ML15141A052

Attachment 1, EAL Bases, Attachment 2, Fission Product Barrier Loss/Potential Loss Matrix and Bases, and Attachment 3, Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

ML15141A052
Person / Time
Site:	Mcguire, McGuire
Issue date:	05/07/2015
From:	Capps S Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML15141A047	List: ML15141A051 ML15141A052 ML15141A053 ML15141A054 MNS-15-018, License Amendment Request to Adopt Emergency Action Level Scheme Pursuant to NEI 99-01, Revision 6, Development of Emergency Action Levels for Non-Passive Reactors Dated November 2012
References
MNS-15-018
Download: ML15141A052 (135)

Text

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant EAL:

HU4.3 Unusual Event A FIRE within the plant PROTECTED AREA not extinguished within 60 min. of the initial report, alarm or indication (Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

All Definition(s):

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

PROTECTEDAREA - An area encompassed by physical barriers and to which access is controlled. The Protected Area refers to the designated security area around the process buildings and is depicted in MNS UFSAR Figure 2-4 Plot Plan and Site Area.

MNS Basis:

None NEI 99-01 Basis:

This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

EAL-#4 T-he intnent of thA 1I mirnute dumrtinn nQ to qwizA thp FIRR ;;Rd tp d6izrrimin~tn :minn~t Arn;;

M:DI=Q{ +-k-J+* *4 A41 53 **

55 ~*W+1 l55*~~A S t.5 kfltA~A %.~.,~JIS *fl.A1,4 55 *~~.Jt j~l... k 11 + ... 4,4;+;

ala-rmG, othor indicatiRns of a FIREcould be a drop iR firo main prFe*Sue, automatic aGfi*ati;n of a suppression system, otc.

Upon recoeipt, operators will tako prompt actions to confirmn tho yalidity of an initial fire alarm-,

indication, Or repot. FoGr E.AL as.esment puFpss, the emrgoGncy declaration clck starts at the time that.theoinitial alarmn, inictin orrport war,received, and-no-t t-ho timo that a Document No. Rev. 0 I Page 138 of 272

ATTACHMENT 1 EAL Bases

~ ~**----------~

01 1 1-10% 1 11ýnx- AXAVA 11 ^r% %Aollý,

L, : i4 i

^ FM64L:3

~j E51.J.

ImIlAr

~j

^

rAn I Way-Inn A Ar, A An ATAIMA Al

• hI~ 55----5~t - S t1551*St*5 ~**~45 555, SS*5L4h15 I *J5 I t.

r-AL-#I This E.AL addr-essos receipt of a single fie alarm~, and the eXiStenco of a FIRE is not '.orfed k-- , *, , v - ,*5- i! -- wav it *V I mm owS m*5 muq, , to aiaIIIlm,

,I4,ilt, wrS% = MyS v urtv a V., to prom.pt actions ..- to. rnfirm the validity of a .-ncilo fire alarm. For EAL a.sesmet .. pupo

. e..

the 30 mini t9 Gtnck staftt at the t 6me that the~ initial ;;lnrm War,~ FeG9ived a!nd Rat thA timnA th~it

i ihkacu -ant varifleiinntL irtinn Wa'R nanrfnrmd A single firo alarm, absent other niains of a FIRE, may be ind-icative of equipment failure-orsa uriu acatlvation, and not an actual FIRE. ForF this resnddoitioal time Is allowed to verf,'thevaidity of the alarm. Tho 30 minute period is a reasonWab a Oun oftime to detrmie f a atua FRE exis-ts-; how~eveFo, after that time, and absent ifraonto the cOntra, i that an actal FIRE i p r if an actua!

rnnVif*4* thnFIRE Ihr*VIiv* is Verified"lnrii byt11a--------

report hVn du from ni thenmn field, thenilinn E-AL- #1irs imdaeyapplicable-,

-- - niii*tiiinm and the emergency muswt be decared if the FIRE is Rot extinguished w..ithin 15fminutesA of the this verificati4on occurs Within 30mntsoftec -a - . L0

-- II J -

__JL_

itof the alarm then this; E=ALi not iiu no omoroozc ociawai

~D~iIC~DIO Is arrnm In addition to a FIRE addressed by EAL #1-HU4.1 or EAL #2HU4.2, a FIRE within the plant PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety. This basis e,,ends to a FIRE occurrn.g Within the PROTECTED AREA of an ISF=SI located outside the plant PROTECTED AREA. [Sentense for plants with an 1SES n --.- All M.................I.

if a FIRE within the plant or ISFSI [for plants with an ISF-SI eutside the plant Protected Areal PROTECTED AREA is of suffticint size to require a response by an offeite firefighting agency (e.g., a locsal town Fire Department), then the level of plant safet is potontially degraded. The dispatch of an off-site firofighting agency to the site requie an emegency doclaratien only if it is needed to actively support firefighting efforts because the fire is, beyond the capability of the Fire Brigade to exinguish. Declaration is Rot necessary if the agency resources are placed On stand by, Or supp~oRtig post extinguishment recoer;F Or investigation actions.

Basi Relte Dp .*n an* rmentr.

- finm AppeRdkn F%

Appendix R to 10 CFR 50, states in part:

Criterion 3- of Appendix A to this part sPe*ifies;, that "*S*t*tu,,rs, systems ,and comRponents important to safety shall be designed and located to minimize, consistent with other safet requirements, the probability and effect of fires and explo-sion-is."

Document No. IRev. 0 1Page 139 of 272

ATTACHMENT 1 EAL Bases

^h, co'*nsidori, gthe offots of firo, thero systems, assoe.ated with ahieViRng a*d mnaintaining 6afo shutdoWn--4 codtosa6Sumo m~ajor impo~tanco to safot bocaus damage to thrm can lead to coro damage resulting from loss o-f c-ola"nt thrQugh boil off no fire many affect safe shutdown systemsand becaluse the loss of fu nctio"n of BecGaus*e systemRs u-ed t mitigate the con.oq.unces.f dersign basis-accidev'ntUs' unI,*der pogt firf GOndatiOs does not per so imnpact public safety', the Reood to limit fire damage to systems required- to- ac-hieve and mnaintain safo shutdown coanditions ors greater than the Reed to limit fire damnaqe to those system reuio toq mitigate the conseQUenceS Of I

IOsIgqn asIf accIEoIntS.

In addition, Appen~dix R to 10 CFR 50, requires,, amRong other coensiderations,, the use of I -hour fire ba -ofo,-r tho encSlosur Of able and equipmenRt and*l asoco, non afot',' Gir*cuits of one Fed undant train (G.2.c). As usod-in E6AL1 #2, the 30 mninutes to verify a single ala~m iswoll within this worFt case 1 -hour time period.

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

MNS Basis Reference(s):

1. NEI 99-01 HU4 I Document No. I Rev. 0 Page 140 of 2721

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant EAL:

HU4.4 Unusual Event A FIRE within the plant PROTECTED AREA that requires firefighting support by an offsite fire response agency to extinguish Mode Applicability:

All Definition(s):

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Protected Area refers to the designated security area around the process buildings and is depicted in MNS UFSAR Figure 2-4 Plot Plan and Site Area.

MNS Basis:

None NEI 99-01 Basis:

This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

-~~~~~- ~ I t I

ýZ f

la,

.k aw

-it-Ar l1

- I .. - -- -

o -rtb mai

W.., eftti.gIGe ke. ., smeldeHII;I wa~tLUIphU basket). in additionI -

alarms, othor indications of a FIRE could be a drop in fire main preSSUre, automatic activation of a suppression system, etc.

Upon rocoipt, operators Wi11 take prompt actions to G.Gnfirm the Yalidity of an initial fire alarmA, inRdicaton, Or report. For EMAL assoessment purposes, the emergency declaration clock starts at the time that the initia! alarm, indication, Or report was received, and not the timne that a rsubsequent verification action was pe~fbrmcd. Similarly, the fire duration cleck also starts at oreipt of the initial a!armn, in~dication or report-.

the time Document No. IRev. 0 Page 141 of 27ý2

ATTACHMENT 1 EAL Bases EAL4-#

Th;is EAL addFrol o rFeceipt of a single fire alarm, a*d the oXistRnco of a FIRE ;Or,not ',r;fi;d (i.e., provod or disproved) within 30 mninutos, of tho alarm. UJpon receipt, operatorS will tk thtq 20 mimrda afani ,.ataL. at'14t~he time that the initial alarm HIHI II I was~

IVHV re I UVVBVV*I aived, andr UB IU MCA+th#4 I IVL LI IV flima LBII IV LI B*L a subseauont '.rificatien action wa6

...... 1 .................. ......

norfbrmed-.

r" ...........

A single fire alarm, abroent othGrFdcains of a FIRE, may be indicWative of equipment f-ailure orsprius acteyafien, and not an actual FIRE. ForF this, reason, additional tkme is allowed to Vorf, th ldity of the alarm. The 30 minuto period is,a roasonablo -amount of tame to dotormine of an actual FIRE exists; hoe'oVor, afteArtih at-time, and abseent ifrmto to the contrary, it is assumed that an ac-tual FIRE Is in progress if an actual FIRE is verified by a report fromR the field, the-n EWL V1 isimdaeyapplicable, and the emergency must be dec~lared- if the FIRE is.not eXtinguis6h~d_ within 15-minutes of theq report. if the alarm is verified to be due to an eqipet failure OrF prosaciain n thmis verifica tion occurs Within 30- minutes of ter I I cit f the alarm, then this RALIs= o appi*a'l"e and no emergency aec'arai'on is warr3ntep.

EAL--#

In ad-l-ition to a FIRE addressed by EAL #1 or EAI #2, a FIRE within the p*ant PROTECTED AREA not ei*ngqUished w., ithin 60 minutes may also p-teRtally degrade the level of pant safety. Thi6 basis extends to a F4REF ecuri~ng within the PROTECGTE-D AREA of an lSF-Sl plant Protocted Ar~eal If a FIRE within the plant orISFSI [for plantr with an ISESI outside the plant P,-tetedAf.al PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish. Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions.

Bass e*oOlated* Oana nirmp ntr fteffm AppndnonA s,0Z A nnA.,.i 54 in a M 4 t'.

4

'.1 I CC)

I

~ ,

4s~oi

'.FLLA t%.tI aa a

-- *-J*-*-- -- LL -- L Ili'l*J. .... L .....

• t**'*a as53.t,.t~a U*V.U as tLS~IU L. I *tl It L LLJ 5t1,553 I aass .A 5~5J*

nonpn~e.mars ngm IMLSU 1551 iLL.

4ýr%+ *gp

• a

• l~5.Fi 5541 r% i c-hogn I~lk- erI,se nran ts ,nrl Ianný+nr +r% ii .~ ar% n c-+^ nf III I lilyI VVl I*1*;*1 il I I I II I

witA otner safety requiements, thle probabilitty ana ottect OTtires and expiesione.S.

I Document No. Rev. 0 1 Page 142 of 2721

ATTACHMENT 1 EAL Bases W*

.. ;nnh nnn8 .k ,ra 9#e nhe Ofrl

,n~d8iC anne nth 9. £ nvrte nearen-. na e withn a n$,sf., anqR damage to therm can lead*o ore damane r4, ultino from IonS of coolant throUah boil off 4

0a a t CC F*.ra ...

CCC44: a "- a 4. n J. "~

.*.4,AJ.

• .*.S**CS) an n.,* .S. .'.a S A SW*A I...

Lj. SSSSS. dFa CS a a a -.

!nSSSSC*AC.tS*S .aa artA -.F Ij . . . LIlI

. t.A-

. . Ifl . Iii::ul

. . . . . ~

iJIi ruuui~nn^C f%

---

..- ^C1;ui Lnh7l;- l:LnfI-- -- t ýztuQLu.--iiu conaUMOnS 909s not po so 4pcPUNIIC 6afety, the nReed to iimit Tire damage to systems6 required to achievo n m-aintani~n safle A-hu--t~down condition is grator than the ne-e-d to lmtfire damage to those systems requirod to mnitigate the conrsequence o design basis accid9nts.

in aaaluen. naix1- to Iu FK 0,urequIIes.

I II amGona otno1 cnsiqeFratIIns. tne use a; 1 nour fr. kn iae f- +ka - - - r f

--nln n - kia -a A - iann IJC1.C in-CS*C*.

+n SACS-- -

4 a a A n +-r+n Ifn_ 2a 0u A a n  ; n~ M A I .440 4k, a 2 rm  ;. +dn da ,a. ;4  ; nlIn In s-n a III

""" M "" "" r1a " . ." . ft "n" " - .. - - . W - - -M.". 11 - W n- - W 4 PW M r 0 ft-1 " Ul "- M -M.ý11 I 1 0 RNP "011

. . .:.LL *.__ ,LL _" __

- ...m-.M 5W FetSD.

~nna e

L....:..an.

A -

• C IPU 11M IPOREP.

A Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA9.

MNS Basis Reference(s):

1. NEI 99-01 HU4 Document No. Rev. 0 Page 143 of 272

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 5 - Hazardous Gases Initiating Condition: Gaseous release IMPEDING access to equipment necessary for normal plant operations, cooldown or shutdown EAL:

HA5.1 Alert Release of a toxic, corrosive, asphyxiant or flammable gas into any Table H-2 rooms or areas AND Entry into the room or area is prohibited or IMPEDED (Note 5)

Note 5: Ifthe equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted Table H-2 Safe Operation & Shutdown Rooms/Areas Bldg. Elevation Unit I Room/Area Unit 2 Room/Area Modes Auxiliary 716' P/C, RHole, near 12N1-185, ABPC thru CAD Door, FF59 4 Outside CAD 212 Auxiliary 750' 800 (1 EMXA) 820 (2EM(XA) 3, 4 803 (1 ETA) 805 (2ETA) 3, 4 702 (Elec. Pene.) 713 (Elec. Pene.) 3 Auxiliary 733' 722 (1 EMXB-1) 724 (2EMXB-1) 3, 4 705 (1ETB) 716 (2ETB) 3,4 Mode Applicability:

3 - Hot Standby, 4 - Hot Shutdown Definition(s):

IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

MNS Basis:

If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event.

Document No. Rev. 0 Page 144 of 272

ATTACHMENT 1 EAL Bases The list of plant rooms or areas with entry-related mode applicability identified specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown. Rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations) are not included. In addition, the list specifies the plant mode(s) during which entry would be required for each room or area (ref. 1).

NEI 99-01 Basis:

This IC addresses an event involving a release of a hazardous gas that precludes or impedes access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant.

An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release.

Evaluation of the IC and EAL does not require atmospheric sampling; it only requires the Emorgency Diroctr* Emergency Coordinator's judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly impede procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter expert or operating experience with the same or similar hazards. Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

An emergency declaration is not warranted if any of the following conditions apply:

" The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release). For example, the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4.

" The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., fire suppression system testing).

" The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

" The access control measures are of a conservative or precautionary nature, and would not actually prevent or impede a required action.

• If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no Document No. Rev. 0 Page 145

ATTACHMENT 1 EAL Bases adverse impact beyond that already allowed by Technical Specifications at the time of the event.

An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels. Most commonly, asphyxiants work by merely displacing air in an enclosed environment.

This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness or even death.

This EAL does not apply to firefighting activities that automatically or manually activate a fire suppression system in an area, or to intontional '"inoFrtig of otainm*. t.. (1BWR G,').

Escalation of the emergency classification level would be via Recognition Category AR, C or F ICs.

MNS Basis Reference(s):

1. Attachment 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

2. NEI 99-01 HA5 IDocument No. I Rev. 0 1 Page 146 of 272

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6 - Control Room Evacuation Initiating Condition: Control Room evacuation resulting in transfer of plant control to alternate locations EAL:

HA6.1 Alert An event has resulted in plant control being transferred from the Control Room to the Auxiliary Shutdown Panels or Standby Shutdown Facility (SSF)

Mode Applicability:

All Definition(s):

None MNS Basis:

The Shift Manager (SM) determines if the Control Room is inoperable and requires evacuation. Control Room inhabitability may be caused by fire, dense smoke, noxious fumes, bomb threat in or adjacent to the Control Room, or other life threatening conditions (Ref. 1, 2).

Inability to establish plant control from outside the Control Room escalates this event to a Site Area Emergency per EAL HS6.1.

NEI 99-01 Basis:

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety.

Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations. The necessity to control a plant shutdown from outside the Control Room, in addition to responding to the event that required the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel. Activation of the ERO and emergency response facilities will assist in responding to these challenges.

Escalation of the emergency classification level would be via IC HS6.

I Document No. Rev. 0 Page 147 of 272

ATTACHMENT 1 EAL Bases MNS Basis Reference(s):

1. AP/1 (2)/A/5500/17 Loss of Control Room

2. MCS-1465.00-00-0022 Appendix R Safe Shutdown Analysis

2. NEI 99-01 HA6 I Document No. I Rev. 0 1 Page 148 of 272

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6- Control Room Evacuation Initiating Condition: Inability to control a key safety function from outside the Control Room EAL:

HS6.1 Site Area Emergency An event has resulted in plant control being transferred from the Control Room to the Auxiliary Shutdown Panels or Standby Shutdown Facility (SSF)

AND Control of any of the following key safety functions is not reestablished within 15 min.

(Note 1):

" Reactivity

" Core Cooling

• NCS heat removal Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

All Definition(s):

None MNS Basis:

The Shift Manager determines if the Control Room is inoperable and requires evacuation.

Control Room inhabitability may be caused by fire, dense smoke, noxious fumes, bomb threat in or adjacent to the Control Room, or other life threatening conditions (Ref. 1, 2).

NEI 99-01 Basis:

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time.

The determination of whether or not "control" is established at the remote safe shutdown location(s) is based on Emergency DIieetGt-Coordinator judgment. The Emergency Diretet Document No. Rev. 0 Page 149 of 2721

ATTACHMENT 1 EAL Bases Coordinator is expected to make a reasonable, informed judgment within (the site .pecific tim.

feo-transfeir1 5 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s).

Escalation of the emergency classification level would be via IC FG1 or CG1 MNS Basis Reference(s):

1. AP/1 (2)/A/5500/17 Loss of Control Room

2. MCS-1465.00-00-0022 Appendix R Safe Shutdown Analysis

3. NEI 99-01 HS6 Document No. Rev. 0 Page 150 of 272

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - Emergency Coordinator Judgment Initiating Condition: Other conditions existing that in the judgment of the Emergency Coordinator warrant declaration of a UE EAL:

HU7.1 Unusual Event Other conditions exist which in the judgment of the Emergency Coordinator/EOF Director indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs.

Mode Applicability:

All Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

MNS Basis:

The Emergency Coordinator/EOF Director are the designated onsite individuals having the responsibility and authority for implementing the MNS Emergency Response Plan. The Operations Shift Manager (SM) initially acts in the capacity of the Emergency Coordinator/EOF Director and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the Emergency Coordinator/EOF Director, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, Document No. I Rev. 0 Page 151 of 272]

ATTACHMENT 1 EAL Bases but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency (ref. 1).

NEI 99-01 Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Di-eGter-Coordinator/EOF Director to fall under the emergency classification level description for an NGUE-Unusual Event.

MNS Basis Reference(s):

1. MNS Emergency Plan section B On-Site Emergency Organization Section B.2 Emergency Coordinator

2. NEI 99-01 HU7 Document No. Rev. 0 Page 152 of 272]

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - Emergency Coordinator Judgment Initiating Condition: Other conditions exist that in the judgment of the Emergency Coordinator/EOF Director warrant declaration of an Alert EAL:

HA7.1 Alert Other conditions exist which, in the judgment of the Emergency Coordinator/EOF Director, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.

Mode Applicability:

All Definition(s):

HOSTILE ACTION - An act toward MNS or its personnel that includes the use of violent force to destroy equipment, take hostages, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, projectiles, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on MNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).

MNS Basis:

The Emergency Coordinator/EOF Director are the designated onsite individuals having the responsibility and authority for implementing the MNS Emergency Response Plan. The Operations Shift Manager (SM) initially acts in the capacity of the Emergency Coordinator and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the Emergency Coordinator, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency (ref.1).

Document No. Rev. 0 Page 153 of 272

ATTACHMENT 1 EAL Bases NEI 99-01 Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Dieote-Coordinator/EOF Director to fall under the emergency classification level description for an Alert.

MNS Basis Reference(s):

1. MNS Emergency Plan section B On-Site Emergency Organization Section B.2 Emergency Coordinator

2. NEI 99-01 HA7 Document No. Rev. 0 Page 154 of 272

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - Emergency Coordinator Judgment Initiating Condition: Other conditions existing that in the judgment of the Emergency Coordinator/EOF Director warrant declaration of a Site Area Emergency EAL:

HS7.1 Site Area Emergency Other conditions exist which in the judgment of the Emergency Coordinator/EOF Director indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely failure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the SITE BOUNDARY.

Mode Applicability:

All Definition(s):

HOSTILE ACTION - An act toward MNS or its personnel that includes the use of violent force to destroy equipment, take hostages, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, projectiles, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on MNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area)

SITE BOUNDARY- Area as depicted in MNS-SLC-16.11.1 Figure 16.11.1-1 Site Boundary/Exclusion Area Boundary MNS Basis:

The Emergency Coordinator/EOF Director are the designated onsite individuals having the responsibility and authority for implementing the MNS Emergency Response Plan. The Operations Shift Manager (SM) initially acts in the capacity of the Emergency Coordinator and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the Emergency Coordinator, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is Document No. I Rev. 0 1 Page 155 of 272

ATTACHMENT 1 EAL Bases responsible for initiating the necessary emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency (ref.

1).

NEI 99-01 Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Qke~tef-Coordinator/EOF Director to fall under the emergency classification level description for a Site Area Emergency.

MNS Basis Reference(s):

1. MNS Emergency Plan section B On-Site Emergency Organization Section B.2 Emergency Coordinator

2. NEI 99-01 HS7 I Document No. I Rev. 0 Page 156 of 272

ATTACHMENT 1 EAL Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - Emergency Coordinator Judgment Initiating Condition: Other conditions exist which in the judgment of the Emergency Coordinator/EOF Director warrant declaration of a General Emergency EAL:

HG7.1 General Emergency Other conditions exist which in the judgment of the Emergency Coordinator/EOF Director indicate that events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area Mode Applicability:

All Definition(s):

HOSTILE ACTION - An act toward MNS or its personnel that includes the use of violent force to destroy equipment, take hostages, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, projectiles, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on MNS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).

IMMINENT- The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

MNS Basis:

The Emergency Coordinator/EOF Director are the designated onsite individuals having the responsibility and authority for implementing the MNS Emergency Response Plan. The Operations Shift Manager(SM) initially acts in the capacity of the Emergency Coordinator and takes actions as outlined in the Emergency Plan implementing procedures. If required by the emergency classification or if deemed appropriate by the Emergency Coordinator, emergency response personnel are notified and instructed to report to their emergency response locations. In this manner, the individual usually in charge of activities in the Control Room is responsible for initiating the necessary emergency response, but Plant Management is expected to manage the emergency response as soon as available to do so in anticipation of the possible wide-ranging responsibilities associated with managing a major emergency (ref.

1).

[Document No. Rev. 0 Page 157 of 272]

ATTACHMENT 1 EAL Bases Releases can reasonably be expected to exceed EPA PAG plume exposure levels outside the Site Boundary.

NEI 99-01 Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency D9ietG-Coordinator/EOF Director to fall under the emergency classification level description I for a General Emergency.

MNS Basis Reference(s):

1. MNS Emergency Plan section B On-Site Emergency Organization Section B.2 Emergency Coordinator

2. NEI 99-01 HG7 I Document No. I Rev. 0 Page 158 of 2721

ATTACHMENT I EAL Bases Category S - System Malfunction EAL Group: Hot Conditions (NCS temperature > 2000 F); EALs in this category are applicable only in one or more hot operating modes.

Numerous system-related equipment failure events that warrant emergency classification have been identified in this category. They may pose actual or potential threats to plant safety.

The events of this category pertain to the following subcategories:

1. Loss of Essential AC Power Loss of emergency electrical power can compromise plant safety system operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of onsite and offsite sources for 4160 VAC essential buses.

2. Loss of Vital DC Power Loss of emergency electrical power can compromise plant safety system operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of vital plant 125 VDC power sources.

3. Loss of Control Room Indications Certain events that degrade plant operator ability to effectively assess plant conditions within the plant warrant emergency classification. Losses of indicators are in this subcategory.

4. NCS Activity During normal operation, reactor coolant fission product activity is very low. Small concentrations of fission products in the coolant are primarily from the fission of tramp uranium in the fuel clad or minor perforations in the clad itself. Any significant increase from these base-line levels (2% - 5% clad failures) is indicative of fuel failures and is covered under the Fission Product Barrier Degradation category. However, lesser amounts of clad damage may result in coolant activity exceeding Technical Specification limits.

These fission products will be circulated with the reactor coolant and can be detected by coolant sampling.

5. NCS Leakage The reactor vessel provides a volume for the coolant that covers the reactor core. The reactor pressure vessel and associated pressure piping (reactor coolant system) together provide a barrier to limit the release of radioactive material should the reactor fuel clad integrity fail. Excessive NCS leakage greater than Technical Specification limits indicates Document No. Rev. 0 Page 159 of 272]

ATTACHMENT 1 EAL Bases potential pipe cracks that may propagate to an extent threatening fuel clad, NCS and containment integrity.

6. RPS Failure This subcategory includes events related to failure of the Reactor Protection System (RPS) to initiate and complete reactor trips. In the plant licensing basis, postulated failures of the RPS to complete a reactor trip comprise a specific set of analyzed events referred to as Anticipated Transient Without Scram (ATWS) events. For EAL classification, however, ATWS is intended to mean any trip failure event that does not achieve reactor shutdown. If RPS actuation fails to assure reactor shutdown, positive control of reactivity is at risk and could cause a threat to fuel clad, NCS and containment integrity.

7. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.

8. Containment Isolation Failure Failure of containment isolation capability (under conditions in which the containment is not currently challenged) warrants emergency classification.

9. Hazardous Event Affectinq Safety Systems Various natural and technological events that result in degraded plant safety system performance or significant visible damage warrant emergency classification under this subcategory.

I Document No. I Rev. 0 1 Page 160 of 272]

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Essential AC Power Initiating Condition: Loss of all offsite AC power capability to essential buses for 15 minutes or longer EAL:

SUl.1 Unusual Event Loss of all offsite AC power capability, Table S-1, to essential 4160V buses 1(2)ETA and 1 (2)ETB for > 15 min. (Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-1 AC Power Sources Offsite:

" ATC (Train A)

" SATA (Train A)

" ATD (Train B)

" SATB (Train B)

Onsite:

" D/G 1(2) A (Train A)

" D/G 1(2) B (Train B)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None Basis:

MNS Basis:

The 4160 VAC System provides the power requirements for operation and safe shutdown of the plant. The essential switchgear are buses ETA (Train A) and ETB (Train B) (ref. 1).

The essential buses are normally powered from the 6.9KV offsite power system through their respective 6.9KV/4160V Station Auxiliary Transformers (1ATC & 1ATD). Additionally, a I Document No. Rev. 0 Page 161 of 272

ATTACHMENT 1 EAL Bases standby source of power to each 4160V essential bus is provided from the 6.9KV offsite power system via two separate and independent 6.9KV/4160V transformers (SATA & SATB). These transformers are shared between the two units (ref. 1, 2).

Each essential bus has a dedicated diesel generator (D/G 1(2) A & DIG 1(2) B) to supply an onsite emergency source of power to safe shutdown loads in the event of a loss of the normal power source or loss of off-site power. The D/Gs will automatically start and tie onto the essential buses if the normal power source or off-site power is lost (ref. 1).

An Alternate AC power source, the Standby Shutdown Diesel Generator, which provides power to the Standby Shutdown System, is located in the Standby Shutdown Facility (SSF).

This AC power source must be started locally from the SSF Control Room. The SSF Diesel Generator has sufficient capability to operate equipment necessary to maintain a safe shutdown condition for the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO event but is not credited as an AC power source by Technical Specifications (ref. 1).

The 15-minute interval was selected as a threshold to exclude transient or momentary power losses.

NEI 99-01 Basis:

This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emegeRGY-essential buses. This condition represents a potential reduction in the level of safety of the plant.

For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emei-eRY -essential buses, whether or not the buses are powered from it.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.

Escalation of the emergency classification level would be via IC SA1.

MNS Basis Reference(s):

1. UFSAR Section 8.0 Electric Power

2. AP/1(2)/A/5500/07 Loss of Electrical Power

3. ECA-0.0 EP/1 (2)/A15000/ECA-0.0 Loss of All AC Power

4. NEI 99-01 SUW Document No. Rev. 0 Page 162 of 272]

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Emergency AC Power Initiating Condition: Loss of all but one AC power source to essential buses for 15 minutes or longer EAL:

SA1.1 Alert AC power capability, Table S-1, to essential 4160V buses 1(2)ETA and I(2)ETB reduced to a single power source for > 15 min. (Note 1)

AND Any additional single power source failure will result in loss of all AC power to SAFETY SYSTEMS Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-1 AC Power Sources Offsite:

" ATC (Train A)

" SATA (Train A)

" ATD (Train B)

" SATB (Train B)

Onsite:

" D/G 1(2) A (Train A)

" D/G 1(2) B (Train B)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

Document No. I Rev. 0 Page 163 of 272]

ATTACHMENT 1 EAL Bases (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

MNS Basis:

For emergency classification purposes, "capability" means that an AC power source is available to the essential buses, whether or not the buses are powered from it.

The 4160 VAC System provides the power requirements for operation and safe shutdown of the plant. The essential switchgear are buses ETA (Train A) and ETB (Train B) (ref. 1).

The essential buses are normally powered from the 6.9KV offsite power system through their respective 6.9KV/4160V Station Auxiliary Transformers (1ATC & 1ATD). Additionally, a standby source of power to each 4160V essential bus is provided from the 6.9KV offsite power system via two separate and independent 6.9KV/4160V transformers (SATA & SATB). These transformers are shared between the two units (ref. 1, 2).

Each essential bus has a dedicated diesel generator (DIG 1(2) A & D/G 1(2) B) to supply an onsite emergency source of power to safe shutdown loads in the event of a loss of the normal power source or loss of off-site power. The D/Gs will automatically start and tie onto the essential buses if the normal power source or off-site power is lost (ref. 1).

An Alternate AC power source, the Standby Shutdown Diesel Generator, which provides power to the Standby Shutdown System, is located in the Standby Shutdown Facility (SSF).

This AC power source must be started locally from the SSF Control Room. The SSF Diesel Generator has sufficient capability to operate equipment necessary to maintain a safe shutdown condition for the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO event but is not credited as an AC power source by Technical Specifications (ref. 1).

The 15-minute interval was selected as a threshold to exclude transient or momentary power losses. If the capability of a second source of emergency bus power is not restored within 15 minutes, an Alert is declared under this EAL.

NEI 99-01 Basis:

This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equipment. This IC provides an escalation path from IC SU1.

An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.

Document No. Rev. 0 Page 164 of 272]

ATTACHMENT 1 EAL Bases

" A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).

" A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being back-fed from the unit main generator.

" A loss of emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being baGk-fed from an offsite power source.

I Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.

Escalation of the emergency classification level would be via IC SSI.

MNS Basis Reference(s):

1. UFSAR Section 8.0 Electric Power

2. AP/I(2)/1A5500/07 Loss of Electrical Power

3. ECA-0.0 EP/I(2)/IA5000/ECA-0.0 Loss of All AC Power

4. NEI 99-01 SA1 Document No. Rev. 0 Page 165 of 272

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 1 - Loss of Emergency AC Power Initiating Condition: Loss of all offsite power and all onsite AC power to essential buses for 15 minutes or longer EAL:

SSI.1 Site Area Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to essential 4160V buses 1(2)ETA and I(2)ETB for > 15 min. (Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-1 AC Power Sources Offsite:

" ATC (Train A)

" SATA (Train A)

" ATD (Train B)

" SATB (Train B)

Onsite:

• D/G 1(2) A (Train A)

" D/G 1(2) B (Train B)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

This EAL is indicated by the loss of all offsite and onsite AC power capability (Table C-2) to 4160V essential buses ETA and ETB. The essential switchgear are buses ETA (Train A) and ETB (Train B) (ref. 1). For emergency classification purposes, "capability" means that an AC power source is available to the essential buses, whether or not the buses are powered from it.

I Document No. I Rev. 0 Page 166 of 272]

ATTACHMENT 1 EAL Bases The essential buses are normally powered from the 6.9KV offsite power system through their respective 6.9KV/4160V Station Auxiliary Transformers (1ATC & 1ATD). Additionally, a standby source of power to each 4160V essential bus is provided from the 6.9KV offsite power system via two separate and independent 6.9KV/4160V transformers (SATA & SATB). These transformers are shared between the two units (ref. 1, 2).

Each essential bus has a dedicated diesel generator (DIG 1(2) A & D/G 1(2) B) to supply an onsite emergency source of power to safe shutdown loads in the event of a loss of the normal power source or loss of off-site power. The D/Gs will automatically start and tie onto the essential buses if the normal power source or off-site power is lost (ref. 1).

An Alternate AC power source, the Standby Shutdown Diesel Generator, which provides power to the Standby Shutdown System, is located in the Standby Shutdown Facility (SSF).

This AC power source must be started locally from the SSF Control Room. The SSF Diesel Generator has sufficient capability to operate equipment necessary to maintain a safe shutdown condition for the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO event but is not credited as an AC power source by Technical Specifications (ref. 1).

The 15-minute interval was selected as a threshold to exclude transient or momentary power losses. The interval begins when both offsite and onsite AC power capability are lost.

NEI 99-01 Basis:

This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. In addition, fission product barrier monitoring capabilities may be degraded under these conditions. This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Escalation of the emergency classification level would be via ICs AG-1-RG1, FG1 or SG1.

MNS Basis Reference(s):

1. UFSAR Section 8.0 Electric Power

2. AP/1(2)/A/5500/07 Loss of Electrical Power

3. ECA-0.0 EP/1 (2)/A/5000/ECA-0.0 Loss of All AC Power

4. NEI 99-01 SS1 Document No. Rev. 0 Page 167 of 272]

ATTACHMENT 1 EAL Bases Category: S -System Malfunction Subcategory: 1 - Loss of Essential AC Power Initiating Condition: Prolonged loss of all offsite and all onsite AC power to essential buses EAL:

SGI.1 General Emergency Loss of all offsite and all onsite AC power capability to essential 4160V buses 1(2)ETA and 1(2)ETB AND EITHER:

• Restoration of at least one essential bus in < 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely (Note 1)

" Core Cooling RED PATH conditions met Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

This EAL is indicated by the extended loss of all offsite and onsite AC power capability to 4160V emergency buses ETA and ETB either for greater then the MNS Station Blackout (SBO) coping analysis time (4 hrs.) (ref. 1) or that has resulted in indications of an actual loss of adequate core cooling.

Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED PATH conditions being met. (ref. 2).

The essential buses are normally powered from the 6.9KV offsite power system through their respective 6.9KV/4160V Station Auxiliary Transformers (1ATC & 1ATD). Additionally, a standby source of power to each 4160V essential bus is provided from the 6.9KV offsite power system via two separate and independent 6.9KV/4160V transformers (SATA & SATB). These transformers are shared between the two units (ref. 1, 2).

Each essential bus has a dedicated diesel generator (DIG 1(2) A & DIG 1(2) B) to supply an onsite emergency source of power to safe shutdown loads in the event of a loss of the normal power source or loss of off-site power. The D/Gs will automatically start and tie onto the essential buses if the normal power source or off-site power is lost (ref. 1).

Document No. Rev. 0 1 Page 168 of 272

ATTACHMENT 1 EAL Bases An Alternate AC power source, the Standby Shutdown Diesel Generator, which provides power to the Standby Shutdown System, is located in the Standby Shutdown Facility (SSF).

This AC power source must be started locally from the SSF Control Room. The SSF Diesel Generator has sufficient capability to operate equipment necessary to maintain a safe shutdown condition for the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO event (ref. 3).

Four hours is the station blackout coping time (ref 2).

Indication of continuing core cooling degradation must be based on fission product barrier monitoring with particular emphasis on Emergency Coordinator judgment as it relates to imminent Loss or Potential Loss of fission product barriers and degraded ability to monitor fission product barriers. Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED PATH conditions being met (ref. 2). Specifically, Core Cooling RED PATH conditions exist if either core exit T/Cs are reading greater than or equal to 1200OF or subcooling is 0°F AND no NC pumps are on AND core exit T/Cs are reading greater than or equal to 700°F AND Reactor Vessel Lower Range level less than or equal to 39% (ref. 2).

NEI 99-01 Basis:

This IC addresses a prolonged loss of all power sources to AC emengeR*y-essential buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.

The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG1. This will allow additional time for implementation of offsite protective actions.

Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emeFgenY-essential bus by the end of the analyzed station blackout coping period. Beyond this time, plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges to multiple fission product barriers.

The estimate for restoring at least one emeFgeny-essential bus should be based on a realistic appraisal of the situation. Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public.

The EAL will also require a General Emergency declaration ifthe loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core.

MNS Basis Reference(s):

1. UFSAR Section 8.4.2 Station Blackout Duration

2. EP/1(2)/A/5000/F-0 Critical Safety Function Status Tress - Core Cooling

3. UFSAR Section 8.0 Electric Power

4. AP/1(2)/A/5500/07 Loss of Electrical Power Document No. Rev. 0 Page 169 of 272

ATTACHMENT 1 EAL Bases

5. ECA-0.0 EP/I1(2)/A/5000/ECA-0.0 Loss of All AC Power

6. NEI 99-01 SG1 I Document No. I Rev. 0 1 Page 170o,272

ATTACHMENT 1 EAL Bases Category: S -System Malfunction Subcategory: 1 - Loss of Essential AC Power Initiating Condition: Loss of all essential AC and vital DC power sources for 15 minutes or longer EAL:

SG1.2 General Emergency Loss of all offsite and all onsite AC power capability, Table S-1, to essential 4160V buses 1(2)ETA and 1(2)ETB for >- 15 min.

AND Loss of all 125 VDC power based on battery bus voltage indications < 105 VDC on both vital DC buses EVDA and EVDD for ->15 min.

(Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-1 AC Power Sources Offsite:

" ATC (Train A)

" SATA (Train A)

" ATD (Train B)

• SATB (Train B)

Onsite:

" D/G 1(2) A (Train A)

" D/G 1(2) B (Train B)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Document No. Rev. 0 Page 171 of 272:]

ATTACHMENT 1 EAL Bases Definition(s):

None MNS Basis:

This EAL is indicated by the loss of all offsite and onsite emergency AC power capability to 4160V emergency buses ETA and ETB for greater than 15 minutes in combination with degraded vital DC power voltage. This EAL addresses operating experience from the March 2011 accident at Fukushima Daiichi.

The essential buses are normally powered from the 6.9KV offsite power system through their respective 6.9KV/4160V Station Auxiliary Transformers (1ATC & 1ATD). Additionally, a standby source of power to each 4160V essential bus is provided from the 6.9KV offsite power system via two separate and independent 6.9KV/4160V transformers (SATA & SATB). These transformers are shared between the two units (ref. 1, 2).

Each essential bus has a dedicated diesel generator (D/G 1(2) A & D/G 1(2) B) to supply an onsite emergency source of power to safe shutdown loads in the event of a loss of the normal power source or loss of off-site power. The D/Gs will automatically start and tie onto the essential buses if the normal power source or off-site power is lost (ref. 1).

An Alternate AC power source, the Standby Shutdown Diesel Generator, which provides power to the Standby Shutdown System, is located in the Standby Shutdown Facility (SSF).

This AC power source must be started locally from the SSF Control Room. The SSF Diesel Generator has sufficient capability to operate equipment necessary to maintain a safe shutdown condition for the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO event (ref. 1).

The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems (Train A or EVDA, and Train B or EVDD).

Each subsystem consists of two channels of 125 VDC batteries (each battery 100% capacity),

the associated battery charger(s) for each battery, and all the associated control equipment and interconnecting cabling. (ref. 1).

The Train A and Train B DC electrical power subsystems provide the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 600 V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses.

(ref. 1, 3).

The minimum battery discharge voltage (requiring opening the degraded battery output breaker) is 105 VDC (ref. 1, 3).

NEI-9901 Basis:

This IC addresses a concurrent and prolonged loss of both essential AC and Vital DC power.

A loss of all essential AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of Document No. I Rev. 0 1 Page 172 of 272 1

ATTACHMENT 1 EAL Bases vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both essential AC and vital DC power will lead to multiple challenges to fission product barriers.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.

MNS Basis Reference(s):

1. UFSAR Section 8.0 Electric Power

2. AP/1 (2)/A/5500/07 Loss of Electrical Power 3 AP/1 (2)/A/5500/15 Loss of Vital or Aux Control Power

4. ECA-0.0 EP/1 (2)/A/5000/ECA-0.0 Loss of All AC Power

5. NEI 99-01 SG8 I Document No. I Rev. 0 Page 173 of 272 1

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all vital DC power for 15 minutes or longer EAL:

SS2.1 Site Area Emergency Loss of all 125 VDC power based on battery bus voltage indications < 105 VDC on both vital DC buses EVDA and EVDD for > 15 min (Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

The 125 VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems (Train A or EVDA, and Train B or EVDD).

Each subsystem consists of two channels of 125 VDC batteries (each battery 100% capacity),

the associated battery charger(s) for each battery, and all the associated control equipment and interconnecting cabling. (ref. 1).

The Train A and Train B DC electrical power subsystems provide the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 600 V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses.

(ref. 1,2).

The minimum battery discharge voltage (requiring opening the degraded battery output breaker) is 105 VDC (ref. 1, 2).

NEI 99-01 Basis:

This IC addresses a loss of vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Escalation of the emergency classification level would be via ICs AG-1-RG1, FG1 or SG8SG1.

Document No. Rev. 0 Page 174 of 272

ATTACHMENT 1 EAL Bases MNS Basis Reference(s):

1. UFSAR Section 8.0 Electric Power 2 AP/1 (2)/A/5500/15 Loss of Vital or Aux Control Power

3. NEI 99-01 SS8 I Document No. I Rev. 0 F Page 175 of 272]

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer EAL:

SU3.1 Unusual Event An UNPLANNED event results in the inability to monitor one or more Table S-2 parameters from within the Control Room for > 15 min. (Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-2 Safety System Parameters

• Reactor power

" NCS level

" NCS pressure

" Core exit T/C temperature

" Level in at least one S/G

" Auxiliary feed flow in at least one S/G Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

MNS Basis:

SAFETY SYSTEM parameters listed in Table S-1 are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems.

The Operator Aid Computer (OAC), which displays SPDS required information, serves as a redundant compensatory indicator which may be utilized in lieu of normal Control Room indicators (ref. 1, 2).

I Document No. I Rev. 0 Page 176 of 272

ATTACHMENT 1 EAL Bases NEI 99-01 Basis:

This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [PWq / RPV love.,ol [B'RI and NCS heat removal.

The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWR]! RPV wat.. level [BWR. cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via IC SA2SA3.

MNS Basis Reference(s):

1. UFSAR Section 7.5 Safety-Related Display Instrumentation

2. OP/1 (2)/A/6100/SD-2 Cooldown to 400 Degrees F

3. NEI 99-01 SU2 Document No. Rev. 0 Page 177 of 2721

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress EAL:

SA3.1 Alert An UNPLANNED event results in the inability to monitor one or more Table S-2 parameters from within the Control Room for > 15 min. (Note 1)

AND Any significant transient is in progress, Table S-3 Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-2 Safety System Parameters

• Reactor power

• NCS level

• NCS pressure

• Core exit T/C temperature

• Level in at least one S/G

• Auxiliary or emergency feed flow Table S-3 Significant Transients

" Reactor trip

" Runback > 25% thermal power

" Electrical load rejection > 25%

electrical load

" Safety injection actuation Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown I Document No. Rev. 0 Page 178 of 272

ATTACHMENT 1 EAL Bases Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

MNS Basis:

SAFETY SYSTEM parameters listed in Table S-1 are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems.

The Operator Aid Computer (OAC), which displays SPDS required information, serves as a redundant compensatory indicator which may be utilized in lieu of normal Control Room indicators (ref. 1,2).

Significant transients are listed in Table S-2 and include response to automatic or manually initiated functions such as reactor trips, runbacks involving greater than 25% thermal power change, electrical load rejections of greater than 25% full electrical load or SI injection actuations.

NEI 99-01 Basis:

This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1 022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, .and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [PWR] I RPV level [BW]4 and NCS heat removal.

The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [P.R ! RPV water l.vol [B-AW cannot be Document No. I Rev. 0 Page 179 of 272

ATTACHMENT 1 EAL Bases determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via ICs FS1 or IC AS4RS1 MNS Basis Reference(s):

1. UFSAR Section 7.5 Safety-Related Display Instrumentation

2. OP/1(2)/A/6100/SD-2 Cooldown to 400 Degrees F

3. NEI 99-01 SA2 I Document No. Rev. 0 Page 180 of 272

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 4 - NCS Activity Initiating Condition: NCS activity greater than Technical Specification allowable limits EAL:

SU4.1 Unusual Event Dose Equivalent 1-131 activity > 1 [tCi/gm OR Dose Equivalent Xe-133 activity > 280 tCi/gm Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

The specific iodine activity is limited to - 1.0 pCi/gm Dose Equivalent 1-131. The specific Xe-133 activity is limited to - 280 pCi/gm Dose Equivalent XE-133 (ref 1, 2).

NEI 99-01 Basis:

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category A-R ICs.

MNS Basis Reference(s):

1. MNS Technical Specifications section 3.4.16 RCS Specific Activity

2. MNS Technical Specifications section 3.4.16 RCS Specific Activity Bases

3. NEI 99-01 SU3 Document No. Rev. 0 Page 181 of 272:

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 5 - NCS Leakage Initiating Condition: NCS leakage for 15 minutes or longer EAL:

SU5.1 Unusual Event NCS unidentified or pressure boundary leakage > 10 gpm for - 15 min.

OR NCS identified leakage > 25 gpm for > 15 min.

OR Leakage from the NCS to a location outside containment > 25 gpm for > 15 min.

(Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

Identified leakage includes leakage such as that from pump seals or valve packing (except reactor coolant pump (NCP) seal water injection or leakoff), that is captured and conducted to collection systems or a sump or collecting tank, leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary leakage; or NCS leakage through a steam generator to the secondary system (primary to secondary leakage) (ref. 1).

Unidentified leakage is all leakage (except NCP seal water injection or leakoff) that is not identified leakage (ref. 1).

Pressure Boundary leakage is leakage (except primary to secondary leakage) through a nonisolable fault in an NCS component body, pipe wall, or vessel wall (ref. 1)

NCS leakage outside of the containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as NCS to the Component Cooling Water (KC), or systems that directly see NCS pressure outside containment such as Chemical & Volume Control System (NV), Nuclear Sampling system (NM) and Residual Heat Removal (ND) system (when in the shutdown cooling mode).

I Document No. Rev. 0 Page 182 of 272

ATTACHMENT 1 EAL Bases Escalation of this EAL to the Alert level is via Category F, Fission Product Barrier Degradation, EAL FAI.1.

NEI 99-01 Basis:

This IC addresses RGS-NCS leakage which may be a precursor to a more significant event.

In this case, RGSNCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.

EAL #1 and EAL -2The first and second EAL conditions are focused on a loss of mass from the NCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications). EAL-#3The third condition addresses an NCS mass loss caused by an UNISOLABLE leak through an interfacing system. These EAL-s-conditions thus apply to leakage into the containment, a secondary-side system (e.g., steam generator tube leakage ii;a PWR) or a location outside of containment.

The leak rate values for each EAL-condition were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). EAL-#! The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.

The release of mass from the RGS-NCS due to the as-designed/expected operation of a relief valve does not warrant an emergency classification. For PWRs--aAn emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flow cannot be isolated). -

BWRs,-a- rtuck opon Safety Reieof Valve (SRV) or SRV leakage is not Gensidered efither identified Or unidentified leakage by Tochnical Specificatiens and, therefore, is not applicable

÷,.- t1,,;s E*AI--

The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.

Escalation of the emergency classification level would be via ICs of Recognition Category A-R or F.

MNS Basis Reference(s):

1. MNS Technical Specifications Definitions section 1.1

2. NEI 99-01 SU4 I Document No. Rev. 0 Page 183 of 272 1

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor EAL:

SU6.1 Unusual Event An automatic trip did not shut down the reactor as indicated by reactor power > 5% after any RPS setpoint is exceeded AND A subsequent automatic trip or manual trip action taken at the reactor control console (manual reactor trip switches or turbine manual trip) is successful in shutting down the reactor as indicated by reactor power < 5% (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations Definition(s):

None MNS Basis:

The first condition of this EAL identifies the need to cease critical reactor operations by actuation of the automatic Reactor Protection System (RPS) trip function. A reactor trip is automatically initiated by the RPS when certain continuously monitored parameters exceed predetermined setpoints (ref. 1).

Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative startup rate. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-trip response from an automatic reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful trip has therefore occurred when there is sufficient rod insertion from the trip of RPS to bring the reactor power below the immediate shutdown decay heat level of 5% (ref. 2, 3, 4).

For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the reactor control console (i.e., manual trip switches or turbine FDocument No. 7 Rev. 0 1 Page 184 of 272

ATTACHMENT 1 EAL Bases trip). Reactor shutdown achieved by use of other trip actions specified in EPII(2)/AI5000IFR-S.1 Response to Nuclear Power Generation/ATWS (such as depressing manual pushbutton on turbine control panel, emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4).

Following any automatic RPS trip signal, EP/1 (2)/A/5000/E-0 (ref. 2) and EP/1 (2)/A/5000/FR-S.1 (ref. 3) prescribe insertion of redundant manual trip signals to back up the automatic RPS trip function and ensure reactor shutdown is achieved. Even if the first subsequent manual trip signal inserts all control rods to the full-in position immediately after the initial failure of the automatic trip, the lowest level of classification that must be declared is an Unusual Event (ref.

4).

In the event that the operator identifies a reactor trip is imminent and initiates a successful manual reactor trip before the automatic RPS trip setpoint is reached, no declaration is required. The successful manual trip of the reactor before it reaches its automatic trip setpoint or reactor trip signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. However, if subsequent manual reactor trip actions fail to reduce reactor power below 5%, the event escalates to the Alert under EAL SA6.1.

If by procedure, operator actions include the initiation of an immediate manual trip following receipt of an automatic trip signal and there are no clear indications that the automatic trip failed (such as a time delay following indications that a trip setpoint was exceeded), it may be difficult to determine if the reactor was shut down because of automatic trip or manual actions.

If a subsequent review of the trip actuation indications reveals that the automatic trip did not cause the reactor to be shut down, then consideration should be given to evaluating the fuel for potential damage, and the reporting requirements of 50.72 should be considered for the transient event.

NEI 99-01 Basis:

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor (trip [PW.4R] / Gcram [BWRI) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [{P-WRJ SGram-FnK44]/R is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on an automatic reactor (trip [PW.] i Sc...rA [&--R]), operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g.,

initiate a manual reactor (trip [PWR] i scram. [B,--R])). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

If an initial manual reactor (trip [PW,] i scram [Br*,4) is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip ,P4r'9,]-/-,a.. [using a different switch).

Depending upon several factors, the initial or subsequent effort to manually (trip [P-WR4

.. FamfBfiW) the reactor, or a concurrent plant condition, may lead to the generation of an Document No. Rev. 0 Page 185 of 272

ATTACHMENT 1 EAL Bases automatic reactor (trip [PWI/ s*cram [...)* signal. If a subsequent manual or automatic (trip [PWRI / scram. [B.4,..) is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor (trip[P"r]/*/ scF, [.W.* )). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".T-aki.g tho Ra*cto* Modo S,,wit.h to SHUTDOW.A^,N i6 considorod to bo a mnanual crGamn actien. [B3WRI The plant response to the failure of an automatic or manual reactor (trip [PWR]-/sG

,BWR.) will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA5SA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA&SA6 or FA1, an Unusual Event declaration is appropriate for this event.

A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.

Should a reactor (trip [PWR, / scram [BWR)* signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied.

" If the signal causes a plant transient that should have included an automatic reactor (trip [PL.r-R] / cr6m ['RJ-)

.rr and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

" If the signal does not cause a plant transient and the (trip[,r, / scr ... m [B,'R]) failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

MNS Basis Reference(s):

1. MNS Technical Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. EP/1 (2)/IA5000/E-0 Reactor Trip or Safety Injection

3. EP/1 (2)/A/5000/F-0 Critical Safety Function Status Trees - Subcriticality

4. EP/1 (2)/IA5000/FR-S.1 Response to Nuclear Power Generation/ATWS

5. NEI 99-01 SU5 I Document No. I Rev. 0 Page 186 of 272 1

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor EAL:

SU6.2 Unusual Event A manual trip did not shut down the reactor as indicated by reactor power > 5% after any manual trip action was initiated AND A subsequent automatic trip or manual trip action taken at the reactor control console (manual reactor trip switches or turbine manual trip) is successful in shutting down the reactor as indicated by reactor power < 5% (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations Definition(s):

None MNS Basis:

This EAL addresses a failure of a manually initiated trip in the absence of having exceeded an automatic RPS trip setpoint and a subsequent automatic or manual trip is successful in shutting down the reactor (reactor power < 5%). (ref. 1).

Following a successful reactor trip, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative startup rate. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-trip response from a manual reactor trip signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful trip has therefore occurred when there is sufficient rod insertion from the trip of RPS to bring the reactor power below the immediate shutdown decay heat level of 5% (ref. 2, 3 4).

For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the reactor control console (i.e., manual trip switches or turbine trip). Reactor shutdown achieved by use of other trip actions specified in EP/1 (2)/A/5000/FR-FDocument No. I Rev. 0 1 Page 187 of 272 1

ATTACHMENT 1 EAL Bases S.1 Response to Nuclear Power Generation/ATWS (such as depressing manual pushbutton on turbine control panel, emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4).

If both subsequent automatic and subsequent manual reactor trip actions in the Control Room fail to reduce reactor power below the power associated with the safety system design (< 5%)

following a failure of an initial manual trip, the event escalates to an Alert under EAL SA6.1 NEI 99-01 Basis:

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor (trip [PWRI1 scram [914Mr) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [LPRI-Ga.Am r[W4R]R is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on an automatic reactor (trip [PWI4R] / cr.am, [.WRJ), operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g.,

initiate a manual reactor (trip [PWR] / crm-,,[...,. If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

If an initial manual reactor (trip,[rDA] / ,,cr]am [BWR) is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip [P,'A*R / scram [BW.])using a different switch).

Depending upon several factors, the initial or subsequent effort to manually (tip-fPR4 sGrFam [-BW4R) the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor (trip [PW].R] / .cram [BKr4,) signal. If a subsequent manual or automatic (trip [PI4.R] i scram [9144R]) is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor (trip[P'R] / crGamn [814rM)). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the RoactOr Mo-do SWitc9h to_ SHUTDOWN is,considoroAd- to9 be a m~anual Scramn acion.

The plant response to the failure of an automatic or manual reactor (trip LPWRD 1SG,/"

[1WRI) will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6SA6. Depending upon the plant Document No. Rev. 0 Page 188 of 272

ATTACHMENT 1 EAL Bases response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA6-SA6 or FAI, an Unusual Event declaration is appropriate for this event.

A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.

Should a reactor (trip [PR]

D* cram. [/. WR]) signal be generated as a result of plant work I (e.g., RPS setpoint testing), the following classification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor (trip[,r, / .cr'am, . [,--,,R]) and the RPSRTS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

o If the signal does not cause a plant transient and the (trip [PW.rDi. cr..am [....-R]) failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

MNS Basis Reference(s):

1. MNS Technical Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. EP/I(2)/A/5000/E-0 Reactor Trip or Safety Injection

3. EP/I(2)/A/5000/F-0 Critical Safety Function Status Trees - Subcriticality

4. EP/I(2)/A/5000/FR-S.1 Response to Nuclear Power Generation/ATWS

5. NEI 99-01 SU5 I Document No. Rev. 0 Page 189 of 272 1

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor EAL:

SA6.1 Alert An automatic or manual trip fails to shut down the reactor as indicated by reactor power

> 5%

AND Manual trip actions taken at the reactor control console (manual reactor trip switches or turbine manual trip) are not successful in shutting down the reactor as indicated by reactor power 2 5% (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations Definition(s):

None MNS Basis:

This EAL addresses any automatic or manual reactor trip signal that fails to shut down the reactor followed by a subsequent manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the safety systems were designed.

For the purposes of emergency classification, successful manual trip actions are those which can be quickly performed from the reactor control console (i.e., manual trip switches or turbine trip). Reactor shutdown achieved by use of other trip actions specified in EP/I (2)/A/5000/FR-S.1 Response to Nuclear Power Generation/ATWS (such as depressing manual pushbutton on turbine control panel, emergency boration or manually driving control rods) do not constitute a successful manual trip (ref. 4).

5% rated power is a minimum reading on the power range scale that indicates continued power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent FDocument No. I Rev. 0 1 Page 190 of 272

ATTACHMENT 1 EAL Bases subsequent core damage. Below 5%, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation can be used to determine if reactor power is greater than 5 % power (ref. 1).

Escalation of this event to a Site Area Emergency would be under EAL SS6.1 or Emergency Coordinator judgment.

NEI 99-01 Basis:

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor (trip [PWR]I/ cr.am ,.r). that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS.

A manual action at the reactor control console is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor (trip[rA4R] / cr.am [BWR])). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers). Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".Taking the ReactGo Modo SWitch to SHUTDOW*,,N is considorod to be a manual crGamn action. [9WR]

The plant response to the failure of an automatic or manual reactor (trip fPWR] i 6G

--WR]J) will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shut down the reactor is prolonged enough to cause a challenge to the core cooling [PWR- / RPV wat.. le'vel [,. WR , or GS NCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS66. Depending upon plant responses and symptoms, escalation is also possible via IC FSI. Absent the plant conditions needed to meet either IC SS66 or FS1, an Alert declaration is appropriate for this event.

It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.

A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.

MNS Basis Reference(s):

1. MNS Technical Specifications section 3.3.1 Reactor Trip System (RTS) Instrumentation

2. EP/1(2)/A/5000/E-0 Reactor Trip or Safety Injection Document No. I Rev. 0 Page 191 of 272

ATTACHMENT 1 EAL Bases

3. EP/1(2)/A/5000/F-0 Critical Safety Function Status Trees - Subcriticality

4. EP/1 (2)/A/5000/FR-S.1 Response to Nuclear Power Generation/ATWS

5. NEI 99-01 SA5 I Document No. Rev. 0 Page 192 of 272]

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Inability to shut down the reactor causing a challenge to core cooling or NCS heat removal EAL:

SS6.1 Site Area Emergency An automatic or manual trip fails to shut down the reactor as indicated by reactor power

- 5%

AND All actions to shut down the reactor are not successful as indicated by reactor power

> 5%

AND EITHER:

• Core Cooling RED PATH conditions met

• Heat Sink RED PATH conditions met Mode Applicability:

1 - Power Operations Definition(s):

None MNS Basis:

This EAL addresses the following:

" Any automatic reactor trip signal followed by a manual trip that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the safety systems were designed (EAL SA6.1), and

• Indications that either core cooling is extremely challenged or heat removal is extremely challenged.

The combination of failure of both front line and backup protection systems to function in response to a plant transient, along with the continued production of heat, poses a direct threat to the Fuel Clad and NCS barriers.

Reactor shutdown achieved by use of EP/I(2)/A/5000/FR-S.1 Response to Nuclear Power Generation/ATWS (such as depressing manual pushbutton on turbine control panel, emergency boration or manually driving control rods) are also credited as a successful manual Document No. Rev. 0 Page 193 of 272

ATTACHMENT 1 EAL Bases trip provided reactor power can be reduced below 5% before indications of an extreme challenge to either core cooling or heat removal exist (ref. 1, 4).

5% rated power is a minimum reading on the power range scale that indicates continued power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below 5%, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation can be used to determine if reactor power is greater than 5% power (ref. 1, 4).

Indication of continuing core cooling degradation is manifested by CSFST Core Cooling RED PATH conditions being met (ref. 2). Specifically, Core Cooling RED PATH conditions exist if either core exit T/Cs are reading greater than or equal to 1200OF or subcooling is 0°F AND no NC pumps are on AND core exit T/Cs are reading greater than or equal to 700°F AND Reactor Vessel Lower Range level less than or equal to 39% (ref. 2).

Indication of inability to adequately remove heat from the NCS is manifested by CSFST Heat Sink RED PATH conditions being met (ref. 2). Specifically, Heat Sink RED PATH conditions exist if narrow range level in at least on steam generator is not greater than or equal to 11 %

(32% ACC) and total feedwater flow to the intact steam generators is less than or equal to 450 gpm. (ref. 3).

NEI 99-01 Basis:

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor (trip [PW,] / scram [BW)r that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RG&NCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs. This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shut down the reactor.

The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shutdown the reactor.

A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.

Escalation of the emergency classification level would be via IC AGI-RG1 or FGI.

MNS Basis Reference(s):

1. EP/1(2)/N5000/F-0 Critical Safety Function Status Trees - Subcriticality

2. EP/1(2)/A15000/F-0 Critical Safety Function Status Tress - Core Cooling

3. EP/1(2)/A/5000/F-0 Critical Safety Function Status Tress - Heat Sink Document No. I Rev. 0 1 Page 194 of 272

ATTACHMENT 1 EAL Bases

4. EP/1(2)/A/5000/FR-S.1 Response to Nuclear Power Generation/ATWS

5. NEI 99-01 SS5 I Document No. I Rev. 0 1 Page 195 of 272]

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 7 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities EAL:

SU7.1 Unusual Event Loss of all Table S-4 onsite communication methods OR Loss of all Table S-4 ORO communication methods OR Loss of all Table S-4 NRC communication methods Table S-4 Communication Methods System Onsite ORO NRC Public Address X Internal Telephones X Onsite Radios X DEMNET X Offsite Radio System X Commercial Telephones X X NRC Emergency Telephone System (ETS) X Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None Document No. Rev. 0 Page 196 of 272]

ATTACHMENT 1 EAL Bases MNS Basis:

Onsite/offsite communications include one or more of the systems listed in Table S-4 (ref. 1).

Public Address System The McGuire Nuclear Station public address system provides paging and party line communications between stations located throughout the plant. Inside and outside type wall and desk-mounted stations are used to communicate between roaming personnel and fixed work locations. Plant-wide instructions are issued using the paging feature.

Internal Telephone System The McGuire Nuclear Station PBX telephone system provides communication capability between telephone stations located within the plant by dialing the four-digit telephone station code.

On-site Radio System Radio systems can be used for communication among operators, off-site monitoring teams, the control room, TSC and EOF.

DEMNET DEMNET is the primary means of offsite communication. This circuit allows intercommunication among the EOF, TSC, control room, counties, and states. DEMNET operates as an internet based (VoIP) communications system with a satellite back-up. Should the internet transfer rate become slow or unavailable, the DEMNET will automatically transfer to satellite mode.

Offsite Radio System A dedicated radio network can be used for communication with county and state warning points.

Commercial Telephones Commercial telephone lines, which supply public telephone communications, are employed by Duke Energy. The local service provider provides primary and secondary power for their lines at the Central Office.

NRC Emergency Telephone System The NRC uses a Duke Energy dedicated telephone line which allows direct telephone communications from the plant to NRC regional and national offices. The Duke Energy communications line provides a link independent of the local public telephone network.

Telephones connected to this network are located in the McGuire Control Room, Technical Support Center, and Emergency Operations Facility and can be used to establish NRC Emergency Notification System (ENS) and Health Physics Network (HPN) capability.

Document No. I Rev. 0 Page 197 of 272

ATTACHMENT 1 EAL Bases This EAL is the hot condition equivalent of the cold condition EAL CU5.1.

NEI 99-01 Basis:

This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to OROs and the NRC.

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

EAL-#4-The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

EAL-#2The second EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are-(see Dovr*.ep Notcs) the State, Gaston, Catawba, Iredell, Lincoln, Cabarrus and Mecklenburg County EOCs7 EAL-#3The third EAL addresses a total loss of the communications methods used to notify the NRC of an emergency declaration.

MNS Basis Reference(s):

1. MNS Emergency Plan Section F Emergency Communications

2. MNS Emergency Plan Section B On-Site Emergency Organization.

3. NEI 99-01 CU5 I Document No. Rev. 0 Page 198 of 272 1

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 8 - Containment Failure Initiating Condition: Failure to isolate containment or loss of containment pressure control.

EAL:

SU8.1 Unusual Event EITHER:

Any penetration is not isolated within 15 min. of a VALID containment isolation signal OR Containment pressure > 3 psig with EITHER a failure of both trains of NS OR failure of both trains of VX-CARF for ->15 min.

(Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

VALID - An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

MNS Basis:

The containment Phase B pressure setpoint (3 psig, ref. 1, 2) is the pressure at which the containment cooling systems should actuate and begin performing their function.

One full train of containment cooling operating per design is considered (ref. 1, 2):

" One train of Containment Air Return Fan System (VX-CARF), and

" One train of Containment Spray System (NS)

Once the Residual Heat Removal system is taking suction from the containment sump, with containment pressure greater than 3 psig and procedural guidance, one train of containment spray is manually aligned to the containment sump. If unable to place one NS train in service or without an operating train of VX-CARF (the CARF with a 10-minute delay) within 15 minutes this EAL has been exceeded. At this point a significant portion of the ice in the ice condenser would have melted and the NS system would be needed for containment pressure control.

Document No. Rev. 0 Page 199 of 272

ATTACHMENT 1 EAL Bases The Unusual Event threshold applies after automatic or manual alignment of the containment spray system has been attempted with containment pressure greater than 3 psig and less than one full train of NS is operating for greater than or equal to 15 minutes.

The Unusual Event threshold also applies if containment pressure is greater than 3 psig and at least one train of VX-CARF is not operating after a 10 minute delay for greater than or equal to 15 minutes. Without a single train of VX-CARF in service following actuation, the Unusual Event should be declared regardless of whether ECCS is in injection or sump recirculation mode after 15 minutes.

NEI 99-01 Basis:

This I*G-EAL addresses a failure of one or more containment penetrations to automatically isolate (close) when required by an actuation signal. It also addresses an event that results in high containment pressure with a concurrent failure of containment pressure control systems.

Absent challenges to another fission product barrier, either condition represents potential degradation of the level of safety of the plant.

For EAL-#4-the first condition, the containment isolation signal must be generated as the result on an off-normal/accident condition (e.g., a safety injection or high containment pressure); a failure resulting from testing or maintenance does not warrant classification. The determination of containment and penetration status - isolated or not isolated - should be made in accordance with the appropriate criteria contained in the plant AOPs and EOPs. The 15-minute criterion is included to allow operators time to manually isolate the required penetrations, if possible.

EAL4-#The second condition addresses a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15-minute criterion is included to allow operators time to manually start equipment that may not have automatically started, if possible. The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g.,

containment sprays or ice condenser fans) are either lost or performing in a degraded manner.

This event would escalate to a Site Area Emergency in accordance with IC FS1 if there were a concurrent loss or potential loss of either the Fuel Clad or RGSNCS fission product barriers.

MNS Basis Reference(s):

1. MNS Technical Specification 3.6.6

2. MNS Technical Specification 3.6.6 Bases

3. MNS Technical Specification 3.3.2

4. UFSAR Section 6.2 Containment Systems

5. NEI 99-01 SU7 Document No. Rev. 0 Page 200 of 272

ATTACHMENT 1 EAL Bases Category: S - System Malfunction Subcategory: 9 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode EAL:

SA9.1 Alert The occurrence of any Table S-5 hazardous event AND EITHER:

" Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode

" The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode

[ Table S-5 Hazardous Events

• Seismic event (earthquake)

• Internal or external FLOODING event

• High winds or tornado strike

• FIRE

• EXPLOSION

• Other events with similar hazard characteristics as determined by the Shift Manager Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

Document No. I Rev. 0 Page 201 of 272

ATTACHMENT 1 EAL Bases FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

MNS Basis:

• The significance of seismic events are discussed under EAL HU2.1 (ref. 1).

• Internal FLOODING may be caused by events such as component failures, equipment misalignment, or outage activity mishaps (ref. 2).

• External flooding may be due to high lake level. MNS powerhouse yard elevation is 760 ft MSL. The administration building and yard are elevation 747 ft MSL. The maximum water level elevation at the site is 760.375 ft MFL (ref. 3, 4).

" Seismic Category I structures are analyzed to withstand a sustained, design wind velocity of 95 mph. (ref. 5).

• Areas containing functions and systems required for safe shutdown of the plant are identified by fire area in the fire response procedure (ref. 5).

" An explosion that degrades the performance of a SAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component or structure would be classified under this EAL.

I Document No. I Rev. 0 1 Page 202 of 272

ATTACHMENT 1 EAL Bases NEI 99-01 Basis:

This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode.

This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant.

EAL-1-h.4The first condition addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded I

performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.

EAL- 7 b4The second condition addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.

Escalation of the emergency classification level would be via IC FS1 or AS4-RSI.

MNS Basis Reference(s):

1. RP/OIAI5700/007 Earthquake

2. AP/O/AI5500/030 Plant Flooding

3. UFSAR Section 2.1 Site Location 4 UFSAR Section 3.4 Water Level (Flood) Design

5. UFSAR Section 3.3.1 Wind Loadings

6. AP/O/AI5500/45 Plant Fire

7. NEI 99-01 CA6 I Document No. I Rev. 0 Page 203 of 272 1

ATTACHMENT 1 EAL Bases Category E - Independent Spent Fuel Storage Installation (ISFSI)

EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold)

An independent spent fuel storage installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. A significant amount of the radioactive material contained within a cask/canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from an accident involving the dry storage of spent nuclear fuel. Formal offsite planning is not required because the postulated worst-case accident involving an ISFSI has insignificant consequences to the public health and safety.

An Unusual Event is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask CONFINEMENT BOUNDARY is damaged or violated.

A hostile security event that leads to a potential loss in the level of safety of the ISFSI is a classifiable event under Security category EAL HS1.1.

Minor surface damage that does not affect storage cask/canister boundary is excluded from the scope of these EALs.

I Document No. I Rev. 0 1 Page 204 of 272I

ATTACHMENT 1 EAL Bases Category: E - ISFSI Sub-category: None Initiating Condition: Damage to a loaded cask CONFINEMENT BOUNDARY EAL:

EUI.1 Unusual Event Damage to a loaded canister CONFINEMENT BOUNDARY as indicated by an on-contact radiation reading on the surface of a loaded spent fuel cask > any Table E-1 dose limit Table E-1 ISFSI Dose Limits NAC Magnastor NAC UMS Transnuclear (TN-32)

• 190 mrem/hr 0 100 mrem/hr

• 120 mrem/hr (gamma) or 20 mrem/hr (gamma) on the side (neutron + (neutron) on top of the cask of the air cask (excludes inlet/outlet ports) gamma) oncask side of the the *340 mrem/hr (gamma) or 40 mrem/hr (neutron) on the sides of the radial neutron

• 10 mrem/hr a 100 mrem/hr shield (neutron) on the side (neutron + 0 560 mrem/hr (gamma) or 280 mrem/hr of the cask (excludes gamma) on the top (neutron) on the side surfaces above the air inlet/outlet ports) of the cask radial neutron shield region

• 900 900 mrem/hr (neutro gamma)200 *200 mrem/hr (neutro 220 mrem/hr (gamma) or 400 mrem/hr on the top of the gamma) at air (neutron) on the side surfaces below the cask (excludes air inlets and outlets radial neutron shield region inlet/outlet ports)

Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY- The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the MNS ISFSI, Confinement Boundary is defined as the Transportable Storage Canister (TSC) for TN, UMS and MAGNASTOR storage systems.

Document No. Rev. 0 Page 205 of 272]

ATTACHMENT 1 EAL Bases MNS Basis:

The MNS ISFSI utilizes three designs for dry spent fuel storage:

" The Transnuclear (TN) TN-32 dry spent fuel storage system

" The NAC-UMS dry spent fuel storage system

" The NAC-MAGNASTOR dry spent fuel storage system All systems consist of a Transportable Storage Canister (TSC) and concrete Vertical Concrete Cask (VCC). The TSC is the CONFINEMENT BOUNDARY for all systems. The TSC is welded/bolted and designed to provide confinement of all radionuclides under normal, off-normal, and accident conditions (ref. 1, 2, 3).

Confinement boundary is defined as the barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. Therefore, damage to a confinement boundary must be a confirmed physical breach between the spent fuel and the environment for the TSC.

The values shown in Table E-1 represent 2 times the limits specified in the ISFSI Certificate of Compliance Technical Specification for radiation external to a loaded cask for each of the NAC-MAGNASTOR, NAC-UMS and TN designs. All Table E-1 ISFSI dose limits are based on surveys taken consistent with the locations specified in the associated Technical Specification (ref. 1,2, 3).

NEI 99-01 Basis:

This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a storage cask containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the loaded storage cask is sealed. The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors, and configuration changes which could cause challenges in removing the cask or fuel from storage.

The existence of "damage" is determined by radiological survey. The technical specification multiple of "2 times", which is also used in Recognition Category A-R IC RAU1, is used here to distinguish between non-emergency and emergency conditions. The emphasis for this classification is the degradation in the level of safety of the spent fuel cask and not the magnitude of the associated dose or dose rate. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask.

Security-related events for ISFSIs are covered under ICs HU1 and HA1.

IDocument No. I Rev. 0 Page 206 of 272]

ATTACHMENT 1 EAL Bases MNS Basis Reference(s):

1. TN Generic Technical Specifications

2. NAC-UMS Certificate of Compliance

3. MAGNASTOR Technical Specifications and Design Features

4. NEI 99-01 E-HU1 Document No. Rev. 0 Page 207 of 272]

ATTACHMENT 1 EAL Bases Category F - Fission Product Barrier Degradation EAL Group: Hot Conditions (NCS temperature > 2000 F); EALs in this category are applicable only in one or more hot operating modes.

EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment. This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. The primary fission product barriers are:

A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.

B. Reactor Coolant System (NCS): The NCS Barrier includes the NCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves.

C. Containment (CMT): The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve.

Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to a Site Area Emergency or a General Emergency.

The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-1 (Attachment 2). "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade. The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emergency classification level:

Alert:

Any loss or any potential loss of either Fuel Clad or NCS Site Area Emergency:

Loss or potentialloss of any two barriers General Emergency:

Loss of any two barriersand loss or potential loss of third barrier The logic used for emergency classification based on fission product barrier monitoring should reflect the following considerations:

• The Fuel Clad Barrier and the NCS Barrier are weighted more heavily than the Containment Barrier.

Document No. Rev. 0 Page 208 of 272

ATTACHMENT 1 EAL Bases

• Unusual Event ICs associated with NCS and Fuel Clad Barriers are addressed under System Malfunction ICs.

" For accident conditions involving a radiological release, evaluation of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to ensure correct and timely escalation of the emergency classification. For example, an evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC RG1 has been exceeded.

" The fission product barrier thresholds specified within a scheme reflect plant-specific MNS design and operating characteristics.

" As used in this category, the term NCS leakage encompasses not just those types defined in Technical Specifications but also includes the loss of NCS mass to any location- inside the primary containment, an interfacing system, or outside of the primary containment. The release of liquid or steam mass from the NCS due to the as-designed/expected operation of a relief valve is not considered to be NCS leakage.

" At the Site Area Emergency level, EAL users should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration. For example, if the Fuel Clad and NCS fission product barriers were both lost, then there should be frequent assessments of containment radioactive inventory and integrity. Alternatively, if both the Fuel Clad and NCS fission product barriers were potentially lost, the Emergency Coordinator/EOF Director would have more assurance that there was no immediate need to escalate to a General Emergency.

I Document No. Rev. 0 Page 209 of 272 1

ATTACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Any loss or any potential loss of either Fuel Clad or NCS EAL:

FAI.1 Alert Any loss OR any potential loss of either Fuel Clad or NCS (Table F-1)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

Fuel Clad, NCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Alert classification level, Fuel Clad and NCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier, loss or potential loss of either the Fuel Clad or NCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability. Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or NCS barrier results in declaration of a Site Area Emergency under EAL FS1.1 NEI 99-01 Basis:

None MNS Basis Reference(s):

1. NEI 99-01 FA1 IDocument No. I Rev. 0 1 Page 210 of 272]

ATTACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss or potential loss of any two barriers EAL:

FSI.1 Site Area Emergency Loss OR potential loss of any two barriers (Table F-I)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

Fuel Clad, NCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions:

" One barrier loss and a second barrier loss (i.e., loss - loss)

• One barrier loss and a second barrier potential loss (i.e., loss - potential loss)

• One barrier potential loss and a second barrier potential loss (i.e., potential loss -

potential loss)

At the Site Area Emergency classification level, the ability to dynamically assess the proximity of present conditions with respect to the threshold for a General Emergency is important. For example, the existence of Fuel Clad and NCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification. Alternatively, if both Fuel Clad and NCS potential loss thresholds existed, the Emergency Coordinator/EOF Director would have greater assurance that escalation to a General Emergency is less imminent.

NEI 99-01 Basis:

None Document No. Rev. 0 Page 211 of 272

ATTACHMENT 1 EAL Bases MNS Basis Reference(s):

1. NEI 99-01 FS1 I Document No. I Rev. 0 Page 212 of 272 1

ATTACHMENT 1 EAL Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss of any two barriers and loss or potential loss of third barrier EAL:

FGI.1 General Emergency Loss of any two barriers AND Loss OR potential loss of third barrier (Table F-1)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Standby, 4 - Hot Shutdown Definition(s):

None MNS Basis:

Fuel Clad, NCS and Containment comprise the fission product barriers. Table F-1 (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions:

• Loss of Fuel Clad, NCS and Containment barriers

" Loss of Fuel Clad and NCS barriers with potential loss of Containment barrier

" Loss of NCS and Containment barriers with potential loss of Fuel Clad barrier

" Loss of Fuel Clad and Containment barriers with potential loss of NCS barrier NEI 99-01 Basis:

None MNS Basis Reference(s):

1. NEI 99-01 FG1 I Document No. Rev. 0 Page 213 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Introduction Table F-1 lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The table is structured so that each of the three barriers occupies adjacent columns. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds.

The first column of the table (to the left of the Fuel Clad Loss column) lists the categories (types) of fission product barrier thresholds. The fission product barrier categories are:

A. NCS or SG Tube Leakage B. Inadequate Heat removal C. CMT Radiation / NCS Activity D. CMT Integrity or Bypass E. Emergency Coordinator Judgment Each category occupies a row in Table F-1 thus forming a matrix defined by the categories.

The intersection of each row with each Loss/Potential Loss column forms a cell in which one or more fission product barrier thresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None" is entered in the cell.

Thresholds are assigned sequential numbers within each Loss and Potential Loss column beginning with number one. In this manner, a threshold can be identified by its category title and number. For example, the first Fuel Clad barrier Loss in Category A would be assigned "FC Loss A.1," the third Containment barrier Potential Loss in Category C would be assigned "CMT P-Loss C.3," etc.

If a cell in Table F-1 contains more than one numbered threshold, each of the numbered thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss.

Subdivision of Table F-1 by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds. This structure promotes a systematic approach to assessing the classification status of the fission product barriers.

When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-I, locates the likely category and then reads across the fission product barrier Loss and Potential Loss thresholds in that category to determine if a threshold has been exceeded. If a threshold has not been exceeded, the EAL-user proceeds to the next likely category and continues review of the thresholds in the new category If the EAL-user determines that any threshold has been exceeded, by definition, the barrier is lost or potentially lost - even if multiple thresholds in the same barrier column are exceeded, only that one barrier is lost or potentially lost. The EAL-user must examine each of the three Document No. Rev. 0 1 Page 214 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if containment radiation is sufficiently high, a Loss of the Fuel Clad and NCS barriers and a Potential Loss of the Containment barrier can occur. Barrier Losses and Potential Losses are then applied to the algorithms given in EALs FG1.1, FS1.1, and FA1.1 to determine the appropriate emergency classification.

In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first, followed by the NCS barrier and finally the Containment barrier threshold bases. In each barrier, the bases are given according category Loss followed by category Potential Loss beginning with Category A, then B,..., E.

I Document No. Rev. 0 Page 215 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Table F-1 Fission Product Barrier Threshold Matrix Fuel Clad (FC) Barrier Reactor Coolant System (NCS) Barrier Containment (CMT) Barrier Category Loss Potential Loss Loss Potential Loss Loss Potential Loss

1. An automatic or manual ECCS 1. Operation of a standby charging A (SI) actuation required by pump is required by EITHER:

EITHER: - UNISOLABLE NCS leakage 1. A leaking or RUPTURED SG is o UNISOLABLE NCS - SG tube leakage FAULTED outside of containment SG Tube leakage Leakage 2. Integrity-RED PATH conditions

" SG tube RUPTURE met

1. Core Cooling-ORANGE PATH conditions met 1. Heat Sink-RED PATH conditions 1. Core Coaling-RED PATH 1 Core Cooling-RED PATH 2. Heat Sink-RED PATH conditions met Inadequate conditions met met None AND None AND AND Heat sink is required Restoration procedures not Removal Heat sink is required effective within 15 min. (Note 1)

Heat sink is required C 1. EMF51AIB >Table F-2 column 1. EMF51AJB > Table F-2 column CMT "FC Loss" None "NCS Loss" None None 1. EMF51 AB > Table F-2 column Radiation 2. Dose equivalent 1-131 coolant "CMT Potential Loss" I NCS activity > 300 pCi/gm Activity

1. Containment isolation is required AND EITHER: 1. Containment-RED Path conditions

- Containment integrity has met been lost based on 2. Containment hydrogen concentratior Emergency

> 6%

CMT None None None None Coordinator/EOF Director judgment 3. Containment pressure > 3 psig with EITHER a failure of both or Bypass

• UNISOLABLE pathway from trains of NS OR failure of both Containment to the environment trains of VX-CARF for > 15 min.

exists (Note 1)

2. Indications of NCS leakage outside of containment E 1. Any condition in the opinion of 1. Any condition in the opinion of 1. Any condition in the opinion of 1. Any condition in the opinion of the 1. Any condition in the opinion of 1. Any condition in the opinion of the the Emergency the Emergency Coordinator/EOF the Emergency Coordinator/EOF Emergency Coordinator/EOF the Emergency Coordinator/EOF Emergency Coordinator/EOF EC Coordinator/EOF Director that Director that indicates potential Director that indicates loss of the Director that indicates potential Director that indicates loss of the Director that indicates potential Judgment ud en barer loss of the fuel clad barrier NCS barrier loss of the NCS barrier containment barrier loss of the containment barrier barrier I Document No. I Rev. 0 1 Page 216 of 272 I

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: 1. NCS or SG Tube Leakage Degradation Threat: Loss Threshold:

None I Document No. Rev. 0 Page 217 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: 1. NCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

None IDocument No. I Rev. 0 1 Page 218 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold:

1. Core Cooling-RED PATH conditions met Definition(s):

None Basis:

Plant-Specific Critical Safety Function Status Tree (CSFST) Core Cooling-RED path indicates significant core exit superheating and core uncovery. The CSFSTs are normally monitored using the SPDS display on the Operator Aid Computer (OAC) (ref. 1).

Generic This reading indicates temperatures within the core are sufficient to cause significant superheating of reactor coolant.

MNS Basis Reference(s):

1. EP/1 (2)/A/5000/F-0 Critical Safety Function Status Trees

2. EP/1(2)/N5000/FR-C.1 Response to Inadequate Core Cooling

3. EP/I(2)/IA5000/FR-C.2 Response to Degraded Core Cooling

4. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A I Document No. I Rev. 0 Page 219 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. Core Coln-RNePath conditions met Definition(s):

None Basis:

Plant-Specific Critical Safety Function Status Tree (CSFST) Core Cooling-ORANGE path indicates indicates subcooling has been lost and that some fuel clad damage may potentially occur. The CSFSTs are normally monitored using the SPDS display on the Operator Aid Computer (OAC) (ref. 1).

Generic This reading indicates a reduction in reactor vessel water level sufficient to allow the onset of heat-induced cladding damage.

MNS Basis Reference(s):

1. EP/1(2)/A/5000/F-0 Critical Safety Function Status Trees

2. EP/1(2)/A/5000/FR-C.1 Response to Inadequate Core Cooling

3. EP/I(2)/IA5000/FR-C.2 Response to Degraded Core Cooling

4. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A I Document No. Rev. 0 1 Page 220 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

2. Heat Sink-RED Path conditions met AND Heat sink is required Definition(s):

None Basis:

Plant-Specific In combination with NCS Potential Loss B.1, meeting this threshold results in a Site Area Emergency.

Critical Safety Function Status Tree (CSFST) Heat Sink-RED path indicates the ultimate heat sink function is under extreme challenge and that some fuel clad damage may potentially occur (ref. 1).

The CSFSTs are normally monitored using the SPDS display on the Operator Aid Computer (OAC) (ref. 1).

The phrase "and heat sink required" precludes the need for classification for conditions in which NCS pressure is less than SG pressure or Heat Sink-RED path entry was created through operator action directed by an EOP. For example, FR-H.1 is entered from CSFST Heat Sink-Red. Step 2 tells the operator to determine if heat sink is required by checking that NCS pressure is greater than any non-faulted SG pressure and NCS Thot is greater than 350°F (3470 F ACC). If these conditions exist, Heat Sink is required. Otherwise, the operator is to either return to the procedure and step in effect or place ND in service for heat removal. For large LOCA events inside the Containment, the SGs are moot because heat removal through the containment heat removal systems takes place. Therefore, Heat Sink Red should not be required and, should not be assessed for EAL classification because a LOCA event alone should not require higher than an Alert classification. (ref. 2).

Generic This condition indicates an extreme challenge to the ability to remove RGS-NCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the Fuel Clad Barrier. In accordance with EOPs, there may be Document No. I Rev. 0 1 Page 221 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.

MNS Basis Reference(s):

1. EP/1 (2)/A/5000/F-0 Critical Safety Function Status Trees

2. EP/I1(2)/A/5000/FR-H.1 Response to Loss of Secondary Heat Sink

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.B I Document No. Rev. 0 Page 222 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. CMT Radiation / NCS Activity Degradation Threat: Loss Threshold:

1. EMF51A/B > Table F-2 column "FC Loss" Table F-2 Containment Radiation - R/hr (EMF51A & B)

Time After S/D (Hrs.) NCS Loss FC Loss CMT Potential Loss 0-1 8.8 550 5500 1-2 8.4 400 4000 2-8 7.0 160 1600

>8 6.2 100 1000 Definition(s):

None Basis:

Plant-Specific The gamma dose rate resulting from a postulated loss of coolant accident (LOCA) is monitored by the containment high range monitors, EMF51A & B. EMF51 & B are located inside containment. The detector range is approximately 1 to 1E8 R/hr (logarithmic scale).

Radiation Monitors EMF51A & B provide a diverse means of measuring the containment for high level gamma radiation. (ref. 1).

The Table F-2 values, column FC Loss represents, based on core damage assessment procedure, the expected containment high range radiation monitor (EMF51A & B) response based on a LOCA, for periods of 1, 2, 8 and >8 hours after shutdown, no sprays and NCS pressure < 1600 psig with -2% fuel failure (ref. 1).

The value is derived as follows:

RP/O/A/5700/019 Figure 3 Containment Radiation Level vs. Time for 100% Clad Damage 1, 2, and 8 and >8 hours after shutdown without spray and NCS pressure < 1600 psig x 0.02 (rounded) (ref. 1).

Document No. Rev. 0 Page 223 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Generic The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals 300 pCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

The radiation monitor reading in this threshold is higher than that specified for R-,S-NCS Barrier Loss threshold -AC.1 since it indicates a loss of both the Fuel Clad Barrier and the RGS-NCS Barrier. Note that a combination of the two monitor readings appropriately escalates the omo.-goncy clacc!ficetion IYooECL to a Site Area Emergency.

MNS Basis Reference(s):

1. RP/O/A/5700/019 Core Damage Assessment

2. NEI 99-01 CMT Radiation / RCS Activity Fuel Clad Loss 3.A I Document No. I Rev. 0 Page 224 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. CMT Radiation / NCS Activity Degradation Threat: Loss Threshold:

2. Dose equivalent 1-131 coolant activity > 300 pCi/gm Definition(s):

None Basis:

Plant-Specific Elevated reactor coolant activity represents a potential degradation in the level of safety of the plant and a potential precursor of more serious problems. The threshold dose equivalent 1-131 concentration is well above that expected for iodine spikes and corresponds to about 2% fuel clad damage. When reactor coolant activity reaches this level the Fuel Clad barrier is considered lost. (ref. 1).

Generic This threshold indicates that RGS NCS radioactivity concentration is greater than 300 pCi/gm dose equivalent 1-131. Reactor coolant activity above this level is greater than that expected I

for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage.

Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

There is no Potential Loss threshold associated with RG, NCS Activity / Containment I

Radiation.

MNS Basis Reference(s):

1. RP/O/A/5700/019 Core Damage Assessment

2. NEI 99-01 CMT Radiation / RCS Activity Fuel Clad Loss 3.B I Document No. Rev. 0 1 Page 225 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: C. CMT Radiation / NCS Activity Degradation Threat: Potential Loss Threshold:

None Document No. Rev. 0 Page 226 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

None Document No. Rev. 0 Page 227 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Document No. Rev. 0 Page 228 of 272:]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: E. Emergency Coordinator Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Coordinator/EOF Director that indicates loss of the Fuel Clad barrier Definition(s):

None Basis:

Plant-Specific The Emergency Coordinator judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

" Imminent barrier degradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

" Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

" Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Coordinator/EOF Director should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Generic This threshold addresses any other factors that are to be used by the Emergency QireGter Coordinator in determining whether the Fuel Clad barrier is lost MNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A Document No. I Rev. 0 Page 229 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Fuel Clad Category: E. Emergency Coordinator Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Coordinator/EOF Director that indicates potential loss of the Fuel Clad barrier Basis:

Plant-Specific The Emergency Coordinator judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier degradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

" Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Coordinator should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Generic This threshold addresses any other factors that are to be used by the Emergency CoordinatorgieGtef in determining whether the Fuel Clad barrier is potentially lost. The Emergency DiQeoter-Coordinator should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

MNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A Document No. Rev. 0 Page 230 of 2721

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. NCS or SG Tube Leakage Degradation Threat: Loss Threshold:

1. An automatic or manual ECCS (SI) actuation required by EITHER:

" UNISOLABLE NCS leakage

" SG tube RUPTURE Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

RUPTURE - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis:

Generic ECCS (SI) actuation is caused by (ref. 1):

• Pressurizer pressure < 1845 psig

• Containment pressure > 1.0 psig Generic This threshold is based on an UNISOLABLE RGS-NCS leak of sufficient size to require an automatic or manual actuation of the Emergency Core Cooling System (ECCS). This condition clearly represents a loss of the RGS-NCS Barrier.

This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RGS-NCS leakage through an interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

A steam generator with primary-to-secondary leakage of sufficient magnitude to require a safety injection is considered to be RUPTURED. If a RUPTURED steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1.A will also be met.

MNS Basis Reference(s):

1. EP/1(2)/A/5000/E-0 Reactor Trip or Safety Injection

2. EP/1(2)/A/5000/E-3 Steam Generator Tube Rupture Document No. I Rev. 0 Page 231 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Loss 1.A IDocument No. I Rev. 0 1 Page 232 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. NCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

1. Operation of a standby charging pump is required by EITHER:

" UNISOLABLE NCS leakage

" SG tube RUPTURE Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

RUPTURE - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis:

Generic The Chemical and Volume Control System (CVCS) includes two centrifugal charging pumps which take suction from the Volume Control Tank and return cooled, purified reactor coolant to the NCS. Normal charging flow is handled by one of the two charging pumps. Each charging pump is designed for a flow rate of 150 gpm. A second charging pump being required is indicative of a substantial NCS leak. (ref. 1).

Generic This threshold is based on an UNISOLABLE RGS-NCS leak that results in the inability to maintain pressurizer level within specified limits by operation of a normally used charging (makeup) pump, but an ECCS (SI) actuation has not occurred. The threshold is met when an operating procedure, or operating crew supervision, directs that a standby charging (makeup) pump be placed in service to restore and maintain pressurizer level.

This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RGS-NCS leakage through an interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

If a leaking steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold 1 .A will also be met.

Document No. Rev. 0 Page 233 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases MNS Basis Reference(s):

1. UFSAR Section 9.3.4 Chemical and Volume Control System

2. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.A I Document No. I Rev. 0 Page 234 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: A. NCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

2. Integrity-RED path conditions met Definition(s):

None Basis:

Generic The "Potential Loss" threshold is defined by the CSFST Reactor Coolant Integrity - RED path.

CSFST NCS Integrity - Red Path plant conditions and associated PTS Limit A indicates an extreme challenge to the safety function when plant parameters are to the right of the limit curve following excessive NCS cooldown under pressure (ref. 1, 2).

Generic This condition indicates an extreme challenge to the integrity of the RGS-NCS pressure boundary due to pressurized thermal shock - a transient that causes rapid RQS-NCS cooldown while the RGS-NCS is in Mode 3 or higher (i.e., hot and pressurized).

MNS Basis Reference(s):

1. EP/1 (2)IA/5000/F-0 Critical Safety Function Status Trees

2. EP/I(2)/A/5000/FR-P.1 Response to Imminent Pressurized Thermal Shock Condition

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss I.B Document No. Rev. 0 1 Page 235 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold:

None IDocument No. I Rev. 0 Page 236 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

Definition(s):

None Basis:

Plant-Specific In combination with FC Potential Loss B.2, meeting this threshold results in a Site Area Emergency.

Critical Safety Function Status Tree (CSFST) Heat Sink-RED path indicates the ultimate heat sink function is under extreme challenge and that some fuel clad damage may potentially occur (ref. 1).

The CSFSTs are normally monitored using the SPDS display on the Operator Aid Computer (OAC) (ref. 1).

The phrase "and heat sink required" precludes the need for classification for conditions in which NCS pressure is less than SG pressure or Heat Sink-RED path entry was created through operator action directed by an EOP. For example, FR-H.1 is entered from CSFST Heat Sink-Red. Step 2 tells the operator to determine if heat sink is required by checking that NCS pressure is greater than any non-faulted SG pressure and NCS Thot is greater than 3500 F. If these conditions exist, Heat Sink is required. Otherwise, the operator is to either return to the procedure and step in effect or place ND in service for heat removal. For large LOCA events inside the Containment, the SGs are moot because heat removal through the containment heat removal systems takes place. Therefore, Heat Sink Red should not be required and, should not be assessed for EAL classification because a LOCA event alone should not require higher than an Alert classification. (ref. 1, 2)

Generic This condition indicates an extreme challenge to the ability to remove RGS-NCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the RGS-NCS Barrier. In accordance with EOPs, there may be Document No. I Rev. 0 1 Page 237 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.

Meeting this threshold results in a Site Area Emergency because this threshold is identical to Fuel Clad Barrier Potential Loss threshold 2.B.2; both will be met. This condition warrants a Site Area Emergency declaration because inadequate RGS-NCS heat removal may result in fuel heat-up sufficient to damage the cladding and increase RGS-NCS pressure to the point where mass will be lost from the system.

MNS Basis Reference(s):

1. EP/1 (2)/A/5000/F-0 Critical Safety Function Status Trees

2. EP/1 (2)/A/5000/FR-H.1 Response to Loss of Secondary Heat Sink

3. NEI 99-01 Inadequate Heat Removal NCS Loss 2.B I Document No. Rev. 0 1 Page 238 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: C. CMT Radiation/ NCS Activity Degradation Threat: Loss Threshold:

1. EMF51A/B > Table F-2 column "NCS Loss" Table F-2 Containment Radiation - R/hr (EMF51A & B)

Time After S/D (Hrs.) NCS Loss FC Loss CMT Potential Loss 0-1 8.8 550 5500 1-2 8.4 400 4000 2-8 7.0 160 1600

>8 6.2 100 1000 Definition(s):

N/A Basis:

Plant-Specific The gamma dose rate resulting from a postulated loss of coolant accident (LOCA) is monitored by the containment high range monitors, EMF51A & B. EMF51A & B are located inside containment. The detector range is approximately 1 to 1E8 R/hr (logarithmic scale).

Radiation Monitors EMF51A & B provide a diverse means of measuring the containment for high level gamma radiation. (ref. 1).

The value specified represents, based on core damage assessment procedure RP/0/A/5700/019 Figure 1, the expected containment high range radiation monitor (EMF51A &

B) response based on a LOCA, for periods of 1, 2, 8 and >8 hours after shutdown with no fuel failure (ref. 1).

The value is derived as follows:

RP/0/A/5000/019 Figure 1 Containment Radiation Level vs. Time for NCS Release for periods of 1, 2, 8 and >8 hours after shutdown (rounded) (ref. 1).

Document No. Rev. 0 Page 239 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Generic The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold ,=%AC.1 since it indicates a loss of the RCS-NCS Barrier only.

There is no Potential Loss threshold associated with RGS-NCS Activity / Containment Radiation.

MNS Basis Reference(s):

1. RP/O/A/5700/019 Core Damage Assessment

2. NEI 99-01 CMT Radiation / RCS Activity NCS Loss 3.A Document No. Rev. 0 Page 240 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: B. CMT Radiation/ NCS Activity Degradation Threat: Potential Loss Threshold:

I None I Document No. I Rev. 0 Page 241 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

None I Document No. I Rev. 0 Page 242 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Document No. Rev. 0 Page 243 of 272:]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: E. Emergency Coordinator Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Coordinator/EOF Director that indicates loss of the NCS barrier Definition(s):

None Basis:

Plant-Specific The Emergency Coordinator judgment threshold addresses any other factors relevant to determining if the NCS barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier degradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to the recognition of the inability to reach safety acceptance criteria before completion of all checks.

" Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Coordinator should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Generic This threshold addresses any other factors that may be used by the Emergency DQiectei Coordinator in determining whether the NCS Barrier is lost.

MNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment NCS Loss 6.A Document No. Rev. 0 Page 244 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Reactor Coolant System Category: E. Emergency Coordinator Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Coordinator/EOF Director that indicates potential loss of the NCS barrier Definition(s):

None Basis:

Plant-Specific The Emergency Coordinator judgment threshold addresses any other factors relevant to determining if the NCS barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

" Imminent barrier degradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to the inability to reach final safety acceptance criteria before completing all checks.

" Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Coordinator should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Generic This threshold addresses any other factors that may be used by the Emergency DiieGtef Coordinator in determining whether the NCS Barrier is potentially lost. The Emergency Di§Gter-Coordinator should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

MNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment NCS Potential Loss 6.A Document No. I Rev. 0 Page 245 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: A. NCS or SG Tube Leakage Degradation Threat: Loss Threshold:

1. A leaking or RUPTURED SG is FAULTED outside of containment Definition(s):

FAULTED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized.

RUPTURED - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis:

Plant-Specific None.

Generic This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of containment. The condition of the SG, whether leaking or RUPTURED, is determined in accordance with the thresholds for RGSNCS Barrier Potential Loss 4-.A.1 and Loss 4-.A.1, respectively. This condition represents a bypass of the containment barrier.

FAULTED is a defined term within the NEI 99-01 methodology; this determination is not necessarily dependent upon entry into, or diagnostic steps within, an EOP. For example, if the pressure in a steam generator is decreasing uncontrollably ([part of the FAULTED definition) and the FAULTED steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher priority condition, the steam generator is still considered FAULTED for emergency classification purposes.

The FAULTED criterion establishes an appropriate lower bound on the size of a steam release that may require an emergency classification. Steam releases of this size are readily observable with normal Control Room indications. The lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC SU4 for the fuel IDocument No. IRev. 0 1 Page 246 of 27

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases clad barrier (i.e., RGS-NCS activity values) and IC SU5 for the RGS-NCS barrier (i.e., RGS NCS leak rate values).

This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldown the plant, or to drive an auxiliary (emergency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a FAULTED condition). The inability to isolate the steam flow without an adverse effect on plant cooldown meets the intent of a loss of containment.

Steam releases associated with the expected operation of a SG power operated relief valve or safety relief valve do not meet the intent of this threshold. Such releases may occur intermittently for a short period of time following a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown. Steam releases associated with the unexpected operation of a valve (e.g.,

a stuck-open safety valve) do meet this threshold.

Following an SG tube leak or rupture, there may be minor radiological releases through a secondary-side system component (e.g., air ejectors, glad seal exhausters, valve packing, etc.). These types of releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-R ICs.

The emcrgency classification ov-olECLs resulting from primary-to-secondary leakage, with or without a steam release from the FAULTED SG, are summarized below.

Affected SG is FAULTED Outside of Containment?

P-to-S Leak Rate Yes No Less than or equal to 25 gpm No classification No classification Unusual Event per Unusual Event per Greater than 25 gpm SU4SU5.1 8U4SU5.1 Requires operation of a standby Site Area Emergency per charging (makeup) pump (RCS Alert per FA1.1 FS1.1 NCS BarrierPotentialLoss)

Requires an automatic or manual Site Area Emergency per ECCS (SI) actuation (RCS-NCS Alert per FA1.1 FS1.1 BarrierLoss)

There is no Potential Loss threshold associated with RGS-NCS or SG Tube Leakage.

Document No. Rev. 0 Page 247 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases MNS Basis Reference(s):

1. EP/1(2)/A/5000/E-0 Reactor Trip or Safety Injection

2. EP/1(2)/A/5000/E-3 Steam Generator Tube Rupture

3. NEI 99-01 RCS or SG Tube Leakage Containment Loss 1.A Document No. Rev. 0 Page 248 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment ,

Category: A. NCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

None I Document No. Rev. 0 1 Page 249 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. Core Cooling-RED path conditions met AND Restoration procedures not effective within 15 min. (Note 1)

Definition(s):

None Basis:

Plant-Specific Critical Safety Function Status Tree (CSFST) Core Cooling-RED path indicates significant core exit superheating and core uncovery. The CSFSTs are normally monitored using the SPDS display on the Operator Aid Computer (OAC) (ref. 1).

The function restoration procedures are those emergency operating procedures that address the recovery of the core cooling critical safety functions. The procedure is considered effective if the temperature is decreasing or if the vessel water level is increasing (ref. 1, 2, 3).

A direct correlation to status trees can be made if the effectiveness of the restoration procedures is also evaluated. If core exit thermocouple (TC) readings are greater than 1,200°F (ref. 1), Fuel Clad barrier is also lost.

Generic This condition represents an IMMINENT core melt sequence which, if not corrected, could lead to vessel failure and an increased potential for containment failure. For this condition to occur, there must already have been a loss of the RGSNCS Barrier and the Fuel Clad Barrier.

If implementation of a procedure(s) to restore adequate core cooling is not effective (successful) within 15 minutes, it is assumed that the event trajectory will likely lead to core melting and a subsequent challenge of the Containment Barrier.

The restoration procedure is considered "effective" if core exit thermocouple readings are decreasing and/or if reactor vessel level is increasing. Whether or not the procedure(s) will be effective should be apparent within 15 minutes. The Emergency Qi-eGt*r-Coordinator should I escalate the emergency classification level as soon as it is determined that the procedure(s) will not be effective.

Document No. Rev. 0 Page 250 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Severe accident analyses (e.g., NUREG-1 150) have concluded that function restoration procedures can arrest core degradation in a significant fraction of core damage scenarios, and that the likelihood of containment failure is very small in these events. Given this, it is appropriate to provide 15 minutes beyond the required entry point to determine if procedural actions can reverse the core melt sequence.

MNS Basis Reference(s):

1. EP/1(2)/A/5000/F-0 Critical Safety Function Status Trees

2. EP/1(2)/A/5000/FR-C.1 Response to Inadequate Core Cooling

3. EP/1(2)/A/5000/FR-C.2 Response to Degraded Core Cooling

4. NEI 99-01 Inadequate Heat Removal Containment Potential Loss 2.A I Document No. I Rev. 0 Page 251 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: C. CMT Radiation/NCS Activity Degradation Threat: Loss Threshold:

None I Document No. Rev. 0 1 Page 252 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: C. CMT Radiation/NCS Activity Degradation Threat: Potential Loss Threshold:

1. EMF5IA/B > Table F-2 column "CMT Potential Loss"I Table F-2 Containment Radiation - R/hr (EMF51A & B)

Time After SOD (Hrs.) NCS Loss FC Loss CMT Potential Loss 0-1 8.8 550 5500 1-2 8.4 400 4000 2-8 7.0 160 1600

>8 6.2 100 1000 Definition(s):

None Basis:

Plant-Specific The gamma dose rate resulting from a postulated loss of coolant accident (LOCA) is monitored by the containment high range monitors, EMF51A & B. EMF51A & B are located inside containment. The detector range is approximately 1 to 1 E8 R/hr (logarithmic scale).

Radiation Monitors EMF51A & B provide a diverse means of measuring the containment for high level gamma radiation. (ref. 1).

The Table F-2 values, column CMT Potential Loss represents, based on core damage assessment procedure, the expected containment high range radiation monitor (EMF51A & B) response based on a LOCA, for periods of 1, 2, 8 and >8 hours after shutdown, no sprays and NCS pressure < 1600 psig with -20% fuel failure (ref. 1).

The value is derived as follows:

RP/0/A/5700/019 Figure 3 Containment Radiation Level vs. Time for 100% Clad Damage 1, 2, 8 and >8 hours after shutdown without spray and NCS pressure < 1600 psig x 0.20 (rounded)

(ref. 1).

Document No. Rev. 0 Page 253 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Generic The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and RCS-NCS Barrier Loss thresholds.

I NUREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RGSNCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the omorgocy clacificfati.n loevoECL to a General Emergency.

MNS Basis Reference(s):

1. RP/O/A/5700/01 9 Core Damage Assessment

2. NEI 99-01 CMT Radiation / RCS Activity Containment Potential Loss 3.A I Document No. Rev. 0 1 Page 254 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

1. Containment isolation is required AND EITHER:

" Containment integrity has been lost based on EC judgment

" UNISOLABLE pathway from containment to the environment exists Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

Basis:

Plant-Specific None Generic These thresholds address a situation where containment isolation is required and one of two conditions exists as discussed below. Users are reminded that there may be accident and release conditions that simultaneously meet both bulleted thresholds 4.A.1 and 4.A.2.

4A-4First Threshold - Containment integrity has been lost, i.e., the actual containment atmospheric leak rate likely exceeds that associated with allowable leakage (or sometimes referred to as design leakage). Following the release of RGS-NCS mass into containment, containment pressure will fluctuate based on a variety of factors; a loss of containment integrity condition may (or may not) be accompanied by a noticeable drop in containment pressure. Recognizing the inherent difficulties in determining a containment leak rate during accident conditions, it is expected that the Emergency 0*eeter-Coordinator will assess this threshold using judgment, and with due consideration given to current plant conditions, and available operational and radiological data (e.g., containment pressure, readings on radiation monitors outside containment, operating status of containment pressure control equipment, etc.).

Refer to the middle piping run of Figure 0-F-41. Two simplified examples are provided. One I is leakage from a penetration and the other is leakage from an in-service system valve.

Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure.

Document No. Rev. 0 Page 255 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Another example would be a loss or potential loss of the RGS-NCS barrier, and the simultaneous occurrence of two FAULTED locations on a steam generator where one fault is located inside containment (e.g., on a steam or feedwater line) and the other outside of containment. In this case, the associated steam line provides a pathway for the containment atmosphere to escape to an area outside the containment.

Following the leakage of RGS-NCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable (design) containment leakage through various penetrations or system components. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-R ICs.

4.ASecond Threshold - Conditions are such that there is an UNISOLABLE pathway for the migration of radioactive material from the containment atmosphere to the environment. As used here, the term "environment" includes the atmosphere of a room or area, outside the containment, that may, in turn, communicate with the outside-the-plant atmosphere (e.g.,

through discharge of a ventilation system or atmospheric leakage). Depending upon a variety of factors, this condition may or may not be accompanied by a noticeable drop in containment pressure.

Refer to the top piping run of Figure 9-F-41. In this simplified example, the inboard and outboard isolation valves remained open after a containment isolation was required (i.e.,

containment isolation was not successful). There is now an UNISOLABLE pathway from the containment to the environment.

The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream.

Leakage between two interfacing liquid systems, by itself, does not meet this threshold.

Refer to the bottom piping run of Figure -F--41. In this simplified example, leakage in an RGP NCP seal cooler is allowing radioactive material to enter the Auxiliary Building. The radioactivity would be detected by the Process Monitor. If there is no leakage from the closed water cooling system to the Auxiliary Building, then no threshold has been met. If the pump developed a leak that allowed steam/water to enter the Auxiliary Building, then second threshold-47-B would be met. Depending upon radiation monitor locations and sensitivities, this leakage could be detected by any of the four monitors depicted in the figure and cause the first threshold 4-A-.-to be met as well.

Following the leakage of RGS-NCS mass into containment and a rise in containment pressure, there may be minor radiological releases associated with allowable containment leakage through various penetrations or system components. Minor releases may also occur if a containment isolation valve(s) fails to close but the containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Recognition Category A-R ICs.

I Document No. I Rev. 0 Page 256 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases The status of the containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold 4-.A.1.

I MNS Basis Reference(s):

1. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.A Document No. Rev. 0 Page 257 of 272]

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Loss Threshold:

2. Indications of NCS leakage outside of containment Definition(s):

None Basis:

Plant-Specific ECA-1.2 LOCA Outside Containment (ref. 1) provides instructions to identify and isolate a LOCA outside of the containment. Potential NCS leak pathways outside containment include (ref. 1,2):

• Residual Heat Removal (ND)

" Safety Injection (NI)

" Chemical & Volume Control (NV)

• NCP seals (NC)

• PZR/NCS Loop sample lines (NM)

Generic Containment sump, temperature, pressure and/or radiation levels will increase if reactor coolant mass is leaking into the containment. If these parameters have not increased, then the reactor coolant mass may be leaking outside of containment (i.e., a containment bypass sequence). Increases in sump, temperature, pressure, flow and/or radiation level readings outside of the containment may indicate that the RGS-NCS mass is being lost outside of containment.

Unexpected elevated readings and alarms on radiation monitors with detectors outside containment should be corroborated with other available indications to confirm that the source is a loss of RGS-NCS mass outside of containment. If the fuel clad barrier has not been lost, radiation monitor readings outside of containment may not increase significantly; however, other unexpected changes in sump levels, area temperatures or pressures, flow rates, etc.

should be sufficient to determine if RG&-NCS mass is being lost outside of the containment.

Refer to the middle piping run of Figure O-F--41. In this simplified example, a leak has occurred at a reducer on a pipe carrying reactor coolant in the Auxiliary Building. Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure and cause threshold 4-AD.1 to be met as well.

Document No. Rev. 0 1 Page 258 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases To ensure proper escalation of the emergency classification, the RGS-NCS leakage outside of containment must be related to the mass loss that is causing the RGS-NCS Loss and/or Potential Loss threshold 47A.1 to be met.

MNS Basis Reference(s):

1. EP/1 (2)/A/5000/ECA-1.2 LOCA Outside Containment

2. EP/1 (2)/A/5000/E-1 Loss of Reactor or Secondary Coolant

3. NEI 99-01 CMT Integrity or Bypass Containment Loss Document No. Rev. 0 Page 259 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Figure 1: Containment Integrity or Bypass Examples Threshold-Airbome

--- --- --- release from Effluent ',pathway.

Monitor Vent RCP Seal Coolinq I Document No. I Rev. 0 Page 260 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

11. Containment-RED Path conditions met I Definition(s):

None Basis:

Plant-Specific Critical Safety Function Status Tree (CSFST) Containment-RED path is entered if containment pressure is greater than or equal to 15 psig and represents an extreme challenge to safety function. (ref. 1).

15 psig is based on the containment design pressure (ref. 2).

Generic If containment pressure exceeds the design pressure, there exists a potential to lose the Containment Barrier. To reach this level, there must be an inadequate core cooling condition for an extended period of time; therefore, the RGS-NCS and Fuel Clad barriers would already I be lost. Thus, this threshold is a discriminator between a Site Area Emergency and General Emergency since there is now a potential to lose the third barrier.

MNS Basis Reference(s):

1. EP/1(2)/A/5000/F-0 Critical Safety Function Status Trees

2. UFSAR Section 6.2 Containment Systems

3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.A Document No. Rev. 0 Page 261 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

12. Containment hydrogen concentration > 6%

Definition(s):

None Basis:

Plant-Specific Following a design basis accident, hydrogen gas may be generated inside the containment by reactions such as zirconium metal with water, corrosion of materials of construction and radiolysis of aqueous solution in the core and sump. (ref. 1).

The lower limit of deflagration of hydrogen in air is > 6% and is the maximum concentration at which hydrogen igniters can be placed in service (ref. 2).

To generate such levels of combustible gas, loss of the Fuel Clad and NCS barriers must have occurred. With the Potential Loss of the containment barrier, the threshold hydrogen concentration, therefore, will likely warrant declaration of a General Emergency.

Generic The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a potential loss of the Containment Barrier.

MNS Basis Reference(s):

1. UFSAR Section 6.2 Containment Systems

2. EP/I(2)/A/5000/FR-Z.4 Response to High Containment Hydrogen Concentration

3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.B Document No. I Rev. 0 Page 262 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: D. CMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

3. Containment pressure > 3 psig with EITHER a failure of both trains of NS OR failure of both trains of VX-CARF for - 15 min. (Note 1)

Note 1: The Emergency Coordinator/EOF Director should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Definition(s):

None Basis:

Plant-Specific The containment Phase B pressure setpoint (3 psig, ref. 1, 2) is the pressure at which the containment cooling systems should actuate and begin performing their function.

One full train of containment cooling operating per design is considered (ref. 1, 2):

• One train of Containment Air Return Fan System (VX-CARF), and

" One train of Containment Spray System (NS)

Once the Residual Heat Removal system is taking suction from the containment sump, with containment pressure greater than 3 psig and procedural guidance, one train of containment spray is manually aligned to the containment sump. If unable to place one NS train in service or without an operating train of VX-CARF (the CARF with a 10-minute delay) within 15 minutes a potential loss of containment exists. At this point a significant portion of the ice in the ice condenser would have melted and the NS system would be needed for containment pressure control. The potential loss of containment applies after automatic or manual alignment of the containment spray system has been attempted with containment pressure greater than 3 psig and less than one full train of NS is operating for greater than or equal to 15 minutes.

The potential loss of containment also applies if containment pressure is greater than 3 psig and at least one train of VX-CARF is not operating after a 10 minute delay for greater than or equal to 15 minutes. Without a single train of VX-CARF in service following actuation, the potential loss should be credited regardless of whether ECCS is in injection or sump recirculation mode after 15 minutes.

Generic Document No. Rev. 0 Page 263 of 272

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases This threshold describes a condition where containment pressure is greater than the setpoint at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15-minute criterion is included to allow operators time to manually start equipment that may not have automatically started, if possible. This threshold represents a potential loss of containment in that containment heat removal/depressurization systems (e.g., containment sprays, ice condenser fans, etc., but not including containment venting strategies) are either lost or performing in a degraded manner.

MNS Basis Reference(s):

1. MNS Technical Specification 3.6.6

2. MNS Technical Specification 3.6.6 Bases

3. MNS Technical Specification 3.3.2

4. UFSAR Section 6.2 Containment Systems

5. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.C I Document No. I Rev. 0 1 Page 264 of 2721

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: F. Emergency Coordinator Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Coordinator/EOF Director that indicates loss of the Containment barrier Definition(s):

None Basis:

Plant-Specific The Emergency Coordinator judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

" Imminent barrier degradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

" Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Coordinator should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Generic This threshold addresses any other factors that may be used by the Emergency DeFeGtOt Coordinator in determining whether the Containment Barrier is lost.

MNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A I Document No. I Rev. 0 Page 265 of 272 1

ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Barrier: Containment Category: F. Emergency Coordinator Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Coordinator/EOF Director that indicates potential loss of the Containment barrier Definition(s):

None Basis:

Plant-Specific The Emergency Coordinator judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

" Imminent barrier degradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

" Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Coordinator should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Generic This threshold addresses any other factors that may be used by the Emergency DieGte Coordinator in determining whether the Containment Barrier is lost.

MNS Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Potential Loss 6.A Document No. Rev. 0 Page 266 of 2721

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

Background

NEI 99-01 Revision 6 ICs AA3 and HA5 prescribe declaration of an Alert based on impeded access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal plant operations, cooldown or shutdown is located.

These areas are intended to be plant operating mode dependent. Specifically the Developers Notes for AA3 and HA5 states:

The "site-specificlist of plant rooms or areas with entry-relatedmode applicabilityidentified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operatingprocedures used for normal plant operation, cooldown and shutdown. Do not include rooms or areasin which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be requiredfor each room or area.

The list should not include rooms or areasfor which entry is required solely to perform actions of an administrativeor record keeping nature (e.g., normalrounds or routine inspections).

Further, as specified in IC HA5:

The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation due to the release of a hazardousgas.

Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmosphericboundaries,or the capabilityto acquire and maintainpositive pressure within the Control Room envelope.

I Document No. I Rev. 0 1 Page 267 of 272

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases MNS Table R-2 and H-2 Bases A review of station operating procedures identified the following mode dependent in-plant actions and associated areas that are required for normal plant operation, cooldown or shutdown:

OP/1 &2/A/6100/003, Perform OP/l/A/61 OO/SD 1 NIA N/A No Enclosure 4.2, Step (Prepare For Cooldown).

3.8.4.1 OP/1 &2/N6100/003, Perform NC System degas N/A N/A No Enclosure 4.2, Step per OP/1/A/61OO/SD-10 3.8.6 (NC System, PRT and NCDT Degas).

OP/I &2/A/6100/003, Open breakers on Transfer Yard 1 No Enclosure 4.2, Steps Transformer Cooling 3.8.8.1 & 3.8.9.1 Groups.

OP/1&2/A/6100/003, Perform Main Steam Main Steam Doghouses 1 No Enclosure 4.2, Step Safety Valve testing.

3.8.14 OP/1 &2/N6100/003, Check transfer of Aux Turbine Bldg. Basement I No Enclosure 4.2, Step Steam from C htr Bleed to (739') North Wall 3.8.17.1 Main Steam (Close 1SP-1 (Main Steam to 1A CF Pump Turb Isol) and 1SP-2 (Main Steam to 1B CF Pump Turb Isol).1AS-1 1).

OP/I &2/N6100/003, Stop G HDT Pumps per Turbine Bldg. Basement 1 No Enclosure 4.2, Step OP/Il/B/6250/004 (739') West Wall 3.8.21 (Feedwater Heater Vents, Drains, and Bleed System).

OP/I1 &2/A/6100/003, Stop C HDT Pumps per Turbine Bldg. Basement 1 No Enclosure 4.2, Step OP/I/B/6250/004 (739') HP Heater Panel 3.8.23 (Feedwater Heater Vents, Drains, and Bleed System).

OP/1 &2/A/6100/003, Transfer of Aux Steam to Service Bldg. (739') or 1 No Enclosure 4.2, Step Unit 2 or Aux Electric Auxiliary Boiler Room 3.8.34 Boilers per OP/I/B/6250/007 B (Auxiliary Electric Boilers).

OP/I1 &2/A/6100/003, Close 1SP-1 (Main Steam Turbine Bldg. Mezz (760') 1 No Enclosure 4.2, Step to 1A CF Pump Turb Isol) at CF Pumps 3.12.7 and 1SP-2 (Main Steam to 1B CF Pump Turb Isol).

OP/1 &2/A/6100/003, Shutdown MG Sets per MG Set Room (767') 3 No Enclosure 4.2, Step OP/1/A/6150/008 (Rod 3.13.16.6 Control), Enclosure 4.5 IDocument No. I Rev. 0 F Page 268 of 272 1

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases OP/1 &2/A/6100/003, Secondary System Wet Secondary Chemistry Lab 3 No .2, Step Layup Chemical addition and TB Basement (739')

3.14.4 (Chemistry).

I. I OP/1 &2/A/6100/003, Begin performance of Inside Containment 3 No .2, Step stroke time testing of Pzr 3.14.6.2 PORVs.

OP/1 &2/A/61 00/SD- When RP allows access to Inside Containment 3 No 1, Step 3.5 Lower Containment, begin Enclosure 4.2 (Pre-Cooldown Containment Entry). This enclosure performs a Containment Inspection with RP, Engineering and Operations involvement.

OP/I &2/A/61 OO/SD- After required amount of Aux. Bldg. (NM Lab 716') 3 No 1, Step 3.3.4 boron is added for SDM Counting Room (767')

requirements for blocking P-11, Primary Chemistry samples NC System.

OP/i &2/A/61 OO/SD- After required amount of Aux. Bldg. (NM Lab 716') 3 No 1, Step 3.4.9 boron is added for SDM Counting Room (767')

Shutdown Boron Concentration, Primary Chemistry samples NC System.

OP/I &2/N6100/SD- After required amount of Aux. Bldg. (NM Lab 716') 3 No 1, Step 3.5.7 boron is added for Crud Counting Room (767')

Burst Boron Concentration, Primary Chemistry samples NC System.

OP/I &2/A/61 00/SD- After required amount of Aux. Bldg. (NM Lab 716') 3 No 1, Step 3.6.7 boron is added for Counting Room (767')

Refueling Boron Concentration, Primary Chemistry samples NC System.

OP/I &2/A/61 00/SD- Have Radwaste align Aux. Bldg. (716') 1-3 No 10, Step 3.5.1.1 Nitrogen for NCDT Degas Radwaste Area per OP/I/A/6200/600 (WG Support of Unit I Shutdown).

Document No. Rev. 0 Page 269 of 272 1 DouetN. e.0Pge29o 7

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases OP/1 &2/N61 00/SD- Radwaste performs Phase Aux. Bldg. (716') 1-3 No 10, Step 3.6.2 1 PRT Degas per Radwaste Area OP/OIA/62001518 (Waste Gas Operation).

OP/1&2/AN6100/SD- Radwaste performs NC Aux. Bldg. (716') 1-3 No 10, Step 3.7.1 System Degas per Radwaste Area OP/1 &2/A/6200/600 (WG Support Of Unit 1/2 Shutdown).

OP/1&2/N6100/SD- Radwaste performs NCDT Aux. Bldg. (716') 1-3 No 10, Step 3.8.3 Degas per Radwaste Area OP/OIA/6200/518 (Waste Gas Operation).

OP/I &2/A/61 00/SD- Radwaste performs Phase Aux. Bldg. (716') 1-3 No 10, Step 3.9.1 & 2 PRT Degas per Radwaste Area 3.9.2 OP/1 &2/N6200/600 (WG Support Of Unit 1/2 Shutdown) and OP/O/A16200/518 (Waste Gas Operation).

OP/I &2/A/61 00/SD- Radwaste crossties BATs. Aux. Bldg. (733') BAT 3 No 2, Step 3.2.3 Area OP/i &2/A/61 OO/SD- When less than 1000 psig, Aux. Bldg. (733') Electrical 3 Yes 2, Step 3.5 IAE places NC System Pene (733' and 750')

Narrow Range Pressure Transmitters in service.

OP/I &2/A/6100/SD- To maximize charging flow, Aux. Bldg. (733') Ledge 3 No 2, Enclosure 4.2, adjust NC Pump Seal Outside VCT Room Step 3.2.3.2 Water Injection Throttles to 8-10 gpm.

OP/1&2/A/61OO/SD- Radwaste crossties BATs. Aux. Bldg. (733') BAT 3 No 4, Step 3.2.3 Area OP/I &2/A/61 00/SD- Perform plant shutdown ETA, ETB, Aux. Bldg. 3 Yes 4, Steps 3.11.1, tagging. (733' and 750') South End 3.11.2, & 3.12.3 OP/I &2/A/61 00/SD- To maximize charging flow, Aux. Bldg. (733') Ledge 3 No 4, Enclosure 4.2, adjust NC Pump Seal Outside VCT Room Step 3.10.2 Water Injection Throttles to 8-10 gpm.

OP/I &2/A/61 00/SD- Secondary Chemistry to Chemistry Lab and 4 No 4, Step 3.15 check S/G sulfate meets Turbine Bldg. (739') North chemistry criteria for Wall continued cooldown.

I Document No. Rev. 0 Page 270 of 272 1

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases OP/1 &2/N61 00/SO- Stroke time testing of Inside Containment 4 No 10, Step 3.8 PORVs per PT/I/A/4151/005 (NC Valve Stroke Timing Test Using Air). Enclosures 13.4, 13.5, 13.6 OP/I&2/A/6100/SO- Rack out and tag one NV ETA (750'), ETB (733') 4 Yes 10, Step 3.11.1, and both NI Pumps per 3.11.2, 3.11.3 OP/O/N6350/008 (Operation of Station Breakers).

OP/I&2/A/6100/SO- Tag out PD Pump at Aux. Bldg. (750') North 4 Yes 10, Step 3.11.6 1MXK-F2C (Reciprocating End Charging Pump No 1).

OP/I&2/N6100/SO- If LTOP vent requirements Inside Containment 4 No 10, Step 3.12 are to be satisfied by securing 1NC-36B (Pzr PORV) open, Maintenance gags 1NC-36B (Pzr PORV).

OP/1&2/A/6100/SD- Unlock and close 1/2ND- P/C, RHole, near 1N1-185, 4 Yes 6A(B), Step 3.3 119 (1/2 A ND ECCS Outside CAD 212 (716')

Sump Suction Relief Inlet ABPC thru CAD Door, Isol #2). FF59 (716')

OP/I &2/A/61 00/SD- Perform PT/l/A/4206/030 Aux Building Pipechase 4 No 6A(B), Enclosure (Draining ECCS Sump (716')

4.1, Step 3.6 Piping Drain Reservoir Train A), Enclosure 13.1 (Draining ECCS Sump Piping Drain Reservoir Train A in Modes 1 4) and PT/1/A/4206/031 (Draining ECCS Sump Piping Drain Reservoir Train B),

Enclosure 13.1 (Draining ECCS Sump Piping Drain Reservoir Train B in Modes 1 4).

OP/I &2/A/61 OO/SD- Monitor and shift NC Aux Building (716'/733') at 4 No 6A(B), Encl. 4..1, System Filters on high DP. NC Filters Room Step 3.8 OP/I &2/N61 00/SD- De-energize 1/2ND-68A (A ETA Aux. Bldg. (750') 4 Yes 6A(B), Encl. 4.2 ND Pump & A Hx Miniflow)

Step 3.7 in the open position at 1/2EMXA-F12B (1/2ND-68A).

Document No. Rev. 0 Page 271 Document No.

I ReV. 0 Page 271 of of 272 272 1

ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases OP/1 &2/A/61 00/SD- Adjust flow through Cation Aux Building (750') over 4 No 6A(B), Step 3.31.1 Bed Demineralizer per Demin Pits OP/1/N6200/001 D (Chemical and Volume Control System Demineralizers).

OP/1&2/NA6100/S0- De-energize 1/2ND-67B (B ETB Aux. Bldg. (733') 4 Yes 6, Step 3.4.3 ND Pump & B Hx Miniflow) in the open position at 1/2EMXBI-2C (1/2ND-67B).

Table R-2 & H-2 Results Table R-2/1H-2 Safe Operation & Shutdown RoomslAreas Bldg. Elevation Unit I RoomlArea Unit 2 RoomlArea Modes Auxiliary 716' P/C, RHole, near 1NI-185, ABPC thru CAD Door, FF59 4 Outside CAD 212 Auxiliary 750' 800 (1 EMXA) 820 (2EMXA) 3, 4 803 (1ETA) 805 (2ETA) 3, 4 702 (Elec. Pene.) 713 (Elec. Pene.) 3 Auxiliary 733' 722 (1EMXB-1) 724 (2EMXB-1) 3, 4 705 (1ETB) 716 (2ETB) 3, 4 Plant Operating Procedures Reviewed

1. OP/1 &2/A/6100/003

2. OP/I&21A/6100/SD-1

3. OP/I &2/A/61 00/SD-2

4. OP/I&21A/6100/SD-4

5. OP/I&2/A/6100/SD-10

6. OP/I &2/A/61 00/SD-6A(B)

7. OP/1 &2/A/61 00/SO-6

8. OP/1 &2/A/61 00/SO-10 I Document No. Rev. 0 Page 272 of 272