay stuck in the "operate" position, because this failure prevents both pump trip and discharge valve closure using the control switches. The specific mitigating action is to open the respective pump breaker at the MeC in the El.

50' switchgear room. The assumed above operator action time of 30 minutes is sufficient to mitigate this failure.

The single tank and common suction nozzle configuration of the CCW makeup system is subject to the single passive failure criteria of ANSI Standard N658-1976, because the system is required to operate for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> post-accident. Concurrent passive failures which must be considered under this standard are flow path blockage and pressure boundary failures."

Flow path blockage due to entrainment of foreign material is not credible because the system is operated using only filtered and demineralized water. Furthermore, blockages due to component internal failures are not credible because:

a) there are no valves in the common flow path, and b) the system suction line is provided with a pointing downward elbow inside the tank (which ensures sufficient submergence of the suction inlet to prevent entrainment of any floating debris even at the maximum suction velocity).

Passive failure of the pressure boundary may be limited to failed valve packing and pump mechanical seals for systems designed and maintained to ASME Section III and Section XI criteria. All such failures in the proposed makeup system can be isolated because the suction isolation valve for each train has a back seat to prevent leakage due to failure of its packing. This valve can be used to isolate all other (continued)

SAN ONOFRE--UNIT 2 B 3.7-43f AMENDMENT NO. 129 02/06/12

CREACUS B 3.7.11 BASES . (continued)

LCO c. Ductwork~ valves, and dampers are OPERABLE, and air (continued) circulation can be maintained.

If an Emergency Isolation Damper is inoperable for reasons other than leakage, the associated train of CREACUS may still be considered OPERABLE if the inoperable damper is closed with power removed. If an Emergency Isolation Damper is inoperable, the associated train of CREACUS may still be

. considered OPERABLE if the redundant damper in series with the inoperable damper is closed with power removed.

In order for the CREACUS trains to be considered OPERABLE.

the eRE boundary must be maintained such that eRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that eRE occupants are protected from hazardous chemicals and smoke.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.

This note only applies to 'openings in the eRE boundary that can be rapidly restored to,the design condition, such as doors, hatches, floor plugs. and access panels. For entry and exit through doors the administrative control of the opening ;s performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the" opening who is in continuous communication with the operators in the eRE. Thi s i ndi vi dua 1 wi 11 have a method to rapidly close the opening and to restore the eRE boundary to a condition equivalent to the design condition when a need for eRE isolation is indicated.

(continued)

SAN DNDFRE--UNIT 2 B 3.7-60 Amendment No. 127 11/30/11

AC Sources - Operati ng B 3.8.1 BASES (continued)

ACTIONS A.2 (continued)

As in Required Action A.2 t the ComRletion Time allows for an exception to the normal "time zero' for beginning the allowed outage time IIclock." This will result in establishing the "time zero" at the time that the LCO was initially not met t instead of at the time Condition A was entered.

An extended Completion Time (CT) for required Action A.2 provides 1 lO-day one time outage per train to allow for maintenance to be performed. This CT option is for use prior to 24:00 (midnight) on 6/30/2012 and is subject to the following compensatory measures being established for both Units 2 and 3 in accordance with the associated NRC amendment for this option.

Online Unit Compensatory Measures (MODES 1 to 4)

• Protect the available offsite source: via switchyard barriers and 4.16 kV cross-tie breaker barriers.

• Protect both onsite sources ~ Perform Surveillances on the operating unit EDGs prior to entering Action Statement, and protect the available switchgear room.

• En~ure the protected train is the train with the OPERABLE 4.16 kV cross-tie.

• Ensure affected train common equipment (IE 480 VAC buses, emergency chillers, control room emergency cooling units) are aligned to the on-line unit.

• Protect all 3 AFW pumps.

• Protect switchgear room normal HVAC cooling unit and exhaust fan.

• Implement switchyard restrictions and do not allow any train work on the protected train.

Outage Unit Compensatory Measures

• Protect the available train offsite source: via swithyard barriers and 4.16 kV cross-tie breaker barriers.

• Protect the available train onsite source, EDG and 4.16 kV bus.

• Protect all available train safety function equipment CCW (component cooling water)t SWC (saltwater cooling). SDC (shutdown cooling), and SFP (Spent Fuel Poo 1) coo 1i ng .

(continued)

SAN ONOFRE--UNIT 2 B 3.8-7 Amendment No. 224 12/21/11

AC Sources - Operati ng B 3.8.1 BASES (conti nued)

ACTIONS A.2 (continued)

• Implement switchyard restrictions and do not allow any work on the Rrotected electric power buses that are providing safety function fulfillment.

• Scheduling: Work the supply cubicles and cross-tie cubicle bottle replacements first, allowing for a quicker emergency return to service.

• Develop a Qlan to effect an emergency return to service. if required to support the operating unit.

• Bus outages are to be performed during the core offload window, when fuel is removed from the reactor vessel.

The following compensatory measures apply to the Unit 3 Cycle 16 refueling only since Unit 3 steam generator replacement is planned for this outage:

• Rigging activities to be limited to one end of the steam generator replacement outside lift system (OLS) to limlt potential impact to Unit 3 Train A diesel generator cables located underground near the containment equipment hatch.

• OLS construction, use, and removal to be limited to specific outage windows to reduce risk to the Unit 3 Train A diesel generator cables.

• SONGS NUREG-0612 heavy loads procedural requirements are to be implemented for both the OLS and the service crane to ensure safe load paths are followed. or safe shutdown equipment is taken out of service, during the rigging activity.

• A Unit 3 Cycle 16 shutdown qualitative risk assessment to be performed to provide qualitative risk management actions to demonstrate acceptable outage risk during construction. use, and deconstruction of the OLS.

• Work controls to be in place to lay the service crane boom down prior to severe weather.

• There are to be no load movements by the service crane over the switchyard.

B.1 To ensure a highly reliable power source remains when one of the required OGs is inoperable. it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Reguired Action only specifies ~perform~"

a failure of SR 3.8.I.1 acceptance criteria does not result in a Required Action being not met. However~ if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability. additional Conditions and Required Actions must then be entered.

(continued)

SAN ONOFRE--UNIT 2 B 3.8-7a Amendment No. 224 12/21/11

AC Sources - Operati ng B 3.8.1 BASES (conti nued)

SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS

a. kVAR is ~ 3000 and ~ 3200 or

b. the excitation current is ~ 5.0 A and ~ 5.5 A or*

c. the ESF bus voltage is ~ 4530 V and ~ 4550 V or

d. DG feeder current is ~ 730 A and s 750 A

• During the U2C17 Outage, between replacement of the generator for Train A &Train B, the excitation range for the Train B generator is ~ 3.8 A and s 4.0 A This method of establishing kVAR loading ensures that, in addition to verifying the load carrying capability (kW) of the diesel engine the reactive power tkVAR) and voltage regulation capability of the generator is verified to the extent practicable. consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Information Notice 91-13 (Ref. 16).

The normal 31 day Frequency for this Surveillance (Table 3.8.1-1) is consistent with Regulatory Guide 1.9 (Ref. 3).

This SR is modified by five Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loadin~, as recommended by the manufacturer, so that mechanlcal stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test.

Similarly. momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory Rerformance. Note 5 - This note discusses operability of the diesel generator sUbcomponent Automatic Voltage Regulator (AVR). The AVR is an inte~ral part of the DG, however, each DG has 2 AVRS that are 100~ redundant to each other. Only one AVR may be inservice at anyone time.

To ensure operability of each AVR. the AVRs must have been in service Quring the performance of SR 3.8.1.2 and SR 3.8.1.3 within the last 60 days plus any allowance per SR 3.0.2. SR 3.8.1.2 is modified by NOTE 1 to indicate that SR 3.8.1.7 satisfies all of the requirements of SR 3.8.1.2.

This note is applicable for AVR operability. Also, each AVR must have been in service for either SR 3.8.1.9.

SR 3.8.1.10, or SR 3.8.1.19 within the last 24 months plus any allowance per SR 3.0.2. During the 24 month test dynamic performance of the AVR is measured to confirm it is acceptable for all required AVR transients. Based on the design of the AVR, its intended function and the maintenance history, the above specified surveillance schedule will assure the AVRs are capable of performing their intended function.

(continued)

SAN ONOFRE~-UNIT 2 8 3.8-17 Amendment No. 127 01/24/12

AC Sources - Operati ng B 3.8.1 BASES (continued)

SURVEILLANCE SR 3.8.1.4 REQUIREMENTS This SR provides verification that the level of fuel oil in the day tank is at or above the level selected to ensure adequate fuel oil for a mini.mum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of DG operati on at full load plus 10%. The level is expressed as an equivalent volume in inches. The 31.5 inch level includes instrument uncertainties and corresponds to the minimum requirement of 389 gallons of fuel oil. .

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous microorganisms that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for microbial survival in the day tanks. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water.

contaminated fuel oil, and from breakdown of the fuel oil by microorganisms. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel 011 system.

The Surveillance Freguencies are established by Regulatory Guide 1.137 (Ref. 10). This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR provided the accumulated water is removed during the performance of this *Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that for each OPERABLE DG at least one fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of the standby power source. This Surveillance provides assurance that at least one fuel oil tran$fer pump is OPERABLE, the fuel oil piping system is intact. the fuel delivery piping is not obstructed. and the controls and control systems for the fuel transfer system are OPERABLE.

(continued)

SAN ONOFRE--UNIT 2 B 3.8-18 Amendment No. 211 01/24/12

AC Sources - Operati ng B 3.8.1 BASES (continued)

SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS The DG full load rejection may occur because of a system fault. inadvertent breaker tripping or a SIAS received during surveillance testing. This Surveillance ensures proper engine and generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG will not trip upon loss of the load. The voltage transient limit of 5450 V is 125% of rated voltage (4360 V). These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application (e.g., reconnection to the bus if the trip initiator can be corrected or isolated). These loads and limits are consistent with Regulatory Guide 1.9 (Ref. 3).

The DG is tested under inductive load conditions that are as close to design basis conditions as possible. Testing is performed with DG kVAR output that offsite power system conditions permit during testing without exceeding equipment ratings (i .e., without creating an overvoltage condition on the ESF buses, over excitation condition in the generator.

or overloading the DG main feeder). The kVAR loading requirement during this test is met. and the equipment ratings are not exceeded, when the DG kVAR output is increased such that:

a. kVAR is ~ 3000 and s 3200 or

b. the excitation current is ~ 5.0 A and s 5.5 A or*

c. the ESF bus voltage is ~ 4530 V and s 4550 V or

d. DG feeder current is ~ 730 A and s 750 A

• During the U2C17 Outage, between replacement of the generator for Train A &Train B, the excitation range for the Train B generator is ~ 3.8 A and ~ 4.0 A This method of establishing kVAR loading ensures that, in addition to verifying the full load rejection capability (kW) of the diesel engine. the reactive power rejection capability (kVAR) of the generator is verified to the extent practicable, consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Information Notice 91-13 (Ref. 16).

The 24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3) and is intended to be consistent with expected fuel cycle lengths.

(continued)

SAN ONOFRE--UNIT 2 B 3.B-22 Amendment No. 127 01/24/12

AC Sources - Operating B 3.B.1 BASES (continued)

SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS The DG is tested under inductive load conditions that are as close to design conditions as possible. Testing is performed with DG kVAR output that offsite power system conditions permit during testing without exceeding equipment ratings (i.e., without creating an overvoltage condition on the ESF buses, over excitation condition in the generator, or overloading the DG main feeder). The kVAR loading requirement during this test is met, and the equipment ratings are not exceeded, when the DG kVAR output is increased such that:

a. kVAR is ~ 3000 and ~ 3200 or

b. the excitation current is ~ 5.0 A and ~ 5.5 A or*

c. the ESF bus voltage is ~ 4530 V and ~ 4550 V or

d. DG feeder current is ~ 730 A and ~ 750 A

• During the U2C17 Outage, between replacement of the generator for Train A &Train B. the excitation range for the Train B generator is ~ 3.8 A and $ 4.0 A This method of establishing kVAR loadin~ ensures that, in addition to verifying the load carryin~ capability (kW) of the diesel engine, the reactive power (kVAR) and voltage regulation capability of the generator is verified to the extent practicable, consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Information Notice 91-13 (Ref. 16).

The kW load band in the SR is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 24 month Frequency is consistent with the recommendations of Regulatory Guide 1.9. (Ref. 3), takes into consideration unit conditions required to perform the Surveill~nce, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly. momentary power factor transients above the power factor limit will not invalidate this test. Note 2 acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 9.4 seconds. The 9.4 second time is .

(continued)

SAN ONOFRE--UNIT 2 B 3.8-27 Amendment No. 127 01/24/12

Distribution Systems -- Operating B 3.8.9 Table B 3.8.9-1 (Page 1 of 1)

AC and DC Electrical Power Distribution Systems TYPE VOLTAGE TRAIN A TRAIN B 4160 V ESF Bus A04 ESF Bus A06 AC Load Center B04 Load Center B06 480 V Load Center B24 Load Center B26 SUBSYSTEM A SUBSYSTEM C SUBSYSTEM B SUBSYSTEM 0 DC 125 V Bus 01 Bus 03 Bus 02 Bus D4 Panel DIPI Panel 03Pl Panel 02Pl Panel D4Pl CHANNEL A CHANNEL C CHANNEL B CHANNEL D AC vital 120 V bus Bus Y01 Bus Y03 Bus Y02 Bus Y04 SAN ONOFRE--UNIT 2 B 3.8-83 Amendment No. 127 02/21/11 I

PART 2: SAN ONOFRE UNIT 3 REVISED TS BASES PAGES Regulating CEA Insertion Limits B 3.1.7 BASES (continued)

APPLICABLE Fuel cladding damage does not occur when the core is SAFETY ANALYSES operated outside these LCOs during normal operation.

(continued) However. fuel cladding damage could result,should an accident occur with simultaneous violation of one or more of these LCOs. Changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.

The SDM requirement is ensured by limiting the regulating and shutdown CEA insertion limits, so that the allowable inserted worth of the CEAs is such that sufficient reactivity is available in the CEAs to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth CEA remains fully withdrawn upon trip (Ref. 3).

The most limiting SDM requirements for Mode 1 and 2 conditions at BOC are determined by the requirements of several transients. e.g .* Loss of Flow. Seized Rotor, etc.

However. the most limiting SDM requirements for Modes 1 and 2 at EOC come from just one transient, Steam Line Break (SLB). The requirements of the SLB event at EOC for both the full power and no load conditions are significantly larger than those of any other event at that time in the cycle and. also, considerably larger than the most limiting reqUirements at BOC.

Although the most limiting SDM requirements at EOC are much larger than those at BOC, the available SDMs obtained via the scramming of the CEAs are also substantially larger due to the much lower boron concentration at EOC. To verify that adequate SDMs are available throughout the cycle to satisfy the changing reqUirements, calculations are performed at both BOC and EOC. It has been determined that calculations at these two times in the cycle are sufficient since the differences between available SDMs and the limiting SDM requirements are the smallest at these times in the cycle. The Startup Testing Program demonstrates that the core has the expected shutdown capability.

Consequently. adherence to LCOs 3.1.6 and 3.1.7 provides assurance that the available SDMs at any time in the cycle will exceed the limiting SDM requirements at that time in the cycle.

(continued)

SAN ONOFRE--UNIT 3 B 3.1-43 Amendment No. t!6,191 04/12/11

STE - Low Power Phys i cs Test i ng B 3.1.12 BASES (continued)

BACKGROUND core are consistent with the design predictions and that the (continued) core can be operated as designed (Ref. 4).

PHYSICS TESTS procedures are written and approved in accordance with established formats. The procedures include all information necessary to permit a detailed execution of testing required to ensure that the design intent is met.

PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long term power operation. Examples of PHYSICS TESTS include determination of critical boron concentration, CEA group worths, reactivity coefficients, flux symmetry, and core power distribution.

APPLICABLE It is acceptable to suspend certain LCOs for PHYSICS TESTS SAFETY ANALYSES because additional limits on power level and shutdown capability are maintained during PHYSICS TESTS.

Reference 5 defines the requirements for initial testing of the facility, including PHYSICS TESTS. Requirements for reload fuel cycle PHYSICS TESTS are defined in ANSI/ANS-19.6.1-1985 (Ref. 4), and WCAP-16011-P-A, Revision O. Startup Test Activity Reduction Program (Ref. 8).

PHYSICS TESTS for reload fuel cycles are given in Table 1 of ANSI/ANS-19.6.1-1985, and WCAP-16011-P-A, Revision 0, Startup Test Activity Reduction Program (Ref. 8). Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs. conditions may occur when one or more Leos must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. As long as the linear heat rate (LHR) remains within its limit, fuel design criteria are preserved.

During PHYSICS TESTS, the following LCOs may be suspended:

a. LCO 3.1.1, "SHUTDOWN MARGIN (SDM)-T avg > 200°FII; and

b. LCD 3.1.4, IIModerator Temperature Coefficient (MTC)";

c. LCO 3.1.5, "Control Element Assembly (CEA) Alignment";

d. LCD 3.1.6, "Shutdown Control Element Assembly (CEA)

Insertion Limits";

(continued)

SAN ONOFRE--UNIT 3 B 3.1-65 Amendment No. 116 04/12/11

STE-Low Power Physics Testing B 3.1.12 BASES (continued)

ACTIONS With less than the minimum required reactivity equivalent available for insertion, restoration of the minimum required reactivity equivalent requirements must be accomplished by increasing the RCS boron concentration. The required Completion Time of 15 minutes for initiating boration allows the operator sufficient time to align the valves and start the boric acid pumps and is consistent with the Completion Time of LCO 3.1.1.

SURVEI LLANCE SR 3.1.12.1 REQUIREMENTS Prior demonstration that each CEA to be withdrawn from ,the core during PHYSICS TESTS is capable of full insertion, when tripped from at least a 50% withdrawn position, ensures that the CEA will insert on a trip signal. The 7 day Frequency ensures that the CEAs are OPERABLE prior to reducing SDM to less than the limits of LCO 3.1.1.

SR 3.1.12.2 Verifying that the required shutdown reactivity equivalent of "at least the highest estimated CEA worth is available ensures that shutdown capability is preserved. A 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Frequency is sufficient to verify the appropriate acceptance criteria.

REFERENCES 1. 10 CFR 50, Appendix B, Secti on XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68, Revision 2, August 1978.

4. ANSI/ANS~19.6.1-1985, December 13, 1985.

5. UFSAR. Chapter 14.

6. 10 CFR 50.46.

7. UFSAR. Chapter 15.

8. WCAP-16011-P-A. Revision 0, Startup Test Activity Reduction Program.

SAN ONOFRE--UNIT 3 B 3.1-68 Amendment No. 116 04/12/11

ESFAS Instrumentation B 3.3.5 BASES (continued)

ACTIONS D.1 and 0.2 (continued)

Function is in two-out-of-three logic in the bypassed input parameter, but with another channel failed. the ESFAS may be operating with a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected.

To correct the problem, the second channel is placed in trip. This places the ESFAS Function in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal. ESFAS actuation will occur.

Action D.2 provides a limit of 7 days for operation with 2 inoperable channels. In the one-out-of-two configuration, a single channel failure can cause a spurious trip. For RAS and EFAS functions, a spurious trip can lead to undesireable consequences during certain Design Basis Events.

The 7 day time limit provides operational flexibility to perform a required CHANNEL FUNCTIONAL TEST on one channel (which is bypassed) while a second channel is inoperable (and is tripped).

The 7 day time limit also maintains acceptable core damage frequency as di scussed in NSG 98-007. Time Limi t for RAS or EFAS Channel in Trip (Reference 11).

E.l, E.2.1. and E.2.2 Condition E applies to one automatic bypass removal channel inoperable. The only automatic bypass removal on an ESFAS is on the Pressurizer Pressure-Low signal. This bypass removal is shared with the RPS Pressurizer Pressure-Low bypass removal.

If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status. the associated ESFAS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise, the affected ESFAS channel must be declared inoperable. as in Conditions A and B, and the bypass either removed or the bypass removal channel repaired. The Bases for the Required Actions and required Completion Times are consistent with Conditions A and B.

(continued)

SAN ONOFRE--UNIT 3 B 3.3-100 Amendment No. 188 08/17/11

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

SURVEILLANCE SR 3.4.13.1 (continued)

REQUIREMENTS The ReS water inventory balance must be performed with the reactor at steady state operating conditions. The Surveillance is modified by two NOTES. Note 1 states that this SR is not required to be performed in MODES 3 and 4, until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of steady state operation have elapsed.

Steady state operation is required to perform a proper water inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met when steady state is established. For ReS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure. temperature. power level, pressurizer and makeup tank levels, makeup and letdown, and RCP controlled bleedoff flows.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. These leakage detection systems are specified in LCD 3.4.15, "RCS Leakage Detection Instrumentation."

Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because primary to secondary LEAKAGE of 150 gallons per day cannot be measured accurately by an ReS water inventory balance.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Frequency is a reasonable interval to trend LEAKAGE and recognizes the ;m~ortance of early leakage detection in the prevention of accidents. A Note under the Frequency column states that this SR is required to be performed during steady state operation.

If a transient evolution is occurring 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> from the last water inventory balance, then a water inventory balance shall be performed within 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br /> of the last water inventory balance.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-74 Amendment No. tt6,196 02/25/11

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

SURVEILLANCE SR 3.4.13.2 REQUIREMENTS (continued) Thi s SR verifi es that primary to secondary LEAKAGE is .1 ess or equal to 150 gallons per day through anyone SG.

Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met.

compliance with LCO 3.4.17, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through anyone 5G. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.

The Surveillance is modified by a Note which states that the Surveillance ;s not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after establishment of steady state operation. For ReS primary to secondary LEAKAGE determination. steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and Rep controlled bleedoff flows.

The Surveillance Frequency of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 5).

REFERENCES 1. 10 CFR 50, Appendix A. GOC 30.

2. Regulatory Guide 1.45, May 1973.

3. UFSAR, Section 15.

4. NEI 97-06, IISteam Generator Program Guidelines."

5. EPRI, uPressurized Water Reactor Primary-to-Secondary Leak GUidelines."

SAN ONOFRE--UNIT 3 B 3.4-75 Amendment No. tt&.196 02/25/11

RCS Leakage Detection Instrumentation B 3.4.15 BASES (continued)

BACKGROUND indicator of potential RCS LEAKAGE. A 1°F increase in dew (continued) point is well within the sensitivity range of available instruments.

Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump.

Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment.

Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS LEAKAGE into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature. detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.

APPLICABLE The need to evaluate the severity of an alarm or an SAFETY ANALYSES indication is important to the operators. and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the UFSAR (Ref. 4).

The safety significance of ReS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area are necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should leakage occur detrimental to the safety of the facility and the public.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

(continued)

SAN ONOFRE--UNIT 3 B 3.4-83 Amendment No. 116 02/21/11

Res Leakage Detection Instrumentation B 3.4.15 BASES (continued)

SURVEILLANCE SR 3.4.15.3 and SR 3.4.15.4 (continued)

REQUIREMENTS atmosphere radioactivity monitors. The test ensures that the monitor can perform its function in the desired manner.

The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency of 92 days considers instrument reliability, and operating experience has shown it proper for detecting degradation.

SR 3.4.15.5, SR 3.4.15.6, and SR 3.4.15.7 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 24 months is a typical refueling cycle and considers channel reliability.

Operating experience has shown this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A.Section IV. GOC 30.

2. Regulatory Guide 1.45. U.S. Nuclear Regulatory Commission.

3. Not Used.

4. UFSAR. Section 5.2.5.

SAN ONOFRE--UNIT 3 B 3.4-87 Amendment No. 116 02/21/11

ECCS - Operating B 3.5.2 BASES (continued)

SURVEI LLANCE SR 3.5.2.1 and 3.5.2.2 REQUIREMENTS SR 3.5.2.1 verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS ;s maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removing power or by key locking the control in the correct position ensures that the valves cannot be inadvertently misaligned or change position as the result of an active failure. These valves (with the exception of HV-8162 and HV-8163) are of the type described in Reference 5, which can disable the function of both ECCS trains and invalidate the accident analysis. (NOTE: A failure to open LPSI miniflow isolation valve HV-8162 or HV-8163 makes only the corresponding LPSI train inoperable.

Misalignment of one of these two valves could not render both ECCS trains inoperable.) SR 3.5.2.2 verification of the proper positions of the Containment Emergency Sump isolation valves and ECCS pumps/containment spray pumps miniflow valves ensures that ECCS operability and containment integrity are maintained. Securing these valves in position with power available will provide additional assurance that these valves will operate on a RAS. A 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered reasonable in view of other administrative controls ensuring that a mispositioned valve is an unlikely possibility.

SR 3.5.2.3 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for Eces operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This Surveillance does not require any testing or valve (continued)

SAN ONOFRE--UNIT 3 B 3.5-18 Amendment No. 116 02/25/11

Containment Dome Air Circulators B 3.6.8 BASES (continued)

APPLICABLE The dome air circulators mix the containment atmosphere to SAFETY ANALYSES provide a uniform hydrogen concentration.

Hydrogen may accumulate in containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant;

b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;

c. Hydrogen in the RCS at the time of the LOCA (; .e.,

hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space); or

d. Corrosion of metals exposed to Containment Spray System and Emergency Core Cooling Systems solutions.

To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 1 are used to maximize the amount of hydrogen calculated.

The dome air circulators satisfy Criterion 3 of the NRC Policy Statement.

LCO Two dome air circulator trains must be OPERABLE, with power to each from an independent. safety related power supply.

Each train consists of two fans with their own motors and controls and is automatically initiated by a CCAS. While each train has two fans, only one OPERABLE fan is required for the train to be OPERABLE, since each fan can provide the necessary flow rate to adequately mix the containment atmosphere.

Operation with at least one dome air circulator train provides the mixing necessary to ensure uniform hydrogen concentration throughout containment.

APPLICABILITY In MODES 1 and 2. the two dome air circulator trains ensure the capability to prevent localized hydrogen concentrations above the flammability limit of 4.1 vlo in containment.

assuming a worst case single active failure.

(continued)

SAN ONOFRE--UNIT 3 B 3.6-54 Amendment No. 150 03/21/11

MSSVs B 3.7.1 BASES (continued)

APPLICABLE The design basis for the MSSVs comes from Reference 2.

SAFETY ANALYSES The MSSVs' purpose is to limit secondary system pressure to

~ 110% of design pressure when passing 100% of design steam flow. This design basis is sufficient to cope with any anticipated operational occurrence (ADO) or accident considered in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the MSSV relieving capacity, and thus RCS pressure, are those characterized as decreased heat removal events, and are presented in the UFSAR, Section 15.2 (Ref. 3). Of these, the full power loss of condenser vacuum (LOCV) event is the limiting AOO. An LOCV isolates the turbine and condenser, and terminates normal feedwater flow to the Steam Generators. Before delivery of auxiliary feedwater to the Steam Generators, Res pressure reaches

~ 2750 psia. This peak pressure is less than or equal to 110% of the design pressure of 2500 psia, but high enough to actuate the pressurizer safety valves. The maximum relieving rate of the MSSVs during the LOCV event (Reference 3), is within the rated capacity of the MSSVs.

The MSSVs satisfy Criterion 3 of the NRC Policy Statement.

(continued)

SAN ONOFRE--UNIT 3 B 3.7-2 Amendment No. 116 03/21/11

MSIVs B 3.7.2 BASES (continued)

APPLICABLE The design basis of the MSIVs is established by the SAFETY ANALYSES containment analysis for the large steam line break (SLB) inside containment, as discussed in the UFSAR. Section 6.2 (Ref. 2). It is also influenced by the accident analysis of the SLB events presented in the UFSAR, Section 15.1.3 (Ref. 3). The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand).

The limiting case for the containment analysis is the hot zero power SLB inside containment with a loss of offsite power following turbine trip, and failure of the MSIV on the affected steam generator to close. At zero power, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Due to reverse flow. failure of the MSIV to close contributes to the total release of the additional mass and energy in the steam headers. which are downstream of the other MSIV. With the most reactive Single Control Element Assembly assumed stuck ;n the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the borated water injection delivered by the Emergency Core Cooling System. Other failures considered are the failure of an MFIV to close. and failure of an emergency diesel generator to start.

The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside containment at hot zero power is the limiting case

. for a post trip return to power. The analysis included scenarios with offsite power available and with a loss of offsite power following turbine trip.

(continued)

SAN ONOFRE--UNIT 3 B 3.7-8 Amendment No. 116 04/12/11

MSIVs B 3.7.2 BASES (continued)

ACTIONS D.1 and D.2 (continued)

If the MSIVs cannot be restored to OPERABLE status, or closed. within the associated Completion Time, the unit must be placed in a MODE in which the lCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is

~ B.O seconds. The MSIV closure time is assumed in the accident and containment analyses. The MSIVs should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power.

As the MSIVs are not tested at power, they are exempt from the ASME Code,Section XI (Ref. 5). requirements during operation in MODES 1 and 2.

REFERENCES 1. UFSAR. Section 10.3.

2. UFSAR, Section 6.2.

3. UFSAR. Section 15.1.3.

4. 10CFR 100.11.

5. ASME. Boiler and Pressure Vessel Code,Section XI, Inservice Inspection. Article IWV-3400.

SAN ONOFRE--UNIT 3 B 3.7-12 Amendment No. 116 04/12/11

MFIVs B 3.7.3 BASES (continued)

LCO Failure to meet the LCD requirements can resul t in nment (continued) additional mass and energy being released to contai following an SLB or FWLB inside containment.

If an alarm on high steam generator level is relied on to terminate an excess feedwater flow event. fajlur e to meet the LCO may resul t in the introduction of water into the main steam lines.

. APPLICABILITY The MFIVs must be OPERABLE whenever there is signi fican t mass and energy in the Reactor Coolant System and steam a generators. This ensures that. in the event of an HELB.

single failur e cannot result in the blowdown of more than one steam generator.

In MODES 1. 2. and 3. the MFIVs are required to be OPERA BLE.

except when they are closed and deactivated in order to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment .. When the valves are closed and deactivated. they are already performing their safety function.

In MODES 4, 5, and 6~ steam* generator energy is low. not Therefore, the MFIVs are normally closed since MFW is requi red.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each value.

A.l and A.2 With one or more MFIVs inoperable, action must be taken When to close or isolat e the inoperable valves within 7 days.

these valves are closed or isolated, they are performing their required safety function (e.g., to isola te the line),

The 7 day Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event occurring during this time period that would require isolation of the MFW flow path.

(continued)

SAN ONOFRE--UNIT 3 B 3.7-15 Amendment No. 116 08/17/11

AFW System B 3.7.5 BASES (continued)

BACKGROUND (MSIV). Each of the steam feed lines will supply 100% of (continued) the requirements of the turbine driven AFW pump. The turbine driven AFW pump supplies a common header capable of feeding both steam generators, with DC powered control valves actuated to the appropriate steam generator by the Emergency Feedwater Actuation System (EFAS).

The AFW System supplies feedwater to the steam generators during normal unit startup, shutdown. and hot standby conditions.

The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the setpoint of the MSSVs. Subsequently, the AFW System supplies sufficient water to cool the unit to SOC entry conditions, and steam is released through the ADVs.

The AFW System actuates automatically on low steam generator level by the EFAS as described in LCO 3.3.5. HEngineered Safety Feature Actuation System (ESFAS) Instrumentation. H The EFAS logic is designed to feed either or both steam generators with low levels, but will isolate the AFW System from a steam generator having a significantly lower steam pressure than the other steam generator. The EFAS automatically actuates the AFW turbine driven pump and associated DC operated valves and controls when required, to ensure an adequate feedwater supply to the steam generators.

DC operated valves are provided for each AFW line to control the AFW flow to each steam generator.

(continued)

SAN ONOFRE--UNIT 3 B 3.7-24 Amendment No. 116 03/21/11

AFW System B 3.7.5 BASES (continued)

BACKGROUND The AFW System is discussed in the UFSAR, Section 10.4.9 (continued) (Ref. 1).

APPLICABLE The AFW System mitigates the consequences of any event with SAFETY ANALYSES a loss of normal feedwater.

The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat, by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest MSSV set pressure plus 3%.

The limiting Design Basis Accidents (DBAs) and transients for the AFW System are as follows:

a. Feedwater Line Break (FWLB)j and

b. Loss of normal feedwater.

In addition, the minimum available AFW flow and system characteristics are serious considerations in the analysis of a small break loss of coolant accident.

The AFW System design ;s such that it can perform its function following an FWLB between the MFW isolation valve and containment, combined with a loss of offsite power following turbine trip, and a single active failure of the (continued)

SAN ONOFRE--UNIT 3 B 3.7-25 Amendment No. 116 03/21/11

CCW Safety Related Makeup System B 3.7.7.1 BASES (continued)

BACKGROUND sufficient time is available after the limiting event (continued) for the operator to initiate manual action emergency makeup is a continuously supervised operation and continuous safety related CCW surge tank level indication is being provided. .

Safety related CCW makeup utilizes the PPMU tank located in the Radwaste Building at El. 9 for each unit as a source of 1

makeup water.

The nominal capacity of each PPMU tank is 300,000 gallons.

203,800 gallons in tank T-056 and 203,719 gallons in tank T-055 are dedicated to the CCW safety related makeup, This amount includes the total tank level instrumentation loop uncertainty (TLU) and the unrecoverable volume. For both tanks, this volume corresponds to the water level at plant elevation 30 -9 3/4" (or 65.5% tank level as indicated in 1

the Control Room). The dedicated volume allows makeup for CCW system leakage (from both CCW trains) of up to 18 gpm for a period of seven days. The minimum water level required in the PPMU tank for the CCW safety related makeup system to be considered OPERABLE is a function of the CCW system total leak rate. The volume above that controlled by the TS is available for the PPMU system use.

A common suction header connects the CCW safety related makeup pumps to the PPMU tank at elevation Ill-Oil, The suction nozzle has a pointing downward elbow attached inside the tank. This is done to increase the tank usable volume and to provide an adequate margin to prevent vortex formation~ After transferring the TS volume from the tank, the level of water remaining in the tank is 10" above the pump suction nozzle inlet.

To enable in-service testin~ of the CCW makeup pumps, a test loop capable of passing a flow approximately eq~al to the nominal makeup flow is provided.

The high and low level alarms annunciate in the Radwaste Control Ro6m on Panel 2/3L-5 at 95% (LSH-7133) and 75% tank level (LSL-7133), respectively. The high level alarm also annunciates in the main Control Room.

(continued)

SAN ONOFRE--UNIT 3 B 3.7-43d AMENDMENT NO *. 118 02/06/12

CCW Safety Related Makeup System B 3.7.7.1 BASES (continued)

APPLICABLE common for bothCCW trains. Such depletion of the inventory SAFETY ANALYSES would take place should relief valves on the CCW surge tank (continued) lift as a result of tank overfilling and water being discharged from the CCW system into the plant vent stack.

Makeup water inventory depletion would impact the CCW safety related makeup system capability to perform its safety funct ion.

Operator action is required outside the control room to mitigate the single active failure of a CCW pump motor control relay stuck in the "operate" position because this J

failure prevents both pump trip and discharge valve closure using the control switches. The specific mitigating action is to open the respective pump breaker at the MeC in the El.

50 1 switchgear room. The assumed above operator action time of 30 minutes is sufficient to mitigate this failure.

The Single tank and common suction nozzle configuration of the CCW makeup system is subject to the single passive failure criteria of ANSI Standard N658-1976 because the J

system is required to operate for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> post-accident. Concurrent passive failures which must be considered under this standard are flow path blockage and pressure boundary failures.

Flow path blockage due to entrainment of foreign material is not credible because the system is operated using only filtered and demineralized water. Furthermore, blockages due to component internal failures are not credible because:

a) there are no valves in the common flow path, and b). the system suction line is provided with a pointing downward elbow inside the tank (which ensures sufficient submergence of the suction inlet to prevent entrainment of any floating debris even at the maximum suction velocity).

Passive failure of the pressure boundary may be limited to failed valve packing and pump mechanical seals for systems designed and maintained to ASME Section III and Section XI criteria. All such failures in the proposed makeup system can be isolated because the suction isolation valve for each train has a back seat to prevent leakage due to failure of its packing. This valve can be used to isolate all other (continued)

SAN ONOFRE--UNIT 3 B 3.7-43f AMENDMENT NO. 118 02/06/12

CREACUS B 3.7.11 BASES (conti nued)

LCD c. Ductwork, valves. and dampers are OPERABLE, and air (continued) circulation can be maintained.

If an Emergency Isolation Damper is inoperable for reasons other than leakage, the associated train of CREACUS may still be considered OPERABLE if the inoperable damper is closed with power removed. If an Emergency Isolation Damper is inoperable; the associated train of CREACUS may still be considered OPERABLE if the redundant damper in series with the inoperable damper is closed with power removed.

In order for the CREACUS trains to be considered OPERABLE.

the CRE boundary must be maintained such that eRE occupant dose from a large radioactive release does not exceed the calculated do.se in the licensing basis cons~quence analyses for DBAs. and that CRE occupants are protected from hazardous chemicals and smoke.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.

This Note only applies to openings in the eRE boundary that can be rapidly restored to the des~gn condition, such as doors. hatches. floor plugs. and access panels. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering Dr exiting the area. For ot~er openings. these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This indivfdual will have a method to rapidly close the opening and to restore the eRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

(continued)

SAN ONOFRE--UNIT 3 B 3.7-60 Amendment No. 116 11/30/11

AC Sources - Operating B 3.8.1 BASES (continued)

ACTIONS A.2 (continued)

As in Required Action A.2, the Comr.letion Time allows for an exception to the normal Utime zero' for beginning the allowed outage time uclock." This will result in establishing the Utime zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.

An extended Completion Time (CT) for required Action A.2 provides 1 lO-day one time outage per train to allow for maintenance to be performed. This CT option is for use Rrior to 24:00 (midnight) on 6/30/2012 and ;s subject to the fo 11 ow; 119 compensatory measures be; ng estab 1i shed for both Units 2 and 3 in accordance with the associated NRC amendment for this option.

Online Unit Compensatory Measures (MODES 1 to 4)

• Protect the available offsite source: via switchyard barriers and 4.16 kV cross-tie breaker barriers.

• Protect both onsite sources - Perform Surveillances on the operating unit EDGs prior to entering Action Statement, and protect the available switchgear room.

• Ensure the protected train is the train with the OPERABLE 4.16 kV cross-tie.

• Ensure affected train common equipment (IE 480 VAC buses,emergency chillers, control room emergency cooling units) are aligned to the on-line unit.

• Protect all 3 AFW pumps.

• Protect switchgear room normal HVAC cooling unit and' exhaust fan.

• Implement switchyard restrictions and do not allow any train work on the protected train.

Outage Unit Compensatory Measures

• Protect the available train offsite source: via 5withyard barriers and 4.16 kV cross-tie breaker barriers.

• Protect the available train onsite source, EOG and 4.16 kV bus.

• Protect all available train safety function equipment CCW (component cooling water), SWC (saltwater cooling), SDC (shutdown cooling), and SFP (Spent Fuel Pool) cooling.

(continued)

SAN ONOFRE--UNIT 3 B 3.8-7 Amendment 217 12/21/11

--- ----~-,---

AC Sources - Operati ng B 3.8.1 BASES (continued)

ACTIONS A.2 (continued)

• Implement switchyard restrictions and do not allow any work on the grotected electric power buses that are providing safety function fulfi'llment.

• Scheduling: Work the supply cubicles and cross-tie cUbicle bottle replacements first, allowing for a quicker emergency return to service.

• Develop a p'lan to effect an emergency return to service, if required to support the operating unit.

• Bus outages are to be performed during the core offload window, when fuel is removed from the reactor vessel.

The following compensatory measures apply to the Unit 3 Cycle 16 refueling only Slnce Unit 3 steam generator replacement is planned for this outage:

• Rigging activities to be limited to one end of the steam generator replacement outside lift system (OLS) to lim,t potential impact to Unit 3 Train A diesel generator cables located underground near the containment equipment hatch.

• OLS construction, use, and remova1 to be limited to specific outage windows to reduce risk to the Unit 3 Train A diesel generator cables.

• SONGS NUREG-0612 heavy loads procedijral requirements are to be implemented for both the OLS and the service crane to ensure safe load paths are followed, or safe s~utgown egy1p'ment 1s taken out of service, auring the r1gg1ng actlvlty.

• A Unit 3 Cycle 16 shutdown qualitative risk assessment to be performed to provide qualitative risk management actions to demonstrate acceptable outage risk during construction, use, and deconstruction of the OlS.

• Work controls to be in place to lay the service crane boom down prior to severe weather.

• There are to be no load movements by the service crane over the switchyard.

B.l To ensure a highly reliable power source remains when one of the required DGs 1S inoperable, it ;s necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Reguired Action onl,y specifies IIperformjll a failure of SR 3.8.1.1 acceptance crlteria does not resu t in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperabi1ity, additiona1 Conditions and Required Actions must then be entered.

(continued)

SAN ONOFRE~-UNIT 3 B 3.8-7a Amendment No. 217 .12/21/11

AC Sources - Opera t i ng B 3.8.1 BASES (continued)

SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS

a. kVAR is > 3000 and < 3200 or

b. The excitation current is > 5.0 A and < 5.5 A or

c. the ESF bus voltage is ~ 4530 V and ~-4550 V or

d. DG feeder current is ~ 730 A and ~ 750 A This method of establishing kVAR loading ensures that, in addition to verifying the load carrying capability (kW) of the diesel engine the reactive power tkVAR) and voltage regulation capability of the generator is verified to the extent practicable, consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Information Notice 91-13 (Ref. 16).

The normal 31 day Frequency for this Surveillance (Table 3.8.1-1) is consistent with Regulatory Guide 1.9 (Ref. 3).

This SR is modified by five Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanlcal stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test.

similarly~ momentary power factor transients above the limit will not lnvalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory Rerformance. Note 5 - This note discusses operability of the diesel generator subcomponent Automatic Voltage Regulator (AVR). The AVR is an inte~ral part of the DG, however, each DG has 2 AVRS that are 100~ redundant to each other. Only one AVR may be inservice at anyone time.

To ensure 0p.erability of each AVR. the AVRs must have been in service auring the performance of SR 3.8.1.2 and SR 3.8.1.3 within the last 60 days plus any allowance per SR 3.0.2. SR 3.8.1.2 is modifiea by NOTE 1 to indicate that SR 3.B.1.7 satisfies all of the requirements of SR 3.8.1.2.

This note is applicable for AVR operability. Also, each AVR must have been in service for either SR 3.8.1.9.

SR 3.8.1.10, or SR 3.8.1.19 within the last 24 months plus any allowance per SR 3.0.2. During the 24 month test dynamic performance of the AVR is measured to confirm it is acceptable for all required AVR transients. Based on the design of the AVR, its intended function and the maintenance historYJ the above specified surveillance schedule will assure the AVRs are capable of performing their intended function.

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level selected to ensure adequate fuel oil for a minimum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of DG operation at (continued)

SAN ONOFRE--UNIT 3 B 3.8-17 Amendment 116 11/05/12

AC Sources - Operating B 3.8.1 BASES (continued)

SURVEILLANCE SR 3.B.l.10 (continued)

REQUIREMENTS The DG full load rejection may occur because of a system fault, inadvertent breaker tripping or a SIAS received during surveillance testing. This Surveillance ensures proper engine and generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG will not trip upon loss of the load. The voltage transient limit of 5450 V is 125% of rated voltage (4360 V). These acceptance criteria provide DG damage protection. 'While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application (e.g., reconnection to the bus if the trip initiator can be corrected or isolated). These loads and limits are consistent with Regulatory Guide 1.9 (Ref. 3).

The DG is tested under inductive load conditions that are as close to design basis conditions as possible. Testing is performed with DG kVAR output that offsite power system conditions permit during testing without exceeding eqUipment ratings (i .e.; without creating an overvoltage condition on the ESF buses, over excitation condition in the generator, or overloading the DG main feeder). The kVAR loading requirement during this test is met; and the equipment ratings are not exceeded, when the DG kVAR output is increased such that:

a. kVAR is ~ 3000 and ~ 3200 or

b. the excitation current is ~ 5.0 A and ~ 5.5 A or

c. the ESF bus voltage is ~ 4530 V and ~ 4550 V or

d. DG feeder current is ~ 730 A and ~ 750 A This method of establishing kVAR loading ensures that. in addition to verifying the full load rejection capability (kW) of the diesel engine, the reactive power rejection capability (kVAR) of the generator is verified to the extent practicable. consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Information Notice 91-13 (Ref. 16).

The 24 month Frequency is consistent with the recommendation of Regulatory Guide 1.9 (Ref. 3) and is intended to be consistent with expected fuel cycle lengths.

(continued)

SAN ONOFRE--UNIT 3 B 3.8-22 Amendment 116 11/05/12

AC Sources - Operati ng B 3.B.1 BASES (continued)

SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS The DG is tested under inductiv~ load conditions that are as close to design conditions as possible. Testing is performed with DG kVAR output that offsite power system conditions permit during testing without exceeding equipment ratings (i.e., without creating an overvoltage condition on the ESF buses, over excitation condition in the generator, or overloading the DG main feeder). The kVAR loading requirement during this test is met, and the equipment ratings are not exceeded, when the DG kVAR output is increased such that:

a. kVAR is > 3000 and < 3200 or

b. the excitation current is > 5.0 A and < 5.5 A or

c. the ESF bus voltage is ~ 4530 V and ~ 4550 V or

d. DG feeder current is ~ 730 A and ~ 750 A This method of establishing kVAR loading ensures that, in addition to verifying the load carrying capability (kW) of the diesel engine, the reactive power (kVAR) and voltage regulation capability of the generator is verified to the extent practicable, consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Information Notice 91-13 (Ref. 16).

The kW load band in the SR is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 24 month Frequency is consistent with the recommendations of Regulatory Guide 1.9, (Ref. 3), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. Note 2 acknowledges that credit may be taken for unplanned events that satisfy this SR.

SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdownrom normal Surveillances, and achieve the required voltage and frequency within 9.4 seconds. The 9.4 second time is (continued)

SAN ONOFRE--UNIT 3 B 3.8-27 Amendment 116 11/05/12

Distribution Systems--Operating B 3.8.9 Table B 3.8.9"1 (Page 1 of 1)

AC and DC Electrical Power Distribution Systems TYPE VOLTAGE TRAIN A TRAIN B 4160 V ESF Bus A04 ESF Bus A06 AC Load Center B04 480 V Load Center B06 Load Center B24 SUBSYSTEM A SUBSYSTEM C SUBSYSTEM B SUBSYSTEM 0 DC 125 V Bus 01 Bus D3 Bus 02 Bus 04 Panel DIPI Panel D3Pl Panel D2Pl Panel D4Pl AC vital . CHANNEL A CHANNEL C CHANNEL B CHANNEL 0 bus 120 V Bus YOI Bus Y03 Bus Y02 Bus Y04 SAN ONOFRE"-UNIT 3 B 3.8-83 Amendment No. 116 02/21/11 I