CNL-15-088, Application to Revise Technical Specifications for Component Cooling Water Snd Essential Raw Cooling Water to Support Dual Unit Operation (TS-WBN-15-13)

Application to Revise Technical Specifications for Component Cooling Water Snd Essential Raw Cooling Water to Support Dual Unit Operation (TS-WBN-15-13)

ML15170A474
Person / Time
Site:	Watts Bar
Issue date:	06/17/2015
From:	James Shea Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CNL-15-088, TS-WBN-15-13
Download: ML15170A474 (55)

Text

Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402 CNL-15-088 June 17, 2015 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Watts Bar Nuclear Plant, Unit 1 Facility Operating License No. NFP-90 NRC Docket No. 50-390

Subject:

Watts Bar Nuclear Plant Unit 1 - Application to Revise Technical Specifications for Component Cooling Water and Essential Raw Cooling Water to Support Dual Unit Operation (TS-WBN-15-13)

References:

1. NUREG-0847 Supplement 27, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Unit 2, dated January 2015

2. Letter from TVA to NRC, Watts Bar Nuclear Plant - Unit 2 - Regulatory Framework for the Completion of Construction and Licensing Activities for Unit 2 - Restructured Tables, dated March 13, 2008 [ML080770237]

3. Letter from TVA to NRC, Watts Bar Nuclear Plant - Unit 2 - Regulatory Framework for the Completion of Construction and Licensing for Unit 2 -

Revision 1 (TAC No. MD6311), dated June 16, 2008 [ML081700293]

4. Letter from TVA to NRC, Watts Bar Nuclear Plant Unit 2 - Shutdown Technical Specifications for Component Cooling System and Essential Raw Cooling Water System to Support Dual Unit Operation, dated June 17, 2015 In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR)

§50.90, Application for amendment of license, construction permit, or early site permit, Tennessee Valley Authority (TVA) is submitting a request for an amendment to Facility Operating License No. NFP-90 for the Watts Bar Nuclear Plant (WBN) Unit 1.

U.S. Nuclear Regulatory Commission CNL-15-088 Page 2 June 17, 2015 The proposed change would add new Technical Specifications (TS) 3.7.16, Component Cooling System (CCS) - Shutdown, and TS 3.7.17, Essential Raw Cooling Water (ERCW)

System - Shutdown, for WBN Unit 1 to support dual unit operation. In addition, changes to TS 5.7.2.18, Safety Function Determination Program, and the related change to the Bases for LCO 3.0.6, LCO Applicability, are being proposed consistent with Technical Specification Task Force (TSTF) Traveler TSTF-273-A, Revision 2, regarding loss of power and determination of loss of safety function.

The Essential Raw Cooling Water System (ERCW) and the Component Cooling Water System (CCS) are safety related water systems that are shared by WBN Unit 1 and Unit 2.

The Nuclear Regulatory Commission (NRC) has reviewed the design of the systems to support dual unit operation as part of the operating license review of WBN Unit 2 and concluded that they conform to the requirements of 10 CFR 50 Appendix A, General Design Criterion 5 (Reference 1). ERCW and CCS support both the WBN Unit 1 and Unit 2 Residual Heat Removal (RHR) System in the removal of decay and residual heat during normal operation and after a design basis accident (DBA).

The new TS for CCS and ERCW will define the support needed from CCS and ERCW in the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after a unit shut down when steam generators are not available for heat removal, assuming a loss of offsite power and the loss of one train of on-site power. provides a description and technical evaluation of the proposed change, a regulatory evaluation, and a discussion of environmental considerations. Attachment 1 to provides the proposed new WBN Unit 1 TS 3.7.16 and associated Bases for CCS. Attachment 2 to Enclosure 1 provides the proposed new WBN Unit 1 TS 3.7.17 and associated Bases for ERCW. Attachment 3 to Enclosure 1 provides the proposed changes to TS 5.7.2.18, Safety Function Determination Program, and the Bases for LCO 3.0.6, LCO Applicability. Attachment 4 to Enclosure 1 provides clean-typed copies of TS 5.7.2.18 and LCO 3.0.6 Bases, with the proposed changes incorporated.

As established in the regulatory framework for licensing WBN Unit 2 (References 2 and 3),

the WBN Unit 2 Final Safety Analysis Report (FSAR) represents the dual unit configuration.

By letter dated June 17, 2015 (Reference 4), TVA provided proposed WBN Unit 2 FSAR changes reflecting the increased heat loads on CCS and ERCW that are associated with dual unit operation. The changes provided in the WBN Unit 2 FSAR markup pages will become part of the combined Unit 1 and Unit 2 FSAR, to be reflected in the WBN Unit 1 FSAR update submittal six months after the fall 2015 refueling outage.

TVA requests approval of the proposed License Amendment by September 3, 2015, to support issuance of the WBN Unit 2 Operating License. The License Amendment will be implemented prior to startup of WBN Unit 2.

TVA has determined that there are no significant hazards considerations associated with the proposed change and that the change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9).

U.S. Nuclear Regulatory Commission CNL-15-088 Page3 June 17, 2015 The WBN Plant Operations Review Committee and the TVA Nuclear Safety Review Board have reviewed this proposed change and determined that operation ofWBN U1 & U2 in accordance with the proposed change will not endanger the health and safety of the public.

Additionally, in accordance with 10 CFR 50.91(b)(1), TVA is sending a copy of this letter and the enclosures to the Tennessee Department of Environment and Conservation.

A new containment pressure analysis is required for WBN Unit 1 to reflect the dual unit ERCW System flowrate to CCS heat exchangers. The dual unit ERCW System flowrate to the CCS heat exchangers of both units is lower than the single unit (Unit 1 only) flowrate. In particular, assuming a Train B electrical failure, the ERCW Train A flow to the CCS Train A heat exchanger would be reduced. In addition, because the CCS flow will be shared between WBN Unit 1 and Unit 2 on CCS Train B via CCS heat exchanger C, the effective heat exchanger performance (UA) would be lower for WBN Unit 1. These changes impact the heat removal from a unit during a design basis event, following switchover to RHR containment sump recirculation on a failure of Train A or B electrical power.

Therefore, by separate correspondence, TVA will submit a WBN Unit 1 license amendment request providing a revised containment pressure analysis and ice condenser ice mass for FSAR Section 6.2.1. The updated containment analysis will address three Westinghouse Nuclear Safety Advisory Letters and the results of the ERCW dual unit flow balance testing.

An increase in the minimum allowable ice weight provided in the WBN Unit 1 TS will be required by this reanalysis. Enclosure 2 provides the one new regulatory commitment contained in this submittal. In the interim, the non-conforming condition of the non-conservative TS will be controlled administratively to assure that the operability of the containment is maintained.

Please address any questions regarding this request to Gordon Arent at 423-365-2004.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 17th day of June 2015.

ully, LJ~

. Shea i e President, Nuclear Licensing Enclosures cc: See Page 4

U.S. Nuclear Regulatory Commission CNL-15-088 Page 4 June 17, 2015

Enclosures:

1. Evaluation of Proposed Changes 2 New Regulatory Commitment cc (Enclosures):

U.S. Nuclear Regulatory Commission, Region II NRC Senior Resident Inspector, Watts Bar Nuclear Plant, Unit 1 NRC Project Manager - Watts Bar Nuclear Plant, Unit 1 Director - Division of Radiological Health - Tennessee State Department of Environment and Conservation

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES

Subject:

Application to Revise Technical Specifications for Component Cooling Water and Essential Raw Cooling Water to Support Dual Unit Operation 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

4.0 TECHNICAL EVALUATION

4.1 Component Cooling Water and Essential Raw Cooling Water 4.2 TSTF-273-A, Revision 2

5.0 REGULATORY EVALUATION

5.1 Applicable Regulatory Requirements and Criteria 5.2 Precedent 5.3 Significant Hazards Consideration 5.4 Conclusions

7.0 REFERENCES

ATTACHMENTS - WBN Unit 1 TS and TS Bases 3.7.16 CCS-Shutdown - WBN Unit 1 TS and TS Bases 3.7.17 ERCW-Shutdown - WBN Unit 1 LCO 3.0.6 Bases and TS 5.7.2.18 Safety Function Determination Program, Mark-ups - WBN Unit 1 LCO 3.0.6 Bases and TS 5.7.2.18 Safety Function Determination Program, Clean-typed E1-1

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES 1.0

SUMMARY

DESCRIPTION Pursuant to Title 10 of the Code of Federal Regulations (CFR) §50.90, the Tennessee Valley Authority (TVA) is submitting a request for a change to Facility Operating License No. NPF-90 for Watts Bar Nuclear Plant (WBN) Unit 1. The proposed change will create new Technical Specifications (TS) 3.7.16, Component Cooling System (CCS) - Shutdown, and TS 3.7.17, Essential Raw Cooling Water (ERCW) System -

Shutdown.

The proposed change is required to support dual unit operation of WBN Unit 1 (Unit 1) and licensing of WBN Unit 2 (Unit 2) in the fall of 2015.

2.0 DETAILED DESCRIPTION 10 CFR Part 50 Appendix A, General Design Criterion (GDC) 5, Sharing of structures, systems and components, provides high level requirements for safety systems that are shared by multiple nuclear units on a single site. The Essential Raw Cooling Water System (ERCW) and the Component Cooling Water System (CCS) at WBN are shared safety systems that meet the requirements of GDC 5. In support of dual unit operation and meeting the GDC 5 requirement for mitigating an accident in one unit and the orderly shutdown and cooldown of the other unit, TVA is providing changes to the Unit 1 TS and TS Bases for CCS and ERCW to support operability of the Residual Heat Removal (RHR) System during the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of a Unit 1 shutdown. Decay heat removal by the RHR System is supported by CCS and ERCW.

2.1 Proposed Changes 2.1.1 Component Cooling Water System and Essential Raw Cooling Water System New TS 3.7.16, Component Cooling System (CCS) - Shutdown, is proposed to require two trains of CCS (Train A and Train B) with two Train B CCS pumps to be operable and aligned to the B Train CCS header for the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shutdown, when not complying with TS Required Actions to place the unit in Mode 5. This alignment will support the simultaneous cooldown of both units in the event of a loss of offsite power (LOOP) concurrent with the loss of both Train A or both Train B 6.9 kV shutdown boards.

New TS 3.7.17, Essential Raw Cooling Water (ERCW) System - Shutdown, is proposed to require two operable ERCW trains (Train A and Train B) with two operable ERCW pumps per Unit 1 6.9 kV shutdown board. With Unit 1 shutdown less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, a third ERCW pump per train must be operable that has the capability to be aligned to its respective Unit 1 6.9 kV shutdown board.

The existing TS 3.7.7, Component Cooling System (CCS), and TS 3.7.8, Essential Raw Cooling Water (ERCW) System, remain applicable, and are supplemented by the proposed TS 3.7.16 and TS 3.7.17 during the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of a shutdown of Unit 1.

E1-2

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES 2.1.2 TSTF-273-A, Revision 2, Safety Function Determination Program Clarifications Changes are proposed to limiting condition for operation (LCO) Bases 3.0.6 to provide a clarification of appropriate LCO for loss of function and to clarify the requirements in TS 5.7.2.18, Safety Function Determination Program (SFDP), that consideration does not have to be made for a loss of power in determining loss of safety function. The proposed changes are taken verbatim from the Technical Specification Task Force (TSTF) Traveler TSTF-273-A, Revision 2, to NUREG-1431, Standard Technical Specifications, Westinghouse Plants.

3.0 BACKGROUND

In June 1982, the Nuclear Regulatory Commission (NRC) staff issued a safety evaluation report (Reference 1), regarding TVA's application for licenses to operate WBN Units 1 and 2. When TVA delayed the construction of Unit 2, detailed reviews of the ERCW System and CCS did not need to consider dual unit operation and compliance with GDC 5.

TVA informed the NRC of the plan to reactivate the construction of Unit 2 in 2007 (Reference 2) and subsequently submitted Final Safety Analysis Report (FSAR) amendments reflecting the proposed dual unit operation at the WBN site. In Reference 3, the NRC issued a request for additional information (RAI) with respect to the design and heat removal capability of ERCW and CCS including compliance to GDC 5. TVA responded with the requested information in December 2010 (Reference 4). In the response, TVA stated that the existing eight ERCW pumps would be replaced with new pumps before the dual unit flow balance was performed and that the system had sufficient capacity to supply the normal and accident flows for dual unit operation. TVA provided additional information in support of the NRC review in a letter dated April 13, 2011 (Reference 5). The Reference 5 letter provided information on the heat removal capability of ERCW and CCS, including the heat loads and the flow rates required to remove the specified heat loads. Specific information was provided on the time needed to bring the non-accident unit to cold shutdown assuming a loss of coolant accident (LOCA) on the other unit in conjunction with a LOOP and a single failure of Train A or Train B power. The response also stated that the safe shutdown condition for WBN is Hot Standby.

The NRC documented their review of the ERCW System and CCS for dual unit operation in Supplemental Safety Evaluation Report (SSER) 23 (Reference 6), issued in July 2011. There were two open items related to the design of the ERCW System.

Open Item 90 stated that the NRC should verify the dual unit flow balance confirms that the ERCW pumps meet the specified performance requirements including flows that establish conformance with GDC 5. The NRC concluded that the information provided in the two RAI responses (References 4 and 5) established that the ERCW System design met GDC 5. Open Item 91 required TVA to incorporate the information provided in the RAI responses in the FSAR.

E1-3

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES In SSER 23, the NRC concluded that the CCS System met GDC 5 requirements based on the information provided in Reference 5. There were no SSER open items related to CCS.

The NRC also reviewed the ultimate heat sink (UHS) for WBN as a shared system. The SSER stated the following: The NRC staff considers the ability to bring the non-accident unit to cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to meet the orderly shutdown and cooldown requirement of GDC 5. Since the minimum available flow from the Tennessee River is well in excess of the ERCW flow requirement, the staff considers the UHS able to meet the requirements of GDC 5. TVA should clarify FSAR Section 9.2.5 to add the capability of the UHS to bring the non-accident unit to cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This is Open Item 66 (Appendix HH).

TVA provided updated information with respect to the ERCW System and CCS and the heat removal rates in FSAR Amendments 105, 106, 107, 110, and 112, including information requested by the NRC in SSER Open Item 91. The information requested by the NRC in SSER Open Item 66 on the UHS was provided in Unit 2 FSAR Amendment 105. Supplemental Safety Evaluation Report 27 was published in January 2015 (Reference 7), in which the staff closed SSER Open Items 66 and 91.

On June 12, 2014, TVA submitted a response (Reference 8) to an informal RAI from the NRC concerning the alignment of pumps and heat exchangers in ERCW and CCS during dual unit operation for combinations of design basis events and accidents, and shutdown of the non-accident unit. This response provided additional detail on the alignments that the plant would be in for specific combinations of accidents, transients, and plant modes of operation, as requested by the NRC. The response stated that for a limiting event of a LOCA on Unit 1, with Unit 2 on RHR cooling within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of shutdown and assuming a LOOP and a single failure of a loss of a power train, that Unit 2 may return to Mode 3 from Mode 4 or 5.

In subsequent discussions between the NRC and TVA, it was noted that a unit ascending in operational modes (e.g., to Mode 3 from Mode 4 or 5) with a LOOP and/or a loss of a power train would be an action prohibited by TS. To address this issue, TVA is proposing a TS change to require two CCS pumps powered from Train B and aligned to the Train B CCS header before the unit transfers decay heat removal from the steam generators to the RHR System, such that if a LOOP or a loss of a power train occurs, the unit can continue to be cooled down and not ascend in operational modes. If the required CCS Train B pump realignment cannot be supported, the unit must remain on steam generator cooling for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shutdown. A second change requires that, with Unit 1 shutdown less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, a third ERCW pump per train must be available that can be aligned to its respective Unit 1 6.9 kV shutdown boards (i.e., 6.9 kV Shutdown Board 1A-A or 1B-B).

E1-4

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES

4.0 TECHNICAL EVALUATION

4.1 Component Cooling Water and Essential Raw Cooling Water 4.1.1 System Description Residual Heat Removal System The Unit 1 RHR System consists of two heat exchangers, two pumps, and the associated piping, valves, and instrumentation necessary for operational control. The inlet line to the RHR System is connected to the hot leg of one reactor coolant loop, while the return lines are connected to the hot and cold legs of each of the reactor coolant loops. Those return lines are also the Emergency Core Cooling System (ECCS) low head injection lines.

During RHR System operation, reactor coolant flows from the Reactor Coolant System (RCS) to the RHR pumps, through the tube side of the RHR heat exchangers, and back to the RCS. The heat is transferred to CCS water circulating through the shell side of the RHR heat exchangers.

The RCS cooldown rate is manually controlled by regulating the reactor coolant flow through the tube side of the RHR heat exchangers. A common line containing a flow control valve bypasses both RHR heat exchangers and is used together with each RHR heat exchanger discharge valve to control return flow to the RCS. With both RHR trains in operation, the RHR System is designed to reduce RCS temperature from 350°F to 140°F within 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. With one RHR System train in operation, the RHR System is designed to reduce RCS temperature from 350°F to cold shutdown (200°F) in 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />.

The RHR System is normally placed in service four hours after reactor shutdown when the RCS is less than or equal to 350°F. The design heat load is based on the decay heat fraction that exists 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> after shutdown following an extended period of full power operation. The heat load handled by the RHR System during cooldown includes decay heat, residual component material heat, and reactor coolant pump (RCP) heat.

The RHR System functions in conjunction with the high head portion of the ECCS to provide injection of borated water from the refueling water storage tank (RWST) into the RCS cold legs during the injection phase following a LOCA.

In its capacity as the low head portion of the ECCS, the RHR System provides long term recirculation capability for core cooling following the injection phase of the LOCA. This function is accomplished by aligning the RHR System to take fluid from the containment sump, cool it by circulation through the RHR heat exchangers, and supply it directly to the core, as well as via the centrifugal charging pumps in the Chemical Volume Control System (CVCS) and the safety injection (SI) pumps in the Safety Injection System (SIS).

The Unit 1 Train A and B RHR pumps are powered from 6.9 kV Shutdown Boards 1A-A and 1B-B, respectively. The Unit 2 Train A and B RHR pumps are powered from 6.9 kV Shutdown Boards 2A-A and 2B-B, respectively.

E1-5

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES Component Cooling System The CCS is designed for operation during all phases of plant operation and shutdown.

The system serves to remove residual and decay heat from the RCS via the RHR System during plant cool down; cool the spent fuel pool water and the letdown flow of the CVCS; provide cooling to dissipate waste heat from various plant components; and provide cooling for Engineered Safety Feature (ESF) loads after an accident.

The CCS serves as an intermediate loop between the RHR System, CVCS, spent fuel pool cooling system, and the ERCW System. Heat from these systems and other systems described in FSAR Section 9.2.2.1 is transferred by the CCS through the CCS heat exchangers to the ERCW system, which is the heat sink for these heat loads.

The intermediate loop provides a double barrier to reduce the possibility of leakage of radioactive water to the environment.

The CCS design is based on a maximum ERCW inlet temperature of 85°F. The ERCW supply from the river is designed to be available under all conditions. The design temperature places no undue limitations on normal plant operation; however, it affects the time required for plant cooldown and the number of CCS heat exchangers in use during the various plant operations.

The CCS is required for post-accident removal of heat from the reactor. Thus, the CCS is designed such that no single active failure can interrupt cooling water to both ESF trains. One ESF train is capable of providing sufficient heat removal capability for maintaining safe shutdown.

The CCS consists of five pumps, three heat exchangers, three headers, and other associated pumps, valves, piping and instrumentation serving both units. CCS is a supporting system to other safe shutdown systems. Two redundant trains per unit are available. For each unit in the normal operation alignment, Train A consists of two CCS pumps and the associated valves, piping, instrumentation and a heat exchanger (Heat Exchanger A for Unit 1 and Heat Exchanger B for Unit 2). Train B is common for both units and consists of one CCS pump and the associated valves, piping, instrumentation and Heat Exchanger C.

Each unit has a CCS pump (1A-A for Unit 1 and 2A-A for Unit 2) that is aligned to the respective unit's Train A header and receives electrical power from Train A. Each unit has another CCS pump (1B-B for Unit 1 and 2B-B for Unit 2) that can be aligned to the respective unit's Train B header and receives electrical power from Train B. These pumps (1B-B and 2B-B) are normally aligned to the Train A piping system for their respective unit. The C-S pump, which normally receives Train B electrical power while serving as the common Train B CCS pump, is capable of being powered from Train A.

During normal full power operation, with all CCS equipment available, CCS pumps 1A-A and 1B-B and Heat Exchanger A are aligned to Unit 1, ESF Train 1A and miscellaneous equipment. CCS pumps 2A-A and 2B-B and Heat Exchanger B are aligned to Unit 2, E1-6

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES ESF Train 2A and miscellaneous equipment. CCS pump C-S and Heat Exchanger C are aligned to both Unit 1 ESF Train 1B and Unit 2 ESF Train 2B equipment.

CCS pump 1B-B or CCS pump 2B-B can serve as a replacement or supplement for CCS Pump C-S. CCS pumps 1B-B and 2B-B, when normally aligned, provide backup to the Train A CCS pumps during normal operation to support RCP seal cooling. A specific alignment is proposed using CCS pump 1B-B or 2B-B to address the unlikely scenario of a LOCA occurring on Unit 2 when Unit 1 has been shut down less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and is being cooled by the RHR System. The new alignment is described in Section 4.1.2 below.

Essential Raw Cooling Water System The ERCW System is a safety-related system providing essential auxiliary support functions to the ESF equipment of the plant. The system is designed to supply cooling water to safety and non-safety related equipment. Provisions are made to ensure a continuous flow of cooling water to those systems and components necessary for plant safety either during normal operation or under accident conditions. Sufficient redundancy of piping and components is provided to ensure that cooling is maintained to vital loads at all times.

The ERCW System has eight pumps (four pumps per train). The major heat exchangers cooled by ERCW are the three CCS heat exchangers and four containment spray heat exchangers. Because an accident on both units is not assumed, only two containment spray heat exchangers would be in service at one time. For this submittal, because the loss of a power train is the condition being addressed, only one containment spray heat exchanger would be in service. Sufficient redundancy, separation and independence of piping and components are provided to ensure that cooling is maintained to vital loads at all times despite the occurrence of a random single active failure. A single active failure would not remove more than one supply train per unit (i.e., either headers 1A and 2A or headers 1B and 2B will always remain in service). The ERCW System is sufficiently independent, so that a single active failure of any one component in one train will not preclude safe plant operations of either unit. The safety-related portion of the ERCW System is designed such that total loss of either train, or a LOOP and the loss of an entire plant shutdown power train, will not prevent safe shutdown of either unit under any credible condition. The major heat load on the ERCW System during normal operation, including a unit shut down, is from the CCS heat exchangers. The highest normal operation ERCW System heat load occurs when one or both units are being shut down as RCS decay heat is being removed from the RHR heat exchangers supplied by CCS.

If a unit experiences a LOCA, the major heat loads on the ERCW System are the CCS and containment spray heat exchangers associated with the accident unit and the normal heat loads from the other unit.

Table 1 shows the normal RHR System, CCS, and ERCW System pump power alignments to specific 6.9 kV shutdown boards and diesel generators (DGs).

E1-7

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES Table 1 Pump/Power Alignment Unit 1 Unit 2 DG 1A-A DG 1B-B DG 2A-A DG 2B-B 6.9 kV SB 1A-A 6.9 kV SB 1B-B 6.9 kV SB 2A-A 6.9 kV SB 2B-B RHR Pump 1A-A RHR Pump 1B-B RHR Pump 2A-A RHR Pump 2B-B CCS Pump 1A-A CCS Pump 1B-B CCS Pump 2A-A CCS Pump 2B-B CCS Pump C-S (alt) CCS Pump C-S (nor)

ERCW Pump A-A ERCW Pump E-B ERCW Pump B-A ERCW Pump F-B ERCW Pump C-A ERCW Pump G-B ERCW Pump D-A ERCW Pump H-B SB - shutdown board 4.1.2 Postulated GDC 5 Event New TS 3.7.16 and TS 3.7.17 are being proposed to address a specific low probability of occurrence plant condition associated with CCS and ERCW heat removal capability.

The proposed change is being made to address an initial plant condition of Unit 1 being in a shutdown condition for less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and either in Mode 4 or Mode 5 with Unit 2 in Mode 1, 2, or 3 when a LOCA on Unit 2 is assumed to occur. The following discussion provides an example of the limiting case for the above scenario.

The assumption is that Unit 1 has been shut down for less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and is in Mode 4 or Mode 5 with cooldown proceeding on the RHR System after extended power operation. A LOCA is assumed to occur on Unit 2, also during an extended period of operation. Concurrent with the LOCA, offsite power is assumed to be lost, and a single failure occurs that results in the loss of an entire train of Class 1E alternating current (AC) power. Therefore, only two 6.9 kV shutdown boards, one associated with each unit, are assumed to be energized and are being powered by the associated DGs.

If the single active failure is the loss of Train B power, RHR Pump 1A-A would be running and circulating RCS water through the Unit 1 Train A RHR heat exchanger.

Decay heat removal from Unit 1 would be provided by CCS Pump 1A-A via CCS Heat Exchanger A. ERCW flow to CCS Heat Exchanger A would be provided by two of the four Train A ERCW pumps. Heat removal to the UHS from Unit 2, the LOCA unit, would not begin until switch over from ECCS injection with water provided by the RWST to recirculation from the containment sump. When Unit 2 RHR suction is automatically transferred to the sump, CCS pump 2A-A would provide water to the Unit 2 Train A RHR heat exchanger, with the decay heat removed via CCS Heat Exchanger B. CCS Heat Exchangers A and B are on the same ERCW header and are supplied cooling water by the same ERCW pumps. One of the ERCW pumps is powered by DG 1A-A and the other ERCW pump is powered by DG 2A-A. A short time later, the Unit 2 Train A containment spray pump would be realigned to the containment sump and ERCW flow would be established to the shell side of the Unit 2 Train A containment spray heat exchanger. Because there are two operable CCS pumps supplying CCS heat E1-8

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES exchangers being cooled by ERCW, a minimum of 5000 gallons per minute (gpm) of CCS flow could be supplied to the Unit 1 RHR heat exchanger and 5000 gpm could be supplied to the Unit 2 RHR heat exchanger. The normal CCS alignment provides sufficient decay heat removal so that both units may proceed to cold shutdown.

When the assumed single active failure is the loss of Train A power, RHR Pump 1B-B would be circulating RCS water through the Unit 1 Train B RHR heat exchanger. Decay heat removal from Unit 1 is normally provided by CCS Pump C-S using CCS Heat Exchanger C. Heat removal to the UHS from Unit 2, the LOCA unit, would not begin until switch over from ECCS injection using the RWST to recirculation from the containment sump. When Unit 2 RHR suction is automatically transferred to the sump, CCS Pump C-S would provide water to the Unit 2 Train B RHR heat exchanger with the decay heat removed via CCS Heat Exchanger C. Therefore, heat removal from both unit RHR heat exchangers would come from a single CCS pump and heat exchanger.

As described in TVAs letter to the NRC on June 12, 2014 (Reference 8), this scenario places too high a demand on CCS, if Unit 1 has not been shutdown for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

There are two approaches to address the situation. The first approach is to realign CCS Pump 1B-B or 2B-B from the A header to the B header before Unit 1 is cooled down to Mode 4 or Mode 5 within the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shut down. With two CCS pumps on the B header, CCS will supply at least 5000 gpm to the Unit 1 B Train RHR heat exchanger and 5000 gpm to the Unit 2 B Train RHR heat exchanger. When there are two CCS pumps on the B Train CCS header, Unit 1 would not need to return to Mode 3, should a LOCA occur on Unit 2, and cool down to Mode 5 can continue or be maintained. The second approach is to maintain Unit 1 in Mode 3 or Mode 4 with decay heat being removed through the steam generators for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

The alignment of either CCS Pump 1B-B or 2B-B to the B Train CCS header before entry into Mode 4 places both units in an alignment that supports LOCA heat removal requirements and allows the other unit to proceed to cold shutdown. Having the CCS pumps realigned while a unit being shut down with steam generators available for heat removal, precludes the need for manual action outside of the main control room to align CCS should a LOCA occur. If a LOCA occurs with the concurrent loss of the Train A 6.9 kV shutdown boards, CCS Pump 1B-B or 2B-B will be started from the main control room, if the pump is not already in operation. Both CCS pumps must be running before the RHR pump suction is transferred from the RWST to the containment sump to ensure adequate cooling is maintained. Should a LOCA occur, the C-S pump automatically starts on an SI actuation from either unit. The CCS pump control circuits are designed such that, if a pump is running and a loss of power occurs, the pump will be automatically reloaded on the DG. With this alignment, two CCS pumps will be available should a LOCA occur on one unit when the other unit is being shut down. Once 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> has passed since the unit shut down, the requirement to have two pumps aligned to the B CCS header is no longer required to provide sufficient heat removal capability.

Alternatively, the unit being shut down can remain on steam generator cooling for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> before RHR is placed in service. If a LOCA occurred on the other unit, CCS E1-9

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES would only be removing heat from one RHR heat exchanger. A single CCS pump and CCS heat exchanger provides the required heat removal capability.

Once 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> has passed after a unit shutdown, the CCS Pump C-S, CCS Heat Exchanger C, and two ERCW pumps provide sufficient heat removal capability that the shutdown unit cooldown can continue and the required heat load from the other unit can be removed assuming a LOCA has occurred, consistent with the safety analysis.

The ERCW System design was based on requiring two ERCW pumps to handle the cooling loads to the UHS for shutting down both units during either normal operation or in the event of a LOCA and the shut down of the non-accident unit. It has been determined, for the specific set of scenarios in this evaluation, that three ERCW pumps will be required if a cool down of the non-accident unit using RHR occurs within the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after a shutdown. If Unit 1 has been shut down and is on RHR cooling and a LOCA occurs on Unit 2 concurrent with a LOOP, the total ERCW flow required is approximately 21,850 gpm, assuming Train A power is lost, and approximately 22,400 gpm, assuming Train B power is lost. When Train A power is lost, ERCW is cooling CCS Heat Exchanger C and the Unit 2 Train B containment spray heat exchanger. If the assumed single failure is Train B power, ERCW is cooling CCS Heat Exchangers A and B and the Unit 2 Train A containment spray heat exchanger. The higher heat loads associated with continuing the cool down of the unit that has been shut down for less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, combined with the heat removal requirements of the safety analysis for the DBA LOCA via RHR and containment spray, necessitates the use of three ERCW pumps during the initial 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> time period. Once Unit 1 has been shut down for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or more, the total ERCW heat removal and thus, flow requirements, drop below the flowrate provided by two ERCW pumps.

Revised FSAR Sections 9.2.1 and 9.2.2 describing ERCW and CCS, respectively, (Reference 9) have been updated to include revised two and three pump flow rates and heat removal values consistent with the revised containment analyses and the results of the dual unit flow balance testing.

The plant is designed such that only one ERCW pump is loaded on each 6.9 kV shutdown board and respective DG. However, each 6.9 kV shutdown board and respective DG has sufficient capacity to power two ERCW pumps. During the postulated scenario, Unit 1 is not in an accident. Therefore, the SI pumps and containment spray pumps will not be running and will not be loaded on the Unit 1 DGs.

The Unit 1 motor-driven Auxiliary Feedwater (AFW) pumps are not assumed to be running as a result of the event, because Unit 1 is being cooled by RHR. As can be seen in Table 2, the horsepower requirements for one ERCW pump is less than any two of the other three pumps (AFW, containment spray, and SI). Table 3 provides the large motor horsepower loads on each DG for the combinations of a LOCA on one unit with the other unit cooled by RHR, concurrent with a single failure of either Train A or Train B power. Similarly, the total long term steady state DG loading for each combination is provided in Table 3. The load on the DG associated with the unit in shutdown assumes two ERCW pumps and two CCS pumps are being powered, and is lower than the load capability for a DG during a LOCA. Therefore, the DG capacity, as reviewed by the E1-10

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES NRC in SSER 23 (Reference 6), is not challenged and remains bounding. Reference 9 provided an update to FSAR Section 8.3 to denote the addition of the ERCW pump interlock bypass switch and that three ERCW pumps are required for the scenario discussed in this submittal.

The requirement to have two ERCW pumps running on one DG is required for the scenario of a LOCA on one unit and the other unit cooled by RHR within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of shutdown. The single failure of a loss of a train of power must also occur to require two ERCW pumps to be loaded on a single DG. Other single failures including the loss of a DG or a 6.9 kV shutdown board will not require two ERCW pumps to be loaded on a single DG. For dual unit shutdown cases without a LOCA, two ERCW pumps provide adequate heat removal irrespective of the single failure assumed, because no flow is required to a containment spray heat exchanger.

The ERCW System controls prevent the automatic loading of two ERCW pumps on a single DG. For each of the pairs of ERCW pumps powered from a 6.9 kV shutdown board, a pump selector switch allows the operations staff to choose which of the two pumps to have in service during normal operation. If one ERCW pump is in operation and powered by a DG, there is a second interlock that prevents the second ERCW pump from starting on that DG. These interlocks prevent the DG from being overloaded should an SI signal occur with the associated loading of the ECCS pumps on the DG.

Interlock bypass switches for the ERCW pumps are being added to each 6.9 kV shutdown board. These switches allow the operations staff to start a second ERCW pump on a DG, if necessary. The interlock bypass switches on the Unit 1 6.9 kV shutdown boards would be activated only in the event of a LOCA on Unit 2, concurrent with a LOOP and a single failure that results in the loss of both 6.9 kV shutdown boards on a power train. The only other scenario requiring two ERCW pumps to be loaded on one DG is for a 10CFR50 Appendix R fire. This requires manual operator action that is performed outside of the main control room. The 6.9 kV shutdown boards are located in close proximity to the main control room. A mission dose calculation has been prepared for this action, should it be required when either unit is experiencing a LOCA. The action is required to be performed within approximately 40 minutes from event initiation, when the containment spray pump suction is being transferred from the RWST to the containment sump. The action has been determined to be feasible because the location for the action is close to the main control room, there is adequate time to perform the action, the calculated mission dose is well within the 10 CFR 50, Appendix A, GDC 19 limits, the action will be procedurally controlled, and the environmental factors are acceptable. The activation of the interlock bypass switch does not cause the second ERCW pump to start. The second pump would be started from the main control room.

A design change notice has been issued to install the ERCW pump interlock bypass switches. The design change process also requires revision of the ERCW System Description to include the interlock switches and their post-accident use. When the system description is revised, the design process will also generate or revise the plant procedures that are impacted by the change. Similarly, a design change notice has been issued to revise the CCS design criteria to describe the alignment of a second E1-11

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES Train B CCS pump to the CCS Train B header. The following procedures will be affected:

General Operating Instruction GO-4, Normal Power Operation, Section 5.3, Unit Shutdown from 100% to 30% Reactor Power. Steps are being added to direct operators to the System Operating Instruction (SOI) for CCS to align a second CCS Train B pump to the CCS Train B Header and to verify that the required ERCW pumps are available.

General Operating Instruction GO-6, Unit Shutdown from Hot Standby to Cold Shutdown. Steps are being added to verify the CCS and ERCW availability and alignments.

Emergency Operating Instruction E-0, Reactor Trip or Safety Injection. Steps are being added to activate the ERCW interlock bypass switch and start the ERCW and CCS pumps as required.

System Operating Instruction SOI-70.01, Component Cooling Water (CCS)

System. This SOI does not require a revision because the steps to realign the CCS Train B pumps are currently in the procedure.

Reference 9 provided a revision to FSAR Section 6.3, Emergency Core Cooling Systems. Table 6.3-3 provides the steps taken when the ECCS and containment spray pump suctions are realigned from the RWST to the containment sump. The table also includes the actions taken to provide CCS flow to the RHR heat exchangers and ERCW flow to the CCS and containment spray heat exchangers. The valve actuations, both opening and closing, required for RHR realignment occur automatically. Providing CCS flow to the RHR heat exchanger requires opening valves from the main control room.

These actions are unchanged by this proposed amendment request. When there is a LOCA on one unit when the other unit is on RHR cooling but has been shut down for less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, concurrent with a LOOP and the loss of Train A power, the operator may need to start the second CCS pump aligned to the CCS Train B header. If CCS Pump 1B-B is the second pump aligned to the B header, and CCS Pump C-S is in service, a main control room operator would need to start the pump. If CCS Pump 2B-B is in service and the CCS Pump C-S is in standby or in the other possible alignments of CCS pumps on the CCS Train B header, operator action would not be required to have two pumps running.

E1-12

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES Table 2 - Brake Horsepower Normal / LOCA Brake Pump Horsepower (HP) Calculated AFW (motor-driven) 600/300 Containment Spray 596 RHR 370/440 SI 460 Centrifugal Charging 532/695 ERCW 805/805 CCS 360/378 E1-13

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES Table 3 Summary of Steady-State DG Loading with 3 ERCW Pumps (>20 mins)

Pumps U1 LOCA / U2 Shutdown / U2 LOCA / U1 Shutdown / U1 LOCA / U2 Shutdown / U2 LOCA / U1 Shutdown /

Loss of Train A Loss of Train A Loss of Train B Loss of Train B DG 1A 2A 1B 2B 1A 2A 1B 2B 1A 2A 1B 2B 1A 2A 1B 2B ERCW 805 1610 1610 805 805 1610 1610 805 CCS 378 720 378 720 378 378 378 378 AFW (motor- 300 300 300 300 driven)

Containment 596 596 596 596 Spray Centrifugal 695 532 532 695 695 532 532 695 Charging SI 460 460 460 460 RHR 440 370 370 440 440 370 370 440 Total / Large 3674 3232 2890 4016 3674 2890 2890 3674 Motor Load (HP)

Pressurizer 500 500 500 500 Heaters (kW)

Total DG 3983 4015 3941 4096 4065 3927 3981 3950 Loading (kW) kVA 4592 4514 4462 4687 4673 4401 4513 4529 Note: Refer to Table 1 for CCS and ERCW pump power alignments.

E1-14

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES 4.2 TSTF-273-A, Revision 2 The proposed changes are based on TSTF-273, Revision 2, SFDP Clarifications.

TSTF-273 changes the limiting condition for operation (LCO) 3.0.6 Bases to provide a clarification of appropriate LCO for loss of function and clarifies the requirements in TS 5.7.2.18, Safety Function Determination Program (SFDP), so that consideration does not have to be made for a loss of power in determining loss of function.

Specifically, the following changes are proposed:

Add discussion to LCO 3.0.6 Bases to clarify when a support systems TS action requirements provide sufficient remedial measures, so that entry into a supported systems action requirements is not required, even though the inoperable support system would prevent the supported system from performing its safety function.

Revise the first sentence of the second paragraph of TS 5.7.2.18 by adding the language indicated in bold type face below:

A loss of safety function exists when, assuming no concurrent single failure, no concurrent loss of offsite power, or no concurrent loss of onsite diesel generator(s), a safety function assumed in the accident analysis cannot be performed.

Revise the third paragraph of TS 5.7.2.18 by adding the sentence indicated in bold type face below:

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered. When a loss of safety function is caused by the inoperability of a single Technical Specification support system, the appropriate Conditions and Required Actions to enter are those of the support system.

Improved Standard Technical Specification (ISTS) LCO 3.0.2 and Unit 1 TS LCO 3.0.2 both require performing applicable required actions upon discovery that the associated LCO is not met. The ISTS and Unit 1 TS definitions of operability both require necessary support systems to be operable in order to consider the supported system operable. Therefore, per LCO 3.0.2 and the definition of operability, when a necessary specified support system is inoperable, the systems it supports are also inoperable and the licensee would be required to implement the applicable required actions of the supported system specifications, as well as those of the support system specification.

However, when a specified support system is inoperable, the ISTS and the Unit 1 TS usually specify sufficient required actions in the support system specification, so that implementation of supported system specification required actions is unnecessary to ensure safety. Because of this, the ISTS and Unit 1 TS contain a general exception to LCO 3.0.2, and do not require entering conditions and required actions of supported system specifications when a specified support system is inoperable (unless otherwise E1-15

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES stated in the support system specification). This general exception to LCO 3.0.2 is contained in LCO 3.0.6, which states:

When a supported system LCO is not met solely due to a support system LCO not being met, the Conditions and Required Actions associated with this supported system are not required to be entered. Only the support system LCO ACTIONS are required to be entered. This is an exception to LCO 3.0.2 for the supported system.

In this event, additional evaluations and limitations may be required in accordance with Specification 5.7.2.18, Safety Function Determination Program (SFDP). If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

When a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

The required actions for specified support systems, though adequate when no other safety systems are inoperable, usually do not consider the possibility that other specified safety systems (both support and supported) in the redundant train are inoperable. If a system in one train is already inoperable when a support system in the opposite train becomes inoperable, a loss of function condition may exist. Accordingly, LCO 3.0.6 requires an evaluation for this condition in accordance with the SFDP whenever a support system LCO is not met.

TSTF-273 clarified the application of LCO 3.0.6 in the event a certain kind of LCO is not met. Some support systems in TS, such as the RWST and the UHS, lack redundancy and support both trains of several safety systems. Not meeting such LCOs would render the supported systems incapable of fully performing their specified safety functions. In this situation, the SFDP and LCO 3.0.6 could be incorrectly interpreted as requiring implementation of the applicable required actions of all affected supported system specifications. However, in this condition, the intent of LCO 3.0.6 is to only require implementation of the applicable required actions of the support system specification.

This is appropriate because the specified action requirements for these kinds of support systems adequately account for the reduced capability of the associated supported systems to perform their specified safety functions. TSTF-273 accomplished this clarification of LCO 3.0.6 with the previously described changes to the Bases for LCO 3.0.6 and TS 5.7.2.18. This clarification of the intent of LCO 3.0.6 is acceptable, because implementing the action requirements for such support systems provides an adequate assurance of safety, which is at least equivalent to that provided by the action requirements for the affected supported systems, and avoids the additional complication of initiating entry into multiple specifications for the inoperability of a single specified support system component.

TSTF-273 also clarified the application of LCO 3.0.6 and TS 5.7.2.18 in the event the AC sources LCO is not met. The required actions for an inoperable offsite or onsite AC E1-16

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES source includes checking for a loss of function condition, and specifies appropriate actions to take should a loss of function condition exist. These actions are adequate to address loss of function conditions involving AC sources. Therefore, in such cases, the LCO 3.0.6 check for loss of function is redundant and unnecessary. However, as written, Unit 1 TS 5.7.2.18 can be interpreted as requiring this check even though it is redundant. To preclude this interpretation, TSTF-273 changed TS 5.7.2.18 for the SFDP, as described previously, to explicitly exclude the assumption of a concurrent inoperable AC source from the loss of function definition. This change only clarifies the intent of the existing requirements of the SFDP and LCO 3.0.6. Therefore, it is an administrative change and is acceptable.

There are no differences between the proposed change and the approved traveler and there are no differences between the plant specific justification and the approved traveler justification.

5.0 REGULATORY EVALUATION

5.1 Applicable Regulatory Requirements and Criteria 5.1.1 TS 3.7.16 and TS 3.7.17 Per GDC 5, structures, systems, and components may only be shared when it can be shown that such sharing does not significantly impair their ability to perform their safety functions, including in the event of an accident on one unit, and an orderly shutdown and cooldown of the other unit.

The proposed changes described in this TS amendment request improve the ability of the plant to meet this requirement. The changes provide additional decay heat removal capability for a limiting set of plant conditions when both units are on RHR cooling in the event of a LOCA on one unit while the other unit is being cooled down. Unit 1 continues to comply with the following applicable regulations and requirements:

10 CFR 50, Appendix A, GDC 5, Sharing of structures, systems, and components.

10 CFR 50, Appendix A, GDC 16, Containment design, specifies that the containment is an essentially leak-tight barrier to prevent the uncontrolled release of radioactivity to the environment and that containment design conditions important to safety are maintained.

10 CFR 50, Appendix A, GDC 34, Residual heat removal, specifies that fission product decay heat and residual heat are removed at a rate such that fuel design limits and the reactor coolant pressure boundary limits are maintained, and the system safety function is maintained assuming a loss of offsite power and a single failure.

E1-17

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES 10 CFR 50, Appendix A, GDC 38, Containment heat removal, specifies the containment pressure and temperature are rapidly reduced consistent with the functioning of other associated systems following a LOCA and maintains them at acceptably low levels.

5.1.2 TSTF-273-A, Revision 2, Safety Function Determination Program Clarifications The proposed changes to the LCO 3.0.6 Bases and TS 5.7.2.18 were developed by the Technical Specification Task Force as TSTF-273, Revision 2. This TSTF was approved by the NRC on August 16, 1999. The proposed changes to the LCO 3.0.6 Bases provided a clarification of appropriate LCO for loss of function and clarified in the requirements for the SFDP that consideration for a loss of power in determining loss of function did not have to be made.

The following discussion was provided with TSTF-273-A, Revision 2:

NUREG -1431 was developed such that the Actions for a single support system inoperability would be addressed by that support system's Actions - without cascading to the supported system; even if both trains of the support system were inoperable resulting from a loss of function. This intent is clarified in the LCO 3.0.6 Bases. Without this clarification, supported systems with a single support system (such as both Containment Spray and ECCS trains supported by the Refueling Water Tank) would be declared inoperable when the support system is inoperable under the provisions of LCO 3.0.6 even though the support system Actions were designed to provide the appropriate response.

Also NUREG-1431 was developed with the appropriate "loss of function" (i.e.,

cross-train) check for electrical power inoperabilities contained within the LCO 3.8.1 Actions, without reliance on the SFDP. The NUREG-1431 Bases for LCO 3.8.1, Required Actions A.2 and B.2 (last paragraph in each) were added during development to attempt to clarify this issue. The clarification is added to the requirements for the SFDP, consistent with the intent of the NUREG-1431.

The same wording in NUREG-1431 (ISTS) Bases for LCO 3.8.1, Required Actions A.2 and B.2 is provided in the Unit 1 TS Bases for LCO 3.8.1, Required Actions A.2 and B.2.

The revised wording documents positions used in determining loss of function. The proposed changes do not add new positions or redefine the positions. The proposed changes add clarity.

5.2 Precedent 5.2.1 Component Cooling Water and Essential Raw Cooling Water TVA did not identify any applicable regulatory precedence with respect to the changes proposed in this license amendment request for CCS and ERCW.

E1-18

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES 5.2.2 TSTF-273-A, Revision 2, Safety Function Determination Program Clarifications TSTF-273-A, Revision 2, was approved by the NRC as documented in a letter from William Beckner (NRC) to James Davis (NEI), dated August 16, 1999. TSTF-273-A, Revision 2, was incorporated into NUREG-1431, Standard Technical Specifications, Westinghouse Plants, Revision 2, and has been adopted by many plants as part of a complete conversion to the ISTS, such as North Anna Power Station (ADAMS Accession Number ML021200265). Examples of plant-specific NRC approval of the changes in TSTF-273-A, Revision 2, include Duane Arnold Energy Center Amendment No. 258, dated May 12, 2005 (ADAMS Accession Number ML051110692) and Susquehanna Steam Electric Station, Units 1 and 2, Amendment Nos. 209/183 dated February 25, 2003 (ADAMS Accession Number ML030560811).

5.3 Significant Hazards Consideration 5.3.1 Component Cooling Water and Essential Raw Cooling Water The Tennessee Valley Authority (TVA) proposes to revise the current licensing basis of Facility Operating License No. NFP-90 for the Watts Bar Nuclear Plant (WBN) Unit 1 by revising the WBN Unit 1 Technical Specifications (TS) to add new TS 3.7.16, Component Cooling System (CCS) - Shutdown, and TS 3.7.17, Essential Raw Cooling Water (ERCW) System - Shutdown, to support dual unit operation of WBN Units 1 and 2, and continue to meet the 10 CFR 50, Appendix A, General Design Criterion 5 requirements of mitigating an accident in one unit and the orderly shutdown and cooldown of the other unit.

TVA has concluded that the changes to WBN Unit 1 TS 3.7.16 and TS 3.7.17 do not involve a significant hazards consideration. TVAs conclusion is based on its evaluation in accordance with 10 CFR 50.91(a)(1) of the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequence of an accident previously evaluated?

Response: No.

The likelihood of a malfunction of any systems, structures or components (SSCs) supported by CCS and ERCW is not significantly increased by adding new TS for ERCW and CCS that require alternate CCS and ERCW system alignments during the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shut down of a unit when the steam generators are not available for heat removal. CCS and ERCW provide the means for transferring residual and decay heat to the Residual Heat Removal (RHR)

System for process and operating heat from safety related components during a transient or accident, as well as during normal operation. Although the proposed change includes a design change to allow two ERCW pumps to be powered from one diesel generator (DG), the additional ERCW pump is only aligned to the DG on a non-accident unit during a design basis event on the other unit, and does E1-19

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES not result in overloading the DG due to the reduced loading on the non-accident DG. The CCS and ERCW are not initiators of any analyzed accident. All equipment supported by CCS and ERCW has been evaluated to demonstrate that their performance and operation remains as described in the FSAR with no increase in probability of failure or malfunction.

The SSCs credited to mitigate the consequences of postulated design basis accidents remain capable of performing their design basis function. The change in CCS and ERCW system alignments has been evaluated to ensure the RHR System remains capable of removing normal operating and post-accident heat.

Additionally, all the CCS and ERCW supported equipment, credited in the accident analysis to mitigate an accident, has been shown to continue to perform their design function as described in the FSAR.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated. The proposed change does not introduce any new modes of plant operation, change the design function of any SSC, or change the mode of operation of any SSC. There are no new equipment failure modes or malfunctions created as the affected SSCs continue to operate in the same manner as previously evaluated and have been evaluated to perform their safety functions when in the alternate alignments as assumed in the accident analysis. Additionally, accident initiators remain as described in the FSAR and no new accident initiators are postulated as a result of the alternate CCS and ERCW alignments.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed change continues to ensure that the cooling capability of RHR during normal operation and during the mitigation of a design basis event remains within the evaluated equipment limits and capabilities assumed in the accident analysis. The proposed change does not result in any changes to plant equipment functions, including setpoints and actuations. The proposed change does not alter existing limiting conditions for operation, limiting safety system E1-20

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES settings, or safety limits specified in the Technical Specifications. The proposed change to add a new TS for ERCW and CCS assures the ability of these systems to support post-accident residual heat removal.

Therefore, since there is no adverse impact of this change on the Watts Bar Nuclear Plant safety analysis, there is no significant reduction in the margin of safety of the plant.

5.3.2 TSTF-273-A, Revision 2, Safety Function Determination Program Clarifications TVA has evaluated whether or not a significant hazards consideration is involved with the proposed amendment to TS 5.7.2.18 by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequence of an accident previously evaluated?

Response: No.

The proposed TS changes add explanatory text to the programmatic description of the Safety Function Determination Program (SFDP) in TS 5.7.2.18 to clarify the requirements that consideration does not have to be made for a loss of power in determining loss of function. The Bases for LCO 3.0.6 is revised to provide clarification of the appropriate LCO for loss of function, and that consideration does not have to be made for a loss of power in determining loss of function.

The changes are editorial and administrative in nature, and therefore do not increase the probability of any accident previously evaluated. No physical or operational changes are made to the plant. The proposed changes do not change how the plant would mitigate an accident previously evaluated.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed changes are editorial and administrative in nature and do not result in a change in the manner in which the plant operates. The loss of function of any specific component will continue to be addressed in its specific TS LCO, and plant configuration will be governed by the required actions of those LCOs.

The proposed changes are clarifications that do not degrade the availability or capability of safety related equipment, and therefore do not create the possibility of a new or different kind of accident from any accident previously evaluated.

There are no design changes associated with the proposed changes, and the changes do not involve a physical alteration of the plant (i.e., no new or different type of equipment will be installed). The changes do not alter assumptions made E1-21

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES in the safety analysis, and are consistent with the safety analysis assumptions and current plant operating practice. Due to the administrative nature of the changes, they cannot be an accident initiator. Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed changes to TS 5.7.2.18 are clarifications and are editorial and administrative in nature. No changes are made to the LCOs for plant equipment, the time required for the TS Required Actions to be completed, or the out of service time for the components involved. The proposed changes do not affect the safety analysis acceptance criteria for any analyzed event, nor is there a change to any safety analysis limit. The proposed changes do not alter the manner in which safety limits, limiting safety system settings or limiting conditions for operation are determined, nor is there any adverse effect on those plant systems necessary to assure the accomplishment of protection functions. The proposed changes will not result in plant operation in a configuration outside the design basis. Therefore, the proposed changes do not involve a significant reduction in a margin of safety.

5.4 Conclusions The design of the CCS and ERCW System conform to the requirements of GDC 5 for shared safety systems. The new TS 3.7.16, Component Cooling System (CCS) -

Shutdown, and new TS 3.7.17, Essential Raw Cooling Water (ERCW) System -

Shutdown, establish alignments for CCS and ERCW that, when Unit 1 has been shut down for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or less, is on RHR cooling, and the steam generators are not available for decay heat removal, ensure that the unit cool down to Mode 5 can continue, while mitigating a LOCA on Unit 2. The CCS and ERCW Shutdown TS provide the alignments necessary to support a dual unit cool down considering the limiting design basis assumptions for availability of offsite power and postulated single failures consistent with the safety analysis.

E1-22

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES

6.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment adds new TS for CCS and ERCW to support dual unit operation. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

7.0 REFERENCES

1. NUREG-0847, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Units 1 and 2, dated June 1982. [ADAMS Accession No. ML072060490]

2. Letter from TVA to NRC, Watts Bar Nuclear Plant (WBN) - Unit 2 - Reactivation of Construction Activities, dated August 3, 2007. [ADAMS Accession No. ML072190047]

3. Letter from NRC to TVA, Watts Bar Nuclear Plant, Unit 2 - Request for Additional Information Regarding Final Safety Analysis Report Amendment Related to Section 9.2 (TAC No. ME4074), dated September 17, 2010. [ADAMS Accession No. ML102510313]

4. Letter from TVA to NRC, Watts Bar Nuclear Plant (WBN) Unit 2 - Final Safety Analysis Report (FSAR) - Response to Requests for Additional Information, dated December 10, 2010. [ADAMS Accession No. ML103480708]

5. Letter from TVA to NRC, Watts Bar Nuclear Plant (WBN) Unit 2 - Final Safety Analysis Report (FSAR) - Response to Requests for Additional Information (RAIs)

Related to FSAR Sections 9.2.1 and 9.2.2, dated April 13, 2011.

[ADAMS Accession No. ML11104A059]

6. NUREG-0847 Supplement 23, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant Unit 2, dated July 2011.

7. NUREG-0847 Supplement 27, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant Unit 2, dated January 2015.

8. Letter from TVA to NRC, Watts Bar Nuclear Plant, Unit 2 - Request for Additional Information Regarding Final Safety Analysis Report Amendment Related to Section 9.2, Component Cooling System, dated June 12, 2014.

9. Letter from TVA to NRC, Watts Bar Nuclear Plant Unit 2 - Shutdown Technical Specifications for Component Cooling System and Essential Raw Cooling Water System to Support Dual Unit Operation, dated June 17, 2015.

E1-23

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGES ATTACHMENTS - WBN Unit 1 TS and TS Bases 3.7.16 CCS-Shutdown - WBN Unit 1 TS and TS Bases 3.7.17 ERCW-Shutdown - WBN Unit 1 LCO 3.0.6 Bases and TS 5.7.2.18 Safety Function Determination Program, Mark-ups - WBN Unit 1 LCO 3.0.6 Bases and TS 5.7.2.18 Safety Function Determination Program, Clean-typed E1-24

ENCLOSURE 1 ATTACHMENT 1 WBN Unit 1 TS and TS Bases 3.7.16 CCS-Shutdown

CCS - Shutdown 3.7.16 3.7 PLANT SYSTEMS 3.7.16 Component Cooling System (CCS) - Shutdown LCO 3.7.16 Two CCS trains shall be OPERABLE with one pump powered from Train A and aligned to the Train A header, and two pumps powered from Train B and aligned to the Train B header.

APPLICABILITY: MODES 4 and 5.

---

NOTE------------------------------------------------

This LCO is not applicable for either of the following conditions:

a. More than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after entry into MODE 3 from MODE 1 or 2.

b. When complying with Required Actions to be in MODE 5.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One CCS train A.1 Verify two OPERABLE Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> inoperable in MODE 4. reactor coolant system (RCS) loops and one RCS loop in operation.

AND A.2 Verify Tavg > 200ºF. Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> B. One CCS train B.1 Initiate action to restore CCS Immediately inoperable in MODE 5. train to OPERABLE status.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.16.1 Verify correct breaker alignment and indicated power 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> available to the required pump(s) that is not in operation.

SR 3.7.16.2 Verify two CCS pumps are aligned to CCS Train B. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Watts Bar-Unit 1 3.7-33 Amendment XX

CCS - Shutdown B 3.7.16 BASES B 3.7 PLANT SYSTEMS B 3.7.16 Component Cooling System (CCS) - Shutdown BASES BACKGROUND The general description of the Component Cooling System (CCS) is provided in TS Bases 3.7.7, Component Cooling System. The CCS has a Unit 1 Train A header supplied by CCS Pump 1A-A cooled through CCS Heat Exchanger (HX) A. Unit 2 has a separate Train A header containing HX B supplied by CCS Pump 2A-A. The Train B header is shared by Unit 1 and Unit 2 and contains HX C. Flow through the Train B header is normally supplied by CCS Pump C-S. CCS Pump 1B-B can be aligned to supply the Train B header, but it is normally aligned to the Unit 1 Train A header. Similarly, CSS Pump 2B-B can supply cooling water to the Train B header, but is normally aligned to the Unit 2 Train A header. The following describes the functions and requirements within the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shut down, when the Residual Heat Removal (RHR) System is being used for residual and decay heat removal.

Entry into MODES 4 and 5 can place high heat loads onto the RHR System, CCS and the Essential Raw Cooling Water System (ERCW) when shutdown cooling is established. Residual and decay heat from the Reactor Coolant System (RCS) is transferred to CCS via the RHR HX.

Heat from the CCS is transferred to the ERCW System via the CCS HXs.

The CCS and ERCW systems are common between the two operating units.

During the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after reactor shutdown, the heat loads are at sufficiently high levels that the normal pump requirement of LCO 3.7.7 for one CCS pump on the Train B header may not be sufficient to support shut down cooling of Unit 1, concurrent with a design basis loss of coolant accident (LOCA) on Unit 2 with loss of offsite power and a single failure of Train A power to 6.9 kV Shutdown Boards 1A-A and 2A-A.

In this scenario, CCS Pump C-S would normally be the only pump supplying the Train B header. The Train B header would be supplying both the Unit 1 RHR Train B HX and the Unit 2 RHR Train B HX cooling the recirculating Emergency Core Cooling System (ECCS) water from the containment sump.

To assure that there would be adequate CCS flow to both units RHR Train B HXs, prior to placing RHR in service for Unit 1, either CCS Pump 1B-B or 2B-B would be aligned to the CCS Train B header.

(continued)

Watts Bar-Unit 1 B 3.7-78

CCS - Shutdown B 3.7.16 BASES BACKGROUND After Unit 1 has been shut down for greater than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, a single CCS (continued) pump on Train B provides adequate flow to both the Unit 1 and the Unit 2 RHR Train B HXs.

If the single failure were the loss of Train B power, the normal CCS alignment is acceptable, because CCS Pump 1A-A supplies the Unit 1 RHR Train A HX and CCS Pump 2A-A supplies the Unit 2 RHR Train A HX. CCS Pump 1A-A does not provide heat removal for Unit 2.

Additional information on the design and operation of the system, along with a list of the components served, is presented in the FSAR, Section 9.2.2 (Ref. 1). The principal safety related function of the CCS is the removal of heat from the reactor via the RHR System. This may be during a normal or post accident cool down and shut down.

The Unit 1 CCS Train A header is not used or required to support Unit 2 operation.

APPLICABLE The CCS functions to cool the unit from RHR entry conditions SAFETY (Tcold < 350F), to MODE 5 (Tcold < 200F), during normal operations. The ANALYSES time required to cool from 350F to 200F is a function of the number of CCS and RHR trains operating. One CCS train is sufficient to remove heat during subsequent operations with Tcold < 200F. This assumes a maximum ERCW inlet temperature of 85F occurring simultaneously with the maximum heat loads on the system.

The design basis of the CCS is for one CCS train to remove the post LOCA heat load from the containment sump during the recirculation phase, with a maximum CCS HX outlet temperature of 110F (Ref. 2).

The ECCS LOCA analysis and containment LOCA analysis each model the maximum and minimum performance of the CCS, respectively. The normal maximum HX outlet temperature of the CCS is 95F, and, during unit cooldown to MODE 5 (Tcold < 200F), a maximum HX outlet temperature of 110F is assumed. The CCS design based on these values, bounds the post accident conditions such that the sump fluid will not increase in temperature after alignment of the RHR HXs during the recirculation phase following a LOCA, and provides a gradual reduction in the temperature of this fluid as it is supplied to the RCS by the ECCS pumps.

The CCS is designed to perform its function with a single failure of any active component, assuming a loss of offsite power.

CCS - Shutdown satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

(continued)

Watts Bar-Unit 1 B 3.7-79

CCS - Shutdown B 3.7.16 BASES (continued)

LCO The CCS trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. During a unit shut down, one CCS train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCS must be OPERABLE.

At least one CCS train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.

This LCO provides CCS train OPERABILITY requirements beyond the requirements of LCO 3.7.7 during the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after reactor shut down, when the heat loads are at sufficiently high levels that the normal pump requirement of one CCS pump on the Train B header may not be sufficient to support shutdown cooling of Unit 1, concurrent with a LOCA on Unit 2, a loss of offsite power, and single failure of Train A power to 6.9 kV Shutdown Boards 1A-A and 2A-A.

Because CCS Train B supports heat removal from Unit 1 and Unit 2, when Unit 1 has been shutdown 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and the RHR System is relied on for heat removal, the following is required for CCS OPERABILITY:

a. Train A is OPERABLE when CCS Pump 1A-A is available and aligned to the CCS Train A header.

b. Train B is OPERABLE when two CCS pumps are available and aligned to the CCS Train B header using any combination of CCS Pumps 1B-B, 2B-B, and C-S.

c. The associated piping, valves, HXs, and instrumentation and controls required to perform the safety related function are OPERABLE.

Because Unit 1 is shutdown and on RHR cooling, no automatic actuations are required as a DBA on Unit 1, such as a LOCA, does not have to be mitigated.

APPLICABILITY Prior to aligning the RHR System for RCS heat removal in MODE 4, an additional CCS pump must be powered from and aligned to the CCS Train B header to ensure adequate heat removal capability.

The Applicability is modified by a Note stating the LCO does not apply after the initial 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after the unit enters MODE 3 from MODE 1 or MODE 2. Following extended operation in MODE 1, the heat loads are at sufficiently high levels that the normal pump requirement of LCO 3.7.7 for (continued)

Watts Bar-Unit 1 B 3.7-80

CCS - Shutdown B 3.7.16 BASES APPLICABILITY one CCS pump on the Train B header may not be sufficient to support (continued) shutdown cooling of Unit 1, concurrent with a design basis LOCA on Unit 2 with loss of offsite power and a single failure of Train A power to 6.9 kV Shutdown Boards 1A-A and 2A-A. However, after the initial 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> following unit shutdown, the heat removal capability of both units is within the capabilities of the CCS without the need for an additional CCS pump aligned to the CCS Train B header.

Additionally, per LCO 3.0.6 Bases, when operation is being restricted in accordance with ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Therefore, postulating the loss of Train A power to 6.9 kV Shutdown Boards 1A-A and 2A-A is not required when complying with the Required Actions to be in MODE 5, and the requirements for an additional CCS pump aligned to the CCS Train B header is not necessary.

ACTIONS A.1 and A.2 When one CCS train is inoperable, the associated RHR loop is also inoperable, and redundancy for decay heat removal is lost. In the event the other RHR loop becomes inoperable, the RHR System would be incapable of maintaining the unit in MODE 4. Therefore, in MODE 4, if one CCS train is inoperable, the requirements of LCO 3.4.6, RCS Loops

- MODE 4, must be met using two OPERABLE reactor coolant system (RCS) loops with one RCS loop in operation to ensure adequate heat removal to maintain the unit in MODE 4.

B.1 In MODE 5, if one CCS train is inoperable, action must be initiated immediately to restore the CCS train to an OPERABLE status to restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

SURVEILLANCE SR 3.7.16.1 REQUIREMENTS Verification that each required CCS pump that is not in operation is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain heat removal. Verification is performed by verifying proper breaker alignment and power available to the CCS pump(s). The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is based on engineering judgment.

(continued)

Watts Bar-Unit 1 B 3.7-81

CCS - Shutdown B 3.7.16 BASES SURVEILLANCE SR 3.7.16.2 REQUIREMENTS (continued) This SR verifies that two of the three CCS pumps that are powered from Train B are aligned to the Train B header. Verification of the correct physical alignment assures that adequate CCS flow can be provided to both the Unit 1 and Unit 2 RHR Train B HXs, if required. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is based on engineering judgment, is consistent with procedural controls governing valve alignment, and ensures correct valve positions.

REFERENCES 1. Watts Bar FSAR, Section 9.2.2, Component Cooling System.

2. Watts Bar Component Cooling System Description, N3-70-4002.

Watts Bar-Unit 1 B 3.7-82

ENCLOSURE 1 ATTACHMENT 2 WBN Unit 1 TS and TS Bases 3.7.17 ERCW-Shutdown

ERCW - Shutdown 3.7.17 3.7 PLANT SYSTEMS 3.7.17 Essential Raw Cooling Water (ERCW) System - Shutdown LCO 3.7.17 Two ERCW trains shall be OPERABLE as follows:

a. Three ERCW pumps aligned to Train A, including two pumps capable of being powered from 6.9 kV Shutdown Board 1A-A, and

b. Three ERCW pumps aligned to Train B, including two pumps capable of being powered from 6.9 kV Shutdown Board 1B-B.

APPLICABILITY: MODES 4 and 5.

---

NOTE------------------------------------------------

This LCO is not applicable for either of the following conditions:

a. More than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after entry into MODE 3 from MODE 1 or 2.

b. When complying with Required Actions to be in MODE 5.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ERCW train A.1 Verify two OPERABLE Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> inoperable in MODE 4. reactor coolant system (RCS) loops and one RCS loop in operation.

AND A.2 Verify Tavg > 200ºF. Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> B. One ERCW train B.1 Initiate action to restore Immediately inoperable in MODE 5. ERCW train to OPERABLE status.

Watts Bar-Unit 1 3.7-34 Amendment XX

ERCW - Shutdown 3.7.17 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.17.1 Verify correct breaker alignment and indicated 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> power available to the required pump(s) that is not in operation.

Watts Bar-Unit 1 3.7-35 Amendment XX

ERCW - Shutdown B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Essential Raw Cooling Water (ERCW) System BASES BACKGROUND The general description of ERCW is provided in TS Bases 3.7.8, Essential Raw Cooling Water (ERCW) System. The descriptions of Applicable Safety Analyses, LCOs, Applicability, ACTIONS and Surveillance Requirements for applicable MODES are also described in TS Bases 3.7.8. The following discussion applies to the specific Applicability in TS 3.7.17 during the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shut down when the Residual Heat Removal (RHR) System is being used for residual and decay heat removal. The ERCW System provides a heat sink for the removal of process and operating heat from safety related components during a design basis accident (DBA) or transient. During normal operation, and a normal shutdown, the ERCW System also provides this function for various safety related and non-safety related components.

The major post-accident heat load on the ERCW System is the Component Cooling System (CCS) heat exchangers (HXs), which are used to cool RHR and the containment spray HXs. The major heat load on the ERCW System when a unit is shut down on RHR is the CCS HX associated with the train(s) of RHR in service.

Normally, two ERCW pumps are sufficient to handle the cooling needs for maintaining one unit in normal operation while mitigating a DBA on the other unit. However, in the unlikely event of a loss of coolant accident (LOCA) on Unit 2 with a concurrent loss of offsite power and a single failure that results in the loss of both Train A or both Train B 6.9 kV shutdown boards while Unit 1 is on RHR shutdown cooling and has been shutdown for less than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, three ERCW pumps may be required.

This LCO controls the availability of ERCW pumps necessary to support mitigation of a LOCA on Unit 2 when Unit 1 has been shut down for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and is utilizing RHR for heat removal.

Additional information about the design and operation of the ERCW, along with a list of the components served, is presented in the FSAR, Section 9.2.1 (Ref. 1).

(continued)

Watts Bar-Unit 1 B 3.7-83

ERCW - Shutdown B 3.7.17 BASES (continued)

APPLICABLE The design basis of the ERCW System is for one ERCW train, in SAFETY conjunction with the CCS and a 100% capacity Containment Spray ANALYSES System and RHR, to remove core decay heat following a design basis LOCA as discussed in the FSAR, Section 9.2.1 (Ref. 1). This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System (RCS) by the Emergency Core Cooling System (ECCS) pumps.

The ERCW System is designed to perform its function with a single failure of any active component, assuming a loss of offsite power.

The ERCW System, in conjunction with the CCS, also cools the unit, as discussed in the FSAR, Section 5.5.7 (Ref. 2) from RHR entry conditions to MODE 5 during normal and post accident operations. The time required to enter MODE 5 is a function of the number of CCS and RHR System trains that are operating. One ERCW train is sufficient to remove heat during subsequent operations in MODES 5 and 6. This assumes a maximum ERCW inlet temperature of 85ºF occurring simultaneously with maximum heat loads on the system. In the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after the shutdown of Unit 1 assuming a DBA LOCA on Unit 2 with the loss of offsite power and the concurrent loss of two 6.9 kV shutdown boards on the same power train as a single failure. Three ERCW pumps are required to provide the heat removal capacity assumed in the safety analysis for Unit 2 while continuing the cooldown of Unit 1.

LCO This LCO provides ERCW train OPERABILITY requirements beyond the requirements of LCO 3.7.8. During the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after reactor shutdown, when the heat loads are at sufficiently high levels that the normal pump requirement of two ERCW pumps on one train may not be sufficient to support shutdown cooling of Unit 1, concurrent with a LOCA on Unit 2, an assumed loss of offsite power, and a single failure that affects both 6.9 kV shutdown boards in one power train.

Two ERCW trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to support a cooldown to MODE 5.

An ERCW train is considered OPERABLE during the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after shutdown when:

a. Two pumps per train, aligned to separate shutdown boards, are OPERABLE; and (continued)

Watts Bar-Unit 1 B 3.7-84

ERCW - Shutdown B 3.7.17 BASES LCO b. One additional Train A pump and one additional Train B pump are (continued) capable of being aligned to their respective Unit 1 6.9 kV shutdown board (1A-A and 1B-B) and manually placed in service.

APPLICABILITY Prior to aligning the RHR System for RCS heat removal in MODE 4, one additional ERCW pump must be capable of being powered by its respective Unit 1 6.9 kV shutdown board (1A-A and 1B-B) and manually placed in service to ensure adequate heat removal capability.

The Applicability is modified by a Note stating the LCO does not apply after the initial 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> after the unit enters MODE 3 from MODE 1 or MODE 2. Following extended operation in MODE 1, the heat loads are at sufficiently high levels that the normal pump requirement of LCO 3.7.8 for two ERCW pumps may not be sufficient to support shutdown cooling of Unit 1, concurrent with a design basis LOCA on Unit 2 with loss of offsite power and a single failure of Train A power to 6.9 kV Shutdown Boards 1A-A and 2A-A. However, after the initial 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> following unit shutdown, the heat removal capability of both units is within the capabilities of the ERCW System without the need for an additional ERCW pump in each train.

Additionally, per LCO 3.0.6 Bases, when operation is being restricted in accordance with ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Therefore, postulating the loss of Train A power to 6.9 kV Shutdown Boards 1A-A and 2A-A is not required when complying with the Required Actions to be in MODE 5, and the requirements for an additional ERCW pump in each train is not necessary.

ACTIONS A.1 and A.2 When one ERCW train is inoperable, the associated RHR loop is also inoperable, and redundancy for decay heat removal is lost. In the event the other RHR loop becomes inoperable, the RHR System would be incapable of maintaining the unit in MODE 4. Therefore, in MODE 4, if one ERCW train is inoperable, the requirements of LCO 3.4.6, RCS Loops - MODE 4, must be met using two OPERABLE reactor coolant system (RCS) loops with one RCS loop in operation to ensure adequate heat removal to maintain the unit in MODE 4. In addition, in order to ensure the RCS loops remain the principle method of heat removal, Tavg is verified to be > 200ºF once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. If the unit were allowed to enter MODE 5 (Tavg 200ºF) using RHR cooling and a LOCA occurred on Unit 2, the heat removal capacity of the remaining RHR loop may not be sufficient to maintain the unit in MODE 5, assuming a single failure.

(continued)

Watts Bar-Unit 1 B 3.7-85

ERCW - Shutdown B 3.7.17 BASES ACTIONS B.1 (continued)

In MODE 5, if one ERCW train is inoperable, action must be initiated immediately to restore the ERCW train to an OPERABLE status to restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

SURVEILLANCE SR 3.7.17.1 REQUIREMENTS Verifying the availability of the ERCW pumps provides assurance that adequate ERCW flow is provided for heat removal. Verification that each required ERCW pump that is not in operation is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal. Verification is performed by verifying proper breaker alignment and power available to the ERCW pump(s). The ERCW pump Interlock Bypass Switches do not need to be in Bypass in order to meet this SR. The associated ERCW pump Interlock Bypass Switch is positioned by procedure when the third ERCW pump in the respective train is required to be started. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is based on engineering judgment and is consistent with the procedural controls governing pump alignment.

REFERENCES 1. Watts Bar FSAR, Section 9.2.1, "Essential Raw Cooling Water."

2. Watts Bar FSAR, Section 5.5.7, "Residual Heat Removal System."

Watts Bar-Unit 1 B 3.7-86

ENCLOSURE 1 ATTACHMENT 3 WBN Unit 1 LCO 3.0.6 Bases and TS 5.7.2.18, Safety Function Determination Program, Mark-ups

Procedures, Programs, and Manuals 5.7 5.7 Procedures, Programs, and Manuals 5.7.2.16 Diesel Fuel Oil Testing Program (continued)

b. Other properties for ASTM 2D fuel oil are within limits within 31 days following sampling and addition to the 7 day storage tanks; and

c. Total particulate concentration of the fuel oil in each of the four interconnected tanks which constitute a 7 day storage tank is 10 mg/l when tested every 31 days in accordance with ASTM D-2276, Method A-2 or A-3.

5.7.2.17 (removed from Technical Specifications) 5.7.2.18 Safety Function Determination Program (SFDP)

This program ensures loss of safety function is detected and appropriate actions taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other appropriate actions may be taken as a result of the support system inoperability and corresponding exception to entering supported system Condition and Required Actions. This program implements the requirements of LCO 3.0.6. The SFDP shall contain the following:

a. Provisions for cross train checks to ensure a loss of the capability to perform the safety function assumed in the accident analysis does not go undetected;

b. Provisions for ensuring the plant is maintained in a safe condition if a loss of function condition exists;

c. Provisions to ensure that an inoperable supported system's Completion Time is not inappropriately extended as a result of multiple support system inoperabilities; and

d. Other appropriate limitations and remedial or compensatory actions.

(continued)

Watts Bar-Unit 1 5.0-23

Procedures, Programs, and Manuals 5.7 5.7 Procedures, Programs, and Manuals 5.7.2.18 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, no concurrent loss of offsite power, or no concurrent loss of onsite diesel generator(s), a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to the system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to the system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to the support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered. When a loss of safety function is caused by the inoperability of a single Technical Specification support system, the appropriate Conditions and Required Actions to enter are those of the support system.

5.7.2.19 Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50 Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide (RG) 1.163, Performance-Based Containment Leak-Test Program, dated September 1995.

The Fall 2007 end date for conducting the 10 year interval containment integrated leakage rate (Type A) test may be deferred up to 5 years but no later than Fall 2012.

The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 15.0 psig.

The maximum allowable containment leakage rate, La, at Pa, is 0.25% of the primary containment air weight per day.

(continued)

Watts Bar-Unit 1 5.0-24

LCO Applicability B 3.0 BASES (continued)

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the SRs.

An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.

LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system (continued)

Watts Bar-Unit 1 B 3.0-7

LCO Applicability B 3.0 BASES LCO 3.0.6 inoperability. However, it is not necessary to enter into the supported (continued) systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.

However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.

This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

Specification 5.7.2.18, "Safety Function Determination Program (SFDP),"

ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.

Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.

The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operation is being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and inoperable diesel generator(s) provide the necessary restriction for cross train inoperabilities. This explicit cross train verification for inoperable AC (continued)

Watts Bar-Unit 1 B 3.0-8

LCO Applicability B 3.0 BASES LCO 3.0.6 electrical power sources also acknowledges that supported system(s) are (continued) not declared inoperable solely as a result of inoperability of a normal or emergency electrical power source (refer to the definition of OPERABILITY).

When a loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g., loss of automatic start due to inoperable instrumentation, or loss of pump suction source due to low tank level) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately addresses the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple support systems, the appropriate LCO is the LCO for the supported system.

In cases where a non-TS support system has two redundant 100 percent capacity subsystems, each capable of supporting both TS trains, loss of one support system does not result in a loss of support for either train of TS equipment. Both TS systems remain operable, despite a loss of support function redundancy, because the TS definition of operability does not require a TS subsystems necessary support function to meet the single failure criterion. No TS limits duration of the non-TS support subsystem outage, even though the single-failure design requirement of the supported TS system is not met. Appropriate duration for a maintenance activity should be determined by assessing and managing risk in accordance with paragraph (a)(4) of 10CFR50.65, the maintenance rule. If inoperable for more than 90 days, the licensee would have to evaluate the maintenance configuration as a change to the facility under 10CFR50.59, including consideration of the single failure design criterion.

LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the plant. These special tests and operations are necessary to demonstrate select plant performance characteristics, to perform special maintenance activities, and to perform special evolutions.

Test Exception LCOs 3.1.9 and 3.1.10 allow specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS.

(continued)

Watts Bar-Unit 1 B 3.0-9

ENCLOSURE 1 ATTACHMENT 4 WBN Unit 1 LCO 3.0.6 Bases and TS 5.7.2.18, Safety Function Determination Program, Clean-typed

Procedures, Programs, and Manuals 5.7 5.7 Procedures, Programs, and Manuals 5.7.2.16 Diesel Fuel Oil Testing Program (continued)

b. Other properties for ASTM 2D fuel oil are within limits within 31 days following sampling and addition to the 7 day storage tanks; and

c. Total particulate concentration of the fuel oil in each of the four interconnected tanks which constitute a 7 day storage tank is 10 mg/l when tested every 31 days in accordance with ASTM D-2276, Method A-2 or A-3.

5.7.2.17 (removed from Technical Specifications) 5.7.2.18 Safety Function Determination Program (SFDP)

This program ensures loss of safety function is detected and appropriate actions taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other appropriate actions may be taken as a result of the support system inoperability and corresponding exception to entering supported system Condition and Required Actions. This program implements the requirements of LCO 3.0.6. The SFDP shall contain the following:

a. Provisions for cross train checks to ensure a loss of the capability to perform the safety function assumed in the accident analysis does not go undetected;

b. Provisions for ensuring the plant is maintained in a safe condition if a loss of function condition exists;

c. Provisions to ensure that an inoperable supported system's Completion Time is not inappropriately extended as a result of multiple support system inoperabilities; and

d. Other appropriate limitations and remedial or compensatory actions.

(continued)

Watts Bar-Unit 1 5.0-23

Procedures, Programs, and Manuals 5.7 5.7 Procedures, Programs, and Manuals 5.7.2.18 Safety Function Determination Program (SFDP) (continued)

A loss of safety function exists when, assuming no concurrent single failure, no concurrent loss of offsite power, or no concurrent loss of onsite diesel generator(s), a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and:

a. A required system redundant to the system(s) supported by the inoperable support system is also inoperable; or

b. A required system redundant to the system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to the support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered. When a loss of safety function is caused by the inoperability of a single Technical Specification support system, the appropriate Conditions and Required Actions to enter are those of the support system.

5.7.2.19 Containment Leakage Rate Testing Program A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50 Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide (RG) 1.163, Performance-Based Containment Leak-Test Program, dated September 1995.

The Fall 2007 end date for conducting the 10 year interval containment integrated leakage rate (Type A) test may be deferred up to 5 years but no later than Fall 2012.

The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 15.0 psig.

The maximum allowable containment leakage rate, La, at Pa, is 0.25% of the primary containment air weight per day.

(continued)

Watts Bar-Unit 1 5.0-24

LCO Applicability B 3.0 BASES (continued)

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the SRs.

An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.

LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system (continued)

Watts Bar-Unit 1 B 3.0-7

LCO Applicability B 3.0 BASES LCO 3.0.6 inoperability. However, it is not necessary to enter into the supported (continued) systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.

However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.

This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

Specification 5.7.2.18, "Safety Function Determination Program (SFDP),"

ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.

Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.

The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operation is being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and inoperable diesel generator(s) provide the necessary restriction for cross train inoperabilities. This explicit cross train verification for inoperable AC (continued)

Watts Bar-Unit 1 B 3.0-8 Revision 103

LCO Applicability B 3.0 BASES LCO 3.0.6 electrical power sources also acknowledges that supported system(s) are (continued) not declared inoperable solely as a result of inoperability of a normal or emergency electrical power source (refer to the definition of OPERABILITY).

When a loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g., loss of automatic start due to inoperable instrumentation, or loss of pump suction source due to low tank level) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately addresses the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple support systems, the appropriate LCO is the LCO for the supported system.

In cases where a non-TS support system has two redundant 100 percent capacity subsystems, each capable of supporting both TS trains, loss of one support system does not result in a loss of support for either train of TS equipment. Both TS systems remain operable, despite a loss of support function redundancy, because the TS definition of operability does not require a TS subsystems necessary support function to meet the single failure criterion. No TS limits duration of the non-TS support subsystem outage, even though the single-failure design requirement of the supported TS system is not met. Appropriate duration for a maintenance activity should be determined by assessing and managing risk in accordance with paragraph (a)(4) of 10CFR50.65, the maintenance rule. If inoperable for more than 90 days, the licensee would have to evaluate the maintenance configuration as a change to the facility under 10CFR50.59, including consideration of the single failure design criterion.

LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the plant. These special tests and operations are necessary to demonstrate select plant performance characteristics, to perform special maintenance activities, and to perform special evolutions.

Test Exception LCOs 3.1.9 and 3.1.10 allow specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS.

(continued)

Watts Bar-Unit 1 B 3.0-9 Revision 103

ENCLOSURE 2 NEW REGULATORY COMMITMENT

1. Submit WBN Unit 1 license amendment request for revised containment pressure analysis and ice condenser ice mass by July 10, 2015.