ML15296A052

Attachments 1 Through 9 - EP-RM-004 to Enclosure 3 to PLA-7399 Mark-up of Proposed Additional Changes Made to the SSES EAL Basis Document

ML15296A052
Person / Time
Site:	Susquehanna
Issue date:	10/15/2015
From:	Franke J Susquehanna, Talen Energy
To:	Office of Nuclear Reactor Regulation
Shared Package
ML15296A048	List: ML15296A050 ML15296A052 ML15296A053 PLA-7399, Proposed Additional Changes to the SSES Emergency Plan Basis Document Since Submittal of Response to NRC Request for Additional Information PLA-7399
References
PLA-7399
Download: ML15296A052 (114)

Text

Attachment 1 EP-RM-004 Revision [X]

Page 175 of 288 Category: S - System Malfunction Subcategory: 1 - Loss of Essential AC Power Initiating Condition: Loss of all offsite AC power capability to essential buses for 15 minutes or longer EAL:

SUI.1 Unusual Event Loss of ALL offsite AC power capability to ALL 4.16 kV ESS buses on EITHER unit (Table S-5) for

_>15 min. (Note 1)

Note 1: The ED/RM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

[ Table S-5 AC 4.16 kV ESS buses Unit 1:

• 1A201

• 1A202

• 1A203

• 1A204 Unit 2:

• 2A201

• 2A202

• 2A203

• 2A204 Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Basis:

The Class 1 E 4.16 kV system supplies all the Engineered Safety Feature (ESE) loads and other loads that are needed for a safe and orderly plant shutdown, and for keeping the plant in a safe shutdown condition. See Figure S-1 (ref. 1, 2)The eight Class lE 4.16 kV ESS Buses 1(2)A through 1(2)D receive power from either the four ESS 13.8/4.16 kV transformers or the diesel generators (A, B, C, D and additional diesel generator E). Buses 1A-1D supply Unit 1 and common loads and Buses 2A-2D supply Unit 2 loads. This configuration prevents a loss of all ESS Buses for one unit in the event one of the ESS Transformers is lost.

Page 145 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 176 of 288 During normal plant operation, ESS Transformer 101 supplies preferred power to ESS Bus 1A and 2A and is an alternate power supply to ESS bus 10 and 2D. ESS Transformer 111 supplies preferred power to ESS Bus 1 C and 20, and is an alternate power supply to ESS bus 1 B and 2B. ESS Transformer 201 supplies preferred power to ESS Bus 10 and 20, and is an alternate power supply to ESS bus 1A and 2A. ESS Transformer 211 supplies preferred power to ESS Bus 1 B and 2B, and is an alternate power supply to ESS bus 10 and 20.

On a loss of a preferred power source, the bus rapidly transfers to the alternate power source to maintain component power. If both the preferred and alternate power sources are lost, the associated standby diesel generator connects to the ESS bus. (ref. 2-6)

The 15-minute interval was selected as a threshold to exclude transient or momentary power losses.

This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency buses. This condition represents a potential reduction in the level of safety of the plant.

For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emergency buses, whether or not the buses are powered from it.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.

Escalation of the emergency classification level would be via IC SAl.

Basis Reference(s):

1. FSAR Section 8.20Offsite Power System

2. FSAR Section 8.30Onsite Power System

3. Technical Specifications 3.8.1 AC Sources - Operating

4. Technical Specifications 3.8.7 Distribution System - Operating

5. ON-i104 (204)-001 Units 1(2) Response to Loss of All Offsite Power

6. EO-100 (200)-030 UNIT 1(2) Response to Station Blackout

7. NEI 99-01 SU1 Page 146 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 177 of 288 Figure S-I ESS 13.8/4.16 kV Transformers and Distribution (ref. 1)

/

MONTOU MOUNTA 1FR (H1' ' S/U TRANS T-20 S*

T1 0) 12 T"-201 ESS201 0X203 oF j1'-211 ESS211

"~0X213 Page 147 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 178 of 288 Category: S - System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all vital DC power for 15 minutes or longer EAL:

SS2.1 Site Area Emergency Indicated voltage is < 105 VDC on ALL of the following vital 125 VDC main distribution buses on the affected unit for _Ž15 min. (Note 1):

• 1D612 (2D612)

• 10622 (20622)

• 10632 (20632)

• 10642 (20642)

Note 1: The EDIRM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

The Class 1 E Battery Banks are 1 (2)0610 (Channel A), 1 (2)0620 (Channel B3), 1 (2)0630 (Channel C), and 1(2)0640 (Channel 0). Each bank consists of 60 cells connected in series.

Each cell produces a nominal voltage of 2.06 VDC resulting in a total battery bank terminal voltage of 123.6 VOC. All battery banks are designed to supply power to its load center for four hours in the event of a loss of power from its battery charger (ref. 1-3).

105 VDC is the minimum design voltage limit (ref. 4).

Indicated voltage for the vital 125 VOC main distribution buses is local only. Local voltage indication is available for each bus based on dispatching a field operator in accordance with Control Room alarm response procedure AR-1(2)06-001 (A12,B312,C12,D12). The 15 minute classification clock begins upon receipt of the 125V DC Panel System Trouble alarm in the Control Room. If battery voltage cannot be verified to be greater than or equal to 105 VOC within the 15 minutes, emergency classification must be made under this EAL.

This IC addresses a loss of vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Escalation of the emergency classification level would be via ICs RG1, FG1 or SG1.

Basis Reference(s):

Page 148 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 179 of 288

1. FSAR Section 8.3.2 DC Power Systems

2. Susquehanna Drawing No. E107159, Sheet 1, "Single Line Meter & Relay Diagram 125 VDC, 250 VDC & 120 VAC Systems"

3. Technical Specifications 3.8.5 DC Sources - Shutdown

4. ON-102(202)-610, -620, -630, -640 Loss of 125V DC

5. AR-i1(2)06-001 Main Turbine/Generator, Computer HVAC, Instrument AC, 24V DC, 125V DC, 250V DC Panel 2C651

6. NEI 99-01 SS8 Page 149 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 180 of 288 Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress EAL:

SA3.1 Alert An UNPLANNED event results in the inability to monitor one or more Table S-I parameters from within the Control Room for _>15 min. (Note 1)

AND Any significant transient is in progress, Table S-2 Note 1: The ED/RM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-I Safety System Parameters

• Reactor power

• RPV water level

• RPV pressure

• Primary Containment pressure

• Suppression Pool water level

• Suppression Pool temperature Table S-2 Significant Transients

• Reactor scram

• Runback > 25% reactor power

• RRC pump trip while > 25% reactor power

• ECCS injection

• Thermal power oscillations > 10%

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Page 150 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 181 of 288 Basis:

SAFETY SYSTEM parameters listed in Table S-1 are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems.

The Plant Process Computer (PPC) and SPDS are redundant compensatory indication which may be utilized in lieu of normal Control Room indicators (ref. 1, 2).

Significant transients are listed in Table S-2 and include response to automatic or manually initiated functions such as scrams, runbacks involving greater than 25% thermal power change, RRC pump trip while > 25% reactor power, ECCS injections, or thermal power oscillations of 10% or greater.

This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, RPV level and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for RPV water level cannot be determined from the indications and recorders on a main control board,.

the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via ICs FS1 or IC RS1 Basis Reference(s):

1. FSAR Section 18.1.17 Plant Safety Parameter Display System

2. OP-I131(231 )-002 Plant Computer Systems

3. EO-000-102 RPV Control Page 151 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 182 of 288

4. EO-000-103 Primary Containment Control

5. NEI 99-01 SA2 Page 152 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 183 of 288 Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: uNPLANNED loss of Control Room indications for 15 minutes or longer EAL:

SU3.1 Unusual Event An UNPLANNED event results in the inability to monitor one or more Table S-I parameters from within the Control Room for _>15 min. (Note 1)

Note 1: The ED/RM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

[Table S-I Safety System Parameters

• Reactor power

• RPV water level ,

• RPV pressure

• Primary Containment pressure

• Suppression Pool water level

• Suppression Pool temperature Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

SAFETY SYSTEM parameters listed in Table S-I are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems.

The Plant Process Computer (PPC) and SPDS are redundant compensatory indication which may be utilized in lieu of normal Control Room indicators (ref. 1, 2).

This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor Page 153 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 184 of 288 power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, RPV level and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for RPV water level cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via IC SA3.

Basis Reference(s):

1. FSAR Section 18.1.17 Plant Safety Parameter Display System

2. OP-131(231)-002 Plant Computer Systems

3. E=O-000-102 RPV Control

4. EO-000-103 Primary Containment Control

5. NEI 99-01 SU2 Page 154 of 185

Attachment 1 EP-RM-004 Revision IX]

Page 185 of 288 Category: S - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits EAL:

SU4.1 Unusual Event Offgas pretreatment monitor high-high radiation alarm Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

The Offgas Pretreatment RMS monitors radioactivity in the Offgas system downstream of the Motive Steam Jet Condenser. The monitor detects the radiation level that is attributable to the fission gases produced in the reactor and transported with steam through the turbine to the condenser (ref. 1). Log rad monitors and trip auxiliary units are located on Panel 10604 in the Upper Relay Room. Instrument Channel 'A' is RITS-D12-1K601A and Instrument Channel 'B' is RITS-D12-1 K601B. Both channels output to Yokagowa Recorder RR-D12-1 R601 on Main Control Room Panel 10600 (ref. 2, 3).

OFEGAS HI-HI RADIATION (AR-I106-F03) is located on Panel 1 C651. The setpoint is variable based on surveillance procedure (ref. 4).

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category R ICs.

Basis Reference(s):

1. ESAR Section 11.5 Process and Effluent Radiological Monitoring and Sampling Systems

2. Technical Specification 3.7.5 Main Condenser Offgas

3. AR-106(206)-001 F03 Offgas Hi Hi Radiation

4. SC-143(243)-101 Unit 1 (Unit 2) Main Condenser Air Ejector Monthly Noble Gas Activity

5. OP-179(279)-002 Process Radiation Monitoring System

6. NEI 99-01 SU3 Page 155 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 186 of 288 Category: S - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits EAL:

SU4.2 Unusual Event Coolant activity > 0.2 pCi/gm dose equivalent 1-131 for > 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR Coolant activity > 4.0 puCi/gm dose equivalent 1-131 at any time Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

The specific iodine activity is limited to *<0.2 IpCi/gm dose equivalent 1-131 (Condition A) with a completion time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. This limit ensures the source term assumed in the safety analysis for the Main Steam Line Break (MSLB) is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the regulatory limits (ref. 1).

The upper limit of 4.0 IpCi/gm dose equivalent 1-131 (Condition B) ensures that the TEDE dose from an MSLB will not exceed the dose guidelines of 10 CFR 50.67 or Control Room operator dose limits specified in GDC 19 of 10 CER 50, Appendix A (ref. 1).

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category R ICs.

Basis Reference(s):

1. Technical Specifications section 3.4.7 RCS Specific Activity

2. NE! 99-01 SU3 Page 156 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 187 of 288 Category: S - System Malfunction Subcategory: 5 - RCS Leakage Initiating Condition: RCS leakage for 15 minutes or longer EAL:

8U5.1 Unusual Event RCS unidentified or pressure boundary leakage > 10 gpm for >15 min.

OR RCS identified leakage > 25 gpm for _>15 min.

OR Leakage from the RCS to a location outside Primary Containment > 25 gpm for >_15 min.

(Note 1)

Note 1: The EDIRM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Leakage is monitored by utilizing the following techniques (ref. 1):

• Monitoring changes in water level in the drywell floor drain sumps and drywell equipment drain tank

• Sensing excess flow in piping systems

• Sensing pressure and temperature changes in the primary containment

• Monitoring for high flow and temperature through selected drains,

• Sampling airborne particulate and gaseous radioactivity.

Identified leakage is leakage into the drywell, such as that from pump seals or valve packing, that is captured and conducted to the drywell equipment drain tank; or leakage into the drywell atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary Unidentified leakage is all leakage into the drywell that is not identified leakage (ref. 2).

Pressure boundary leakage is leakage through a nonisolable fault in a Reactor Coolant System (RCS) component body, pipe wall, or vessel wall (ref. 2).

Two drywell floor drain sumps are located in the primary containment for collection of leakage from vent coolers, control rod drive flange leakage, chilled water drains, cooling water drains, Page 157 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 188 of 288 and overflow from the drywell equipment drain tank. The drywell floor drain sumps are located at the drywell diaphragm slab low point. Unidentified leakages will, by gravity, flow down the slab surface into the floor drain sumps. Water flow rate greater than 0.5 gpm can be detected by monitoring changes of level over a time period. The sump depth of 0-5 in. is displayed on a 0-100 percent recorder chart, which relates to the sump nominal capacity of 0-150 gal.

The drywell equipment drain tank collects identified leakage within the primary containment from reactor head seal leak off, bulkhead drain, refueling bellows drain, RPV head vent, recirculation pump seals, reactor recirculation pump cooler drains, and RPV bottom drain (Unit I only). The measured tank depth of 36 in. is displayed on a 0-100 percent recorder chart. This relates directly to the measured tank capacity of 842 gal.

RCS leakage outside of the Primary containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Reactor Building Closed Cooling Water (RBCCW system), or systems that directly see RCS pressure outside primary containment such as Reactor Water Cleanup (RWCU), reactor water sampling system and Residual Heat Removal (RHR) system (when in the shutdown cooling mode) (ref. 1, 3).

Indicated changes in drywell sump water level are used to calculate unidentified drywell leakage. Indicated changes in drywell equipment drain tank level are used to calculate identified drywell leakage. SO-100-006 and SO-200-006 are the procedures that specify how to complete these calculations.

Drywell leakage calculations in SO-I100(200)-006 take a finite period of time to complete.

Leakage rates cannot be determined quickly by merely observing an indicator. For this reason, the 15 minutes clock starts after it is determined that leakage rates exceed the entry value.

Upon determination that leakage has increased substantially, effort should be made to quantify this leakage in a timely manner.

ON-i1(2)00-005, "Excessive Drywell Leakage Identification", contains methods of quickly estimating drywell leakage. These methods can be used in lieu of completing the calculations contained in SO-i1(2)00-006.

Means to directly quantify RCS leakage outside containment may not be available. For this reason, judgment must be used for assessment of the 25 gpm leak rate criterion. For example, a short steam plume that does not appreciably change room temperature or room radiation levels can be judged to be less than 25 gpm. A leak that causes room temperature to rise rapidly above maximum safe tern peratures could be judged to be greater than 25 gpm in the absence of measurable lea k rates, and thus judgment is an acceptable method to evaluate this criterion.

Escalation of this EAL to the Alert level is via Category F, Fission Product Barrier Degradation, EAL FAI .1. The note has been added to remind the EAL-user to review Table F-I for possible escalation to higher emergency classifications.

This IC addresses RCS leakage which may be a precursor to a more significant event. In this case, RCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.

Page 158 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 189 of 288 The first and second EAL conditions are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications). The third condition addresses an RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These conditions thus apply to leakage into the Primary Containment, or a location outside of Primary Containment.

The leak rate values for each condition were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.

A stuck-open Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical Specifications and, therefore, is not applicable to this EAL.

The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.

Escalation of the emergency classification level would be via ICs of Recognition Category R or F.

Basis Reference(s):

1. FSAR Section 5.2.5 Detection of Leakage Through Reactor Coolant Pressure Boundary

2. Technical Specifications Definitions Section 1.1

3. ON-100(200)-005 Excess Drywell Leakage Identification

4. SO-100O(200)-006

5. NEI 99-01 SU4 Page 159 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 190 of 288 Category: S - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Inability to shut down the reactor causing a challenge to RPV water level or RCS heat removal EAL:

SS6.1 Site Area Emergency An automatic or manual scram fails to shut down the reactor AND ALL actions to shut down the reactor are not successful as indicated by reactor power >_5%

AND EITHER:

• RPV level CANNOT BE RESTORED AND MAINTAINED > -179 in. or CANNOT be determined OR

• Suppression pool water temperature AND RPV pressure CANNOT BE MAINTAINED below the Heat Capacity Temperature Limit (Figure - HCTL)

Figure - HCTL

" .. & I :..*:j.

flUUL ~dpUUILy I UIII~UI~1LUf U LIHIIL Page 160 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 191 of 288 Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

This EAL addresses the following:

• Any automatic reactor scram signal followed by a manual scram actions that fail to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the safety systems were designed (EAL SA6.1), and

• Indications that either core cooling is extremely challenged or heat removal is extremely challenged.

Reactor shutdown achieved by use of EO-000-1 13, Control Rod Insertion, is also credited as a successful scram provided reactor power can be reduced below the APRM downscale trip setpoint before indications of an extreme challenge to either core cooling or heat removal exist.

(ref. 1)

The APRM downscale trip setpoint (5%) is a minimum reading on the power range scale that indicates power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below the APRM downscale trip setpoint, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation (APRM) indications or other reactor parameters (steam flow, RPV pressure, torus temperature trend) can be used to determine if reactor power is greater than 2% power (ref. 2, 3).

The combination of failure of both front line and backup protection systems to function in response to a plant transient, along with the continued production of heat, poses a direct threat to the Fuel Clad and RCS barriers.

Indication that core cooling is extremely challenged is manifested by inability to restore and maintain RPV/water level above the Minimum Steam Cooling RPV Water Level (MSCRWL) (ref.

3). The MSCRWL is the lowest RPV level at which the covered portion of the reactor core will generate sufficient steam to prevent any clad temperature in the uncovered part of the core from exceeding 1500 0 F. This water level is utilized in the EOPs to preclude fuel damage when RPV level is below the top of active fuel. RPV level below the MSCRWL for an extended period of time without satisfactory core spray cooling could be a precursor of a core melt sequence.

When RPV level cannot be determined, EOPs require entry to EO-000-1 14, RPV Flooding. RPV water level indication provides the primary means of knowing if adequate core cooling is being maintained. When all means of determining RPV water level are unavailable, the fuel clad barrier is threatened and reliance on alternate means of assuring adequate core cooling must be attempted. The instructions in EO-000-1 14 specify these means, which include emergency depressurization of the RPV and injection into the RPV at a rate needed to flood to the elevation of the main steam lines or hold RPV pressure above the Minimum Steam Cooling Pressure (ref.

4).

Page 161 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 192 of 288 The Heat Capacity Temperature Limit (HCTL) is the highest suppression pool water temperature from which Emergency RPV Depressurization will not raise suppression chamber pressure above the Primary Containment Pressure Limit, while the rate of energy transfer from the RPV to the containment is greater than the capacity of the containment vent.

The HCTL is a function of RPV pressure and suppression pool water level. It is utilized to preclude failure of the containment and equipment in the containment necessary for the safe shutdown of the plant. This threshold is met when the final step of section SP/T in EO-000-103, Primary Containment Control, is reached (ref. 5). This condition addresses loss of functions required for hot shutdown with the reactor at pressure and temperature.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs. This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shut down the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shut down the reactor.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Escalation of the emergency classification level would be via IC RG1 or FG1.

Page 162 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 193 of 288 Basis Reference(s):

1. EO-000-1 13 Control Rod Insertion

2. Technical Specifications Table 3.3.1 .1-1

3. EO-000-102 RPV Control

4. EO-000-114 RPV Flooding

5. EO-000-103 Primary Containment Control

6. NE! 99-01 SS5 Page 163 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 194 of 288 Category: S - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Automatic or manual scram fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor EAL:

SA6.1 Alert An automatic or manual scram fails to shut down the reactor AND Manual scram actions taken at the reactor control console (Manual PBs, Mode Switch, ARI) are not successful in shutting down the reactor as indicated by reactor power _>5% (Note 8)

Note 8: A manual scram action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

This EAL addresses any automatic or manual reactor scram signal that fails to shut down the reactor followed by a subsequent manual scram that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the safety systems were designed.

For the purposes of emergency classification, successful manual scram actions are those which can be quickly performed from the reactor control console (i.e., manual scram pushbuttons, mode switch, or ARI initiation in accordance with EO-000-1 02 or EO-OOO-1 13). Reactor shutdown achieved by use of other control rod insertion methods (e.g. individual control rod insertion) directed by EO-000-1 13 does not constitute a successful manual scram (ref. 2, 3).

For the purposes of this EAL, a successful automatic initiation of ARI that reduces reactor power below 5% is no__t considered a successful automatic scram. If automatic actuation of ARI has occurred and caused reactor shutdown, the automatic RPS scram must have failed. ARI is a backup means of inserting control rods in the unlikely event that an automatic RPS scram signal exists but the reactor continues to generate significant power. However, a successful automatic initiation of ARI is an acceptable means of establishing reactor shutdown conditions relative to the EAL threshold in the absence of any required subsequent manual scram actions.

The APRM downscale trip setpoint (5%) is a minimum reading on the power range scale that indicates power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to Page 164 of 185

Attachment 1 EP.-RM-004 Revision [X]

Page 195 of 288 prevent subsequent core damage. Below the APRM downscale trip setpoint, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation (APRM) indications or other reactor parameters (steam flow, RPV pressure, torus temperature trend) can be used to determine if reactor power is greater than 5% power (ref. 1, 3).

Escalation of this event to a General Emergency would be under EAL SG2.1 or Emergency Director/Recovery Manager judgment.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS.

A manual action at the reactor control console is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor scram). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control console (e.g., locally opening breakers). Actions taken at backpanels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control console".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.

The plant response to the failure of an automatic or manual reactor scram will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shut down the reactor is prolonged enough to cause a challenge to RPV water level or RCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS6. Depending upon plant responses and symptoms, escalation is also possible via IC FSi. Absent the plant conditions needed to meet either IC SS6 or FSl, an Alert declaration is appropriate for this event.

It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Basis Reference(s):

1. Technical Specifications Table 3.3.1.1-1

2. EO-000-1 13 Control Rod Insertion

3. EO-000-1 02 RPV Control

4. NEI 99-01 SA5 Page 165 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 196 of 288 Category: S - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual scram fails to shut down the reactor EAL:

SU6.1 Unusual Event An automatic scram did not shut down the reactor after any RPS setpoint is exceeded AND A subsequent automatic scram or manual scram action taken at the reactor control console (Manual PBs, Mode Switch, ARI) is successful in shutting down the reactor as indicated by reactor power < 5% (APRM downscale) (Note 8)

Note 8: A manual scram action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

The first condition of this EAL identifies the need to cease critical reactor operations by actuation of the automatic Reactor Protection System (RPS) scram function. A reactor scram is automatically initiated by the Reactor Protection System (RPS) when certain continuously monitored parameters exceed predetermined setpoints (ref. 1).

Following a successful reactor scram, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative period. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-scram response from an automatic reactor scram signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful scram has therefore occurred when there is sufficient rod insertion from the trip of RPS to bring the reactor power below the APRM downscale setpoint of 5%.

The EAL is not applicable if a manual scram is initiated and no RPS setpoint is exceeded. For the purposes of emergency classification, successful manual scram actions are those which can be quickly performed from the reactor control console (i.e., manual scram pushbuttons, mode switch, or ARI initiation in accordance with EO-000-102 or EO-000-1 13). Reactor shutdown achieved by use of other control rod insertion methods (e.g. individual control rod insertion) directed by EO-000-1 13 does not constitute a successful manual scram (ref. 2, 3).

Following any automatic RPS scram signal, operating procedures (e.g., EO-000-1 02) prescribe insertion of redundant manual scram signals to back up the automatic RPS scram function and Page 166 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 197 of 288 ensure reactor shutdown is achieved. Even if the first subsequent manual scram signal inserts all control rods to the full-in position immediately after the initial failure of the automatic scram, the lowest level of classification that must be declared is an Unusual Event. (ref. 3)

Taking the mode switch to shutdown is a manual scram action. When the Mode Switch is taken out of the Run position, however, the nuclear instrumentation scram setpoint is lowered. If reactor power remains above the lowered setpoint, an automatic scram is initiated.

For the purposes of this EAL, a successful automatic initiation of ARI that reduces reactor power below 5% is not considered a successful automatic scram. If automatic initiation of ARI has occurred and caused reactor shutdown, the automatic RPS scram must have failed. ARI is a backup means of inserting control rods in the unlikely event that an automatic RPS scram signal exists but the reactor continues to generate significant power. However, a successful automatic or manual initiation of ARI is an acceptable means of establishing reactor shutdown conditions relative to the EAL threshold in the absence, of any required subsequent manual scram actions.

In the event that the operator identifies a reactor scram is imminent and initiates a successful manual reactor scram before the automatic scram setpoint is reached, no declaration is req uired. The successful manual scram of the reactor before it reaches its automatic scram setpoint or reactor scram signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. If manual reactor scram actions fail to reduce reactor power below 5%, the event escalates to the Alert under EAL SA6.1.

If by procedure, operator actions include the initiation of an immediate manual scram following receipt of an automatic scram signal and there are no clear indications that the automatic scram failed (such as a time delay following indications that a scram setpoint was exceeded), it may be difficult to determine if the reactor was shut down because of automatic scram or manual actions. If a subsequent review of the scram actuation indications reveals that the automatic scram did not cause the reactor to be shut down, then consideration should be given to evaluating the fuel for potential damage, and the reporting requirements of 10OCER 50.72 should be considered for the transient event.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic scram is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on* an automatic reactor scram, operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

If an initial manual reactor scram is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram) using a different switch). Depending upon several factors, the initial or subsequent effort to manually scram the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor scram signal. If a subsequent manual or automatic scram is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

Page 167 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 198 of 288 A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor scram). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.

The plant response to the failure of an automatic or manual reactor scram will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in Shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA6 or FA1, an Unusual Event declaration is appropriate for this event.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Should a reactor scram signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor scram and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

• If the signal does not cause a plant transient and the scram failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Basis Reference(s):

1. Technical Specifications Table 3.3.1.1-1

2. EO-000-1 13 Control Rod Insertion

3. EO-000-1 02 RPV Control

4. NEI 99-01 SU5 Page 168 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 199 of 288 Category: S - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual scram fails to shut down the reactor EAL:

SU6.2 Unusual Event A manual scram did not shut down the reactor after any manual scram action was initiated AND A subsequent automatic scram or manual scram action taken at the reactor control console (Manual PBs, Mode Switch, ARI) is successful in shutting down the reactor as indicated by reactor power < 5% (APRM downs'cale) (Note 8)

Note 8: A manual scram action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

This EAL addresses a failure of a manually initiated scram in the absence of having exceeded an automatic RPS trip setpoint and a subsequent automatic or manual scram is successful in shutting down the reactor (reactor power < 5%) (ref. 1). ,

• Following a successful reactor scram, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative period. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-scram response from a manual reactor scram signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful scram has therefore occurred when there is sufficient rod insertion from the trip of RPS to bring the reactor power below the APRM downscale setpoint of 5%.

For the purposes of emergency classification, successful manual scram actions are those which can be quickly performed from the reactor control console (i.e., manual scram pushbuttons, mode switch, or ARI initiation in accordance with EO-000-1 02 or EO-000-1 13). Reactor shutdown achieved by use of other control rod insertion methods (e.g. individual control rod insertion) directed by EO-000-1 13 does not constitute a successful manual scram (ref. 2, 3).

Taking the mode switch to shutdown is a manual scram action. When the Mode Switch is taken out of the Run position, however, the nuclear instrumentation scram setpoint is lowered. If reactor power remains above the lowered setpoint, an automatic scram is initiated.

Page 169 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 200 of 288 Successful automatic or manual initiation of ARI is an acceptable means of establishing reactor shutdown conditions relative to the EAL threshold in the absence of any required subsequent manual scram actions.

If both subsequent automatic and subsequent manual reactor scram actions in the Control Room fail to reduce reactor power below the power associated with the safety system design

(< 5%) following a failure of an initial manual scram, the event escalates to an Alert under EAL SA6.1 This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic scram is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on an automatic reactor scram, operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

If an initial manual reactor scram is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram) using a different switch). Depending upon several factors, the initial or subsequent effort to manually scram the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor scram signal. If a subsequent manual or automatic scram is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor scram). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.

The plant response to the failure of an automatic or manual reactor scram will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA6 or FA1, an Unusual Event declaration is appropriate for this event.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Should a reactor scram signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied.

Page 170 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 201 of 288

• If the signal causes a plant transient that should have included an automatic reactor scram and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

• If the signal does not cause a plant transient and the scram failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Basis Reference(s):

1. Technical Specifications Table 3.3.1 .1-1

2. EO-000-1 13 Control Rod Insertion

3. EO-000-102 RPV Control

4. NEI 99-01 SU5 Page 171 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 202 of 288 Category: S - System Malfunction Subcategory: 7 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities EAL:

SU7.1 Unusual Event Loss of ALL Table S-3 onsite communication methods OR Loss of ALL Table S-30ORO communication methods OR Loss of ALL Table S-3 NRC communication methods Table S-3 Communication Methods System Onsite ORO NRC UHF Radio X Plant PA System X Dedicated Conference Lines X Commercial Telephone Systems X X X Cellular Telephone X X FTS-2001 (ENS) X X Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Onsite/offsite communications include one or more of the systems listed in Table S-3 (ref. 1, 2, 3).

UHF Radio Onsite portable radio communication systems are described in the Susquehanna SES Physical Security Plan and in the Susquehanna SES Emergency Plan. Four UHF channels, each Page 172 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 203 of 288 consisting of two frequencies for duplex operation through one of five in-plant repeaters, provide onsite portable radio, communications. Operations is assigned two channels; one channel is assigned to Unit 1 and one to Unit 2. Operators in the plant on rounds and on specific assignments are equipped with handheld two-way radios.

Plant PA System The plant PA system is an intra-plant public address providing the following functions:

• A 5-channel page-talk handset intercom system for on-site communications between plant locations.

• Broadcast accountability and fire alarms designed to warn personnel of emergency conditions.

The system consists of telephone handsets, amplifiers and loudspeakers located at various selected areas throughout the plant.

Dedicated Conference Lines (Centrex Three (3) di~qit dialincq)

The Dedicated Conference Lines are those normally used to communicate with several offsite agencies at one time (e.g., 191 conference line).

Commercial Telephone Systems Two independent telecommunications networks exist to provide primary and backup telephone communications between ERFs and offsite agencies.

Cellular Telephone Cell phones can be utilized to perform both ORO and NRC communications.

FTS 2001 (ENS)

This system is for NRC offsite communications but may also be used to perform ORO notifications.

This EAL is the hot condition equivalent of the cold condition EAL CU5.1.

This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to OROs and the NRC.

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

The second EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are the Commonwealth of Pennsylvania, Luzerne and Columbia County EOCs The third EAL addresses a total loss of the communications methods used to notify the NRC of an emergency declaration.

Page 173 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 204 of 288 Basis Reference(s):

1. EP-RM-007 Emergency Telephone Instructions and Directory

2. SSES Emergency Plan Section 8

3. FSAR Section 9.5.2

4. NEI 99-01 SU6 Page 174 of 185

Attachment 1 EP-RM-004 Revision IX]

Page 205 of 288 Category: S - System Malfunction Subcategory: 8 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode EAL:

SA8.1 Alert The occurrence of any Table S-4 hazardous event AND EITHER:

• Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode

• The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode Table S-4 Hazardous Events

• Seismic event (earthquake)

• Internal or external FLOODING event

• High winds or tornado strike

• FIRE

• EXPLOSION

• Other events with similar hazard characteristics as determined by the Shift Manager Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

Page 175 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 206 of 288 FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

FLOODING- A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 100FR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Basis:

• The significance of a seismic event is discussed under EAL HU2.1 (ref. 1, 2).

• Internal FLOODING may be caused by events such as component failures, equipment misalignment, or outage activity mishaps (ref. 3, 4, 5).

• Seismic Category I structures are analyzed to withstand a sustained, design wind velocity of at least 80 mph. (ref. 6, 7).

• Areas containing functions and systems required for safe shutdown of the plant are identified by Fire Zone in the fire response procedure (ref. 8, 9).

• An EXPLOSION that degrades the performance of a SAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component or structure would be classified under this EAL.

This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode.

This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant.

The first condition addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.

The second condition addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of Page 176 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 207 of 288 available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.

Escalation of the emergency classification level would be via IC FS1 or RS1.

Basis Reference(s):

1. ON-000-002 Severe Weather / Natural Phenomena

2. FSAR Section 3.7 Seismic Design

3. ON-169(269)-001 Flooding in Turbine Building

4. ON-169(269)-002 Flooding in Reactor Building

5. ESAR Section 3.4 Water Level (Flood) Design

6. FSAR Section 3.3 Wind and Tornado Loadings

7. FSAR Section 3.5 Missile Projection

8. SSES-FPRR Section 6.2 Fire Area Description

9. ON-013-001 Response to Fire

10. NEI 99-01 SA9 Page 177 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 208 of 288 Category E - Independent Spent Fuel Storage Installation (ISFSI)

EAL Group: ANY (EALs in this category are applicable to any piant condition, hot or cold)

An independent spent fuel storage installation (ISFSl) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. A significant amount of the radioactive material contained within a cask/canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from an accident involving the dry storage of spent nuclear fuel.

An Unusual Event is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask CONFINEMENT BOUNDARY is damaged or violated.

A security event involving the ISESI would be classified in accordance with Category HI security based EALs.

Minor surface damage that does not affect storage cask/canister boundary is excluded from the scope of these EALs.

Page 178 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 209 of 288 Category: E - ISFSI Sub-category: None Initiating Condition: Damage to a loaded cask CONFINEMENT BOUNDARY EAL:

EUI.1 Notification of Unusual Event Damage to a loaded canister CONFINEMENT BOUNDARY as indicated by a radiation reading on a loaded spent fuel cask > any of the following:

• 800 mrem/hr at 3 ft from the HSM surface

• 200 mrem/hr on contact on the outside of the HSM door centerline

• 40 mrem/hr on contact on the end shield wall exterior Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY- The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the Susquehanna ISFSI, Confinement Boundary is defined as the Dry Shielded Canister (DSC).

Basis:

The SSES Independent Spent Fuel Storage Installation utilizes the standardized NUHMOS Horizontal Modular System. The standardized NUHMOS system is a horizontal canister system composed of a steel dry shielded canister (DSC) and a reinforced concrete horizontal storage module (HSM). The DSC provides confinement and criticality control for the storage and transfer of irradiated fuel. The HSM houses the DSC and provides for heat removal. An HSM is considered loaded when it houses a DSC containing spent fuel. (ref. 1, 2)

The values shown represent 2 times the limits specified in the ISFSI Certificate of Compliance Technical Specification 1.2.7, HSM Dose Rates (ref. 1).

This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a storage cask containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the loaded storage cask is sealed. The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors, and configuration changes which could cause challenges in removing the cask or fuel from storage.

The existence of "damage" is determined by radiological survey. The technical specification multiple of "2 times" is used here to distinguish between non-emergency and emergency conditions. The emphasis for this classification is the degradation in the level of safety of the spent fuel cask and not the magnitude of the associated dose or dose rate. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask.

Page 179 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 210 of 288 Security-related events for ISFSIs are covered under l~s HU1 and HAl.

Basis Reference(s):

1. Certification of Compliance No. 1004 for the NUHOMS Storage System

2. TRM B3.1O.3 Independent Spent Fuel Storage Installation (ISFSI)

3. NEI 99-01 E-HU1 Page 180 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 211 of 288 Category F - Fission Product Barrier Degradation EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes.

EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment. This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. The primary fission product barriers are:

A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.

B. Reactor Coolant System (RCS): The RCS Barrier is the reactor coolant system pressure boundary and includes the RPV and all reactor coolant system piping up to and including the isolation valves.

C. Containment (PC): The drywell, the wetwell, their respective interconnecting paths, and other connections up to and including the outermost containment isolation valves comprise the PC barrier. Primary Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to either a Site Area Emergency or a General Emergency.

The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-i (Attachment 2). "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade. The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emergency classification level:

Alert:

Any loss or any potential loss of either Fuel Clad or RCS Site Area Emergency:

Loss or potential loss of any two barriers GeneralEmergency:

Loss of any two barriersand loss or potentialloss of third barrier The logic used for emergency classification based on fission product barrier monitoring should reflect the following considerations:

• The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Primary Containment Barrier.

• Unusual Event ICs associated with RCS and Fuel Clad Barriers are addressed under System Malfunction ICs.

• For accident conditions involving a radiological release, evaluation of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to Page 181 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 212 of 288 ensure correct and timely escalation of the emergency classification. For example, an, evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC RG1 has been exceeded.

• The fission product barrier thresholds specified within a scheme reflect SSES design and operating characteristics.

• As used in this category, the term RCS leakage encompasses not just those types defined in Technical Specifications but also includes the loss of RCS mass to any location- inside the primary containment, an interfacing system, or outside of the primary containment. The release of liquid or steam mass from the ROS due to the as-designed/expected operation of a relief valve is not considered RCS leakage.

• At the Site Area Emergency level, EAL users should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration. For example, if the Fuel Clad and ROS fission product barriers were both lost, there should be frequent assessments of containment radioactive inventory and integrity. Alternatively, if both the Fuel Clad and RCS fission product barriers were potentially lost, the Emergency Director/Recovery Manager would have more assurance that there was no immediate need to escalate to a General Emergency.

Page 182 of 185

Attachment I EP-RM-004 Revision XIX Page 213 of 288 Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss of any two barriers and loss or potential loss of the third barrier EAL:

FGI.1 General Emergency Loss of any two barriers AND Loss or potential loss of the third barrier (Table F-I)

Mode Applicability:

I - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Fuel.Clad, RCS and Containment comprise the fission product barriers. Table F-I (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions:

• Loss of Fuel Clad, RCS and Containment barriers

• Loss of Fuel Clad and RCS barriers with potential loss of Containment barrier

• Loss of RCS and Containment barriers with potential loss of Fuel Clad barrier

• Loss of Fuel Clad and Containment barriers with potential loss of RCS barrier Basis Reference(s):

I. NEI 99-01 FG1 Page 183 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 214 of 288 Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss or potential loss of any two barriers EAL:

FSI.1 Site Area Emergency Loss or potential loss of any two barriers (Table F-I)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-I (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions:

• One barrier loss and a second barrier loss (i.e., loss - loss)

• One barrier loss and a second barrier potential loss (i.e., loss - potential loss)

• One barrier potential loss and a second barrier potential loss (i.e., potential loss -

potential loss)

At the Site Area Emergency classification level, the ability to dynamically assess the proximity of present conditions with respect to the threshold for a General Emergency is important. For example, the existence of Fuel Clad and RCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification. Alternatively, if both Fuel Clad and RCS potential loss thresholds existed, the Emergency Director/Recovery Manager would have greater assurance that escalation to a General Emergency is less imminent.

Basis Reference(s):

1. NEI 99-01 FS1 Page 184 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 215 of 288 Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Any loss or any potential loss of either Fuel Clad or RCS EAL:

FA1.1 Alert Any loss or any potential loss of EITHER Fuel Clad or RCS (Table F-i)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Fuel Clad, RCS and Primary Containment comprise the fission product barriers. Table F-i (Attachment 2) lists the fission product barrier thresholds, bases and references.

At the Alert classification level, Fuel Clad and RCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier, loss or potential loss of either the Fuel Clad or RCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability. Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or RCS barrier results in declaration of a Site Area Emergency under EAL FS1.1 Basis Reference(s):

1. NEI 99-01 FA1 Page 185 of 185

Attachment 2 EP-RM-004 Revision [X]

Page 216 of 288 ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Introduction Table F-i lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The table is structured so that each of the three barriers occupies adjacent columns. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds.

The first column of the table (to the left of the Fuel Clad Loss column) lists the categories (types) of fission product barrier thresholds. The fission product barrier categories are:

A. RPV Level B. RCS Leak Rate C. Primary Containment Conditions D. Primary Containment Radiation I RCS Activity E. Primary Containment Integrity or Bypass F. EDlRM Jugement Each category occupies a row in Table F-i thus forming a matrix defined by the categories. The intersection of each row with each Loss/Potential Loss column forms a cell in which one or more fission product barrier thresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None" is entered in the cell.

Thresholds are assigned sequential numbers within each Loss and Potential Loss column beginning with number one. In this manner, a threshold can be identified by its category title and number. For example, the first Fuel Clad barrier Loss in Category A would be assigned "FC Loss A.1 ," the third Containment barrier Potential Loss would be assigned "PC P-Loss C.3," etc.

If a cell in Table F-i contains more than one numbered threshold, each of the numbered thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss.

Subdivision of Table F-i by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds. This structure promotes a systematic approach to assessing the classification status of the fission product barriers.

When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-i, locates the likely category and then reads across the fission product barrier Loss and Potential Loss thresholds in that category to determine if a threshold has been exceeded. If a threshold has not been exceeded, the EAL-user proceeds to the next likely category and continues review of the thresholds in the new category If the EAL-user determines that any threshold has been exceeded, by definition, the barrier is lost or potentially lost - even if multiple thresholds in the same barrier column are exceeded, only that one barrier is lost or potentially lost. The EAL-user must examine each of the three fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if containment radiation is sufficiently high, a Loss of the Fuel Clad Page 1 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 217 of 288 and RCS barriers and a Potential Loss of the Containment barrier can occur. Barrier Losses and Potential Losses are then applied to the algorithms given in EALs FG1.1, FS1.1, and FA1.1 to determine the appropriate emergency classification.

In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first, followed by the RCS barrier and finally the Containment barrier threshold bases. In each barrier, the bases are given according category Loss followed by category Potential Loss beginning with Category A, then B,...,. F.

Table F-2 provides a human factors enhancement mechanism to track the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor.

Coolant System, and Containment) to assist with quickly determining which initiating condition for EALs FGI.1, FSI.1, or FA1.1 is met.

Page 2 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 218 of 288 Table F-I Fission Product Barrier Threshold Matrix Fuel Clad Barrier Reactor Coolant System Barrier Primary Containment Barrier Category LOSS Potential Loss Loss Potential Loss Loss Potential Loss

1. RPV level CANNOT BE 1I RPV level CANNOT BE A t. SAG entry required RESTORED AND MAINTAINED'> RESTORED AND MAINTAINED >Noeon1.SGntyrqid evl161 -P in. -161 in.NoeNn1.SGntyrqid RMeelor CANNOT be determined or CANNOT be determined

1. UNISOLABLE break in any of the 1. UNISOLABLE primary system 1. UNISOLABLE primary system leakage that results in exceeding leakage that results in exceeding following: EITHER of the following: EITHER of the following:

• Main Steam Line

• One or more Max Normal

• One or more Max Safe

• HPCI Steam Line Reactor Building Radiation Reactor Building Radiation

• RClC Steam Line Limits (EO-000-1 04 Table 9) Limits (EO-000-104 Table 9)

BNone None RWCU Feedwater that can be read in the Control Room (Table F-3) that can be read in the Control Room (Table F-5) None RCS Leak Rate OR OR OR

• One or more Max Normal

• One or more Max Safe

2. Emergency RPV Depressurization Reactor Building area Reactor Building area is required temperature Limits temperature Limits (EO-000-104 Table 8) that can (EO-000-104 Table 8) that be read in the Control Room can be read in the Control (Table F-4) Room (Table F-6)

1. UNPLANNED rapid drop in 1. Primary Containment pressure Primary Containment pressure ' 53 psig Cfollowing Primary Containment OR NoeNoe1 Piay otinetprsue oepressure rise 2. Deflagration concentrations exist PC None NoneP1.iPrimayoContainmentppressur response not consistent with 3. I-eat Capacity Temperature Limit LOCA conditions (HCTL) exceeded D l1, CH-RRM radiation > 3.0E+3 R/hr OR 1. CHRRM radiation > 7.0E+O RJhr PC Rad I None with indications of RCS leakage None None 1. CHRRM radiation>* 4.0E+4 R/hr ROS 2. Primary coolant activity>* 300) inside the dry'well Activity pCi/gm 1-131dose equivalent I.UNISOLABLE direct downstream pathway to the environment exists after Primary Containment E isolation signal PCItgiyNone None None None OR None or Bypass 2. Intentional Primary Containment 3

venting per EP-DS-OO4-RP =-fi l,-V-tqorocedures RE F AnEcndtenr nten opniny t1. 1. Any condition in the opinion of the 1. Any condition in the opinion of the 1. Any condition in the opinion of the 1.Any condition in the opinion of the 1. Any condition in the opinion of the EDR ietrRcvr aaeclad ht Emergency Manager thatDirector/Recovery Emergency Manager thatDirector/Recovery Emergency Manager thatDirector/Recovery Emergency Manager thatDirector/Recovery Emergency idircato/esossofter funael indicates potential indicates loss of the indicates potential loss indicates loss of the Manager thatDirector/Recovery indicates potential loss Judgment barrier loss of the fuel clad barrier RCS barrier of the RCS barrier Primary Containment barrier of the Primary Containment barrier Page 3 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 219 of 288 Table F-2 Fission Product Barrier Status Table Circle the X's in the FG1: General Emergency FS1: Site Area Emergency FA1: Alert table below for all Loss of any two barriers Loss or potential loss of any two barriers Any loss or any potential loss applicable and loss or potential loss of of EITHER Fuel Clad or RCS situations. Declare third barrier, barrier the EAL based upon all circled X's in any column.

Fuel Clad -Loss X X X X X X X X Fuel Clad -Potential X X X X X X Loss RCS -Loss X X X X X X X X RCS -Potential Loss X X X X X X Primary Containment X X X X X X X

- Loss Primary Containment X X X X X

- Potential Loss Page 4 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 220 of 288 Barrier: Fuel Clad Category: A. RPV Level Degradation Threat: Loss Threshold:

1. SGentry required Definition(s):

N/A Basis:

The Loss threshold represents the EOP requirement for SAG entry. This is identified in the BWROG EPGs/SAGs when the phrase, "SAG Entry Is Required," EOPs specify the requirement for entry to the SAGs when core cooling is severely challenged..These EOPs provide instructions to ensure adequate core cooling by maintaining RPV water level above prescribed limits or operating sufficient RPV injection sources when level cannot be determined.

SAG entry is required when (ref. 1, 2):

• ,PD\/' .... t.,r Il...ol CANNO'T BE RESQTORED-' ANDl' M/AIN*TAIED-F b'*k.... "170 in.

---AND OR

• EO-1 (2)00-1 02 - when RPV level cannot be restored and maintained above MSCRWL

(-179") or elevation of iet pump suctions (-210") when a loop of Core Spray is iniectingq (>

6350 ppm).

• EO-1 (2)00-113 - when RPV level cannot be restored and maintained above MSCRWL (E-1792).014 AW)-we or aaq socri

• EO-1 (2)00-1 14A(N-n-ATWS) - when core damaqe is occurring.

The above EOP conditions represent a challenge to core cooling and are the minimum values to assure core cooling without further degradation of the clad.

SAGs entry is also a Potential Loss of the Primary Containment barrier (PC P-Loss A.1) which constitutes a Site Area Emergency. The threshold for the RCS barrier (RCS Loss A. 1) should Page 5 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 221 of 288 also be evaluated for escalation to a General Emergency if SAGs entry results in meeting that threshold.

Basis Reference(s):

1. EP-DS-001 Containment Combustible Gas Control

2. EP-DS-002 RPV and Primary Containment Flooding SAG-2

3. NEI 99-0 1 RPV Water Level Fuel Clad Loss 2.A Page 6 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 222 of 288 Barrier: Fuel Clad Category: A. RPV Level Degradation Threat: Potential Loss Threshold:

1. RPV level CANNOT BE RESTORED AND MAINTAINED > -161 in. or CANNOT be determined Definition(s):

N/A Basis:

An RPV water level instrument reading of -161 in. indicates RPV level is at the top of active fuel (TAF) (ref. 1). When RPV level is at or above the TAF, the core is completely submerged. Core submergence is the most desirable means of core cooling. When RPV level is below TAF, the uncovered portion of the core must be cooled by less reliable means (i.e., steam cooling or spray cooling). If core uncovery is threatened, the EOPs specify alternate, more extreme, RPV water level control measures in order to restore and maintain adequate core cooling. Since core uncovery begins if RPV level drops to TAF, the level is indicative of a challenge to core cooling and the Fuel Clad barrier.

This Fuel Clad barrier Potential Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

When RPV water level cannot be determined, EOPs require entry to EO-000-1 14, RPV Flooding. RPV water level indication provides the primary means of knowing if adequate core cooling is being maintained (ref. 2). When all means of determining RPV water level are unavailable, the fuel clad barrier is threatened and reliance on alternate means of assuring adequate core cooling must be attempted. The instructions in EO-000-1 14 specify these means, which include emergency depressurization of the RPV and injection into the RPV at a rate needed to flood to the elevation of the main steam lines or hold RPV pressure above the Minimum Steam Cooling Pressure (in scram-failure events. If RPV water level cannot be determined with respect to the top of active fuel, a potential loss of the fuel clad barrier exists.

This threshold is intended to be interpreted the same as in EO-000-1 14, that is, a loss of instrumentation is not, by itself, a loss of ability to determine level.

Note that EO-000-1 13, Level/Power Control, may require intentionally lowering RPV water level to -161 in. and control level between the Minimum Steam Cooling RPV Water Level (MSCRWL) and the top of active fuel (ref. 3). Although such action is a challenge to core cooling and the Fuel Clad barrier, the immediate need to reduce reactor power is the higher priority. For such events, ICs SA6 or SS6 will dictate the need for emergency classification.

Page 7 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 223 of 288 This water level corresponds to the top of the active fuel and is used in the EOPs to indicate a challenge to core cooling.

The RPV water level threshold is the same as RCS barrier Loss threshold A.1. Thus, this threshold indicates a Potential Loss of the Fuel Clad barrier and a Loss of the RCS barrier that appropriately escalates the emergency classification level to a Site Area Emergency.

This threshold is considered to be exceed'ed when, as specified in the site-specific EOPs, RPV water CANNOT BE RESTORED AND MAINTAINED above the specified level following depressurization of the RPV (either manually, automatically or by failure of the RCS barrier) or when procedural guidance or a lack of low pressure RPV injection sources preclude Emergency RPV depressurization. EOPs allow the operator a wide choice of RPV injection sources to consider when restoring RPV water level to within prescribed limits. EOPs also specify depressurization of the RPV in order to facilitate RPV water level control with low-pressure injection sources. In some events, elevated RPV pressure may prevent restoration of RPV water level until pressure drops below the shutoff heads of available injection sources.

Therefore, this Fuel Clad barrier Potential Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

The term "CANNOT BE RESTORED AND MAINTAINED above' means the value of RPV water level is not able to be brought above the specified limit (top of active fuel). The determination requires an evaluation of system performance and availability in relation to the RPV water level value and trend. A threshold prescribing declaration when a threshold value CANNOT BE RESTORED AND MAINTAINED above a specified limit does not require immediate action simply because the current value is below the top of active fuel, but does not permit extended operation below the limit; the threshold must be considered reached as soon as it is apparent that the top of active fuel cannot be attained.

In high-power ATWS/failure tO scram events, EOPs may direct the operator to deliberately lower RPV water level to the top of active fuel in order to reduce reactor power. RPV water level is then controlled between the top of active fuel and the Minimum Steam Cooling RPV Water Level (MSCRWL). Although such action is a challenge to core cooling and the Fuel Clad barrier, the immediate need to reduce reactor power is the higher priority. For such events, ICs SA6 or SS6 will dictate the need for emergency classification.

Since the loss of ability to determine if adequate core cooling is being provided presents a significant challenge to the fuel clad barrier, a potential loss of the fuel clad barrier is specified.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. EO-000-1 14 RPV Flooding

3. EO-000-1 13 Level/Power Control

4. NEI 99-01 RPV Water Level Fuel Clad Potential Loss 2.A Page 8 of 64

Attachment 2 EP-RM.-004 Revision [X]

Page 224 of 288 Barrier: Fuel Clad Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

None Page 9 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 225 of 288 Barrier: Fuei Clad Category: B. RCS Leak Rate Degradation Threat: Potential Loss Threshold:

None Page 10 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 226 of 288 Barrier: Fuel Clad Category: C. PC Conditions Degradation Threat: Loss Threshold:

None Page 11 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 227 of 288 Barrier: Fuel Clad Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

None Page 12 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 228 of 288 Barrier: Fuel Clad Category: D. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

1. CHRRM radiation > 3.0E+3 R/hr Definition(s):

None Basis:

Two gamma radiation levels ion chambers are located inside the drywell to monitor post-accident radiation levels. The detectors are located in the drywell on elevation 719'. They are always in service and read out on the 0601 panel. Range is 100 to 108 R/hr. Environmentally qualified since they are required for use after an accident. A U-234 bug source is installed in the detector to serve as a self-check for instrument operability. The source provides approximately a 1 R/hr dose rate with the reactor shutdown. When the plant is at 100% power, drywell rad indication is normally about 3-4 R/hr. A reading of 3,000 R/hr indicates the release of reactor coolant into the drywell with elevated activity indicative of fuel clad damage (ref. 2).

For a fuel failure event equivalent to approximately 1% of cladding failure and an instantaneous and complete release of reactor coolant to the primary containment, the response of the Containment High Range Radiation Monitors (CHRRM) in the drywell will be approximately 3,450 R/hr immediately after shutdown (rounded to 3,000 R/hr, which approximates the dose rate 10 minutes after shutdown). This assumes that the release has occurred soon after reactor shutdown, and that the fuel cladding failures produce a coolant source term of 300 #.Ci/gm of 1-131 dose equivalent just prior to the release into primary containment. (ref. 2)

Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

The radiation monitor reading in this threshold is higher than that specified for RCS Barrier Loss threshold D.1 since it indicates a loss of both the Fuel Clad Barrier and the RCS Barrier. Note that a combination of the two monitor readings appropriately escalates the emergency classification level to a Site Area Emergency.

There is no Fuel Clad Barrier Potential Loss threshold associated with Primary Containment Radiation.

Page 13 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 229 of 288 Basis ,Reference(s):

1. General Atomic High-Range Gamma Radiation Monitoring System Manual

2. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008

3. NEI 99-01 Primary Containment Radiation Fuel Clad Loss 4.A Page 14 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 230 of 288 Barrier: Fuel Clad Category: 0. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

2. Primary coolant activity > 300 pCi/gm 1-131 dose equivalent Basis:

The Fuel Clad Barrier shall be declared "lost" if the Primary coolant activity is determined to be

> 300 IpCi/gm 1-131 dose equivalent. Two separate methods can be used make this determination:

• Sample collection and analysis of reactor coolant activity

• Analysis of plant parameters to determine fuel clad damage > 1%

Sample collection and analysis of reactor coolant activity are accomplished in accordance with CH-ON-007.

It is recognized that sample collection and analysis of reactor coolant with highly elevated activity levels could require several hours to complete. The fuel clad damage analysis methodology in ref. 3 provides an alternative method to determine if the 1-131 dose equivalent activity is > 300 tpCi/gm.

Fuels Engineering determines if > 1% fuel clad damage has occurred based on the analysis methodology in ref. 3. Fuel clad damage equal to 1% corresponds to at least 300 micro-Ci/gm 1-131 dose equivalent in the reactor coolant, and drywell radiation values of at least 3000 R/hr during LOCA events (breach inside primary containment) (ref. 1). However, drywell radiation levels can be significantly lower than 3000 R/hr with a similar amount of fuel damage without a LOCA (no breach inside primary containment), since the fission products remain in the reactor vessel/do not escape into the drywell space and the CHRM is shielded from the radiation source (ref. 2 and 3).

Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

There is no Potential Loss threshold associated with RCS Activity.

Basis Reference(s):

1. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008

2. EWR 1642196 - Investigation of EPLAN 1% Clad Damage vs. Barrier Loss

3. EP-PS-324 - Fuels Lead Engineer/Core Thermal Hydraulics Engineer

4. CH-ON-007 - Emergency Sampling Procedures

5. NEI 99-01 RCS Activity Fuel Clad Loss 1.A Page 15 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 231 of 288 Barrier: Fuel Clad Category: D. PC Radiation / RECS Activity Degradation Threat: Potential Loss Threshold:

None Page 16 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 232 of 288 Barrier: Fuel Clad Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

None Page 17 of 64

Attachment 2 EP-RM-004 Revision XI]

Page 233 of 288 Barrier: Fuel Clad Category~ E. PC Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Page 18 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 234 of 288 Barrier: Fuel Clad Category: F. ED/RM Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates loss of the Fuel Clad barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqiradation exists ifthe degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitorinci capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A Page 19 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 235 of 288 Barrier: Fuel Clad Category: F. ED/RM Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates potential loss of the Fuel Clad barrier Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

The Emergency Director/Recovery Manager should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A Page 20 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 236 of 288 Barrier: Reactor Coolant System Category: A. RPV Level Degradation Threat: Loss Threshold:

1. RPV level CANNOT BE RESTORED AND MAINTAINED > -161 in. or CANNOT be determined Definition(s):

None Basis:

An RPV level instrument reading of -161 in. indicates RPV level is at the top of active fuel (TAF)

(ref. 1). TAF is significantly lower than the normal operating RPV level control band. To reach this level, RPV inventory loss would have previously required isolation of the RCS and Primary Containment barriers, and initiation of all ECCS. If RPV level cannot be maintained above TAF, ECCS and other sources of RPV injection have been ineffective or incapable of reversing the decreasing level trend. The cause of the loss of RPV inventory is therefore assumed to be a LOCA. By definition, a LOCA event is a Loss of the RCS barrier.

This RCS barrier Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

When RPV water level cannot be determined, EOPs require entry to EO-000-1 14, RPV Flooding. RPV water level indication provides the primary means of knowing if adequate core cooling is being maintained (ref. 2). When all means of determining RPV water level are unavailable, the RCS barrier is threatened and reliance on alternate means of assuring adequate core cooling must be attempted. The instructions in EO-000-1 14 specify these means, which include emergency depressurization of the RPV and injection into the RPV at a rate needed to flood to the elevation of the main steam lines or hold RPV pressure above the Minimum Steam Cooling Pressure (in scram-failure events. If RPV water level cannot be determined with respect to the top of active fuel, a loss of the RCS barrier exists. This threshold is intended to be interpreted the same as in EO-000-1 14, that is, a loss of instrumentation is not, by itself, a loss of ability to determine level.

The conditions of this threshold are also a Potential Loss of the Fuel Clad barrier (FC P-Loss A.1 ). A Loss of the RCS barrier and Potential Loss of the Fuel Clad barrier requires a Site Area Emergency classification.

Note that EO-000-1 13, Level/Power Control, may require intentionally lowering RPV water level to -161 in. and control level between the Minimum Steam Cooling RPV Water Level (MSCRWL) and the top of active fuel (ref. 3). Although such action is a challenge to core cooling and the Page 21 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 237 of 288 Fuel Clad b'arrier, the immediate need to reduce reactor power is the higher priority. For such events, l~s SA6 or SS6 will dictate the need for emergency classification.

This water level corresponds to the top of active fuel and is used in the EOPs to indicate challenge to core cooling.

The RPV water level threshold is the same as Fuel Clad barrier Potential Loss threshold A.1.

Thus, this threshold indicates a Loss of the RCS barrier and Potential Loss of the Fuel Clad barrier and that appropriately escalates the emergency classification level to a Site Area Emergency.

This threshold is considered to be exceeded when, as specified in the site-specific EOPs, RPV water CANNOT BE RESTORED AND MAINTAINED above the specified level following depressurization of the RPV (either manually, automatically or by failure of the RCS barrier) or when procedural guidance or a lack of low pressure RPV injection sources preclude Emergency RPV depressurization. EOPs allow the operator a wide choice of RPV injection sources to consider when restoring RPV water level to within prescribed limits. EOPs also specify depressurization of the RPV in order to facilitate RPV water level control with low-pressure injection sources. In some events, elevated RPV pressure may prevent restoration of RPV water level until pressure drops below the shutoff heads of available injection sources.

Therefore, this RCS barrier Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. EO-000-114 RPV Flooding

3. EO-000-1 13 Level/Power Control

4. NEI 99-01 RPV Water Level RCS Loss 2.A Page 22 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 238 of 288 Barrier: Reactor Coolant System Category: A. RPV Level Degradation Threat: Potential Loss Threshold:

None Page 23 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 239 of 288 Barrier: Reactor Coolant System Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

1. UNISOLABLE break in ANY of the following:

• Main Steam Line

• HPCI Steam Line'

• ROIC Steam Line

• RWCU

• Feedwater Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system.

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

As used in this threshold, local isolation actions can only be credited if isolation can be completed promptly (i.e. within 15 min.).

In the case of a failure of both isolation valves to close but in which no downstream flow path exists, emergency declaration under this threshold would not be required. Similarly, if the emergency response requires the normal process flow of a system outside primary containment (e.g., EOP requirement to bypass MSIV low RPV water level interlocks and maintain the main condenser as a heat sink using main turbine bypass valves), the threshold is not met. The combination of these threshold conditions represent the loss of both the RCS and Primary Containment (see PC Loss E.1) barriers and justifies declaration of a Site Area Emergency (i.e.,

Loss or Potential Loss of any two barriers).

High steam flow and high steam tunnel temperature annunciators are an indication of a Main Steam Line break. Either parameter will cause an isolation of the MSlVs. Note that the high steam flow alarm may clear if any of the MSlVs close and flow is reduced below the setpoint. I the high steam flow alarm was received (even though it was subsequently cleared) or there is other indication of high flow along with the high temperature alarm, the entry condition for this threshold has been met.

Even though RWCU and Feedwater systems do not contain steam, they are included in the list because an UNISOLABLE break could result in the high-pressure discharge of fluid that is flashed to steam from relatively large volume systems directly connected to the RCS. Note:

Each of the two feedwater injection lines is isolated from the reactor vessel via a series of swing Page 24 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 240 of 288 check valves. The ability of these check valves to isolate cannot be determined until after feedwater is no longer injecting into the reactor vessel.

Large high-energy lines that rupture outside primary containment can discharge significant amounts of inventory and jeopardize the pressure-retaining capability of the RCS until they are isolated. If it is determined that the ruptured line cannot be promptly isolated, the RCS barrier Loss threshold is met.

Basis Reference(s):

1. FSAR Section 5.4.5

2. FSAR Section 6.3

3. FSAR Section 5.4.6

4. FSAR Section 10.4.7

5. FSAR Section 5.4.8

6. P&ID M-141 Nuclear Boiler

7. NEI 99-01 RCS Leak Rate RCS Loss 3.A Page 25 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 241 of 288 Barrier: Reactor Coolant System Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

2. Emergency RPV Depressurization is required Definition(s):

N/A Basis:

Plant symptoms requiring Emergency RPV Depressurization per the EOPs are indicative of a loss of the RCS barrier. If emergency depressurization is required, the plant operators are directed to open safety relief valves (SRVs). Even though the RCS is being vented into the suppression pool, a loss of the RCS exists due to the diminished effectiveness of the RCS pressure barrier to a release of fission products beyond its boundary.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. EO-000-103 Primary Containment Control

3. EO-000-104 Secondary Containment Control

4. EO-000-1 05 Radioactivity Release Control

5. EO-000-1 12 Emergency RPV Depressurization

6. EO-000-1 13 Level Power Control

7. EO-000-114 RPV Flooding

8. NEI 99-01 RCS Leak Rate RCS Loss 3.B Page 26 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 242 of 288 Barrier: Reactor Coolant System Category: B. RCS Leak Rate Degradation Threat: Potential Loss Threshold:

1. UNISOLABLE primary system leakage that results in exceeding EITHER of the following:

• One or more Max Normal Reactor Building Radiation Limits (EO-000-104 Table 9) that can be read in the control room (Table F-3)

OR

• One or more Max Normal Reactor Building Area Temperature Limits (EO-000-1 04 Table 8) that can be read in the control room (Table F-4)

Table F-3 Max Normal Reactor Building Radiation Limits RB Area ARM Channel Max Norm ARM NumberDecito Elevation (ft) DsrpinRad Limit 818 35 Cask Stor Area Hi Alarm 14 Spent Fuel Crit Mon 15 Refuel Floor North (South U2) 42 Refuel Floor West 47 (44 U2) Spent Fuel Crit Mon 749 8 RWCU Recirc PP Access Hi Alarm 10 Fuel Pool PP Area 11 Rx Bldg Sample St 719 5 CRD North Hi Alarm 6 CRD South 670 16 Remote Shutdown Room Hi Alarm 645 3 HPCI PP & Turbine Room Hi Alarm 2 RCIC PP & Turbine Room 25 RHR AC PP Room 1 RHR BD PPRoom 4 RB/RW Sump Area Page 27 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 243 of 288 Table F-4 Max Normal Reactor Building Temperature Limits RB Area Max Normal Elevation Area Temperature Temp (ft) (°F) 749 RWCU-Pump Room 120 RWCU-Heat Exch Room 120 RWCU-Penetration Room 120 719 Main Steam Line Tunnel 157 683 HPCI Pipe Routing Area 120 RCIC Pipe Routing Area 120 645 HPCI-Equip Area 120 HPCI-Emerg Area Cooler 120 645 RCIC-Emerg Area Cooler 120 RCIC-Equip Area 120 645 RHR Equip Areal1 110 645 RHR Equip Area 2 110 Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system (e.g. EP-OOO-104 has direction not to isolate systems if they are needed for EOP actions or damage control)

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

This RCS Potential Loss threshold is limited to primary system leakage that results in exceeding one or more Max Normal Reactor Building Radiation or Temperature Limits that can be remotely determined from within the control room shown in Tables F-3 and F-4 (ref. 1).

NRC regulations require the SSES to establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded (EAL "triqgper").

Max Normal conditions shall be assumed to be from RCS leakage until proven otherwise.

1. Tho* 15 minuto, cl,,

-sification** r...u.iromont (EAL 'trigger"-) for this threshold begins when one or more of the above Max Normal Reactor Building Radiation or Temperature Limits are exceeded.

Page 28 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 244 of 288

• If subsequent actions taken to isolate the leak are successful within the 15 minute classification period, this EAL should not be declared. (Note: EAL SU5.1 should be evaluated).

• If subsequent investigation, within the 15 minute classification period, reveals that the Max Norm conditions are not due to RCS leakage, this EAL should not be declared.

If it cannot be determined within 15 minutes of the EAL "triqper" that the leak is isolable and not the result of condition previously described, then the EAL shall be declared.

Note that a RCS leak could cause the fire suppression systems to actuate. If this occurs, the potential exists that the fire suppression systems could cause the area temperatures to be lower than the values specified in the EO-000-104 even though there is a RCS leak.

• Once it is known that the cause of exceeding Max Norm temperatures is due to a FIRE or loss of ventilation then this threshold is not met. The applicable FIRE EAL should be evaluated.

• If there is certainty that the fire suppression system actuation was caused by a RCS leak and NOT a fire then it is appropriate to judge that the MAX NORM temperature limits have been met even if the actual area temperatures are lower than those listed in the EO-000-1 04.

The presence of elevated general area temperatures or radiation levels in the secondary containment may be indicative of UNISOLABLE primary system leakage outside the primary containment.

The Max Normal Reactor Building Limit values define this RCS threshold because they are the maximum normal operating values and signify the onset of abnormal system operation. When parameters reach this level, equipment failure or misoperation may be occurring. Elevated parameters may also adversely affect the ability to gain access to or operate equipment within the affected area. The locations into which the primary system discharge is of concern correspond to the areas addressed in EO-000-1 04, Secondary Containment Control, Table 8 that can be read in the control room (ref. 2).

Cycling of SRVs to reduce primary system overpressure is not considered reactor coolant leakage. Inventory loss events, such as a stuck open SRV, venting and draining the RCS during cold shutdown or refueling, should not be considered when referring to "RCS leakage" because they are not indications of a break which could propagate. For these events entry into this threshold is not warranted however consideration should be given to RCS Loss - RCS Leak Rate threshold B2.

In general, multiple indications should be used to validate that a primary system is discharging outside Primary Containment. For example, a high area radiation condition may be caused by radiation shine from nearby steam lines or the movement of radioactive materials. Conversely, a high area radiation condition in conjunction with other indications (e.g. room flooding, high area temperatures, reports of steam in the secondary containment, an unexpected rise in feedwater flowrate, or unexpected main turbine control valve closure) may indicate that a primary system is discharging into the secondary containment.

Page 29 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 245 of 288 Potential loss of RCS based on primary system leakage outside the primary containment is determined from EOP temperature or radiation Max Normal Operating values in areas such as main steam line tunnel, RCIC, HPCI, etc., which indicate a direct path from the RCS to areas outside primary containment.

A Max Normal Operating value is the highest value of the identified parameter expected to occur during normal plant operating conditions with all directly associated support and control systems functioning properly.

The indicators reaching the threshold barriers and confirmed to be Caused by RCS leakage from a primary system warrant an Alert classification. A primary system is defined to be the pipes, valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system.

An UNISOLABLE leak as described above escalates to a Site Area Emergency when combined with Containment Barrier Loss threshold B.1 (after a containment isolation) and a General Emergency when the Fuel Clad Barrier criteria is also exceeded.

Basis Reference(s):

1. NCV 05000387; 388/2013005-04, Inadequate Instrumentation to Implement EALs for Fission Product Barrier. Degradation

2. EO-000-104 Secondary Containment Control

3. NEI 99-01 RCS Leak Rate RCS Potential Loss 3.A Page 30 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 246 of 288 Barrier: Reactor Cooiant System Category: C. PC Conditions Degradation Threat: Loss Threshold:

1. Primary Containment pressure > 1.72 psig due to RCS leakage Definition(s):

None Basis:

The drywell high pressure scram setpoint is an entry condition to EO-000-1 02, RPV Control, and EO-000-1 03, Primary Containment*Control (ref. 1, 2). Normal primary containment pressure control functions (e.g., operation of drywell coolers, vent through SGT, etc.) are specified in EO-000-1 03 in advance of less desirable but more effective functions (e.g., operation of drywell or suppression pool sprays, etc.).

In the design basis, primary containment pressures above the drywell high pressure scram setpoint are assumed to be the result of a high-energy release into the containment for which normal pressure control systems are inadequate or incapable of reversing the increasing pressure trend. Pressures of this magnitude, however, can be caused by non-LOCA events such as a loss of drywell cooling or inability to control primary containment vent/purge (ref. 3).

The threshold phrase "...due to RCS leakage" focuses the barrier failure on the RCS instead of the non-LOCA malfunctions that~may adversely affect primary containment pressure. PC pressure greater than 1.72 psig with corollary indications (e.g., drywell temperature, indications of loss of RCS inventory) should therefore be considered a Loss of the RCS barrier. Loss of drywell cooling that results in pressure greater than 1.72 psig should not be considered an RCS barrier Loss.

1.72 psig is the drywell high pressure setpoint which indicates a LOCA by automatically initiating the ECCS or equivalent makeup system.

There is no Potential Loss threshold associated with Primary Containment Pressure.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. FO-000-103 Primary Containment Control

3. FSAR Section 6.2.1 Primary Containment Functional Design

4. NEI 99-01 Primary Containment Pressure RCS Loss 1I.A Page 31 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 247 of 288 Barrier: Reactor Coolant System Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

None Page 32 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 248 of 288 Barrier: Reactor Coolant System Category: 0. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

1. CHRRM radiation > 7.0E+0 R/hr with indication of a RCS leak inside the drywell Definition(s):

N/A Basis:

Two gamma radiation levels ion chambers are located inside the drywell to monitor post-accident rad levels. The detectors are located in the drywell on elevation 719'. They are always in service and read out on the 0601 panel. Range is 100 to 108 R~hr. Environmentally qualified since they are required for use after an accident. A U-234 bug source is installed in the detector to serve as a self-check for instrument operability. The source provides approximately a 1 R/hr dose rate with the reactor shutdown (ref. 1). When the plant is at 100% power, drywell rad indication is normally about 3-4 R/hr. Containment High Range Radiation Monitor (CHRRM) readings of approximately 3 R/hr indicate an instantaneous release of reactor coolant at normal operating concentrations of 1-131 to the drywell atmosphere. Adding this value to the normal CHRRM background readings of 3-4 R/hr (100% power normal operation) provides the value of 7 R/hr. (ref. 2)

Indication of a RCS leak into the drywell is added to qualify the radiation monitor indication to avoid declaring the loss of the RCS barrier for situations where the radiation increase is not due to a primary system leak. For situations that involve failure of the Fuel Clad Barrier alone,"

containment Radiation levels would increase to greater than 30 R/hr potentially giving a false indication of a loss of the RCS barrier. Therefore the EAL contains a qualifier to preclude over classification of the event if only the fuel clad barrier has failed. Indication of a leak should be determined by observing other containment indications such as sump level, drywell pressure and ambient temperature.

The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold D.1 since it indicates a loss of the RCS Barrier only.

There is no RCS Barrier Potential Loss threshold associated with Primary Containment Radiation.

Basis Reference(s):

1. General Atomic High-Range Gamma Radiation Monitoring System Manual

2. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008 Page 33 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 249 of 288

3. NEI 99-01 Primary Containment Radiation RCS Loss 4.A Page 34 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 250 of 288 Barrier: Reactor Coolant System Category: 0. PC Radiation / RCS Activity Degradation Threat: Potential Loss Threshold:

None Page 35 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 251 of 288 Barrier: Reactor Coolant System Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

None Page 36 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 252 of 288 Barrier: Reactor Coolant System Category: E. PC Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Page 37 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 253 of 288 Barrier: Reactor Coolant System Category: F. ED/RM Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates loss of the RCS barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the RCS barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation existslif the degradation will likely occur within two hours based on a projection of current safety system perf'ormance. The term "imminent" refers to the recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoringq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident seguences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergen~cy classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Loss 6.A Page 38 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 254 of 288 Barrier: Reactor Coolant System Category: F. ED/RM Judgment Degradation Threat: Potential Loss

,Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates potential loss of the RCS barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the RCS barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to the inability to reach final safety acceptance criteria before completing all checks.

• Barrier monitorinq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

• The Emergency Director/Recovery Manager should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Potential Loss 6.A Page 39 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 255 of 288 Barrier: Primary Containment Category: A. RPV Level Degradation Threat: Loss Threshold:

None Page 40 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 256 of 288 Barrier: Primary Containment Category: A. RPV Level Degradation Threat: Potential Loss Threshold:

1. SAsentry required Definition(s):

None Basis:

The Potential Loss threshold is identical to the Fuel Clad Loss RPV Water Level threshold A.1.

The Potential Loss requirement for SAG entry is required indicates adequate core cooling CANNOT BE RESTORED AND MAINTAINED and that core damage is possible. EOPs specify the requirement for entry to the SAGs when core cooling is severely challenged. These EOPs provide instructions to ensure adequate core cooling by maintaining RPV water level above prescribed limits or operating sufficient RPV injection sources when level cannot be determined.

SAG entry is required when (ref. 1, 2):

- RPI ater*÷,Iocl C'ANlNOT BE DrESTORED-F ANDlr M/AI!NTAINED-r ,.bovet, ,179 in.

• , DDP/ wa,,c-r !cve, C'ANNOC~T BE. RES:ZTOREDr' ANDl' MAIN~TAINEDr~ above-.,* 2)10* in. (jt pump.*

suction) w=ith at least ono cor *e,'prayloop injecting into tho DDP/ at% 6350 gpm OR

• EO-1(2)00-102 - when RPV level cannot be restored and maintained above MSCRWL

(-179") or elevation of iet pump suctions (-210") when a loop of Core Sprav is injecting (>

6350 gom).

• EO-1 (2)00-113 - when RPV level cannot be restored and maintained above MSCRWL (E-1792).014 AW)-we oedm~ei curnq

• EO-1(2)00-1 14A(Non-ATWS) - when core damagqe is occurring.

The above EOP conditions represent a challenge to core cooling and are the minimum values to assure core cooling without further degradation of the clad.

SAGs entry is also a Potential Loss of the Fuel Clad barrier (FC P-Loss A.1) which constitutes a Site Area Emergency. The threshold for the RCS barrier (RCS Loss A.1) should also be Page 41 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 257 of 288 evaluated for escalation to a General Emergency if SAGs entry results in meeting that threshold.

PRA studies indicate that the condition of this Potential Loss threshold could be a core melt sequence which, if not corrected, could lead to RPV failure and increased potential for primary containment failure.

Basis Reference(s):

1. EP-DS-001 Containment Combustible Gas Control

2. EP-DS-002 RPV and Primary Containment Flooding SAG-2

3. NEI 99-01 RPV Water Level PC Potential Loss 2.A Page 42 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 258 of 288 Barrier: Primary Containment Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

1. UNISOLABLE primary system leakage that results in exceeding EITHER of the following:

• One or more Max Safe Reactor Building Radiation Limits (EO-000-104 Table 9) that can be read in the control room (Table F-5)

OR

• One or more Max Safe Reactor Building area temperature Limits (EO-000-104 Table 8) that can be read in the control room (Table F-6)

Table F-5 Max Safe Reactor Building Radiation Limits Max Safe Rad RB Area AR ubrARM ChannelLit Elevation (ft) Description (IR 818 49 Refuel Floor Area 10 749 52 RWCU Recirc PP Access 10 54 Fuel Pool PP Area 719 50 CRD North 10 51 CRD South 670 53 Remote Shutdown Room 10 645 48 HPCI PP & Turbine Room 10 57 RCIC PP & Turbine Room 55 RHR A CPP Room 56 RHR B D PP Room Page 43 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 259 of 288 Table F-6 Max Safe Reactor Building Temperature Limits RB Area Max Safe Elevation Area Temperature Temp (ft) (°F) 749 RWCU-Pump Room 147 RWCU-Heat Exch Room 147 RWCU-Penetration Room 131 719 Main Steam Line Tunnel 177 683 HPCI Pipe Routing Area 167 RCIC Pipe Routing Area 167 645 HPCI-Equip Area 167 HPCI-Emerg Area Cooler 167 645 RCIC-Emerg Area Cooler 167 RCIC-Equip Area 167 645 RHR Equip Areal1 142 645 RHR Equip Area 2 142 Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system (e.g. EP-O00-104 has direction not to isolate systems if they are needed for EOP actions or damage control)

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

This Primary Containment Loss threshold is limited to primary system leakage that results in exceeding one or more Max Safe Reactor Building Radiation or Temperature Limits that can be remotely determined from within the control room shown in Tables F-5 and F-6 ,(ref. 1).

NRC regulations require the SSES to establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded (EAL "tripqper").

• 1 J P J j m I J* A I I£d

• tl*

• II

• I I I no i~, minuto c:acs:Tlcat:on reguiromont (b.AL irippor") Tor mis tflrccflold DopIns wncn onc or

.... # I  !----!l ........... J_ I more ni TnlU *nnUV(J nviav *aTC rw nTor *n iiunnnn i-nauiain or n momratroT limi rnTs are exceaea1.t Page 44 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 260 of 288 Max Safe conditions shall be assumed to be from RCS leakage until proven otherwise.

• EAL "triqper" for this threshold beqins when one or more of the above Max Safe Reactor Buildinp Radiation or Temperature Limits are exceeded.

emergenc...ma. be appoprat...;* If subsequent actions taken to isolate the leak are successful within the 15 minute classification period, this EAL should not be declared.

• If subsequent investigation, within the 15 minute classification period, reveals that the Max Safe conditions are not due to RCS leakage, this EAL should not be declared.

If it cannot be determined within 15 minutes of the EAL "Triqpqer" that the leak is isolable and not the result of condition previously described, then the EAL shall be declared.

Note that a RCS leak could cause the fire suppression systems to actuate. If this occurs the potential exists that the fire suppression systems could cause the area temperatures to be lower than the values specified in the EO-000-104 even though there is a RCS.

• Once it is known that the cause of exceeding MAX SAFE temperatures is due to a FIRE or loss of ventilation then this threshold is not met. The applicable FIRE EAL should be evaluated.

• If there is certainty that the fire suppression system actuation was caused by a RCS leak and NOT a fire then it is appropriate to judge that the MAX NORM temperature limits have been met even if the actual area temperatures are lower than those listed in the EO-000-1 04 The presence of elevated general area temperatures or radiation levels in the secondary containment may be indicative of UNISOLABLE primary system leakage outside the primary containment.

• The Maximum Safe Reactor Building Limit values define this Containment barrier threshold because they are indicative of problems in the secondary containment that are spreading and pose a threat to achieving a safe plant shutdown. This threshold addresses problematic discharges outside primary containment that may not originate from a high-energy line break. The locations into which the primary system discharge is of concern correspond to the areas addressed in EO-000-104, Secondary Containment Control, Table 8 that can be read in the control room (ref. 2).

In general, multiple indications should be used to validate that a primary system is discharging outside Primary Containment. For example, a high area radiation condition may be caused by radiation shine from nearby steam lines or the movement of radioactive materials. Conversely, a high area radiation condition in conjunction with other indications (e.g. room flooding, high area temperatures, reports of steam in the secondary containment, an unexpected rise in feedwater flowrate, or unexpected main turbine control valve closure) may indicate that a primary system is discharging into the secondary containment.

The Max Safe Operating Temperature and the Max Safe Operating Radiation Level are each the highest value of these parameters at which neither: (1) equipment necessary for the safe shutdown of the plant will fail, nor (2) personnel access necessary for the safe shutdown of the Page 45 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 261 of 288 plant will be precluded. EOPs utilize these temperatures and radiation levels to establish conditions under which RPV depressurization is required.

The temperatures and radiation levels should be confirmed to be caused by RCS leakage from a primary system. A primary system is defined to be the pipes, valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system.

In combination with RCS Potential Loss B.1 this threshold would result in a Site Area Emergency.

There is no Potential Loss threshold associated with Primary Containment Isolation Failure.

Basis Reference(s):

1. NOV 05000387; 388/2013005-04, Inadequate Instrumentation to Implement EALs for Fission Product Barrier Degradation

2. EO-000-104 Secondary Containment Control

3. NEI 99-01 RCS Leak Rate PC Loss 3.0 Page 46 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 262 of 288 Barrier: Primary Containment Category: B. RCS Leak Rate Degradation Threat: Potential Loss Threshold:

None Page 47 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 263 of 288 Barrier: Primary Containment Category: C. PC Conditions Degradation Threat: Loss Threshold:

1. UNPLANNED rapid drop in Primary Containment pressure following Primary Containment pressure rise Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

Rapid UNPLANNED loss of primary containment pressure (i.e., not attributable to drywell spray or condensation effects) following an initial pressure increase indicates a loss of primary containment integrity.

This threshold relies on operator recognition of an unexpected response for the condition and therefore a specific value is not assigned. The unexpected (UNPLANNED) response is important because it is the indicator for a containment bypass condition.

Basis Reference(s):

1. NEI 99-0 1 Primary Containment Conditions PC Loss I.A Page 48 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 264 of 288 Barrier: Primary Containment Category: C. PC Conditions Degradation Threat: Loss Threshold:

2. Primary Containment pressure response not consistent with LOCA conditions Definition(s):

None Basis:

The calculated pressure response of the containment is shown in Figure 6.2-2 (ref. 1)

(reproduced on next page). The maximum calculated drywell pressure (63.3 psia or 48.6 psig) is well below the design allowable pressure of 53 psig (ref. 2).

Due to conservatisms in LOCA analyses, actual pressure response is expected to be less than the analyzed response. For example, blowdown mass flowrate may be only 60-80% of the analyzed rate.

Primary containment pressure should increase as a result of mass and energy release into the primary containment from a LOCA. Thus, primary containment pressure not increasing under these conditions indicates a loss of primary containment integrity.

This threshold relies on operator recognition of an unexpected response for the condition and therefore a specific value is not assigned. The unexpected (UNPLANNED) response is important because it is the indicator for a containment bypass condition.

Basis Reference(s):

1. FSAR Figure 6.2-2

2. FSAR Section 6.2.1.1.3.1

3. NEI 99-01 Primary Containment Conditions PC Loss 1 .B Page 49 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 265 of 288 Short-Term RSLB Pressure Response 70 60 50 g 40 O* 30 20 -O W',Pres*

-WW Press 10 0 5 10 15 20 25 30 Time (se*)

FSAR REV. 65 SUSQUEHANNA STEAM ELECFRIC STATION UNIrTS 1 AND 2 FINAL SAFETY ANALYSIS REPORT PRESSURE RESPONSE FOR RECIRCULATION UINE BREAK FIGURE 6.2-2, Re':. 56 Auto ,Cart; Figura Fsar 6__,dn-.g Page 50 of164

Attachment 2 EP-RM-004 Revision [X]

Page 266 of 288 Barrier: Containment Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

1. Primary Containment pressure > 53 psig Definition(s):

None Basis:

When the primary containment exceeds the maximum allowable value (53 psig) (ref. 1), primary containment venting may be required even if offsite radioactivity release rate limits will be exceeded (ref. 2). The drywell and suppression chamber maximum allowable value of 53 psig is based on the primary containment design pressure as identified in the SSES accident analysis.

If this threshold is exceeded, a challenge to the containment structure has occurred because assumptions used in the accident analysis are no longer valid and an unanalyzed condition exists. This constitutes a Potential Loss of the Containment barrier even if a containment breach has not occurred.

The threshold pressure is the primary containment internal design pressure. Structural acceptance testing demonstrates the capability of the primary containment to resist pressures greater than the internal design pressure. A pressure of this magnitude is greater than those expected to result from any design basis accident and, thus, represent a Potential Loss of the, Containment barrier.

Basis Reference(s):

1. ESAR Section 6.2.1.1.3.1

2. EO-000-103 Primary Containment Control

3. NEI 99-01 Primary Containment Conditions PC Potential Loss 1I.A Page 51 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 267 of 288 Barrier: Containment Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

2. Deflagration concentrations exist inside PC (H2 _>6% AND 02 Ž>5%)

Definition(s):

None Basis:

Deflagration (explosive) mixtures in the primary containment are assumed to be elevated concentrations of hydrogen and oxygen. BWR industry evaluation of hydrogen generation for development of EPGs/SAGs indicates that any hydrogen concentration above minimum detectable is not to be expected within the short term. Post-LOCA hydrogen generation primarily caused by radiolysis is a slowly evolving, long-term condition. Hydrogen concentrations that rapidly develop are most likely caused by metal-water reaction. A metal-water reaction is indicative of an accident more severe than accidents considered in the plant design basis and would be indicative, therefore, of a potential threat to primary containment integrity. Hydrogen concentration of approximately 6% is considered the global deflagration concentration limit (ref. 1).

Except for brief periods during plant startup and shutdown, oxygen concentration in the primary containment is maintained at insignificant levels by nitrogen inertion. The specified values for this Potential Loss threshold are the minimum global deflagration concentration limits (6%

hydrogen and 5% oxygen) and readily recognizable because 6%..,J.,-*- .... ,hydrge

,ell

... a,

'bo've the.,,

EQ* 000 103, Prima,"' Containmont,rol,,,*

Cont ont,"' cond,,ition. EP-DS-001 requires control of drywell and suppression chamber atmosphere gas concentrations to less than 6% hydrogen and 5% oxygen to assure that an exp~losive mixture does not exit (ref. 2 ,-3 ). Values above the hydrogen/oxygen concentrations (6% and 5%, respectively) require intentional primary containment venting, which is defined to be a Loss of Containment (PC Loss E.2).

Hydrogen and oxygen concentration in the drywell during normal operation. These monitors are isolated by accident isolation signals. However, monitors CAC-AT-4409 and 4410 will be realigned to the primary containment for post-accident monitoring via an operator actuated isolation signal override circuit when directed by the EOPs.

If hydrogen concentration reaches or exceeds the lower flammability limit, as defined in plaf-t

• Q~EP-DS-001, in an oxygen rich environment, a potentially explosive mixture exists. If the combustible mixture ignites inside the primary containment, loss of the Containment barrier could occur.

Basis Reference(s):

1. BWROG EPG/SAG Revision 3, Subsection PC/G

-- "2" E"t*t*/*"

000-103 Q Primar Cot"an*mont* Cot'-÷rol Page 52 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 268 of 288

32. EP-DS-001 Containment Combustible Gas Control 4_3. NEI 99-0 1 Primary Containment Conditions PC Potential Loss 1 .B Page 53 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 269 of 288 Barrier: Containment Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

3. Heat Capacity Temperature Limit (Figure - HCTL) exceeded Figure - HCTL He"t Cap..city, Temperature.. Limit Definition(s):

None Basis:

This threshold is met when the final step of section SP/T in EO-O00-1 03, Primary Containment Control, is reached (ref. 1).

Page 54 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 270 of 288 The Heat Capacity Temperature Limit (HCTL) 'is the highest suppression pool temperature from which Emergency RPV Depressurization will not raise:

Suppression chamber temperature above the maximum temperature capability of the suppression chamber and equipment within the suppression chamber which may be required to operate when the RPV is pressurized, OR Suppression chamber pressure above Primary Containment Pressure Limit A, while the rate of energy transfer from the RPV to the containment is greater than the capacity of the containment vent.

The HCTL is a function 'of RPV pressure, suppression pool temperature and suppression pool water level. It is utilized to preclude failure of the containment and equipment in the containment necessary for the safe shutdown of the plant and therefore, the inability to maintain plant parameters below the limit constitutes a potential loss of containment.

Basis Reference(s):

1. E0-000-1 03 Primary Containment Control

2. NEI 99-01 PrimarY Containment Conditions PC Potential Loss 1.C Page 55 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 271 of 288 Barrier: Primary Containment Category: D. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

None Page 56 of 64

Attachment 2 EP-RM-004 Revision [X]

• Page 272 of 288 Barrier: Primary Containment Category: 0. PC Radiation / RCS Activity Degradation Threat: Potential Loss Threshold:

1. CHRRM radiation > 4.0E+4R/hr Definition(s):

None Basis:

Two gamma radiation levels ion chambers are located inside the drywell to monitor post-accident radiation levels. The detectors are located in the drywell on elevation 719'. They are always in service and read out on the 0601 panel. Range is 100 to 108 R/hr. Environmentally qualified since they are required for use after an accident. A U-234 bug source is installed in the detector to serve as a self-check for instrument operability. The source provides approximately a 1 R/hr dose rate with the reactor shutdown (ref. 1). When the plant is at 100% power, Containment High Range Radiation Monitor (CHRRM) indication is normally about 3-4 R/hr. A reading of 40,000 R/hr indicates the release of reactor coolant into the drywell with elevated activity indicative of 20% fuel clad damage (ref. 2).

An analysis of the Containment High Range Radiation Monitor (CHRRM) response to a Loss-Of-Coolant Accident (LOCA) is given in reference 2. Results are summarized in Reference 2, Section 2 for the case of 1% clad damage. For this threshold a reactor shutdown time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is conservatively assumed. Although CHRRM data is always available for emergency planning, a one hour shutdown time is conservative for times less than one hour and is applicable to the timing of the sequence of events for a LOCA that would result in both the release of reactor coolant activity to containment and damage to 20% of the fuel clad. From reference 2, Section 2, the calculated CHRRM dose rate at one hour after shutdown for a complete loss of reactor coolant activity to containment with 1% clad damage is 2160 R/hr. Multiplying this value by a factor of 20 to account for 20% clad damage results in a CHRRM dose rate of 43,200 R/hr. This value is rounded to 40,000 R/hr for human factors considerations.

A Containment High Range Rad Monitor reading > 40,000 R/hr is a value which indicates significant fuel damage well in excess of that required for loss of RCS and Fuel Clad. A major failure of fuel cladding which allows radioactive material to be released from the core into the reactor coolant could result in a major release of radioactivity requiring offsite protective actions.

Regardless of whether containment is challenged, this amount of activity in containment corresponding to a CHHRM reading > 40,000 R*hr, if released, could have such severe consequences that it is prudent to treat this as a potential loss of containment, such that a General Emergency declaration is warranted.

In order to reach this Containment barrier Potential Loss threshold, a loss of the RCS barrier (RCS Loss D.1 ) and a loss of the Fuel Clad barrier (FC'Loss D.1) have already occurred. This threshold, therefore, represents at a General Emergency classification.

Page 57 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 273 of 288 The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and ROS Barrier Loss thresholds.

N UREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification level to a General Emergency.

Basis Reference(s):

1. General Atomic High-Range Gamma Radiation Monitoring System Manual

2. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008

3. NEI 99-01 Primary Containment Radiation Fuel Clad Potential Loss I .D Page 58 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 274 of 288 Barrier: Primary Containment Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

1. UNISOLABLE direct downstream pathway to the environment exists after Primary Contain ment isolation signal Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system (e.g. EP-O00-104 has direction not to isolate systems if they are needed for EOP actions or damage control)

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

This threshold addresses failure of open isolation devices which should close upon receipt of a manual or automatic containment isolation signal resulting in a significant radiological release pathway directly to the environment.

The concern is the unisolable open pathway to the environment. A failure of the ability to isolate any one line with a pathway directly to the environment indicates a breach of primary containment integrity. Examples include:

• This EAL is applicable if plant operators attempt to close isolation valves before any automatic setpoints are reached, and both valves fail to close AND a downstream pathway to the environment exists. If subsequent actions are successful, downgrading the emergency may be appropriate.

• Main Steam Line breaks with two MSIVs in one line failing to close.

• HPCI, RCIC or RWCU steam line breaks with all isolation valves in one line failing to close.

• UNISOLABLE containment atmosphere vent paths.

• Automatic closure of both isolation valves in one line are disabled AND an isolation signal occurs AND a downstream pathway exits.

The adjective "direct" modifies "release pathway" to discriminate against release paths through interfacing liquid systems. The following examples do not meet the EAL threshold:

• If the main condenser is available with an UNISOLABLE main intact steam line, there may be releases through the steam jet air ejectors and gland seal exhausters. These pathways are monitored, however, and do not meet the intent of an UNISOLABLE direct release path to the environment. These minor releases are assessed using the Category R, Abnormal Rad Release / Rad Effluent, EALs.

• Leakage into a closed system (e.g. RHR, Core Spray) is to be considered only if the closed system is breached and thereby creates a significant pathway to the environment.

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Page 59 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 275 of 288

• SCRAM Discharge Volume valves fail to close. The SDV drains to the Reactor Building Sump, which creates the pathway to the environment.

• The existence of an in-line charcoal filter (SGTS) does not make a release path indirect since the filter is not effective at removing fission noble gases. Typical filters have an efficiency of 95-99% removal of iodine. Given the magnitude of the core inventory of iodine, significant releases could still occur. In addition, since the fission product release would be driven by boiling in the reactor vessel, the high humidity in the release stream can be expected to render the filters ineffective in a short period.

• EO-000-1 03, Primary Containment Control, Section PC/P may specify primary containment venting and intentional bypassing of the containment isolation valve logic, even if offsite radioactivity release rate limits are exceeded (ref. 1). Under these conditions with a valid containment isolation signal, the Containment barrier should be considered lost.

Declaration of this EAL threshold constitutes a radiological release in progress.

The use of the modifier "direct" in defining the release path discriminates against release paths through interfacing liquid systems or minor release pathways, such as instrument lines, not protected by the Primary Containment Isolation System (PCIS).

The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream.

Following the leakage of RCS mass into primary containment and a rise in primary containment pressure, there may be minor radiological releases associated with allowable primary containment leakage through various penetrations or system components. Minor releases may also occur if a primary containment isolation valve(s) fails to close but the primary containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of primary containment but should be evaluated using the Recognition Category R ICs.

Basis Reference(s):

1. EO-000-1 03 Primary Containment Control

2. NEI 99-01 Primary Containment Isolation Failure PC Loss 3.A Page 60 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 276 of 288 Barrier: Primary Containment Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

2. Intentional Primary Containment venting per E..-k,..[DS 001*RPlv anD\,P,*'.

Cv Vontingprocedures OR EQ procedures Definition(s):

None Basis:

EQ 000nn- 103,*, Primary Co,,ntainmc,,,,nt,Cnrol,,,.-*v,,,

EP-DS procedures or EQ procedures may specify primary containment venting and intentional bypassing of the containment isolation valve logic, even if offsite radioactivity release rate limits are exceeded (ref. 1 -_._). The threshold is met when the operator begins venting the primary containment in accordanco ';ith EP DS 001, RPV ad-P.C-.Veit4i, not when actions are taken to bypass interlocks prior to opening the vent valves (ref. 2).

Because the containment vent valves are not qualified for opening/reclosure in a post-accident environment, there is no guarantee that venting, once initiated, can be terminated. Thus it is assumed that once the vents are opened with a source term, they are not re-closed (ref. 3,7).

Intentional venting of primary containment for primary containment pressure control to the secondary containment and/or the environment is a Loss of the Containment. Venting for primary containment pressure control when not in an accident situation (e.g., to control pressure below the drywell high pressure scram setpoint) does not meet the threshold condition.

Basis Reference(s):

1. EP-DS-001 Containment Combustible Gas Control

2. EP-DS-002 RPV and Primary Containment Floodinq SAG-2

3. EP-DS-004 Primary Containment Ventinq

4. EP-DS-005 Loss of All Decay Heat Removal

5. EO-000-1 03 Primary Containment Control

2. EP DS 001 RPV and PC Vonting6. EO-000-1 12 Emerqency Rapid Depressurization

,37. NL-98-036, SSES Safety Evaluation for EP-DS-004, Primary Containment and RPV Venting 48_. NEI 99-01 Primary Containment Isolation Failure PC Loss 3.B Page 61 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 277 of 288 Barrier: Primary Containment Category: E. PC Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Page 62 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 278 of 288 Barrier: Primary Containment Category: F. ED/RM Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates loss of the Primary Containment barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoringq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A Page 63 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 279 of 288 Barrier: Primary Containment Category: F. ED/RM Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates potential loss of the Primary Containment barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitorinq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A Page 64 of 64

Attachment 3 EP-RM-004 Revision [X]

Page 280 of 288 ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

Background

NEI 99-01 Revision 6 l~s AA3 (SSES RA3.2) and HA5 (SSES HA5.1) prescribe declaration of an Alert based on impeded access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal plant operations, cooldown or shutdown is located. These areas are intended to be plant operating mode dependent. Specifically the Developers Notes For AA3 and HA5 states:

The "site-specific list of plant rooms or areas with entry-related mode applicabilityidentified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operatingprocedures used for normal plant operation, cooldown and shutdown. Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be required for each room or area.

The list should not include rooms or areas for which entry is requiredsolely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

Further, as specified in IC HA5:

The list need not include the Control Room if adequate engineeredsafety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas.

Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.

Site-Specific Analysis The Control Room is excluded from Table R-2 since it is included EAL RA3.1 for all modes.

NEI 99-01 Rev. 6 developer notes state that the control room does not need to be included Table R-2 for this reason.

The Control Room is included in Table H-2 for all modes since adequate engineered safety/design features are not in place to preclude a Control Room evacuation due to the release of a hazardous gas at SSES.

The remaining list of mode dependent rooms in Tables R-2 and H-2 is a list of rooms where actions are absolutely required to be performed to move the plant from normal operations through cool down and to achieve and maintain cold shutdown. These areas are not areas requiring entry to solely meet surveillance requirements. This does not include actions called out for in the procedures that are not absolutely needed to move the plant into and maintain cold shutdown (e.g. shutting down turbine lube oils systems, opening of system drains). In order to transition from normal operations (Modes 1 and 2) to hot shutdown (Mode 3) the only location required is the Control Room since the plant is able to be placed into hot shutdown from the control room without the need for any other room entry.

Page 1 of 3

Attachment 3 EP-RM-004 Revision [X]

Page 281 of 288 The remaining rooms/areas shown in in Tables R-2 and H-2 were determined based on the discussion section above and Modes 1 and 2 were excluded. Therefore, the analysis starting point was a review the steps of GO-100/200-005 "PLANT SHUTDOWN TO HOT/COLD SHUTDOWN" after the Unit is has reached Mode 3. The analysis then branched to other procedure steps described in the GO's if those procedures steps were not excluded from consideration as noted in the discussion section. The analysis concluded that Reactor Building areas and elevations listed in in Tables R-2 and H-2 contain equipment that must be manipulated in Mode 3 to achieve and maintain cold shutdown. Modes 4 and 5 are also included for these areas to account for swapping loops for long term operation of shutdown cooling.

Tables R-2 and H-2 Bases A review of station operating procedures identified the following mode dependent in-plant actions and associated areas that are required for normal plant operation, cooldown or shutdown Unit 1 RA3.2 /HA5.1 Elevation Area(s)

Mode(s) 670 27 3,4,5 683 27, 28 & 29 3,4,5 703 28 &29 3,4,5 719 25 &29 3,4,5 749 25 &29 3,4,5 729

• 12, 21 1,2,3,4,5,D Unit 2 RA3.2 / HA5.1 Mode(s)

Elevation Area(s) 670 32 3,4,5 683 32, 33 & 34 3,4,5 703 33 & 34 3,4,5 719 30 & 34 3,4,5 749 32 & 33 3,4,5 729

• 12, 21 1, 2,3,4,5,D

• Control Room - only applicable to HAS Page 2 of 3

Attachment 3 EP-RM-004 Revision IX]

Page 282 of 288 Table R-2 & H-2 Results Table R-2 & H-2 Safe Operation & Shutdown Areas Elevation Unit I Area(s) ** Unit 2 Area(s) ** Mode(s) 670' RB 27 RB 32 3,4,5 683' RB 27, 28, 29 RB 32, 33, 34 3,4,5 703' RB 28, 29 RB 33, 34 3,4,5 719' RB 25, 29 RB 30, 34 3,4,5 749' RB 25, 29 RB 32, 33 3,4,5 729' CSI12, 21" CS12,21" 1, 2, 3,4,5, D

• Control Room - only applicable to HA5

• • See Chart 1 for the specific locations of areas listed in Table R-2 and H-2.

Chart 1- Plant Area Key Plan

___ LOWWASTE 70RAD LEVEL WATER TREATMENT E SRYPN PRY ON 48 AID AD ~VALVE VAULT CHLORINE 53J5251 50 47BUILDING PUMPHOUSE ESSW IUI#

.1TURBINE UNIT#2 BLDG. TRIEBD.RDAT TURB. 16 15 14 13 4 3 2 1 E

20 19 18 I17 .t-t-I-t-8 7 6 5 I24 23 22 21 12 11 10 9 42 1411

=1-4.-I 36 35 u.COND &REF STORAG 44 43 <*..DIESEL i

- - 4- - -

E #2 #

IIINTAKE REACTOR REACTOR R*IVER '* E DIESEL I STRUCTURE E~GENERATORT Page 3 of 3

Attachment 1 EP-RM-004 Revision [X]

Page 175 of 288 Category: S - System Malfunction Subcategory: 1 - Loss of Essential AC Power Initiating Condition: Loss of all offsite AC power capability to essential buses for 15 minutes or longer EAL:

SUI.1 Unusual Event Loss of ALL offsite AC power capability to ALL 4.16 kV ESS buses on EITHER unit (Table S-5) for

_>15 min. (Note 1)

Note 1: The ED/RM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

[ Table S-5 AC 4.16 kV ESS buses Unit 1:

• 1A201

• 1A202

• 1A203

• 1A204 Unit 2:

• 2A201

• 2A202

• 2A203

• 2A204 Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Basis:

The Class 1 E 4.16 kV system supplies all the Engineered Safety Feature (ESE) loads and other loads that are needed for a safe and orderly plant shutdown, and for keeping the plant in a safe shutdown condition. See Figure S-1 (ref. 1, 2)The eight Class lE 4.16 kV ESS Buses 1(2)A through 1(2)D receive power from either the four ESS 13.8/4.16 kV transformers or the diesel generators (A, B, C, D and additional diesel generator E). Buses 1A-1D supply Unit 1 and common loads and Buses 2A-2D supply Unit 2 loads. This configuration prevents a loss of all ESS Buses for one unit in the event one of the ESS Transformers is lost.

Page 145 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 176 of 288 During normal plant operation, ESS Transformer 101 supplies preferred power to ESS Bus 1A and 2A and is an alternate power supply to ESS bus 10 and 2D. ESS Transformer 111 supplies preferred power to ESS Bus 1 C and 20, and is an alternate power supply to ESS bus 1 B and 2B. ESS Transformer 201 supplies preferred power to ESS Bus 10 and 20, and is an alternate power supply to ESS bus 1A and 2A. ESS Transformer 211 supplies preferred power to ESS Bus 1 B and 2B, and is an alternate power supply to ESS bus 10 and 20.

On a loss of a preferred power source, the bus rapidly transfers to the alternate power source to maintain component power. If both the preferred and alternate power sources are lost, the associated standby diesel generator connects to the ESS bus. (ref. 2-6)

The 15-minute interval was selected as a threshold to exclude transient or momentary power losses.

This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency buses. This condition represents a potential reduction in the level of safety of the plant.

For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emergency buses, whether or not the buses are powered from it.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.

Escalation of the emergency classification level would be via IC SAl.

Basis Reference(s):

1. FSAR Section 8.20Offsite Power System

2. FSAR Section 8.30Onsite Power System

3. Technical Specifications 3.8.1 AC Sources - Operating

4. Technical Specifications 3.8.7 Distribution System - Operating

5. ON-i104 (204)-001 Units 1(2) Response to Loss of All Offsite Power

6. EO-100 (200)-030 UNIT 1(2) Response to Station Blackout

7. NEI 99-01 SU1 Page 146 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 177 of 288 Figure S-I ESS 13.8/4.16 kV Transformers and Distribution (ref. 1)

/

MONTOU MOUNTA 1FR (H1' ' S/U TRANS T-20 S*

T1 0) 12 T"-201 ESS201 0X203 oF j1'-211 ESS211

"~0X213 Page 147 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 178 of 288 Category: S - System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all vital DC power for 15 minutes or longer EAL:

SS2.1 Site Area Emergency Indicated voltage is < 105 VDC on ALL of the following vital 125 VDC main distribution buses on the affected unit for _Ž15 min. (Note 1):

• 1D612 (2D612)

• 10622 (20622)

• 10632 (20632)

• 10642 (20642)

Note 1: The EDIRM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

The Class 1 E Battery Banks are 1 (2)0610 (Channel A), 1 (2)0620 (Channel B3), 1 (2)0630 (Channel C), and 1(2)0640 (Channel 0). Each bank consists of 60 cells connected in series.

Each cell produces a nominal voltage of 2.06 VDC resulting in a total battery bank terminal voltage of 123.6 VOC. All battery banks are designed to supply power to its load center for four hours in the event of a loss of power from its battery charger (ref. 1-3).

105 VDC is the minimum design voltage limit (ref. 4).

Indicated voltage for the vital 125 VOC main distribution buses is local only. Local voltage indication is available for each bus based on dispatching a field operator in accordance with Control Room alarm response procedure AR-1(2)06-001 (A12,B312,C12,D12). The 15 minute classification clock begins upon receipt of the 125V DC Panel System Trouble alarm in the Control Room. If battery voltage cannot be verified to be greater than or equal to 105 VOC within the 15 minutes, emergency classification must be made under this EAL.

This IC addresses a loss of vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Escalation of the emergency classification level would be via ICs RG1, FG1 or SG1.

Basis Reference(s):

Page 148 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 179 of 288

1. FSAR Section 8.3.2 DC Power Systems

2. Susquehanna Drawing No. E107159, Sheet 1, "Single Line Meter & Relay Diagram 125 VDC, 250 VDC & 120 VAC Systems"

3. Technical Specifications 3.8.5 DC Sources - Shutdown

4. ON-102(202)-610, -620, -630, -640 Loss of 125V DC

5. AR-i1(2)06-001 Main Turbine/Generator, Computer HVAC, Instrument AC, 24V DC, 125V DC, 250V DC Panel 2C651

6. NEI 99-01 SS8 Page 149 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 180 of 288 Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress EAL:

SA3.1 Alert An UNPLANNED event results in the inability to monitor one or more Table S-I parameters from within the Control Room for _>15 min. (Note 1)

AND Any significant transient is in progress, Table S-2 Note 1: The ED/RM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Table S-I Safety System Parameters

• Reactor power

• RPV water level

• RPV pressure

• Primary Containment pressure

• Suppression Pool water level

• Suppression Pool temperature Table S-2 Significant Transients

• Reactor scram

• Runback > 25% reactor power

• RRC pump trip while > 25% reactor power

• ECCS injection

• Thermal power oscillations > 10%

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Page 150 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 181 of 288 Basis:

SAFETY SYSTEM parameters listed in Table S-1 are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems.

The Plant Process Computer (PPC) and SPDS are redundant compensatory indication which may be utilized in lieu of normal Control Room indicators (ref. 1, 2).

Significant transients are listed in Table S-2 and include response to automatic or manually initiated functions such as scrams, runbacks involving greater than 25% thermal power change, RRC pump trip while > 25% reactor power, ECCS injections, or thermal power oscillations of 10% or greater.

This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, RPV level and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for RPV water level cannot be determined from the indications and recorders on a main control board,.

the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via ICs FS1 or IC RS1 Basis Reference(s):

1. FSAR Section 18.1.17 Plant Safety Parameter Display System

2. OP-I131(231 )-002 Plant Computer Systems

3. EO-000-102 RPV Control Page 151 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 182 of 288

4. EO-000-103 Primary Containment Control

5. NEI 99-01 SA2 Page 152 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 183 of 288 Category: S - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: uNPLANNED loss of Control Room indications for 15 minutes or longer EAL:

SU3.1 Unusual Event An UNPLANNED event results in the inability to monitor one or more Table S-I parameters from within the Control Room for _>15 min. (Note 1)

Note 1: The ED/RM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

[Table S-I Safety System Parameters

• Reactor power

• RPV water level ,

• RPV pressure

• Primary Containment pressure

• Suppression Pool water level

• Suppression Pool temperature Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

SAFETY SYSTEM parameters listed in Table S-I are monitored in the Control Room through a combination of hard control panel indicators as well as computer based information systems.

The Plant Process Computer (PPC) and SPDS are redundant compensatory indication which may be utilized in lieu of normal Control Room indicators (ref. 1, 2).

This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor Page 153 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 184 of 288 power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, RPV level and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for RPV water level cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via IC SA3.

Basis Reference(s):

1. FSAR Section 18.1.17 Plant Safety Parameter Display System

2. OP-131(231)-002 Plant Computer Systems

3. E=O-000-102 RPV Control

4. EO-000-103 Primary Containment Control

5. NEI 99-01 SU2 Page 154 of 185

Attachment 1 EP-RM-004 Revision IX]

Page 185 of 288 Category: S - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits EAL:

SU4.1 Unusual Event Offgas pretreatment monitor high-high radiation alarm Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

The Offgas Pretreatment RMS monitors radioactivity in the Offgas system downstream of the Motive Steam Jet Condenser. The monitor detects the radiation level that is attributable to the fission gases produced in the reactor and transported with steam through the turbine to the condenser (ref. 1). Log rad monitors and trip auxiliary units are located on Panel 10604 in the Upper Relay Room. Instrument Channel 'A' is RITS-D12-1K601A and Instrument Channel 'B' is RITS-D12-1 K601B. Both channels output to Yokagowa Recorder RR-D12-1 R601 on Main Control Room Panel 10600 (ref. 2, 3).

OFEGAS HI-HI RADIATION (AR-I106-F03) is located on Panel 1 C651. The setpoint is variable based on surveillance procedure (ref. 4).

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category R ICs.

Basis Reference(s):

1. ESAR Section 11.5 Process and Effluent Radiological Monitoring and Sampling Systems

2. Technical Specification 3.7.5 Main Condenser Offgas

3. AR-106(206)-001 F03 Offgas Hi Hi Radiation

4. SC-143(243)-101 Unit 1 (Unit 2) Main Condenser Air Ejector Monthly Noble Gas Activity

5. OP-179(279)-002 Process Radiation Monitoring System

6. NEI 99-01 SU3 Page 155 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 186 of 288 Category: S - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits EAL:

SU4.2 Unusual Event Coolant activity > 0.2 pCi/gm dose equivalent 1-131 for > 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR Coolant activity > 4.0 puCi/gm dose equivalent 1-131 at any time Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

The specific iodine activity is limited to *<0.2 IpCi/gm dose equivalent 1-131 (Condition A) with a completion time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. This limit ensures the source term assumed in the safety analysis for the Main Steam Line Break (MSLB) is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the regulatory limits (ref. 1).

The upper limit of 4.0 IpCi/gm dose equivalent 1-131 (Condition B) ensures that the TEDE dose from an MSLB will not exceed the dose guidelines of 10 CFR 50.67 or Control Room operator dose limits specified in GDC 19 of 10 CER 50, Appendix A (ref. 1).

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Escalation of the emergency classification level would be via ICs FA1 or the Recognition Category R ICs.

Basis Reference(s):

1. Technical Specifications section 3.4.7 RCS Specific Activity

2. NE! 99-01 SU3 Page 156 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 187 of 288 Category: S - System Malfunction Subcategory: 5 - RCS Leakage Initiating Condition: RCS leakage for 15 minutes or longer EAL:

8U5.1 Unusual Event RCS unidentified or pressure boundary leakage > 10 gpm for >15 min.

OR RCS identified leakage > 25 gpm for _>15 min.

OR Leakage from the RCS to a location outside Primary Containment > 25 gpm for >_15 min.

(Note 1)

Note 1: The EDIRM should declare the event promptly upon determining that time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Leakage is monitored by utilizing the following techniques (ref. 1):

• Monitoring changes in water level in the drywell floor drain sumps and drywell equipment drain tank

• Sensing excess flow in piping systems

• Sensing pressure and temperature changes in the primary containment

• Monitoring for high flow and temperature through selected drains,

• Sampling airborne particulate and gaseous radioactivity.

Identified leakage is leakage into the drywell, such as that from pump seals or valve packing, that is captured and conducted to the drywell equipment drain tank; or leakage into the drywell atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary Unidentified leakage is all leakage into the drywell that is not identified leakage (ref. 2).

Pressure boundary leakage is leakage through a nonisolable fault in a Reactor Coolant System (RCS) component body, pipe wall, or vessel wall (ref. 2).

Two drywell floor drain sumps are located in the primary containment for collection of leakage from vent coolers, control rod drive flange leakage, chilled water drains, cooling water drains, Page 157 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 188 of 288 and overflow from the drywell equipment drain tank. The drywell floor drain sumps are located at the drywell diaphragm slab low point. Unidentified leakages will, by gravity, flow down the slab surface into the floor drain sumps. Water flow rate greater than 0.5 gpm can be detected by monitoring changes of level over a time period. The sump depth of 0-5 in. is displayed on a 0-100 percent recorder chart, which relates to the sump nominal capacity of 0-150 gal.

The drywell equipment drain tank collects identified leakage within the primary containment from reactor head seal leak off, bulkhead drain, refueling bellows drain, RPV head vent, recirculation pump seals, reactor recirculation pump cooler drains, and RPV bottom drain (Unit I only). The measured tank depth of 36 in. is displayed on a 0-100 percent recorder chart. This relates directly to the measured tank capacity of 842 gal.

RCS leakage outside of the Primary containment that is not considered identified or unidentified leakage per Technical Specifications includes leakage via interfacing systems such as RCS to the Reactor Building Closed Cooling Water (RBCCW system), or systems that directly see RCS pressure outside primary containment such as Reactor Water Cleanup (RWCU), reactor water sampling system and Residual Heat Removal (RHR) system (when in the shutdown cooling mode) (ref. 1, 3).

Indicated changes in drywell sump water level are used to calculate unidentified drywell leakage. Indicated changes in drywell equipment drain tank level are used to calculate identified drywell leakage. SO-100-006 and SO-200-006 are the procedures that specify how to complete these calculations.

Drywell leakage calculations in SO-I100(200)-006 take a finite period of time to complete.

Leakage rates cannot be determined quickly by merely observing an indicator. For this reason, the 15 minutes clock starts after it is determined that leakage rates exceed the entry value.

Upon determination that leakage has increased substantially, effort should be made to quantify this leakage in a timely manner.

ON-i1(2)00-005, "Excessive Drywell Leakage Identification", contains methods of quickly estimating drywell leakage. These methods can be used in lieu of completing the calculations contained in SO-i1(2)00-006.

Means to directly quantify RCS leakage outside containment may not be available. For this reason, judgment must be used for assessment of the 25 gpm leak rate criterion. For example, a short steam plume that does not appreciably change room temperature or room radiation levels can be judged to be less than 25 gpm. A leak that causes room temperature to rise rapidly above maximum safe tern peratures could be judged to be greater than 25 gpm in the absence of measurable lea k rates, and thus judgment is an acceptable method to evaluate this criterion.

Escalation of this EAL to the Alert level is via Category F, Fission Product Barrier Degradation, EAL FAI .1. The note has been added to remind the EAL-user to review Table F-I for possible escalation to higher emergency classifications.

This IC addresses RCS leakage which may be a precursor to a more significant event. In this case, RCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.

Page 158 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 189 of 288 The first and second EAL conditions are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications). The third condition addresses an RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These conditions thus apply to leakage into the Primary Containment, or a location outside of Primary Containment.

The leak rate values for each condition were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.

A stuck-open Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical Specifications and, therefore, is not applicable to this EAL.

The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.

Escalation of the emergency classification level would be via ICs of Recognition Category R or F.

Basis Reference(s):

1. FSAR Section 5.2.5 Detection of Leakage Through Reactor Coolant Pressure Boundary

2. Technical Specifications Definitions Section 1.1

3. ON-100(200)-005 Excess Drywell Leakage Identification

4. SO-100O(200)-006

5. NEI 99-01 SU4 Page 159 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 190 of 288 Category: S - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Inability to shut down the reactor causing a challenge to RPV water level or RCS heat removal EAL:

SS6.1 Site Area Emergency An automatic or manual scram fails to shut down the reactor AND ALL actions to shut down the reactor are not successful as indicated by reactor power >_5%

AND EITHER:

• RPV level CANNOT BE RESTORED AND MAINTAINED > -179 in. or CANNOT be determined OR

• Suppression pool water temperature AND RPV pressure CANNOT BE MAINTAINED below the Heat Capacity Temperature Limit (Figure - HCTL)

Figure - HCTL

" .. & I :..*:j.

flUUL ~dpUUILy I UIII~UI~1LUf U LIHIIL Page 160 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 191 of 288 Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

This EAL addresses the following:

• Any automatic reactor scram signal followed by a manual scram actions that fail to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the safety systems were designed (EAL SA6.1), and

• Indications that either core cooling is extremely challenged or heat removal is extremely challenged.

Reactor shutdown achieved by use of EO-000-1 13, Control Rod Insertion, is also credited as a successful scram provided reactor power can be reduced below the APRM downscale trip setpoint before indications of an extreme challenge to either core cooling or heat removal exist.

(ref. 1)

The APRM downscale trip setpoint (5%) is a minimum reading on the power range scale that indicates power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to prevent subsequent core damage. Below the APRM downscale trip setpoint, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation (APRM) indications or other reactor parameters (steam flow, RPV pressure, torus temperature trend) can be used to determine if reactor power is greater than 2% power (ref. 2, 3).

The combination of failure of both front line and backup protection systems to function in response to a plant transient, along with the continued production of heat, poses a direct threat to the Fuel Clad and RCS barriers.

Indication that core cooling is extremely challenged is manifested by inability to restore and maintain RPV/water level above the Minimum Steam Cooling RPV Water Level (MSCRWL) (ref.

3). The MSCRWL is the lowest RPV level at which the covered portion of the reactor core will generate sufficient steam to prevent any clad temperature in the uncovered part of the core from exceeding 1500 0 F. This water level is utilized in the EOPs to preclude fuel damage when RPV level is below the top of active fuel. RPV level below the MSCRWL for an extended period of time without satisfactory core spray cooling could be a precursor of a core melt sequence.

When RPV level cannot be determined, EOPs require entry to EO-000-1 14, RPV Flooding. RPV water level indication provides the primary means of knowing if adequate core cooling is being maintained. When all means of determining RPV water level are unavailable, the fuel clad barrier is threatened and reliance on alternate means of assuring adequate core cooling must be attempted. The instructions in EO-000-1 14 specify these means, which include emergency depressurization of the RPV and injection into the RPV at a rate needed to flood to the elevation of the main steam lines or hold RPV pressure above the Minimum Steam Cooling Pressure (ref.

4).

Page 161 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 192 of 288 The Heat Capacity Temperature Limit (HCTL) is the highest suppression pool water temperature from which Emergency RPV Depressurization will not raise suppression chamber pressure above the Primary Containment Pressure Limit, while the rate of energy transfer from the RPV to the containment is greater than the capacity of the containment vent.

The HCTL is a function of RPV pressure and suppression pool water level. It is utilized to preclude failure of the containment and equipment in the containment necessary for the safe shutdown of the plant. This threshold is met when the final step of section SP/T in EO-000-103, Primary Containment Control, is reached (ref. 5). This condition addresses loss of functions required for hot shutdown with the reactor at pressure and temperature.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs. This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shut down the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shut down the reactor.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Escalation of the emergency classification level would be via IC RG1 or FG1.

Page 162 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 193 of 288 Basis Reference(s):

1. EO-000-1 13 Control Rod Insertion

2. Technical Specifications Table 3.3.1 .1-1

3. EO-000-102 RPV Control

4. EO-000-114 RPV Flooding

5. EO-000-103 Primary Containment Control

6. NE! 99-01 SS5 Page 163 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 194 of 288 Category: S - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Automatic or manual scram fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor EAL:

SA6.1 Alert An automatic or manual scram fails to shut down the reactor AND Manual scram actions taken at the reactor control console (Manual PBs, Mode Switch, ARI) are not successful in shutting down the reactor as indicated by reactor power _>5% (Note 8)

Note 8: A manual scram action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

This EAL addresses any automatic or manual reactor scram signal that fails to shut down the reactor followed by a subsequent manual scram that fails to shut down the reactor to an extent the reactor is producing energy in excess of the heat load for which the safety systems were designed.

For the purposes of emergency classification, successful manual scram actions are those which can be quickly performed from the reactor control console (i.e., manual scram pushbuttons, mode switch, or ARI initiation in accordance with EO-000-1 02 or EO-OOO-1 13). Reactor shutdown achieved by use of other control rod insertion methods (e.g. individual control rod insertion) directed by EO-000-1 13 does not constitute a successful manual scram (ref. 2, 3).

For the purposes of this EAL, a successful automatic initiation of ARI that reduces reactor power below 5% is no__t considered a successful automatic scram. If automatic actuation of ARI has occurred and caused reactor shutdown, the automatic RPS scram must have failed. ARI is a backup means of inserting control rods in the unlikely event that an automatic RPS scram signal exists but the reactor continues to generate significant power. However, a successful automatic initiation of ARI is an acceptable means of establishing reactor shutdown conditions relative to the EAL threshold in the absence of any required subsequent manual scram actions.

The APRM downscale trip setpoint (5%) is a minimum reading on the power range scale that indicates power production. It also approximates the decay heat which the shutdown systems were designed to remove and is indicative of a condition requiring immediate response to Page 164 of 185

Attachment 1 EP.-RM-004 Revision [X]

Page 195 of 288 prevent subsequent core damage. Below the APRM downscale trip setpoint, plant response will be similar to that observed during a normal shutdown. Nuclear instrumentation (APRM) indications or other reactor parameters (steam flow, RPV pressure, torus temperature trend) can be used to determine if reactor power is greater than 5% power (ref. 1, 3).

Escalation of this event to a General Emergency would be under EAL SG2.1 or Emergency Director/Recovery Manager judgment.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS.

A manual action at the reactor control console is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor scram). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control console (e.g., locally opening breakers). Actions taken at backpanels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control console".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.

The plant response to the failure of an automatic or manual reactor scram will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shut down the reactor is prolonged enough to cause a challenge to RPV water level or RCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS6. Depending upon plant responses and symptoms, escalation is also possible via IC FSi. Absent the plant conditions needed to meet either IC SS6 or FSl, an Alert declaration is appropriate for this event.

It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Basis Reference(s):

1. Technical Specifications Table 3.3.1.1-1

2. EO-000-1 13 Control Rod Insertion

3. EO-000-1 02 RPV Control

4. NEI 99-01 SA5 Page 165 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 196 of 288 Category: S - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual scram fails to shut down the reactor EAL:

SU6.1 Unusual Event An automatic scram did not shut down the reactor after any RPS setpoint is exceeded AND A subsequent automatic scram or manual scram action taken at the reactor control console (Manual PBs, Mode Switch, ARI) is successful in shutting down the reactor as indicated by reactor power < 5% (APRM downscale) (Note 8)

Note 8: A manual scram action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

The first condition of this EAL identifies the need to cease critical reactor operations by actuation of the automatic Reactor Protection System (RPS) scram function. A reactor scram is automatically initiated by the Reactor Protection System (RPS) when certain continuously monitored parameters exceed predetermined setpoints (ref. 1).

Following a successful reactor scram, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative period. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-scram response from an automatic reactor scram signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful scram has therefore occurred when there is sufficient rod insertion from the trip of RPS to bring the reactor power below the APRM downscale setpoint of 5%.

The EAL is not applicable if a manual scram is initiated and no RPS setpoint is exceeded. For the purposes of emergency classification, successful manual scram actions are those which can be quickly performed from the reactor control console (i.e., manual scram pushbuttons, mode switch, or ARI initiation in accordance with EO-000-102 or EO-000-1 13). Reactor shutdown achieved by use of other control rod insertion methods (e.g. individual control rod insertion) directed by EO-000-1 13 does not constitute a successful manual scram (ref. 2, 3).

Following any automatic RPS scram signal, operating procedures (e.g., EO-000-1 02) prescribe insertion of redundant manual scram signals to back up the automatic RPS scram function and Page 166 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 197 of 288 ensure reactor shutdown is achieved. Even if the first subsequent manual scram signal inserts all control rods to the full-in position immediately after the initial failure of the automatic scram, the lowest level of classification that must be declared is an Unusual Event. (ref. 3)

Taking the mode switch to shutdown is a manual scram action. When the Mode Switch is taken out of the Run position, however, the nuclear instrumentation scram setpoint is lowered. If reactor power remains above the lowered setpoint, an automatic scram is initiated.

For the purposes of this EAL, a successful automatic initiation of ARI that reduces reactor power below 5% is not considered a successful automatic scram. If automatic initiation of ARI has occurred and caused reactor shutdown, the automatic RPS scram must have failed. ARI is a backup means of inserting control rods in the unlikely event that an automatic RPS scram signal exists but the reactor continues to generate significant power. However, a successful automatic or manual initiation of ARI is an acceptable means of establishing reactor shutdown conditions relative to the EAL threshold in the absence, of any required subsequent manual scram actions.

In the event that the operator identifies a reactor scram is imminent and initiates a successful manual reactor scram before the automatic scram setpoint is reached, no declaration is req uired. The successful manual scram of the reactor before it reaches its automatic scram setpoint or reactor scram signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. If manual reactor scram actions fail to reduce reactor power below 5%, the event escalates to the Alert under EAL SA6.1.

If by procedure, operator actions include the initiation of an immediate manual scram following receipt of an automatic scram signal and there are no clear indications that the automatic scram failed (such as a time delay following indications that a scram setpoint was exceeded), it may be difficult to determine if the reactor was shut down because of automatic scram or manual actions. If a subsequent review of the scram actuation indications reveals that the automatic scram did not cause the reactor to be shut down, then consideration should be given to evaluating the fuel for potential damage, and the reporting requirements of 10OCER 50.72 should be considered for the transient event.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic scram is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on* an automatic reactor scram, operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

If an initial manual reactor scram is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram) using a different switch). Depending upon several factors, the initial or subsequent effort to manually scram the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor scram signal. If a subsequent manual or automatic scram is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

Page 167 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 198 of 288 A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor scram). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.

The plant response to the failure of an automatic or manual reactor scram will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in Shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA6 or FA1, an Unusual Event declaration is appropriate for this event.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Should a reactor scram signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied.

• If the signal causes a plant transient that should have included an automatic reactor scram and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

• If the signal does not cause a plant transient and the scram failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Basis Reference(s):

1. Technical Specifications Table 3.3.1.1-1

2. EO-000-1 13 Control Rod Insertion

3. EO-000-1 02 RPV Control

4. NEI 99-01 SU5 Page 168 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 199 of 288 Category: S - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual scram fails to shut down the reactor EAL:

SU6.2 Unusual Event A manual scram did not shut down the reactor after any manual scram action was initiated AND A subsequent automatic scram or manual scram action taken at the reactor control console (Manual PBs, Mode Switch, ARI) is successful in shutting down the reactor as indicated by reactor power < 5% (APRM downs'cale) (Note 8)

Note 8: A manual scram action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operations, 2 - Startup Definition(s):

None Basis:

This EAL addresses a failure of a manually initiated scram in the absence of having exceeded an automatic RPS trip setpoint and a subsequent automatic or manual scram is successful in shutting down the reactor (reactor power < 5%) (ref. 1). ,

• Following a successful reactor scram, rapid insertion of the control rods occurs. Nuclear power promptly drops to a fraction of the original power level and then decays to a level several decades less with a negative period. The reactor power drop continues until reactor power reaches the point at which the influence of source neutrons on reactor power starts to be observable. A predictable post-scram response from a manual reactor scram signal should therefore consist of a prompt drop in reactor power as sensed by the nuclear instrumentation and a lowering of power into the source range. A successful scram has therefore occurred when there is sufficient rod insertion from the trip of RPS to bring the reactor power below the APRM downscale setpoint of 5%.

For the purposes of emergency classification, successful manual scram actions are those which can be quickly performed from the reactor control console (i.e., manual scram pushbuttons, mode switch, or ARI initiation in accordance with EO-000-1 02 or EO-000-1 13). Reactor shutdown achieved by use of other control rod insertion methods (e.g. individual control rod insertion) directed by EO-000-1 13 does not constitute a successful manual scram (ref. 2, 3).

Taking the mode switch to shutdown is a manual scram action. When the Mode Switch is taken out of the Run position, however, the nuclear instrumentation scram setpoint is lowered. If reactor power remains above the lowered setpoint, an automatic scram is initiated.

Page 169 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 200 of 288 Successful automatic or manual initiation of ARI is an acceptable means of establishing reactor shutdown conditions relative to the EAL threshold in the absence of any required subsequent manual scram actions.

If both subsequent automatic and subsequent manual reactor scram actions in the Control Room fail to reduce reactor power below the power associated with the safety system design

(< 5%) following a failure of an initial manual scram, the event escalates to an Alert under EAL SA6.1 This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor scram that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic scram is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on an automatic reactor scram, operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

If an initial manual reactor scram is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor scram) using a different switch). Depending upon several factors, the initial or subsequent effort to manually scram the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor scram signal. If a subsequent manual or automatic scram is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor scram). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.

The plant response to the failure of an automatic or manual reactor scram will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA6. Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC SA6 or FA1, an Unusual Event declaration is appropriate for this event.

The adequacy of reactor shutdown (< 5%) is determined in accordance with applicable Emergency Operating Procedure criteria.

Should a reactor scram signal be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied.

Page 170 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 201 of 288

• If the signal causes a plant transient that should have included an automatic reactor scram and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.

• If the signal does not cause a plant transient and the scram failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Basis Reference(s):

1. Technical Specifications Table 3.3.1 .1-1

2. EO-000-1 13 Control Rod Insertion

3. EO-000-102 RPV Control

4. NEI 99-01 SU5 Page 171 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 202 of 288 Category: S - System Malfunction Subcategory: 7 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities EAL:

SU7.1 Unusual Event Loss of ALL Table S-3 onsite communication methods OR Loss of ALL Table S-30ORO communication methods OR Loss of ALL Table S-3 NRC communication methods Table S-3 Communication Methods System Onsite ORO NRC UHF Radio X Plant PA System X Dedicated Conference Lines X Commercial Telephone Systems X X X Cellular Telephone X X FTS-2001 (ENS) X X Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Onsite/offsite communications include one or more of the systems listed in Table S-3 (ref. 1, 2, 3).

UHF Radio Onsite portable radio communication systems are described in the Susquehanna SES Physical Security Plan and in the Susquehanna SES Emergency Plan. Four UHF channels, each Page 172 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 203 of 288 consisting of two frequencies for duplex operation through one of five in-plant repeaters, provide onsite portable radio, communications. Operations is assigned two channels; one channel is assigned to Unit 1 and one to Unit 2. Operators in the plant on rounds and on specific assignments are equipped with handheld two-way radios.

Plant PA System The plant PA system is an intra-plant public address providing the following functions:

• A 5-channel page-talk handset intercom system for on-site communications between plant locations.

• Broadcast accountability and fire alarms designed to warn personnel of emergency conditions.

The system consists of telephone handsets, amplifiers and loudspeakers located at various selected areas throughout the plant.

Dedicated Conference Lines (Centrex Three (3) di~qit dialincq)

The Dedicated Conference Lines are those normally used to communicate with several offsite agencies at one time (e.g., 191 conference line).

Commercial Telephone Systems Two independent telecommunications networks exist to provide primary and backup telephone communications between ERFs and offsite agencies.

Cellular Telephone Cell phones can be utilized to perform both ORO and NRC communications.

FTS 2001 (ENS)

This system is for NRC offsite communications but may also be used to perform ORO notifications.

This EAL is the hot condition equivalent of the cold condition EAL CU5.1.

This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to OROs and the NRC.

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

The second EAL condition addresses a total loss of the communications methods used to notify all OROs of an emergency declaration. The OROs referred to here are the Commonwealth of Pennsylvania, Luzerne and Columbia County EOCs The third EAL addresses a total loss of the communications methods used to notify the NRC of an emergency declaration.

Page 173 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 204 of 288 Basis Reference(s):

1. EP-RM-007 Emergency Telephone Instructions and Directory

2. SSES Emergency Plan Section 8

3. FSAR Section 9.5.2

4. NEI 99-01 SU6 Page 174 of 185

Attachment 1 EP-RM-004 Revision IX]

Page 205 of 288 Category: S - System Malfunction Subcategory: 8 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode EAL:

SA8.1 Alert The occurrence of any Table S-4 hazardous event AND EITHER:

• Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode

• The event has caused VISIBLE DAMAGE to a SAFETY SYSTEM component or structure needed for the current operating mode Table S-4 Hazardous Events

• Seismic event (earthquake)

• Internal or external FLOODING event

• High winds or tornado strike

• FIRE

• EXPLOSION

• Other events with similar hazard characteristics as determined by the Shift Manager Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

Page 175 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 206 of 288 FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

FLOODING- A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 100FR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE - Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Basis:

• The significance of a seismic event is discussed under EAL HU2.1 (ref. 1, 2).

• Internal FLOODING may be caused by events such as component failures, equipment misalignment, or outage activity mishaps (ref. 3, 4, 5).

• Seismic Category I structures are analyzed to withstand a sustained, design wind velocity of at least 80 mph. (ref. 6, 7).

• Areas containing functions and systems required for safe shutdown of the plant are identified by Fire Zone in the fire response procedure (ref. 8, 9).

• An EXPLOSION that degrades the performance of a SAFETY SYSTEM train or visibly damages a SAFETY SYSTEM component or structure would be classified under this EAL.

This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode.

This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the plant.

The first condition addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.

The second condition addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of Page 176 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 207 of 288 available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.

Escalation of the emergency classification level would be via IC FS1 or RS1.

Basis Reference(s):

1. ON-000-002 Severe Weather / Natural Phenomena

2. FSAR Section 3.7 Seismic Design

3. ON-169(269)-001 Flooding in Turbine Building

4. ON-169(269)-002 Flooding in Reactor Building

5. ESAR Section 3.4 Water Level (Flood) Design

6. FSAR Section 3.3 Wind and Tornado Loadings

7. FSAR Section 3.5 Missile Projection

8. SSES-FPRR Section 6.2 Fire Area Description

9. ON-013-001 Response to Fire

10. NEI 99-01 SA9 Page 177 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 208 of 288 Category E - Independent Spent Fuel Storage Installation (ISFSI)

EAL Group: ANY (EALs in this category are applicable to any piant condition, hot or cold)

An independent spent fuel storage installation (ISFSl) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. A significant amount of the radioactive material contained within a cask/canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from an accident involving the dry storage of spent nuclear fuel.

An Unusual Event is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask CONFINEMENT BOUNDARY is damaged or violated.

A security event involving the ISESI would be classified in accordance with Category HI security based EALs.

Minor surface damage that does not affect storage cask/canister boundary is excluded from the scope of these EALs.

Page 178 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 209 of 288 Category: E - ISFSI Sub-category: None Initiating Condition: Damage to a loaded cask CONFINEMENT BOUNDARY EAL:

EUI.1 Notification of Unusual Event Damage to a loaded canister CONFINEMENT BOUNDARY as indicated by a radiation reading on a loaded spent fuel cask > any of the following:

• 800 mrem/hr at 3 ft from the HSM surface

• 200 mrem/hr on contact on the outside of the HSM door centerline

• 40 mrem/hr on contact on the end shield wall exterior Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY- The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the Susquehanna ISFSI, Confinement Boundary is defined as the Dry Shielded Canister (DSC).

Basis:

The SSES Independent Spent Fuel Storage Installation utilizes the standardized NUHMOS Horizontal Modular System. The standardized NUHMOS system is a horizontal canister system composed of a steel dry shielded canister (DSC) and a reinforced concrete horizontal storage module (HSM). The DSC provides confinement and criticality control for the storage and transfer of irradiated fuel. The HSM houses the DSC and provides for heat removal. An HSM is considered loaded when it houses a DSC containing spent fuel. (ref. 1, 2)

The values shown represent 2 times the limits specified in the ISFSI Certificate of Compliance Technical Specification 1.2.7, HSM Dose Rates (ref. 1).

This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a storage cask containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the loaded storage cask is sealed. The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors, and configuration changes which could cause challenges in removing the cask or fuel from storage.

The existence of "damage" is determined by radiological survey. The technical specification multiple of "2 times" is used here to distinguish between non-emergency and emergency conditions. The emphasis for this classification is the degradation in the level of safety of the spent fuel cask and not the magnitude of the associated dose or dose rate. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask.

Page 179 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 210 of 288 Security-related events for ISFSIs are covered under l~s HU1 and HAl.

Basis Reference(s):

1. Certification of Compliance No. 1004 for the NUHOMS Storage System

2. TRM B3.1O.3 Independent Spent Fuel Storage Installation (ISFSI)

3. NEI 99-01 E-HU1 Page 180 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 211 of 288 Category F - Fission Product Barrier Degradation EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes.

EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment. This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. The primary fission product barriers are:

A. Fuel Clad (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.

B. Reactor Coolant System (RCS): The RCS Barrier is the reactor coolant system pressure boundary and includes the RPV and all reactor coolant system piping up to and including the isolation valves.

C. Containment (PC): The drywell, the wetwell, their respective interconnecting paths, and other connections up to and including the outermost containment isolation valves comprise the PC barrier. Primary Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to either a Site Area Emergency or a General Emergency.

The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-i (Attachment 2). "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade. The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emergency classification level:

Alert:

Any loss or any potential loss of either Fuel Clad or RCS Site Area Emergency:

Loss or potential loss of any two barriers GeneralEmergency:

Loss of any two barriersand loss or potentialloss of third barrier The logic used for emergency classification based on fission product barrier monitoring should reflect the following considerations:

• The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Primary Containment Barrier.

• Unusual Event ICs associated with RCS and Fuel Clad Barriers are addressed under System Malfunction ICs.

• For accident conditions involving a radiological release, evaluation of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to Page 181 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 212 of 288 ensure correct and timely escalation of the emergency classification. For example, an, evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC RG1 has been exceeded.

• The fission product barrier thresholds specified within a scheme reflect SSES design and operating characteristics.

• As used in this category, the term RCS leakage encompasses not just those types defined in Technical Specifications but also includes the loss of RCS mass to any location- inside the primary containment, an interfacing system, or outside of the primary containment. The release of liquid or steam mass from the ROS due to the as-designed/expected operation of a relief valve is not considered RCS leakage.

• At the Site Area Emergency level, EAL users should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration. For example, if the Fuel Clad and ROS fission product barriers were both lost, there should be frequent assessments of containment radioactive inventory and integrity. Alternatively, if both the Fuel Clad and RCS fission product barriers were potentially lost, the Emergency Director/Recovery Manager would have more assurance that there was no immediate need to escalate to a General Emergency.

Page 182 of 185

Attachment I EP-RM-004 Revision XIX Page 213 of 288 Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss of any two barriers and loss or potential loss of the third barrier EAL:

FGI.1 General Emergency Loss of any two barriers AND Loss or potential loss of the third barrier (Table F-I)

Mode Applicability:

I - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Fuel.Clad, RCS and Containment comprise the fission product barriers. Table F-I (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions:

• Loss of Fuel Clad, RCS and Containment barriers

• Loss of Fuel Clad and RCS barriers with potential loss of Containment barrier

• Loss of RCS and Containment barriers with potential loss of Fuel Clad barrier

• Loss of Fuel Clad and Containment barriers with potential loss of RCS barrier Basis Reference(s):

I. NEI 99-01 FG1 Page 183 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 214 of 288 Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss or potential loss of any two barriers EAL:

FSI.1 Site Area Emergency Loss or potential loss of any two barriers (Table F-I)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-I (Attachment

2) lists the fission product barrier thresholds, bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions:

• One barrier loss and a second barrier loss (i.e., loss - loss)

• One barrier loss and a second barrier potential loss (i.e., loss - potential loss)

• One barrier potential loss and a second barrier potential loss (i.e., potential loss -

potential loss)

At the Site Area Emergency classification level, the ability to dynamically assess the proximity of present conditions with respect to the threshold for a General Emergency is important. For example, the existence of Fuel Clad and RCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification. Alternatively, if both Fuel Clad and RCS potential loss thresholds existed, the Emergency Director/Recovery Manager would have greater assurance that escalation to a General Emergency is less imminent.

Basis Reference(s):

1. NEI 99-01 FS1 Page 184 of 185

Attachment 1 EP-RM-004 Revision [X]

Page 215 of 288 Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Any loss or any potential loss of either Fuel Clad or RCS EAL:

FA1.1 Alert Any loss or any potential loss of EITHER Fuel Clad or RCS (Table F-i)

Mode Applicability:

1 - Power Operations, 2 - Startup, 3 - Hot Shutdown Definition(s):

None Basis:

Fuel Clad, RCS and Primary Containment comprise the fission product barriers. Table F-i (Attachment 2) lists the fission product barrier thresholds, bases and references.

At the Alert classification level, Fuel Clad and RCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier, loss or potential loss of either the Fuel Clad or RCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability. Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or RCS barrier results in declaration of a Site Area Emergency under EAL FS1.1 Basis Reference(s):

1. NEI 99-01 FA1 Page 185 of 185

Attachment 2 EP-RM-004 Revision [X]

Page 216 of 288 ATTACHMENT 2 Fission Product Barrier Loss/Potential Loss Matrix and Bases Introduction Table F-i lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The table is structured so that each of the three barriers occupies adjacent columns. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds.

The first column of the table (to the left of the Fuel Clad Loss column) lists the categories (types) of fission product barrier thresholds. The fission product barrier categories are:

A. RPV Level B. RCS Leak Rate C. Primary Containment Conditions D. Primary Containment Radiation I RCS Activity E. Primary Containment Integrity or Bypass F. EDlRM Jugement Each category occupies a row in Table F-i thus forming a matrix defined by the categories. The intersection of each row with each Loss/Potential Loss column forms a cell in which one or more fission product barrier thresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None" is entered in the cell.

Thresholds are assigned sequential numbers within each Loss and Potential Loss column beginning with number one. In this manner, a threshold can be identified by its category title and number. For example, the first Fuel Clad barrier Loss in Category A would be assigned "FC Loss A.1 ," the third Containment barrier Potential Loss would be assigned "PC P-Loss C.3," etc.

If a cell in Table F-i contains more than one numbered threshold, each of the numbered thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss.

Subdivision of Table F-i by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds. This structure promotes a systematic approach to assessing the classification status of the fission product barriers.

When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-i, locates the likely category and then reads across the fission product barrier Loss and Potential Loss thresholds in that category to determine if a threshold has been exceeded. If a threshold has not been exceeded, the EAL-user proceeds to the next likely category and continues review of the thresholds in the new category If the EAL-user determines that any threshold has been exceeded, by definition, the barrier is lost or potentially lost - even if multiple thresholds in the same barrier column are exceeded, only that one barrier is lost or potentially lost. The EAL-user must examine each of the three fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if containment radiation is sufficiently high, a Loss of the Fuel Clad Page 1 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 217 of 288 and RCS barriers and a Potential Loss of the Containment barrier can occur. Barrier Losses and Potential Losses are then applied to the algorithms given in EALs FG1.1, FS1.1, and FA1.1 to determine the appropriate emergency classification.

In the remainder of this Attachment, the Fuel Clad barrier threshold bases appear first, followed by the RCS barrier and finally the Containment barrier threshold bases. In each barrier, the bases are given according category Loss followed by category Potential Loss beginning with Category A, then B,...,. F.

Table F-2 provides a human factors enhancement mechanism to track the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor.

Coolant System, and Containment) to assist with quickly determining which initiating condition for EALs FGI.1, FSI.1, or FA1.1 is met.

Page 2 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 218 of 288 Table F-I Fission Product Barrier Threshold Matrix Fuel Clad Barrier Reactor Coolant System Barrier Primary Containment Barrier Category LOSS Potential Loss Loss Potential Loss Loss Potential Loss

1. RPV level CANNOT BE 1I RPV level CANNOT BE A t. SAG entry required RESTORED AND MAINTAINED'> RESTORED AND MAINTAINED >Noeon1.SGntyrqid evl161 -P in. -161 in.NoeNn1.SGntyrqid RMeelor CANNOT be determined or CANNOT be determined

1. UNISOLABLE break in any of the 1. UNISOLABLE primary system 1. UNISOLABLE primary system leakage that results in exceeding leakage that results in exceeding following: EITHER of the following: EITHER of the following:

• Main Steam Line

• One or more Max Normal

• One or more Max Safe

• HPCI Steam Line Reactor Building Radiation Reactor Building Radiation

• RClC Steam Line Limits (EO-000-1 04 Table 9) Limits (EO-000-104 Table 9)

BNone None RWCU Feedwater that can be read in the Control Room (Table F-3) that can be read in the Control Room (Table F-5) None RCS Leak Rate OR OR OR

• One or more Max Normal

• One or more Max Safe

2. Emergency RPV Depressurization Reactor Building area Reactor Building area is required temperature Limits temperature Limits (EO-000-104 Table 8) that can (EO-000-104 Table 8) that be read in the Control Room can be read in the Control (Table F-4) Room (Table F-6)

1. UNPLANNED rapid drop in 1. Primary Containment pressure Primary Containment pressure ' 53 psig Cfollowing Primary Containment OR NoeNoe1 Piay otinetprsue oepressure rise 2. Deflagration concentrations exist PC None NoneP1.iPrimayoContainmentppressur response not consistent with 3. I-eat Capacity Temperature Limit LOCA conditions (HCTL) exceeded D l1, CH-RRM radiation > 3.0E+3 R/hr OR 1. CHRRM radiation > 7.0E+O RJhr PC Rad I None with indications of RCS leakage None None 1. CHRRM radiation>* 4.0E+4 R/hr ROS 2. Primary coolant activity>* 300) inside the dry'well Activity pCi/gm 1-131dose equivalent I.UNISOLABLE direct downstream pathway to the environment exists after Primary Containment E isolation signal PCItgiyNone None None None OR None or Bypass 2. Intentional Primary Containment 3

venting per EP-DS-OO4-RP =-fi l,-V-tqorocedures RE F AnEcndtenr nten opniny t1. 1. Any condition in the opinion of the 1. Any condition in the opinion of the 1. Any condition in the opinion of the 1.Any condition in the opinion of the 1. Any condition in the opinion of the EDR ietrRcvr aaeclad ht Emergency Manager thatDirector/Recovery Emergency Manager thatDirector/Recovery Emergency Manager thatDirector/Recovery Emergency Manager thatDirector/Recovery Emergency idircato/esossofter funael indicates potential indicates loss of the indicates potential loss indicates loss of the Manager thatDirector/Recovery indicates potential loss Judgment barrier loss of the fuel clad barrier RCS barrier of the RCS barrier Primary Containment barrier of the Primary Containment barrier Page 3 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 219 of 288 Table F-2 Fission Product Barrier Status Table Circle the X's in the FG1: General Emergency FS1: Site Area Emergency FA1: Alert table below for all Loss of any two barriers Loss or potential loss of any two barriers Any loss or any potential loss applicable and loss or potential loss of of EITHER Fuel Clad or RCS situations. Declare third barrier, barrier the EAL based upon all circled X's in any column.

Fuel Clad -Loss X X X X X X X X Fuel Clad -Potential X X X X X X Loss RCS -Loss X X X X X X X X RCS -Potential Loss X X X X X X Primary Containment X X X X X X X

- Loss Primary Containment X X X X X

- Potential Loss Page 4 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 220 of 288 Barrier: Fuel Clad Category: A. RPV Level Degradation Threat: Loss Threshold:

1. SGentry required Definition(s):

N/A Basis:

The Loss threshold represents the EOP requirement for SAG entry. This is identified in the BWROG EPGs/SAGs when the phrase, "SAG Entry Is Required," EOPs specify the requirement for entry to the SAGs when core cooling is severely challenged..These EOPs provide instructions to ensure adequate core cooling by maintaining RPV water level above prescribed limits or operating sufficient RPV injection sources when level cannot be determined.

SAG entry is required when (ref. 1, 2):

• ,PD\/' .... t.,r Il...ol CANNO'T BE RESQTORED-' ANDl' M/AIN*TAIED-F b'*k.... "170 in.

---AND OR

• EO-1 (2)00-1 02 - when RPV level cannot be restored and maintained above MSCRWL

(-179") or elevation of iet pump suctions (-210") when a loop of Core Spray is iniectingq (>

6350 ppm).

• EO-1 (2)00-113 - when RPV level cannot be restored and maintained above MSCRWL (E-1792).014 AW)-we or aaq socri

• EO-1 (2)00-1 14A(N-n-ATWS) - when core damaqe is occurring.

The above EOP conditions represent a challenge to core cooling and are the minimum values to assure core cooling without further degradation of the clad.

SAGs entry is also a Potential Loss of the Primary Containment barrier (PC P-Loss A.1) which constitutes a Site Area Emergency. The threshold for the RCS barrier (RCS Loss A. 1) should Page 5 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 221 of 288 also be evaluated for escalation to a General Emergency if SAGs entry results in meeting that threshold.

Basis Reference(s):

1. EP-DS-001 Containment Combustible Gas Control

2. EP-DS-002 RPV and Primary Containment Flooding SAG-2

3. NEI 99-0 1 RPV Water Level Fuel Clad Loss 2.A Page 6 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 222 of 288 Barrier: Fuel Clad Category: A. RPV Level Degradation Threat: Potential Loss Threshold:

1. RPV level CANNOT BE RESTORED AND MAINTAINED > -161 in. or CANNOT be determined Definition(s):

N/A Basis:

An RPV water level instrument reading of -161 in. indicates RPV level is at the top of active fuel (TAF) (ref. 1). When RPV level is at or above the TAF, the core is completely submerged. Core submergence is the most desirable means of core cooling. When RPV level is below TAF, the uncovered portion of the core must be cooled by less reliable means (i.e., steam cooling or spray cooling). If core uncovery is threatened, the EOPs specify alternate, more extreme, RPV water level control measures in order to restore and maintain adequate core cooling. Since core uncovery begins if RPV level drops to TAF, the level is indicative of a challenge to core cooling and the Fuel Clad barrier.

This Fuel Clad barrier Potential Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

When RPV water level cannot be determined, EOPs require entry to EO-000-1 14, RPV Flooding. RPV water level indication provides the primary means of knowing if adequate core cooling is being maintained (ref. 2). When all means of determining RPV water level are unavailable, the fuel clad barrier is threatened and reliance on alternate means of assuring adequate core cooling must be attempted. The instructions in EO-000-1 14 specify these means, which include emergency depressurization of the RPV and injection into the RPV at a rate needed to flood to the elevation of the main steam lines or hold RPV pressure above the Minimum Steam Cooling Pressure (in scram-failure events. If RPV water level cannot be determined with respect to the top of active fuel, a potential loss of the fuel clad barrier exists.

This threshold is intended to be interpreted the same as in EO-000-1 14, that is, a loss of instrumentation is not, by itself, a loss of ability to determine level.

Note that EO-000-1 13, Level/Power Control, may require intentionally lowering RPV water level to -161 in. and control level between the Minimum Steam Cooling RPV Water Level (MSCRWL) and the top of active fuel (ref. 3). Although such action is a challenge to core cooling and the Fuel Clad barrier, the immediate need to reduce reactor power is the higher priority. For such events, ICs SA6 or SS6 will dictate the need for emergency classification.

Page 7 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 223 of 288 This water level corresponds to the top of the active fuel and is used in the EOPs to indicate a challenge to core cooling.

The RPV water level threshold is the same as RCS barrier Loss threshold A.1. Thus, this threshold indicates a Potential Loss of the Fuel Clad barrier and a Loss of the RCS barrier that appropriately escalates the emergency classification level to a Site Area Emergency.

This threshold is considered to be exceed'ed when, as specified in the site-specific EOPs, RPV water CANNOT BE RESTORED AND MAINTAINED above the specified level following depressurization of the RPV (either manually, automatically or by failure of the RCS barrier) or when procedural guidance or a lack of low pressure RPV injection sources preclude Emergency RPV depressurization. EOPs allow the operator a wide choice of RPV injection sources to consider when restoring RPV water level to within prescribed limits. EOPs also specify depressurization of the RPV in order to facilitate RPV water level control with low-pressure injection sources. In some events, elevated RPV pressure may prevent restoration of RPV water level until pressure drops below the shutoff heads of available injection sources.

Therefore, this Fuel Clad barrier Potential Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

The term "CANNOT BE RESTORED AND MAINTAINED above' means the value of RPV water level is not able to be brought above the specified limit (top of active fuel). The determination requires an evaluation of system performance and availability in relation to the RPV water level value and trend. A threshold prescribing declaration when a threshold value CANNOT BE RESTORED AND MAINTAINED above a specified limit does not require immediate action simply because the current value is below the top of active fuel, but does not permit extended operation below the limit; the threshold must be considered reached as soon as it is apparent that the top of active fuel cannot be attained.

In high-power ATWS/failure tO scram events, EOPs may direct the operator to deliberately lower RPV water level to the top of active fuel in order to reduce reactor power. RPV water level is then controlled between the top of active fuel and the Minimum Steam Cooling RPV Water Level (MSCRWL). Although such action is a challenge to core cooling and the Fuel Clad barrier, the immediate need to reduce reactor power is the higher priority. For such events, ICs SA6 or SS6 will dictate the need for emergency classification.

Since the loss of ability to determine if adequate core cooling is being provided presents a significant challenge to the fuel clad barrier, a potential loss of the fuel clad barrier is specified.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. EO-000-1 14 RPV Flooding

3. EO-000-1 13 Level/Power Control

4. NEI 99-01 RPV Water Level Fuel Clad Potential Loss 2.A Page 8 of 64

Attachment 2 EP-RM.-004 Revision [X]

Page 224 of 288 Barrier: Fuel Clad Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

None Page 9 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 225 of 288 Barrier: Fuei Clad Category: B. RCS Leak Rate Degradation Threat: Potential Loss Threshold:

None Page 10 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 226 of 288 Barrier: Fuel Clad Category: C. PC Conditions Degradation Threat: Loss Threshold:

None Page 11 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 227 of 288 Barrier: Fuel Clad Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

None Page 12 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 228 of 288 Barrier: Fuel Clad Category: D. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

1. CHRRM radiation > 3.0E+3 R/hr Definition(s):

None Basis:

Two gamma radiation levels ion chambers are located inside the drywell to monitor post-accident radiation levels. The detectors are located in the drywell on elevation 719'. They are always in service and read out on the 0601 panel. Range is 100 to 108 R/hr. Environmentally qualified since they are required for use after an accident. A U-234 bug source is installed in the detector to serve as a self-check for instrument operability. The source provides approximately a 1 R/hr dose rate with the reactor shutdown. When the plant is at 100% power, drywell rad indication is normally about 3-4 R/hr. A reading of 3,000 R/hr indicates the release of reactor coolant into the drywell with elevated activity indicative of fuel clad damage (ref. 2).

For a fuel failure event equivalent to approximately 1% of cladding failure and an instantaneous and complete release of reactor coolant to the primary containment, the response of the Containment High Range Radiation Monitors (CHRRM) in the drywell will be approximately 3,450 R/hr immediately after shutdown (rounded to 3,000 R/hr, which approximates the dose rate 10 minutes after shutdown). This assumes that the release has occurred soon after reactor shutdown, and that the fuel cladding failures produce a coolant source term of 300 #.Ci/gm of 1-131 dose equivalent just prior to the release into primary containment. (ref. 2)

Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

The radiation monitor reading in this threshold is higher than that specified for RCS Barrier Loss threshold D.1 since it indicates a loss of both the Fuel Clad Barrier and the RCS Barrier. Note that a combination of the two monitor readings appropriately escalates the emergency classification level to a Site Area Emergency.

There is no Fuel Clad Barrier Potential Loss threshold associated with Primary Containment Radiation.

Page 13 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 229 of 288 Basis ,Reference(s):

1. General Atomic High-Range Gamma Radiation Monitoring System Manual

2. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008

3. NEI 99-01 Primary Containment Radiation Fuel Clad Loss 4.A Page 14 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 230 of 288 Barrier: Fuel Clad Category: 0. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

2. Primary coolant activity > 300 pCi/gm 1-131 dose equivalent Basis:

The Fuel Clad Barrier shall be declared "lost" if the Primary coolant activity is determined to be

> 300 IpCi/gm 1-131 dose equivalent. Two separate methods can be used make this determination:

• Sample collection and analysis of reactor coolant activity

• Analysis of plant parameters to determine fuel clad damage > 1%

Sample collection and analysis of reactor coolant activity are accomplished in accordance with CH-ON-007.

It is recognized that sample collection and analysis of reactor coolant with highly elevated activity levels could require several hours to complete. The fuel clad damage analysis methodology in ref. 3 provides an alternative method to determine if the 1-131 dose equivalent activity is > 300 tpCi/gm.

Fuels Engineering determines if > 1% fuel clad damage has occurred based on the analysis methodology in ref. 3. Fuel clad damage equal to 1% corresponds to at least 300 micro-Ci/gm 1-131 dose equivalent in the reactor coolant, and drywell radiation values of at least 3000 R/hr during LOCA events (breach inside primary containment) (ref. 1). However, drywell radiation levels can be significantly lower than 3000 R/hr with a similar amount of fuel damage without a LOCA (no breach inside primary containment), since the fission products remain in the reactor vessel/do not escape into the drywell space and the CHRM is shielded from the radiation source (ref. 2 and 3).

Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

There is no Potential Loss threshold associated with RCS Activity.

Basis Reference(s):

1. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008

2. EWR 1642196 - Investigation of EPLAN 1% Clad Damage vs. Barrier Loss

3. EP-PS-324 - Fuels Lead Engineer/Core Thermal Hydraulics Engineer

4. CH-ON-007 - Emergency Sampling Procedures

5. NEI 99-01 RCS Activity Fuel Clad Loss 1.A Page 15 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 231 of 288 Barrier: Fuel Clad Category: D. PC Radiation / RECS Activity Degradation Threat: Potential Loss Threshold:

None Page 16 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 232 of 288 Barrier: Fuel Clad Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

None Page 17 of 64

Attachment 2 EP-RM-004 Revision XI]

Page 233 of 288 Barrier: Fuel Clad Category~ E. PC Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Page 18 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 234 of 288 Barrier: Fuel Clad Category: F. ED/RM Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates loss of the Fuel Clad barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqiradation exists ifthe degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitorinci capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A Page 19 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 235 of 288 Barrier: Fuel Clad Category: F. ED/RM Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates potential loss of the Fuel Clad barrier Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Fuel Clad barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoring capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

The Emergency Director/Recovery Manager should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A Page 20 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 236 of 288 Barrier: Reactor Coolant System Category: A. RPV Level Degradation Threat: Loss Threshold:

1. RPV level CANNOT BE RESTORED AND MAINTAINED > -161 in. or CANNOT be determined Definition(s):

None Basis:

An RPV level instrument reading of -161 in. indicates RPV level is at the top of active fuel (TAF)

(ref. 1). TAF is significantly lower than the normal operating RPV level control band. To reach this level, RPV inventory loss would have previously required isolation of the RCS and Primary Containment barriers, and initiation of all ECCS. If RPV level cannot be maintained above TAF, ECCS and other sources of RPV injection have been ineffective or incapable of reversing the decreasing level trend. The cause of the loss of RPV inventory is therefore assumed to be a LOCA. By definition, a LOCA event is a Loss of the RCS barrier.

This RCS barrier Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

When RPV water level cannot be determined, EOPs require entry to EO-000-1 14, RPV Flooding. RPV water level indication provides the primary means of knowing if adequate core cooling is being maintained (ref. 2). When all means of determining RPV water level are unavailable, the RCS barrier is threatened and reliance on alternate means of assuring adequate core cooling must be attempted. The instructions in EO-000-1 14 specify these means, which include emergency depressurization of the RPV and injection into the RPV at a rate needed to flood to the elevation of the main steam lines or hold RPV pressure above the Minimum Steam Cooling Pressure (in scram-failure events. If RPV water level cannot be determined with respect to the top of active fuel, a loss of the RCS barrier exists. This threshold is intended to be interpreted the same as in EO-000-1 14, that is, a loss of instrumentation is not, by itself, a loss of ability to determine level.

The conditions of this threshold are also a Potential Loss of the Fuel Clad barrier (FC P-Loss A.1 ). A Loss of the RCS barrier and Potential Loss of the Fuel Clad barrier requires a Site Area Emergency classification.

Note that EO-000-1 13, Level/Power Control, may require intentionally lowering RPV water level to -161 in. and control level between the Minimum Steam Cooling RPV Water Level (MSCRWL) and the top of active fuel (ref. 3). Although such action is a challenge to core cooling and the Page 21 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 237 of 288 Fuel Clad b'arrier, the immediate need to reduce reactor power is the higher priority. For such events, l~s SA6 or SS6 will dictate the need for emergency classification.

This water level corresponds to the top of active fuel and is used in the EOPs to indicate challenge to core cooling.

The RPV water level threshold is the same as Fuel Clad barrier Potential Loss threshold A.1.

Thus, this threshold indicates a Loss of the RCS barrier and Potential Loss of the Fuel Clad barrier and that appropriately escalates the emergency classification level to a Site Area Emergency.

This threshold is considered to be exceeded when, as specified in the site-specific EOPs, RPV water CANNOT BE RESTORED AND MAINTAINED above the specified level following depressurization of the RPV (either manually, automatically or by failure of the RCS barrier) or when procedural guidance or a lack of low pressure RPV injection sources preclude Emergency RPV depressurization. EOPs allow the operator a wide choice of RPV injection sources to consider when restoring RPV water level to within prescribed limits. EOPs also specify depressurization of the RPV in order to facilitate RPV water level control with low-pressure injection sources. In some events, elevated RPV pressure may prevent restoration of RPV water level until pressure drops below the shutoff heads of available injection sources.

Therefore, this RCS barrier Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. EO-000-114 RPV Flooding

3. EO-000-1 13 Level/Power Control

4. NEI 99-01 RPV Water Level RCS Loss 2.A Page 22 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 238 of 288 Barrier: Reactor Coolant System Category: A. RPV Level Degradation Threat: Potential Loss Threshold:

None Page 23 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 239 of 288 Barrier: Reactor Coolant System Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

1. UNISOLABLE break in ANY of the following:

• Main Steam Line

• HPCI Steam Line'

• ROIC Steam Line

• RWCU

• Feedwater Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system.

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

As used in this threshold, local isolation actions can only be credited if isolation can be completed promptly (i.e. within 15 min.).

In the case of a failure of both isolation valves to close but in which no downstream flow path exists, emergency declaration under this threshold would not be required. Similarly, if the emergency response requires the normal process flow of a system outside primary containment (e.g., EOP requirement to bypass MSIV low RPV water level interlocks and maintain the main condenser as a heat sink using main turbine bypass valves), the threshold is not met. The combination of these threshold conditions represent the loss of both the RCS and Primary Containment (see PC Loss E.1) barriers and justifies declaration of a Site Area Emergency (i.e.,

Loss or Potential Loss of any two barriers).

High steam flow and high steam tunnel temperature annunciators are an indication of a Main Steam Line break. Either parameter will cause an isolation of the MSlVs. Note that the high steam flow alarm may clear if any of the MSlVs close and flow is reduced below the setpoint. I the high steam flow alarm was received (even though it was subsequently cleared) or there is other indication of high flow along with the high temperature alarm, the entry condition for this threshold has been met.

Even though RWCU and Feedwater systems do not contain steam, they are included in the list because an UNISOLABLE break could result in the high-pressure discharge of fluid that is flashed to steam from relatively large volume systems directly connected to the RCS. Note:

Each of the two feedwater injection lines is isolated from the reactor vessel via a series of swing Page 24 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 240 of 288 check valves. The ability of these check valves to isolate cannot be determined until after feedwater is no longer injecting into the reactor vessel.

Large high-energy lines that rupture outside primary containment can discharge significant amounts of inventory and jeopardize the pressure-retaining capability of the RCS until they are isolated. If it is determined that the ruptured line cannot be promptly isolated, the RCS barrier Loss threshold is met.

Basis Reference(s):

1. FSAR Section 5.4.5

2. FSAR Section 6.3

3. FSAR Section 5.4.6

4. FSAR Section 10.4.7

5. FSAR Section 5.4.8

6. P&ID M-141 Nuclear Boiler

7. NEI 99-01 RCS Leak Rate RCS Loss 3.A Page 25 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 241 of 288 Barrier: Reactor Coolant System Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

2. Emergency RPV Depressurization is required Definition(s):

N/A Basis:

Plant symptoms requiring Emergency RPV Depressurization per the EOPs are indicative of a loss of the RCS barrier. If emergency depressurization is required, the plant operators are directed to open safety relief valves (SRVs). Even though the RCS is being vented into the suppression pool, a loss of the RCS exists due to the diminished effectiveness of the RCS pressure barrier to a release of fission products beyond its boundary.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. EO-000-103 Primary Containment Control

3. EO-000-104 Secondary Containment Control

4. EO-000-1 05 Radioactivity Release Control

5. EO-000-1 12 Emergency RPV Depressurization

6. EO-000-1 13 Level Power Control

7. EO-000-114 RPV Flooding

8. NEI 99-01 RCS Leak Rate RCS Loss 3.B Page 26 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 242 of 288 Barrier: Reactor Coolant System Category: B. RCS Leak Rate Degradation Threat: Potential Loss Threshold:

1. UNISOLABLE primary system leakage that results in exceeding EITHER of the following:

• One or more Max Normal Reactor Building Radiation Limits (EO-000-104 Table 9) that can be read in the control room (Table F-3)

OR

• One or more Max Normal Reactor Building Area Temperature Limits (EO-000-1 04 Table 8) that can be read in the control room (Table F-4)

Table F-3 Max Normal Reactor Building Radiation Limits RB Area ARM Channel Max Norm ARM NumberDecito Elevation (ft) DsrpinRad Limit 818 35 Cask Stor Area Hi Alarm 14 Spent Fuel Crit Mon 15 Refuel Floor North (South U2) 42 Refuel Floor West 47 (44 U2) Spent Fuel Crit Mon 749 8 RWCU Recirc PP Access Hi Alarm 10 Fuel Pool PP Area 11 Rx Bldg Sample St 719 5 CRD North Hi Alarm 6 CRD South 670 16 Remote Shutdown Room Hi Alarm 645 3 HPCI PP & Turbine Room Hi Alarm 2 RCIC PP & Turbine Room 25 RHR AC PP Room 1 RHR BD PPRoom 4 RB/RW Sump Area Page 27 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 243 of 288 Table F-4 Max Normal Reactor Building Temperature Limits RB Area Max Normal Elevation Area Temperature Temp (ft) (°F) 749 RWCU-Pump Room 120 RWCU-Heat Exch Room 120 RWCU-Penetration Room 120 719 Main Steam Line Tunnel 157 683 HPCI Pipe Routing Area 120 RCIC Pipe Routing Area 120 645 HPCI-Equip Area 120 HPCI-Emerg Area Cooler 120 645 RCIC-Emerg Area Cooler 120 RCIC-Equip Area 120 645 RHR Equip Areal1 110 645 RHR Equip Area 2 110 Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system (e.g. EP-OOO-104 has direction not to isolate systems if they are needed for EOP actions or damage control)

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

This RCS Potential Loss threshold is limited to primary system leakage that results in exceeding one or more Max Normal Reactor Building Radiation or Temperature Limits that can be remotely determined from within the control room shown in Tables F-3 and F-4 (ref. 1).

NRC regulations require the SSES to establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded (EAL "triqgper").

Max Normal conditions shall be assumed to be from RCS leakage until proven otherwise.

1. Tho* 15 minuto, cl,,

-sification** r...u.iromont (EAL 'trigger"-) for this threshold begins when one or more of the above Max Normal Reactor Building Radiation or Temperature Limits are exceeded.

Page 28 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 244 of 288

• If subsequent actions taken to isolate the leak are successful within the 15 minute classification period, this EAL should not be declared. (Note: EAL SU5.1 should be evaluated).

• If subsequent investigation, within the 15 minute classification period, reveals that the Max Norm conditions are not due to RCS leakage, this EAL should not be declared.

If it cannot be determined within 15 minutes of the EAL "triqper" that the leak is isolable and not the result of condition previously described, then the EAL shall be declared.

Note that a RCS leak could cause the fire suppression systems to actuate. If this occurs, the potential exists that the fire suppression systems could cause the area temperatures to be lower than the values specified in the EO-000-104 even though there is a RCS leak.

• Once it is known that the cause of exceeding Max Norm temperatures is due to a FIRE or loss of ventilation then this threshold is not met. The applicable FIRE EAL should be evaluated.

• If there is certainty that the fire suppression system actuation was caused by a RCS leak and NOT a fire then it is appropriate to judge that the MAX NORM temperature limits have been met even if the actual area temperatures are lower than those listed in the EO-000-1 04.

The presence of elevated general area temperatures or radiation levels in the secondary containment may be indicative of UNISOLABLE primary system leakage outside the primary containment.

The Max Normal Reactor Building Limit values define this RCS threshold because they are the maximum normal operating values and signify the onset of abnormal system operation. When parameters reach this level, equipment failure or misoperation may be occurring. Elevated parameters may also adversely affect the ability to gain access to or operate equipment within the affected area. The locations into which the primary system discharge is of concern correspond to the areas addressed in EO-000-1 04, Secondary Containment Control, Table 8 that can be read in the control room (ref. 2).

Cycling of SRVs to reduce primary system overpressure is not considered reactor coolant leakage. Inventory loss events, such as a stuck open SRV, venting and draining the RCS during cold shutdown or refueling, should not be considered when referring to "RCS leakage" because they are not indications of a break which could propagate. For these events entry into this threshold is not warranted however consideration should be given to RCS Loss - RCS Leak Rate threshold B2.

In general, multiple indications should be used to validate that a primary system is discharging outside Primary Containment. For example, a high area radiation condition may be caused by radiation shine from nearby steam lines or the movement of radioactive materials. Conversely, a high area radiation condition in conjunction with other indications (e.g. room flooding, high area temperatures, reports of steam in the secondary containment, an unexpected rise in feedwater flowrate, or unexpected main turbine control valve closure) may indicate that a primary system is discharging into the secondary containment.

Page 29 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 245 of 288 Potential loss of RCS based on primary system leakage outside the primary containment is determined from EOP temperature or radiation Max Normal Operating values in areas such as main steam line tunnel, RCIC, HPCI, etc., which indicate a direct path from the RCS to areas outside primary containment.

A Max Normal Operating value is the highest value of the identified parameter expected to occur during normal plant operating conditions with all directly associated support and control systems functioning properly.

The indicators reaching the threshold barriers and confirmed to be Caused by RCS leakage from a primary system warrant an Alert classification. A primary system is defined to be the pipes, valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system.

An UNISOLABLE leak as described above escalates to a Site Area Emergency when combined with Containment Barrier Loss threshold B.1 (after a containment isolation) and a General Emergency when the Fuel Clad Barrier criteria is also exceeded.

Basis Reference(s):

1. NCV 05000387; 388/2013005-04, Inadequate Instrumentation to Implement EALs for Fission Product Barrier. Degradation

2. EO-000-104 Secondary Containment Control

3. NEI 99-01 RCS Leak Rate RCS Potential Loss 3.A Page 30 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 246 of 288 Barrier: Reactor Cooiant System Category: C. PC Conditions Degradation Threat: Loss Threshold:

1. Primary Containment pressure > 1.72 psig due to RCS leakage Definition(s):

None Basis:

The drywell high pressure scram setpoint is an entry condition to EO-000-1 02, RPV Control, and EO-000-1 03, Primary Containment*Control (ref. 1, 2). Normal primary containment pressure control functions (e.g., operation of drywell coolers, vent through SGT, etc.) are specified in EO-000-1 03 in advance of less desirable but more effective functions (e.g., operation of drywell or suppression pool sprays, etc.).

In the design basis, primary containment pressures above the drywell high pressure scram setpoint are assumed to be the result of a high-energy release into the containment for which normal pressure control systems are inadequate or incapable of reversing the increasing pressure trend. Pressures of this magnitude, however, can be caused by non-LOCA events such as a loss of drywell cooling or inability to control primary containment vent/purge (ref. 3).

The threshold phrase "...due to RCS leakage" focuses the barrier failure on the RCS instead of the non-LOCA malfunctions that~may adversely affect primary containment pressure. PC pressure greater than 1.72 psig with corollary indications (e.g., drywell temperature, indications of loss of RCS inventory) should therefore be considered a Loss of the RCS barrier. Loss of drywell cooling that results in pressure greater than 1.72 psig should not be considered an RCS barrier Loss.

1.72 psig is the drywell high pressure setpoint which indicates a LOCA by automatically initiating the ECCS or equivalent makeup system.

There is no Potential Loss threshold associated with Primary Containment Pressure.

Basis Reference(s):

1. EO-000-1 02 RPV Control

2. FO-000-103 Primary Containment Control

3. FSAR Section 6.2.1 Primary Containment Functional Design

4. NEI 99-01 Primary Containment Pressure RCS Loss 1I.A Page 31 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 247 of 288 Barrier: Reactor Coolant System Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

None Page 32 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 248 of 288 Barrier: Reactor Coolant System Category: 0. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

1. CHRRM radiation > 7.0E+0 R/hr with indication of a RCS leak inside the drywell Definition(s):

N/A Basis:

Two gamma radiation levels ion chambers are located inside the drywell to monitor post-accident rad levels. The detectors are located in the drywell on elevation 719'. They are always in service and read out on the 0601 panel. Range is 100 to 108 R~hr. Environmentally qualified since they are required for use after an accident. A U-234 bug source is installed in the detector to serve as a self-check for instrument operability. The source provides approximately a 1 R/hr dose rate with the reactor shutdown (ref. 1). When the plant is at 100% power, drywell rad indication is normally about 3-4 R/hr. Containment High Range Radiation Monitor (CHRRM) readings of approximately 3 R/hr indicate an instantaneous release of reactor coolant at normal operating concentrations of 1-131 to the drywell atmosphere. Adding this value to the normal CHRRM background readings of 3-4 R/hr (100% power normal operation) provides the value of 7 R/hr. (ref. 2)

Indication of a RCS leak into the drywell is added to qualify the radiation monitor indication to avoid declaring the loss of the RCS barrier for situations where the radiation increase is not due to a primary system leak. For situations that involve failure of the Fuel Clad Barrier alone,"

containment Radiation levels would increase to greater than 30 R/hr potentially giving a false indication of a loss of the RCS barrier. Therefore the EAL contains a qualifier to preclude over classification of the event if only the fuel clad barrier has failed. Indication of a leak should be determined by observing other containment indications such as sump level, drywell pressure and ambient temperature.

The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold D.1 since it indicates a loss of the RCS Barrier only.

There is no RCS Barrier Potential Loss threshold associated with Primary Containment Radiation.

Basis Reference(s):

1. General Atomic High-Range Gamma Radiation Monitoring System Manual

2. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008 Page 33 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 249 of 288

3. NEI 99-01 Primary Containment Radiation RCS Loss 4.A Page 34 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 250 of 288 Barrier: Reactor Coolant System Category: 0. PC Radiation / RCS Activity Degradation Threat: Potential Loss Threshold:

None Page 35 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 251 of 288 Barrier: Reactor Coolant System Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

None Page 36 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 252 of 288 Barrier: Reactor Coolant System Category: E. PC Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Page 37 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 253 of 288 Barrier: Reactor Coolant System Category: F. ED/RM Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates loss of the RCS barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the RCS barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation existslif the degradation will likely occur within two hours based on a projection of current safety system perf'ormance. The term "imminent" refers to the recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoringq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident seguences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergen~cy classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Loss 6.A Page 38 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 254 of 288 Barrier: Reactor Coolant System Category: F. ED/RM Judgment Degradation Threat: Potential Loss

,Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates potential loss of the RCS barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the RCS barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to the inability to reach final safety acceptance criteria before completing all checks.

• Barrier monitorinq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

• The Emergency Director/Recovery Manager should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Potential Loss 6.A Page 39 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 255 of 288 Barrier: Primary Containment Category: A. RPV Level Degradation Threat: Loss Threshold:

None Page 40 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 256 of 288 Barrier: Primary Containment Category: A. RPV Level Degradation Threat: Potential Loss Threshold:

1. SAsentry required Definition(s):

None Basis:

The Potential Loss threshold is identical to the Fuel Clad Loss RPV Water Level threshold A.1.

The Potential Loss requirement for SAG entry is required indicates adequate core cooling CANNOT BE RESTORED AND MAINTAINED and that core damage is possible. EOPs specify the requirement for entry to the SAGs when core cooling is severely challenged. These EOPs provide instructions to ensure adequate core cooling by maintaining RPV water level above prescribed limits or operating sufficient RPV injection sources when level cannot be determined.

SAG entry is required when (ref. 1, 2):

- RPI ater*÷,Iocl C'ANlNOT BE DrESTORED-F ANDlr M/AI!NTAINED-r ,.bovet, ,179 in.

• , DDP/ wa,,c-r !cve, C'ANNOC~T BE. RES:ZTOREDr' ANDl' MAIN~TAINEDr~ above-.,* 2)10* in. (jt pump.*

suction) w=ith at least ono cor *e,'prayloop injecting into tho DDP/ at% 6350 gpm OR

• EO-1(2)00-102 - when RPV level cannot be restored and maintained above MSCRWL

(-179") or elevation of iet pump suctions (-210") when a loop of Core Sprav is injecting (>

6350 gom).

• EO-1 (2)00-113 - when RPV level cannot be restored and maintained above MSCRWL (E-1792).014 AW)-we oedm~ei curnq

• EO-1(2)00-1 14A(Non-ATWS) - when core damagqe is occurring.

The above EOP conditions represent a challenge to core cooling and are the minimum values to assure core cooling without further degradation of the clad.

SAGs entry is also a Potential Loss of the Fuel Clad barrier (FC P-Loss A.1) which constitutes a Site Area Emergency. The threshold for the RCS barrier (RCS Loss A.1) should also be Page 41 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 257 of 288 evaluated for escalation to a General Emergency if SAGs entry results in meeting that threshold.

PRA studies indicate that the condition of this Potential Loss threshold could be a core melt sequence which, if not corrected, could lead to RPV failure and increased potential for primary containment failure.

Basis Reference(s):

1. EP-DS-001 Containment Combustible Gas Control

2. EP-DS-002 RPV and Primary Containment Flooding SAG-2

3. NEI 99-01 RPV Water Level PC Potential Loss 2.A Page 42 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 258 of 288 Barrier: Primary Containment Category: B. RCS Leak Rate Degradation Threat: Loss Threshold:

1. UNISOLABLE primary system leakage that results in exceeding EITHER of the following:

• One or more Max Safe Reactor Building Radiation Limits (EO-000-104 Table 9) that can be read in the control room (Table F-5)

OR

• One or more Max Safe Reactor Building area temperature Limits (EO-000-104 Table 8) that can be read in the control room (Table F-6)

Table F-5 Max Safe Reactor Building Radiation Limits Max Safe Rad RB Area AR ubrARM ChannelLit Elevation (ft) Description (IR 818 49 Refuel Floor Area 10 749 52 RWCU Recirc PP Access 10 54 Fuel Pool PP Area 719 50 CRD North 10 51 CRD South 670 53 Remote Shutdown Room 10 645 48 HPCI PP & Turbine Room 10 57 RCIC PP & Turbine Room 55 RHR A CPP Room 56 RHR B D PP Room Page 43 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 259 of 288 Table F-6 Max Safe Reactor Building Temperature Limits RB Area Max Safe Elevation Area Temperature Temp (ft) (°F) 749 RWCU-Pump Room 147 RWCU-Heat Exch Room 147 RWCU-Penetration Room 131 719 Main Steam Line Tunnel 177 683 HPCI Pipe Routing Area 167 RCIC Pipe Routing Area 167 645 HPCI-Equip Area 167 HPCI-Emerg Area Cooler 167 645 RCIC-Emerg Area Cooler 167 RCIC-Equip Area 167 645 RHR Equip Areal1 142 645 RHR Equip Area 2 142 Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system (e.g. EP-O00-104 has direction not to isolate systems if they are needed for EOP actions or damage control)

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

This Primary Containment Loss threshold is limited to primary system leakage that results in exceeding one or more Max Safe Reactor Building Radiation or Temperature Limits that can be remotely determined from within the control room shown in Tables F-5 and F-6 ,(ref. 1).

NRC regulations require the SSES to establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded (EAL "tripqper").

• 1 J P J j m I J* A I I£d

• tl*

• II

• I I I no i~, minuto c:acs:Tlcat:on reguiromont (b.AL irippor") Tor mis tflrccflold DopIns wncn onc or

.... # I  !----!l ........... J_ I more ni TnlU *nnUV(J nviav *aTC rw nTor *n iiunnnn i-nauiain or n momratroT limi rnTs are exceaea1.t Page 44 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 260 of 288 Max Safe conditions shall be assumed to be from RCS leakage until proven otherwise.

• EAL "triqper" for this threshold beqins when one or more of the above Max Safe Reactor Buildinp Radiation or Temperature Limits are exceeded.

emergenc...ma. be appoprat...;* If subsequent actions taken to isolate the leak are successful within the 15 minute classification period, this EAL should not be declared.

• If subsequent investigation, within the 15 minute classification period, reveals that the Max Safe conditions are not due to RCS leakage, this EAL should not be declared.

If it cannot be determined within 15 minutes of the EAL "Triqpqer" that the leak is isolable and not the result of condition previously described, then the EAL shall be declared.

Note that a RCS leak could cause the fire suppression systems to actuate. If this occurs the potential exists that the fire suppression systems could cause the area temperatures to be lower than the values specified in the EO-000-104 even though there is a RCS.

• Once it is known that the cause of exceeding MAX SAFE temperatures is due to a FIRE or loss of ventilation then this threshold is not met. The applicable FIRE EAL should be evaluated.

• If there is certainty that the fire suppression system actuation was caused by a RCS leak and NOT a fire then it is appropriate to judge that the MAX NORM temperature limits have been met even if the actual area temperatures are lower than those listed in the EO-000-1 04 The presence of elevated general area temperatures or radiation levels in the secondary containment may be indicative of UNISOLABLE primary system leakage outside the primary containment.

• The Maximum Safe Reactor Building Limit values define this Containment barrier threshold because they are indicative of problems in the secondary containment that are spreading and pose a threat to achieving a safe plant shutdown. This threshold addresses problematic discharges outside primary containment that may not originate from a high-energy line break. The locations into which the primary system discharge is of concern correspond to the areas addressed in EO-000-104, Secondary Containment Control, Table 8 that can be read in the control room (ref. 2).

In general, multiple indications should be used to validate that a primary system is discharging outside Primary Containment. For example, a high area radiation condition may be caused by radiation shine from nearby steam lines or the movement of radioactive materials. Conversely, a high area radiation condition in conjunction with other indications (e.g. room flooding, high area temperatures, reports of steam in the secondary containment, an unexpected rise in feedwater flowrate, or unexpected main turbine control valve closure) may indicate that a primary system is discharging into the secondary containment.

The Max Safe Operating Temperature and the Max Safe Operating Radiation Level are each the highest value of these parameters at which neither: (1) equipment necessary for the safe shutdown of the plant will fail, nor (2) personnel access necessary for the safe shutdown of the Page 45 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 261 of 288 plant will be precluded. EOPs utilize these temperatures and radiation levels to establish conditions under which RPV depressurization is required.

The temperatures and radiation levels should be confirmed to be caused by RCS leakage from a primary system. A primary system is defined to be the pipes, valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system.

In combination with RCS Potential Loss B.1 this threshold would result in a Site Area Emergency.

There is no Potential Loss threshold associated with Primary Containment Isolation Failure.

Basis Reference(s):

1. NOV 05000387; 388/2013005-04, Inadequate Instrumentation to Implement EALs for Fission Product Barrier Degradation

2. EO-000-104 Secondary Containment Control

3. NEI 99-01 RCS Leak Rate PC Loss 3.0 Page 46 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 262 of 288 Barrier: Primary Containment Category: B. RCS Leak Rate Degradation Threat: Potential Loss Threshold:

None Page 47 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 263 of 288 Barrier: Primary Containment Category: C. PC Conditions Degradation Threat: Loss Threshold:

1. UNPLANNED rapid drop in Primary Containment pressure following Primary Containment pressure rise Definition(s):

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

Rapid UNPLANNED loss of primary containment pressure (i.e., not attributable to drywell spray or condensation effects) following an initial pressure increase indicates a loss of primary containment integrity.

This threshold relies on operator recognition of an unexpected response for the condition and therefore a specific value is not assigned. The unexpected (UNPLANNED) response is important because it is the indicator for a containment bypass condition.

Basis Reference(s):

1. NEI 99-0 1 Primary Containment Conditions PC Loss I.A Page 48 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 264 of 288 Barrier: Primary Containment Category: C. PC Conditions Degradation Threat: Loss Threshold:

2. Primary Containment pressure response not consistent with LOCA conditions Definition(s):

None Basis:

The calculated pressure response of the containment is shown in Figure 6.2-2 (ref. 1)

(reproduced on next page). The maximum calculated drywell pressure (63.3 psia or 48.6 psig) is well below the design allowable pressure of 53 psig (ref. 2).

Due to conservatisms in LOCA analyses, actual pressure response is expected to be less than the analyzed response. For example, blowdown mass flowrate may be only 60-80% of the analyzed rate.

Primary containment pressure should increase as a result of mass and energy release into the primary containment from a LOCA. Thus, primary containment pressure not increasing under these conditions indicates a loss of primary containment integrity.

This threshold relies on operator recognition of an unexpected response for the condition and therefore a specific value is not assigned. The unexpected (UNPLANNED) response is important because it is the indicator for a containment bypass condition.

Basis Reference(s):

1. FSAR Figure 6.2-2

2. FSAR Section 6.2.1.1.3.1

3. NEI 99-01 Primary Containment Conditions PC Loss 1 .B Page 49 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 265 of 288 Short-Term RSLB Pressure Response 70 60 50 g 40 O* 30 20 -O W',Pres*

-WW Press 10 0 5 10 15 20 25 30 Time (se*)

FSAR REV. 65 SUSQUEHANNA STEAM ELECFRIC STATION UNIrTS 1 AND 2 FINAL SAFETY ANALYSIS REPORT PRESSURE RESPONSE FOR RECIRCULATION UINE BREAK FIGURE 6.2-2, Re':. 56 Auto ,Cart; Figura Fsar 6__,dn-.g Page 50 of164

Attachment 2 EP-RM-004 Revision [X]

Page 266 of 288 Barrier: Containment Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

1. Primary Containment pressure > 53 psig Definition(s):

None Basis:

When the primary containment exceeds the maximum allowable value (53 psig) (ref. 1), primary containment venting may be required even if offsite radioactivity release rate limits will be exceeded (ref. 2). The drywell and suppression chamber maximum allowable value of 53 psig is based on the primary containment design pressure as identified in the SSES accident analysis.

If this threshold is exceeded, a challenge to the containment structure has occurred because assumptions used in the accident analysis are no longer valid and an unanalyzed condition exists. This constitutes a Potential Loss of the Containment barrier even if a containment breach has not occurred.

The threshold pressure is the primary containment internal design pressure. Structural acceptance testing demonstrates the capability of the primary containment to resist pressures greater than the internal design pressure. A pressure of this magnitude is greater than those expected to result from any design basis accident and, thus, represent a Potential Loss of the, Containment barrier.

Basis Reference(s):

1. ESAR Section 6.2.1.1.3.1

2. EO-000-103 Primary Containment Control

3. NEI 99-01 Primary Containment Conditions PC Potential Loss 1I.A Page 51 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 267 of 288 Barrier: Containment Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

2. Deflagration concentrations exist inside PC (H2 _>6% AND 02 Ž>5%)

Definition(s):

None Basis:

Deflagration (explosive) mixtures in the primary containment are assumed to be elevated concentrations of hydrogen and oxygen. BWR industry evaluation of hydrogen generation for development of EPGs/SAGs indicates that any hydrogen concentration above minimum detectable is not to be expected within the short term. Post-LOCA hydrogen generation primarily caused by radiolysis is a slowly evolving, long-term condition. Hydrogen concentrations that rapidly develop are most likely caused by metal-water reaction. A metal-water reaction is indicative of an accident more severe than accidents considered in the plant design basis and would be indicative, therefore, of a potential threat to primary containment integrity. Hydrogen concentration of approximately 6% is considered the global deflagration concentration limit (ref. 1).

Except for brief periods during plant startup and shutdown, oxygen concentration in the primary containment is maintained at insignificant levels by nitrogen inertion. The specified values for this Potential Loss threshold are the minimum global deflagration concentration limits (6%

hydrogen and 5% oxygen) and readily recognizable because 6%..,J.,-*- .... ,hydrge

,ell

... a,

'bo've the.,,

EQ* 000 103, Prima,"' Containmont,rol,,,*

Cont ont,"' cond,,ition. EP-DS-001 requires control of drywell and suppression chamber atmosphere gas concentrations to less than 6% hydrogen and 5% oxygen to assure that an exp~losive mixture does not exit (ref. 2 ,-3 ). Values above the hydrogen/oxygen concentrations (6% and 5%, respectively) require intentional primary containment venting, which is defined to be a Loss of Containment (PC Loss E.2).

Hydrogen and oxygen concentration in the drywell during normal operation. These monitors are isolated by accident isolation signals. However, monitors CAC-AT-4409 and 4410 will be realigned to the primary containment for post-accident monitoring via an operator actuated isolation signal override circuit when directed by the EOPs.

If hydrogen concentration reaches or exceeds the lower flammability limit, as defined in plaf-t

• Q~EP-DS-001, in an oxygen rich environment, a potentially explosive mixture exists. If the combustible mixture ignites inside the primary containment, loss of the Containment barrier could occur.

Basis Reference(s):

1. BWROG EPG/SAG Revision 3, Subsection PC/G

-- "2" E"t*t*/*"

000-103 Q Primar Cot"an*mont* Cot'-÷rol Page 52 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 268 of 288

32. EP-DS-001 Containment Combustible Gas Control 4_3. NEI 99-0 1 Primary Containment Conditions PC Potential Loss 1 .B Page 53 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 269 of 288 Barrier: Containment Category: C. PC Conditions Degradation Threat: Potential Loss Threshold:

3. Heat Capacity Temperature Limit (Figure - HCTL) exceeded Figure - HCTL He"t Cap..city, Temperature.. Limit Definition(s):

None Basis:

This threshold is met when the final step of section SP/T in EO-O00-1 03, Primary Containment Control, is reached (ref. 1).

Page 54 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 270 of 288 The Heat Capacity Temperature Limit (HCTL) 'is the highest suppression pool temperature from which Emergency RPV Depressurization will not raise:

Suppression chamber temperature above the maximum temperature capability of the suppression chamber and equipment within the suppression chamber which may be required to operate when the RPV is pressurized, OR Suppression chamber pressure above Primary Containment Pressure Limit A, while the rate of energy transfer from the RPV to the containment is greater than the capacity of the containment vent.

The HCTL is a function 'of RPV pressure, suppression pool temperature and suppression pool water level. It is utilized to preclude failure of the containment and equipment in the containment necessary for the safe shutdown of the plant and therefore, the inability to maintain plant parameters below the limit constitutes a potential loss of containment.

Basis Reference(s):

1. E0-000-1 03 Primary Containment Control

2. NEI 99-01 PrimarY Containment Conditions PC Potential Loss 1.C Page 55 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 271 of 288 Barrier: Primary Containment Category: D. PC Radiation / RCS Activity Degradation Threat: Loss Threshold:

None Page 56 of 64

Attachment 2 EP-RM-004 Revision [X]

• Page 272 of 288 Barrier: Primary Containment Category: 0. PC Radiation / RCS Activity Degradation Threat: Potential Loss Threshold:

1. CHRRM radiation > 4.0E+4R/hr Definition(s):

None Basis:

Two gamma radiation levels ion chambers are located inside the drywell to monitor post-accident radiation levels. The detectors are located in the drywell on elevation 719'. They are always in service and read out on the 0601 panel. Range is 100 to 108 R/hr. Environmentally qualified since they are required for use after an accident. A U-234 bug source is installed in the detector to serve as a self-check for instrument operability. The source provides approximately a 1 R/hr dose rate with the reactor shutdown (ref. 1). When the plant is at 100% power, Containment High Range Radiation Monitor (CHRRM) indication is normally about 3-4 R/hr. A reading of 40,000 R/hr indicates the release of reactor coolant into the drywell with elevated activity indicative of 20% fuel clad damage (ref. 2).

An analysis of the Containment High Range Radiation Monitor (CHRRM) response to a Loss-Of-Coolant Accident (LOCA) is given in reference 2. Results are summarized in Reference 2, Section 2 for the case of 1% clad damage. For this threshold a reactor shutdown time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is conservatively assumed. Although CHRRM data is always available for emergency planning, a one hour shutdown time is conservative for times less than one hour and is applicable to the timing of the sequence of events for a LOCA that would result in both the release of reactor coolant activity to containment and damage to 20% of the fuel clad. From reference 2, Section 2, the calculated CHRRM dose rate at one hour after shutdown for a complete loss of reactor coolant activity to containment with 1% clad damage is 2160 R/hr. Multiplying this value by a factor of 20 to account for 20% clad damage results in a CHRRM dose rate of 43,200 R/hr. This value is rounded to 40,000 R/hr for human factors considerations.

A Containment High Range Rad Monitor reading > 40,000 R/hr is a value which indicates significant fuel damage well in excess of that required for loss of RCS and Fuel Clad. A major failure of fuel cladding which allows radioactive material to be released from the core into the reactor coolant could result in a major release of radioactivity requiring offsite protective actions.

Regardless of whether containment is challenged, this amount of activity in containment corresponding to a CHHRM reading > 40,000 R*hr, if released, could have such severe consequences that it is prudent to treat this as a potential loss of containment, such that a General Emergency declaration is warranted.

In order to reach this Containment barrier Potential Loss threshold, a loss of the RCS barrier (RCS Loss D.1 ) and a loss of the Fuel Clad barrier (FC'Loss D.1) have already occurred. This threshold, therefore, represents at a General Emergency classification.

Page 57 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 273 of 288 The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and ROS Barrier Loss thresholds.

N UREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification level to a General Emergency.

Basis Reference(s):

1. General Atomic High-Range Gamma Radiation Monitoring System Manual

2. Calculation EC RADN 0525 Rev 2, "Estimation of Containment High Range Radiation Monitor Response to a Loss of Coolant Accident for Emergency Planning Purposes,"

January 8, 2008

3. NEI 99-01 Primary Containment Radiation Fuel Clad Potential Loss I .D Page 58 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 274 of 288 Barrier: Primary Containment Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

1. UNISOLABLE direct downstream pathway to the environment exists after Primary Contain ment isolation signal Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

• The term UNISOLABLE also includes any decision by plant staff or procedure direction to not isolate a primary system (e.g. EP-O00-104 has direction not to isolate systems if they are needed for EOP actions or damage control)

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Basis:

This threshold addresses failure of open isolation devices which should close upon receipt of a manual or automatic containment isolation signal resulting in a significant radiological release pathway directly to the environment.

The concern is the unisolable open pathway to the environment. A failure of the ability to isolate any one line with a pathway directly to the environment indicates a breach of primary containment integrity. Examples include:

• This EAL is applicable if plant operators attempt to close isolation valves before any automatic setpoints are reached, and both valves fail to close AND a downstream pathway to the environment exists. If subsequent actions are successful, downgrading the emergency may be appropriate.

• Main Steam Line breaks with two MSIVs in one line failing to close.

• HPCI, RCIC or RWCU steam line breaks with all isolation valves in one line failing to close.

• UNISOLABLE containment atmosphere vent paths.

• Automatic closure of both isolation valves in one line are disabled AND an isolation signal occurs AND a downstream pathway exits.

The adjective "direct" modifies "release pathway" to discriminate against release paths through interfacing liquid systems. The following examples do not meet the EAL threshold:

• If the main condenser is available with an UNISOLABLE main intact steam line, there may be releases through the steam jet air ejectors and gland seal exhausters. These pathways are monitored, however, and do not meet the intent of an UNISOLABLE direct release path to the environment. These minor releases are assessed using the Category R, Abnormal Rad Release / Rad Effluent, EALs.

• Leakage into a closed system (e.g. RHR, Core Spray) is to be considered only if the closed system is breached and thereby creates a significant pathway to the environment.

• Normal leakage past a closed isolation valve is not considered UNISOLABLE leakage.

Page 59 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 275 of 288

• SCRAM Discharge Volume valves fail to close. The SDV drains to the Reactor Building Sump, which creates the pathway to the environment.

• The existence of an in-line charcoal filter (SGTS) does not make a release path indirect since the filter is not effective at removing fission noble gases. Typical filters have an efficiency of 95-99% removal of iodine. Given the magnitude of the core inventory of iodine, significant releases could still occur. In addition, since the fission product release would be driven by boiling in the reactor vessel, the high humidity in the release stream can be expected to render the filters ineffective in a short period.

• EO-000-1 03, Primary Containment Control, Section PC/P may specify primary containment venting and intentional bypassing of the containment isolation valve logic, even if offsite radioactivity release rate limits are exceeded (ref. 1). Under these conditions with a valid containment isolation signal, the Containment barrier should be considered lost.

Declaration of this EAL threshold constitutes a radiological release in progress.

The use of the modifier "direct" in defining the release path discriminates against release paths through interfacing liquid systems or minor release pathways, such as instrument lines, not protected by the Primary Containment Isolation System (PCIS).

The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream.

Following the leakage of RCS mass into primary containment and a rise in primary containment pressure, there may be minor radiological releases associated with allowable primary containment leakage through various penetrations or system components. Minor releases may also occur if a primary containment isolation valve(s) fails to close but the primary containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of primary containment but should be evaluated using the Recognition Category R ICs.

Basis Reference(s):

1. EO-000-1 03 Primary Containment Control

2. NEI 99-01 Primary Containment Isolation Failure PC Loss 3.A Page 60 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 276 of 288 Barrier: Primary Containment Category: E. PC Integrity or Bypass Degradation Threat: Loss Threshold:

2. Intentional Primary Containment venting per E..-k,..[DS 001*RPlv anD\,P,*'.

Cv Vontingprocedures OR EQ procedures Definition(s):

None Basis:

EQ 000nn- 103,*, Primary Co,,ntainmc,,,,nt,Cnrol,,,.-*v,,,

EP-DS procedures or EQ procedures may specify primary containment venting and intentional bypassing of the containment isolation valve logic, even if offsite radioactivity release rate limits are exceeded (ref. 1 -_._). The threshold is met when the operator begins venting the primary containment in accordanco ';ith EP DS 001, RPV ad-P.C-.Veit4i, not when actions are taken to bypass interlocks prior to opening the vent valves (ref. 2).

Because the containment vent valves are not qualified for opening/reclosure in a post-accident environment, there is no guarantee that venting, once initiated, can be terminated. Thus it is assumed that once the vents are opened with a source term, they are not re-closed (ref. 3,7).

Intentional venting of primary containment for primary containment pressure control to the secondary containment and/or the environment is a Loss of the Containment. Venting for primary containment pressure control when not in an accident situation (e.g., to control pressure below the drywell high pressure scram setpoint) does not meet the threshold condition.

Basis Reference(s):

1. EP-DS-001 Containment Combustible Gas Control

2. EP-DS-002 RPV and Primary Containment Floodinq SAG-2

3. EP-DS-004 Primary Containment Ventinq

4. EP-DS-005 Loss of All Decay Heat Removal

5. EO-000-1 03 Primary Containment Control

2. EP DS 001 RPV and PC Vonting6. EO-000-1 12 Emerqency Rapid Depressurization

,37. NL-98-036, SSES Safety Evaluation for EP-DS-004, Primary Containment and RPV Venting 48_. NEI 99-01 Primary Containment Isolation Failure PC Loss 3.B Page 61 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 277 of 288 Barrier: Primary Containment Category: E. PC Integrity or Bypass Degradation Threat: Potential Loss Threshold:

None Page 62 of 64

Attachment 2 EP-RM-004 Revision [X]

Page 278 of 288 Barrier: Primary Containment Category: F. ED/RM Judgment Degradation Threat: Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates loss of the Primary Containment barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitoringq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A Page 63 of 64

Attachment 2 EP-RM-004 Revision IX]

Page 279 of 288 Barrier: Primary Containment Category: F. ED/RM Judgment Degradation Threat: Potential Loss Threshold:

1. Any condition in the opinion of the Emergency Director/Recovery Manager that indicates potential loss of the Primary Containment barrier Definition(s):

None Basis:

The Emergency Director/Recovery Manager judgment threshold addresses any other factors relevant to determining if the Primary Containment barrier is potentially lost. Such a determination should include imminent barrier degradation, barrier monitoring capability and dominant accident sequences.

• Imminent barrier deqradation exists if the degradation will likely occur within two hours based on a projection of current safety system performance. The term "imminent" refers to recognition of the inability to reach safety acceptance criteria before completion of all checks.

• Barrier monitorinq capability is decreased if there is a loss or lack of reliable indicators.

This assessment should include instrumentation operability concerns, readings from portable instrumentation and consideration of offsite monitoring results.

• Dominant accident sequences lead to degradation of all fission product barriers and likely entry to the EOPs. The Emergency Director/Recovery Manager should be mindful of the Loss of AC power (Station Blackout) and ATWS EALs to assure timely emergency classification declarations.

Basis Reference(s):

1. NEI 99-01 Emergency Director Judgment PC Loss 6.A Page 64 of 64

Attachment 3 EP-RM-004 Revision [X]

Page 280 of 288 ATTACHMENT 3 Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

Background

NEI 99-01 Revision 6 l~s AA3 (SSES RA3.2) and HA5 (SSES HA5.1) prescribe declaration of an Alert based on impeded access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal plant operations, cooldown or shutdown is located. These areas are intended to be plant operating mode dependent. Specifically the Developers Notes For AA3 and HA5 states:

The "site-specific list of plant rooms or areas with entry-related mode applicabilityidentified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operatingprocedures used for normal plant operation, cooldown and shutdown. Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be required for each room or area.

The list should not include rooms or areas for which entry is requiredsolely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

Further, as specified in IC HA5:

The list need not include the Control Room if adequate engineeredsafety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas.

Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.

Site-Specific Analysis The Control Room is excluded from Table R-2 since it is included EAL RA3.1 for all modes.

NEI 99-01 Rev. 6 developer notes state that the control room does not need to be included Table R-2 for this reason.

The Control Room is included in Table H-2 for all modes since adequate engineered safety/design features are not in place to preclude a Control Room evacuation due to the release of a hazardous gas at SSES.

The remaining list of mode dependent rooms in Tables R-2 and H-2 is a list of rooms where actions are absolutely required to be performed to move the plant from normal operations through cool down and to achieve and maintain cold shutdown. These areas are not areas requiring entry to solely meet surveillance requirements. This does not include actions called out for in the procedures that are not absolutely needed to move the plant into and maintain cold shutdown (e.g. shutting down turbine lube oils systems, opening of system drains). In order to transition from normal operations (Modes 1 and 2) to hot shutdown (Mode 3) the only location required is the Control Room since the plant is able to be placed into hot shutdown from the control room without the need for any other room entry.

Page 1 of 3

Attachment 3 EP-RM-004 Revision [X]

Page 281 of 288 The remaining rooms/areas shown in in Tables R-2 and H-2 were determined based on the discussion section above and Modes 1 and 2 were excluded. Therefore, the analysis starting point was a review the steps of GO-100/200-005 "PLANT SHUTDOWN TO HOT/COLD SHUTDOWN" after the Unit is has reached Mode 3. The analysis then branched to other procedure steps described in the GO's if those procedures steps were not excluded from consideration as noted in the discussion section. The analysis concluded that Reactor Building areas and elevations listed in in Tables R-2 and H-2 contain equipment that must be manipulated in Mode 3 to achieve and maintain cold shutdown. Modes 4 and 5 are also included for these areas to account for swapping loops for long term operation of shutdown cooling.

Tables R-2 and H-2 Bases A review of station operating procedures identified the following mode dependent in-plant actions and associated areas that are required for normal plant operation, cooldown or shutdown Unit 1 RA3.2 /HA5.1 Elevation Area(s)

Mode(s) 670 27 3,4,5 683 27, 28 & 29 3,4,5 703 28 &29 3,4,5 719 25 &29 3,4,5 749 25 &29 3,4,5 729

• 12, 21 1,2,3,4,5,D Unit 2 RA3.2 / HA5.1 Mode(s)

Elevation Area(s) 670 32 3,4,5 683 32, 33 & 34 3,4,5 703 33 & 34 3,4,5 719 30 & 34 3,4,5 749 32 & 33 3,4,5 729

• 12, 21 1, 2,3,4,5,D

• Control Room - only applicable to HAS Page 2 of 3

Attachment 3 EP-RM-004 Revision IX]

Page 282 of 288 Table R-2 & H-2 Results Table R-2 & H-2 Safe Operation & Shutdown Areas Elevation Unit I Area(s) ** Unit 2 Area(s) ** Mode(s) 670' RB 27 RB 32 3,4,5 683' RB 27, 28, 29 RB 32, 33, 34 3,4,5 703' RB 28, 29 RB 33, 34 3,4,5 719' RB 25, 29 RB 30, 34 3,4,5 749' RB 25, 29 RB 32, 33 3,4,5 729' CSI12, 21" CS12,21" 1, 2, 3,4,5, D

• Control Room - only applicable to HA5

• • See Chart 1 for the specific locations of areas listed in Table R-2 and H-2.

Chart 1- Plant Area Key Plan

___ LOWWASTE 70RAD LEVEL WATER TREATMENT E SRYPN PRY ON 48 AID AD ~VALVE VAULT CHLORINE 53J5251 50 47BUILDING PUMPHOUSE ESSW IUI#

.1TURBINE UNIT#2 BLDG. TRIEBD.RDAT TURB. 16 15 14 13 4 3 2 1 E

20 19 18 I17 .t-t-I-t-8 7 6 5 I24 23 22 21 12 11 10 9 42 1411

=1-4.-I 36 35 u.COND &REF STORAG 44 43 <*..DIESEL i

- - 4- - -

E #2 #

IIINTAKE REACTOR REACTOR R*IVER '* E DIESEL I STRUCTURE E~GENERATORT Page 3 of 3