Text

Issuance of Amendment Nos. 240 and 203 to Implement TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4B
	ML20034F637
Person / Time
Site:	Limerick
Issue date:	02/28/2020
From:	V Sreenivas; NRC/NRR/DORL/LPL1
To:	Bryan Hanson; Exelon Generation Co, Exelon Nuclear
	Sreenivas V
References
	EPID L-2018-LLA-0567
	Download: ML20034F637 (154)
	v • d • e

February 28, 2020 Mr. Bryan C. Hanson Senior Vice President Exelon Generation Company, LLC President and Chief Nuclear Officer Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

SUBJECT:

LIMERICK GENERATING STATION, UNITS 1 AND 2 ISSUANCE OF AMENDMENT NOS. 240 AND 203 TO IMPLEMENT TSTF-505, REVISION 2, PROVIDE RISK-INFORMED EXTENDED COMPLETION TIMES - RITSTF INITIATIVE 4B (EPID L-2018-LLA-0567)

Dear Mr. Hanson:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment Nos. 240 and 203 to Renewed Facility Operating License Nos. NPF-39 and NPF-85 for the Limerick Generating Station, Units 1 and 2, respectively, in response to your application dated December 13, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18347B366), as supplemented by letters dated February 14, 2019; August 12, 2019; August 27, 2019; and January 7, 2020 (ADAMS Accession Nos. ML19045A011, ML19224B705, ML19239A004, and ML20008D203, respectively).

The amendments revise technical specification requirements to permit the use of risk-informed completion times for actions to be taken when limiting conditions for operation are not met. The changes are based on Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF [Risk-Informed Technical Specification Task Force] Initiative 4b, dated July 2, 2018 (ADAMS Accession No. ML18183A493). The Commission issued a final model safety evaluation approving TSTF-505, Revision 2, on November 21, 2018 (ADAMS Accession No. ML18269A041).

B. Hanson A copy of the related safety evaluation is also enclosed. Notice of Issuance will be included in the Commissions biweekly Federal Register notice.

Sincerely,

/RA/

V. Sreenivas, Project Manager Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-352 and 50-353

Enclosures:

1. Amendment No. 240 to Renewed NPF-39

2. Amendment No. 203 to Renewed NPF-85

3. Safety Evaluation cc: Listserv

EXELON GENERATION COMPANY, LLC DOCKET NO. 50-352 LIMERICK GENERATING STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 240 Renewed License No. NPF-39

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Exelon Generation Company, LLC (Exelon Generation Company), dated December 13, 2018, as supplemented by letters dated February 14, 2019; August 12, 2019; August 27, 2019; and January 7, 2020, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Renewed Facility Operating License No. NPF-39 is hereby amended to read as follows:

(2) Technical Specifications The Technical Specifications contained in Appendix A and the Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 240, are hereby incorporated into this renewed license. Exelon Generation Company shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

2. Accordingly, the license is amended by changes to the Renewed Facility Operating License and Technical Specifications as indicated in the attachment to this license amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented within 180 days.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

James G. Danna, Chief Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License and Technical Specifications Date of Issuance: February 28, 2020

ATTACHMENT TO LICENSE AMENDMENT NO. 240 LIMERICK GENERATING STATION, UNIT 1 RENEWED FACILITY OPERATING LICENSE NO. NPF-39 DOCKET NO. 50-352 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change.

Page Page 3 3 Replace the following pages of the Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Page Page 3/4 1-19 3/4 1-19 3/4 3-1 3/4 3-1 3/4 3-9 3/4 3-9 3/4 3-32 3/4 3-32 3/4 3-36 3/4 3-36 3/4 3-42 3/4 3-42 3/4 3-46 3/4 3-46 3/4 3-54 3/4 3-54 3/4 3-112 3/4 3-112 3/4 4-23 3/4 4-23 3/4 5-2 3/4 5-2 3/4 5-3 3/4 5-3 3/4 6-5 3/4 6-5 3/4 6-15 3/4 6-15 3/4 6-16 3/4 6-16 3/4 6-17 3/4 6-17 3/4 6-44 3/4 6-44 3/4 7-1 3/4 7-1 3/4 7-1a 3/4 7-1a 3/4 7-3 3/4 7-3 3/4 7-9 3/4 7-9 3/4 7-33 3/4 7-33 3/4 8-1 3/4 8-1 3/4 8-1a 3/4 8-1a 3/4 8-2 3/4 8-2 3/4 8-2a 3/4 8-2a 3/4 8-10 3/4 8-10 3/4 8-10a 3/4 8-10a 3/4 8-17 3/4 8-17 6-14e 6-14e

--- 6-14f

(2) Pursuant to the Act and 10 CFR Part 70, to receive, possess and to use at any time special nuclear material as reactor fuel, in accordance with the limitations for storage and amounts required for reactor operation, as described in the Final Safety Analysis Report, as supplemented and amended; (3) Pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess and use at any time any byproduct, source and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required;

( 4) Pursuant to the Act and 10 CFR Parts 30, 40, 70, to receive, possess, and use in amounts as required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Pursuant to the Act and 10 CFR Parts 30, 40 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility, and to receive and possess, but not separate, such source, byproduct, and special nuclear materials as contained in the fuel assemblies and fuel channels from the Shoreham Nuclear Power Station.

C. This renewed license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I ( except as exempted from compliance in Section 2.D. below) and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

( 1) Maximum Power Level Exelon Generation Company is authorized to operate the facility at reactor core power levels not in excess of 3515 megawatts thermal

( 100% rated power) in accordance with the conditions specified herein and in Attachment 1 to this license. The items identified in Attachment 1 to this renewed license shall be completed as specified. Attachment 1 is hereby incorporated into this renewed license.

(2) Technical Specifications The Technical Specifications contained in Appendix A and the Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 240, are hereby incorporated into this renewed license. Exelon Generation Company shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

Renewed License No. NPF-39 Amendment No. 240

REACTIVITY CONTROL SYSTEMS 3/4.1.5 STANDBY LIQUID CONTROL SYSTEM LIMITING CONDITION FOR OPERATION 3.1.5 The standby liquid control system shall be OPERABLE and consist of the following:

a. In OPERATIONAL CONDITIONS 1 and 2, two pumps and corresponding flow paths,

b. In OPERATIONAL CONDITION 3, a minimum of one pump and corresponding flow path.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3 ACTION:

a. With only one pump and corresponding explosive valve OPERABLE, in OPERATIONAL CONDITION 1 or 2, restore one inoperable pump and corresponding explosive valve to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

b. With standby liquid control system otherwise inoperable, in OPERATIONAL CONDITION 1, 2, or 3, restore the system to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.1.5 The standby liquid control system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by verifying that:

1. The temperature of the sodium pentaborate solution is within the limits of Figure 3.1.5-1.

2. The available volume of sodium pentaborate solution is at least 3160 gallons.

3. The temperature of the pump suction piping is within the limits of Figure 3.1.5-1 for the most recent concentration analysis.

LIMERICK - UNIT 1 3/4 1-19 Amendment No. ~.~.su.~.~.

~.240

3/4.3 INSTRUMENTATION 3/4.3.1 REACTOR PROTECTION SYSTEM INSTRUMENTATION 3.3.1 As a m1n1mum, the reactor protection system instrumentation channels shown in Table 3.3.1-1 shall be OPERABLE with the REACTOR PROTECTION SYSTEM RESPONSE TIME as shown in Table 3.3.1-2.

APPLICABILITY: As shown in Table 3.3.1-1.

ACTION:

Note: Separate condition entry is allowed for each channel.

Note: When Functional Unit 2.b and 2.c channels are inoperable due to the calculated power exceeding the APRM output by more than 2% of RATED THERMAL POWER while operating at~ 25% of RATED THERMAL POWER, entry into the associated Actions may be delayed up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

a. With the number of OPERABLE channels in either trip system for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, within one hour or in accordance with the Risk Informed Completion Time Program*** for each affected functional unit either verify that at least one* channel in each trip system is OPERABLE or tripped or that the trip system is tripped, or place either the affected trip system or at least one inoperable channel in the affected trip system in the tripped condition.

b. With the number of OPERABLE channels in either trip system less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel Cs) or the affected trip system** in the tripped conditions within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program***.

c. With the number of OPERABLE channels in both trip systems for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(sl in one trip system or one trip system in the tripped condition within 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s** or in accordance with the Risk Informed Completion Time Program***.

d. lf within the allowable time allocated by Actions a, b or c, it is not desired to place the inoperable channel or trip system in trip (e.g., full scram would occur), Then no later than expiration of that allowable time initiate the action identified in Table 3.3.1-1 for the applicable Functional Unit.

For Functional Units 2.a, 2.b, 2.c, 2.d, and 2.f, at least two channels shall be OPERABLE or tripped. For Functional Unit 5, both trip systems shall have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems) OPERABLE or tripped. For Function 9, at least three channels per trip system shall be OPERABLE or tripped.

- For Functional Units 2.a, 2.b, 2.c, 2.d, and 2.f, inoperable channels shall be placed in the tripped condition to comply with Action b. Action c does not apply for these Functional Units.

- - Not applicable when trip capability is not maintained for one or more Functional Units.

LIMERICK - UNIT 1 3/4 3-1 Amendment No. ~.-7-1 ..l.4+,-+/--7+,200,219,

~.240

INSTRUMENTATION 3/4.3.2. ISOLATION ACTUATION INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.2 The isolation actuation instrumentation channels shown in Table 3.3.2-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.2.-2 and with ISOLATION SYSTEM RESPONSE TIME as shown in Table 3.3.2-3.

APPLICABILITY: As shown in Table 3.3.2-1.

ACTION:

a) With an isolation actuation instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.2-2, declare the channel inoperable until the channel is restored to OPERABLE status with its trip setpoint adjusted consistent with the Trip Setpoint value.

b) With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirements for one trip system:

1. If placing the inoperable channel(s) in the tripped condition would cause an isolation, the inoperable channel(s) shall be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or in accordance with the Risk Informed Completion Time Program**#. If this cannot be accomplished, the ACTION required by Table 3.3.2-1 for the affected trip function shall be taken, or the channel shall be placed in the tripped condition.

or

2. If placing the inoperable channel (s) in the tripped condition would not cause an isolation, the inoperable channel (s) and/or that trip system shall be placed in the tripped condition within:

a) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program**# for trip functions common* to RPS Instrumentation.

b) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program**# for trip functions not common* to RPS Instrumentation.

Trip functions common to RPS Actuation Instrumentation are shown in Table 4.3.2.1-1.

- Not applicable when trip capability is not maintained.

Not applicable for Function 7, Secondary Containment Isolation.

LIMERICK - UNIT 1 3/4 3-9 Amendment No. -&J,-&9,~. 240

INSTRUMENTATION 3/4.3.3 EMERGENCY CORE COOLING SYSTEM ACTUATION INSTRUMENTATION 3.3.3 The emergency core cooling system (ECCS) actuation instrumentation channels shown in Table 3.3.3-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.3-2 and with EMERGENCY CORE COOLING SYSTEM RESPONSE TIME as shown in Table 3.3.3-3.

APPLICABILITY: As shown in Table 3.3.3-1 ACTION:

a. With an ECCS actuation instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.3-2, declare the channel inoperable until the channel is restored to Operable status with its trip setpoint adjusted consistent with the Trip Setpoint value.

b. With one or more ECCS actuation instrumentation channels inoperable, take the ACTION required by Table 3.3.3-1.

c. With either ADS trip system subsystem inoperable, restore the inoperable trip system to OPERABLE status within:

1. 7 days or in accordance with the Risk Informed Completion Time Program, provided that the HPCI and RCIC systems are OPERABLE.

2. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to less than or equal to 100 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.3.3.1 Each ECCS actuation instrumentation channel shall be demonstrated OPERABLE by the performance of the CHANNEL CHECK, CHANNEL FUNCTIONAL TEST and CHANNEL CALIBRATION operations for the OPERATIONAL CONDITIONS shown in Table 4.3.3.1-1 and at the frequencies specified in the Surveillance Frequency Control Program unless otherwise noted in Table 4.3.3.1-1.

4.3.3.2 LOGIC SYSTEM FUNCTIONAL TESTS and simulated automatic operation of all channels shall be performed in accordance with the Survei 11 ance Frequency Control Program.

4.3.3.3 The ECCS RESPONSE TIME of each ECCS trip function shown in Table 3.3.3-3 shall be demonstrated to be within the limit in accordance with the Surveillance Frequency Control Program. Each test shall include at least one channel per trip system such that all channels are tested at least once every N times the frequency specified in the Surveillance Frequency Control Program where N is the total number of redundant channels in a specific ECCS trip system.

LIMERICK - UNIT 1 3/4 3-32 Amendment No. ++/-,-+/--8&, 240

TABLE 3.3.3-1 (Continued)

EMERGENCY CORE COOLING SYSTEM ACTUATION INSTRUMENTATION ACTION STATEMENTS ACTION 30 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the associated system inoperable.

b. With more than one channel inoperable, declare the associated system inoperable.

ACTION 31 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, declare the associated ECCS inoperable within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION 32 - DELETED ACTION 33 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*, or declare the associated ECCS inoperable.

ACTION 34 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. For one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the HPCI system inoperable.

b. With more than one channel inoperable, declare the HPCI system inoperable.

ACTION 35 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*, or declare the HPCI system inoperable.

ACTION 36 - With the number of OPERABLE channels less than the Total Number of Channels, declare the associated emergency diesel generator and the associated offsite source breaker that is not supplying the bus inoperable and take the ACTION required by Specification 3.8.1.1 or 3.8.1.2, as appropriate.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 1 3/4 3-36 Amendment No. +l,~.~.~. 240

INSTRUMENTATION 3/4.3.4 RECIRCULATION PUMP TRIP ACTUATION INSTRUMENTATION ATWS RECIRCULATION PUMP TRIP SYSTEM INSTRUMENTATION 3.3.4.1 The anticipated transient without scram recirculation pump trip (ATWS-RPT) system instrumentation channels shown in Table 3.3.4.1-1 shall be OPERABLE with their trip setpoints set consistent with values shown in the Trip Setpoint column of Table 3.3.4.1-2.

APPLICABILITY: OPERATIONAL CONDITION 1.

ACTION:

a. With an ATWS recirculation pump trip system instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.4.1-2, declare the channel inoperable until the channel is restored to OPERABLE status with the channel trip setpoint adjusted consistent with the Trip Setpoint value.

b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel (s) in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*.

c. With the number of OPERABLE channels two or more less than required by the Minimum OPERABLE Channels per Trip System requirement for one trip system and:

1. If the inoperable channels consist of one reactor vessel water level channel and one reactor vessel pressure channel, pl ace both inoperable channels in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or if this action will initiate a pump trip, declare the trip system inoperable.

2. If the inoperable channels include two reactor vessel water level channels or two reactor vessel pressure channels, declare the trip system inoperable.

d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

e. With both trip systems inoperable, restore at least one trip system to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

SURVEILLANCE REQUIREMENTS 4.3.4.1.1 Each of the required ATWS recirculation pump trip system instrumentation channels shall be demonstrated OPERABLE by the performance of the CHANNEL CHECK, CHANNEL ~UNCTIONAL TEST and CHANNEL CALIBRATION operations at the frequencies specified in the Surveillance Frequency Control Program.

4.3.4.1.2 LOGIC SYSTEM FUNCTIONAL TESTS and simulated automatic operation of all channels shall be performed in accordance with the Survei 11 ance Frequency Control Program.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 1 3/4 3-42 Amendment No. 0,-7-+/--,~. 240

INSTRUMENTATION END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM INSTRUMENTATION 3.3.4.2 The end-of-cycle recirculation pump trip (EOC-RPT) system instrumentation channels shown in Table 3.3.4.2-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.4.2-2 and with the END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM RESPONSE TIME as shown in Table 3.3.4.2-3.

APPLICABILITY: OPERATIONAL CONDITION 1, when THERMAL POWER is greater than or equal to 29.5% of RATED THERMAL POWER.

ACTION:

a. With an end-of cycle recirculation pump trip system instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.4.2 2, declare the channel inoperable until the channel is restored to OPERABLE status with the channel setpoint adjusted consistent with the Trip Setpoint value.

b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel (s) in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program*.

c. With the number of OPERABLE channels two or more less than required by the Minimum OPERABLE Channels per Trip System requirement for one trip system and:

1. If the inoperable channels consist of one turbine control valve channel and one turbine stop valve channel, place both inoperable channels in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program.

2. If the inoperable channels include two turbine control valve channels or two turbine stop valve channels, declare the trip system inoperable. *

d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or take the ACTION required by Specification 3.2.3.

e. With both trip systems inoperable, restore at least one trip system to OPERABLE status within one hour or take the ACTION required by Specification 3.2.3.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 1 3/4 3-46 Amendment No.~.~. 240

TABLE 3.3.5-1 (Continued)

REACTOR CORE ISOLATION COOLING SYSTE~

ACTION STATEMENTS ACTION 50 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the RCIC system inoperable.

b. With more than one channel inoperable, declare the RCIC system inoperable.

ACTION 51 - With the number of OPERABLE channels less than required by the minimum OPERABLE channels per Trip System requirement, declare the RCIC system inoperable within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION 52 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program,* or declare the RCIC system inoperable.

ACTION 53 - With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or declare the RCIC system inoperable.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 1 3/4 3-54 Amendment No. -eJ, 240

INSTRUMENTATION 3/4,3.9 FEEDWATER/MAIN TURBINE TRIP SYSTEM ACTUATION INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.9 The feedwater/main turbine trip system actuation instrumentation channels shown in the Table 3.3.9-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.9-2.

APPLICABILITY: As shown in Table 3.3.9-1.

ACTION:

a. With a feedwater/main turbine trip system actuation instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.9-2, declare the channel inoper-able and either place the inoperable channel in the tripped condition until the channel is restored to OPERABLE status with its trip set-point adjusted consistent with the Trip Setpoint value, or declare the associated system inoperable.

b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

c. With the number of OPERABLE channels two less than required by the Minimum OPERABLE Channels requirement, restore at least one of the inoperable channels to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program**, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

4.3.9.1 Each of the required feedwater/main turbine trip system actuation instrumentation channels shall be demonstrated OPERABLE* by the performance of the CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION operations at the frequencies specified in the Surveillance Frequency Control Program.

4.3.9.2 LOGIC SYSTEM FUNCTIONAL TESTS and simulated automatic operation of all channels shall be performed in accordance with the Surveillance Frequency Control Program.

A channel may be placed in an inoperable status for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for required surveillance without placing the trip system in the tripped condition.

- Not applicable when trip capability is not maintained.

LIMERICK - UNIT 1 3/4 3-112 Amendment No. +-0,+l,~. 240

REACTOR COOLANT SYSTEM 3/4.4.7 MAIN STEAM LINE ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.4.7 Two main steam line isolation valves (MSIVs) per main steam line shall be OPERABLE with closing times greater than or equal to 3 and less than or equal to 5 seconds.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

With one or more MSIVs inoperable:

a. Maintain at least one MSIV OPERABLE in each affected main steam line that is open and within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program, either:

1. Restore the inoperable valve(s) to OPERABLE status, or

2. Isolate the affected main steam line by use of a deactivated MSIV in the closed position.

b. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.4.7 Each of the above required MSIVs shall be demonstrated OPERABLE by verifying full closure between 3 and 5 seconds when tested pursuant to Specification 4.0.5.

LIMERICK - UNIT 1 3/4 4-23 Amendment No . .J..e.9-, 240

EMERGENCY CORE COOLING SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION:

a. For the core spray system:

1. With one CSS subsystem inoperable, provided that at least two LPCI subsystems are OPERABLE, restore the inoperable CSS subsystem to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With both CSS subsystems inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. For the LPCI system:

1. With one LPCI subsystem inoperable, provided that at least one CSS subsystem is OPERABLE, restore the inoperable LPCI pump to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOW~ within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With one RHR cross-tie valve (HV-51-182 A or B) open, or power not removed from one closed RHR cross-tie valve operator, close the open valve and/or remove power from the closed valves operator within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. With no RHR cross-tie valves (HV-51-182 A, B) closed, or power not removed from both closed RHR cross-tie valve operators, or with one RHR cross-tie valve open and power not removed from the other RHR cross-tie valve operator, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. With two LPCI subsystems inoperable, provided that at least one CSS subsystem is OPERABLE, restore at least three LPCI subsystems to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

5. With three LPCI subsystems inoperable, provided that both CSS subsystems are OPERABLE, restore at least two LPCI subsystems to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

6. With all four LPCI subsystems inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .*

Whenever both shutdown cooling subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - UNIT 1 3/4 5-2 Amendment No. ~.-94.~. 240

EMERGENCY CORE COOLING SYSTEMS LIMITING CONDITION FOR OPERATION {Continued)

ACTION: (Continued)

C. For the HPCI system:

1. With the HPCI system inoperable, provided the CSS, the LPCI system, the ADS and the RCIC system are OPERABLE, restore the HPCI system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to s 200 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ,

2. With the HPCI system inoperable, and one CSS subsystem, and/or LPCI subsystem inoperable, and provided at least one CSS subsystem, three LPCI subsystems, and ADS are operable, restore the HPCI to OPERABLE within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program, or be in HOT SHUTDOWN in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and in COLD SHUTDOWN in the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. Specification 3.0.4.b is not applicable to HPCI.

d. For the ADS:

1. With one of the above required ADS valves inoperable, provided the HPCI system, the CSS and the LPCI system are OPERABLE, restore the inoperable ADS valve to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to s 100 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With two or more of the above required ADS valves inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to s 100 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

e. With a CSS and/or LPCI header ~p instrumentation channel inoperable, restore the inoperable channel to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or determine the ECCS header ~p locally at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; otherwise, declare the associated CSS and/or LPCI, as applicable, inoperable.

f. DELETED LIMERICK UNIT 1 3/4 5-3 Amendment No. ~.-94.~.~. 240

CONTAINMENT SYSTEMS PRIMARY CONTAINMENT AIR LOCK LIMITING CONDITION FOR OPERATION 3.6.1.3 The primary containment air lock shall be OPERABLE with:

a. Both doors closed except when the air lock is being used for normal transit entry and exit through the containment, then at least one air lock door shall be closed, and

b. An overall air lock leakage rate in accordance with the Primary Containment Leakage Rate Testing Program.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2*, and 3.

ACTION:

a. With one primary containment air lock door inoperable:

1. Maintain at least the OPERABLE air lock door closed and either restore the inoperable air lock door to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or lock the OPERABLE air lock door closed.

2. Operation may then continue until performance of the next required overall air lock leakage test provided that the OPERABLE air lock door is verified to be locked closed at least once per 31 days.

3. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With the primary containment air lock inoperable, except as a result of an inoperable air lock door, maintain at least one air lock door closed; restore the inoperable air lock to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

See Special Test Exception 3.10.1.

LIMERICK - UNIT 1 3/4 6-5 Amendment No . .J.J.~.~. 240

CONTAINMENT SYSTEMS SUPPRESSION POOL SPRAY 3.6.2.2 The suppression pool spray mode of the residual heat removal CRHR) system shall be OPERABLE with two independent loops, each loop consisting of:

a. One OPERABLE RHR pump, and

b. An OPERABLE flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger and the suppression pool spray sparger(s).

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one suppression pool spray loop inoperable, restore the inoperable loop to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within I

the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With both suppression pool spray loops inoperable, restore at least one loop to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.6.2.2 The suppression pool spray mode of the RHR system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b. By verifying that each of the required RHR pumps develops a flow of at least 500 gpm on recirculation flow through the RHR heat exchanger and the suppression pool spray sparger when tested pursuant to Speci-fication 4.0.5.

c. By verifying RHR suppression pool spray subsystem locations susceptible to gas accumulation are sufficiently filled with water in accordance with the Surveillance Frequency Control Program.

Whenever both RHR subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - UNIT 1 3/4 6-15 Amendment No. ~.-+/-Jl,-Hl-e,-&+/--e, 240

CONTAINMENT SYSTEMS SUPPRESSION POOL COOLING LIMITING CONDITION FOR OPERATION 3.6.2.3 The suppression pool cooling mode of the residual heat removal (RHR) system shall be OPERABLE with two independent loops, each loop consisting of:

a. One OPERABLE RHR pump, and

b. An OPERABLE flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger.

APPLICABILITY: OPERATIONAL CONDITIONS l, 2, and 3.

ACTION:

a. With one suppression pool cooling loop inoperable, restore the inoperable loop to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s** or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With both suppression pool cooling loops inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.6.2.3 The suppression pool cooling mode of the RHR system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b. By verifying that each of the required RHR pumps develops a flow of at least 10,ooa gpm on recirculation flow through the flow path including the RHR heat exchanger and its associated closed bypass valve, the suppression pool and the full flow test line when tested pursuant to Specification 4.0.5.

c. By verifying RHR suppression pool cooling subsystem locations susceptible to gas accumulation are sufficiently filled with water in accordance with the Surveillance Frequency Control Program.

Whenever both RHR subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

- During the extended Allowed Outage Time CAOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for one inoperable suppression pool cooling loop may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the s*ame period.

LIMERICK - UNIT 1 3/4 6-16 Amendment No . .§-7,~.~.-+/-J.l.,-+/-Se,~.

~ . 240

CONTAINMENT SYSTEMS 3/4.6.3 PRIMARY CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3 Each primary containment isolation valve and each instrumentation line excess flow check valve shall be OPERABLE.

APPLICABILITY: OPERATIONAL CONDITIONS l, 2, and 3.

ACTION:

a. With one or more of the primary containment isolation valves inoperable,**

maintain at least one isolation valve OPERABLE in each affected penetration that is open and within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or in accordance with the Risk Informed Completion Time Program either:

1. Restore the inoperable valve(s) to OPERABLE status, or

2. Isolate each affected penetration by use of at least one de-activated automatic valve secured i~ the isolated position,* or

3. Isolate each affected penetration by use of at least one closed manual valve or blind flange.*

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one or more of the i*nstrumentation line excess flow check valves inoperable, operation may continue and the provisions of Specification 3.0.3 are not applicable provided that within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months either:

1. The inoperable valve is returned to OPERABLE status, or

2. The instrument line is isolated and the associated instrument is declared inoperable.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With one or more scram discharge volume vent or drain valves inoperable, perform the applicable actions specified in Specification 3.1.3.1.

Isolation valves closed to satisfy these requirements may be reopened on an intermittent basis under administrative control.

- Except for the scram discharge volume vent and drain valves.

LIMERICK - UNIT 1 3/4 6-17 Amendment No. 9-,+/-4&,~,-Mi-9.~. 240

CONTAINMENT SYSTEMS 3/4.6.4 VACUUM RELIEF SUPPRESSION CHAMBER - DRYWELL VACUUM BREAKERS LIMITING CONDITION FOR OPERATION 3.6.4.1 Three pairs of suppression chamber - drywell vacuum breakers shall be OPERABLE and all suppression chamber - drywell vacuum breakers shall be closed.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one or more vacuum breakers in one of the three required pairs of suppression chamber - drywell vacuum breaker pairs inoperable for opening but known to be closed, restore at least one inoperable pair of vacuum breakers to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one suppression chamber - drywel l vacuum breaker open, verify the other vacuum breaker in the pair to be closed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ; restore the open vacuum breaker to the closed position within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With one position indicator of any suppression chamber - drywell vacuum breaker inoperable:

1. Verify the other vacuum breaker in the pair to be closed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 15 days thereafter, or

2. Verify the vacuum breaker(s) with the inoperable position indicator to be closed by conducting a test which demonstrates that the ~pis maintained at greater than or equal to 0.7 psi for one hour without makeup within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and at least once per 15 days thereafter.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LIMERICK - UNIT 1 3/4 6-44 Amendment No. 4-e,, 240

3/4.7 PLANT SYSTEMS 3/4.7.1 SERVICE WATER SYSTEMS RESIDUAL HEAT REMOVAL SERVICE WATER SYSTEM - COMMON SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.l At least the following independent residual heat removal service water (RHRSW) system subsystems, with each subsystem comprised of:

a. Two OPERABLE RHRSW pumps, and

b. An OPERABLE flow path capable of taking suction from the RHR service water pumps wet pits which are supplied from the spray pond or the cooling tower basin and transferring the water through one Unit 1 RHR heat exchanger, shall be OPERABLE:

a. In OPERABLE CONDITIONS 1, 2, and 3, two subsystems.

b. In OPERABLE CONDITIONS 4 and 5, the subsystem(s) associated with systems and components required OPERABLE by Specification 3.4.9.2, 3.9.11.1, and 3.9.11.2.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, 3, 4, and 5.

ACTION:

a. In OPERATIONAL CONDITION 1, 2, or 3:

1. With one RHRSW pump inoperable, restore the inoperable pump to OPERABLE status within 30 days, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With one RHRSW pump in each subsystem inoperable, restore at least one of the inoperable RHRSW pumps to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. With one RHRSW subsystem otherwise inoperable, restore the inoperable subsystem to OPERABLE status with at least one OPERABLE RHRSW pump within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, unless otherwise specified in a) orb) below**, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

a) When the 'A' RHRSW subsystem is inoperable to allow for repairs of the 'A' RHRSW subsystem piping, with Limerick Generating Station Unit 2 shutdown, reactor vessel head removed and reactor cavity flooded, the 72-hour Allowed Outage Time may be extended to 7 days or in accordance with the Risk Informed Completion Time Program once every other calendar year with the following compensatory measures established:

- Only one of these two Actions, either a.3.a) or a.3;b), may be entered on Unit 1 in a calendar year. However, if either Unit 2 TS LCO 3.7.1.1, Action a.3.a) or a.3.b) has previously been entered in the calendar year, then Unit 1 Action a.3.a) or a.3.b) may not be entered during that same calendar year.

LIMERICK - UNIT 1 3/4 7-1 Amendment No . .§.S,~.+J-+/-..~. 240

3/4.7 PLANT SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

1) The following systems and subsystems will be protected in accordance with applicable station procedures:

'B' RHRSW subsystem

'B' ESW loop

'B' and 'D' RHR subsystems

D12, Dl4, D22, and D24 4kV buses and emergency diesel generators

Division 2 and Division 4 Safeguard DC, and

2) The 'A' and 'B' loop of ESW return flow shall be aligned to the operable 'B' RHRSW return header only.

The ESW return valves to the 'B' RHRSW return header (i.e., HV-ll-015A and HV-ll-015B) will be administratively controlled in the open position and de-energized prior to entering the extended AOT. The ESW return valves to the 'A' RHRSW return header Ci .e., HV-11-0llA and HV-11-0llB) will be administratively controlled in the closed position and de-energized as part of the work boundary.

b) When the 'B' RHRSW subsystem is inoperable to allow for repairs of the 'B' RHRSW subsystem piping, with Limerick Generating Station Unit 2 shutdown, reactor vessel head removed and reactor cavity flooded, the 72-hour Allowed Outage Time may be extended to 7 days or in accordance with the Risk Informed Completion Time Program once every other calendar year with the following compensatory measures established:

1) The following systems and subsystems will be protected in accordance with applicable station procedures:

'A' RHRSW subsystem

'A' ESW loop

'A' and 'C' RHR subsystems

Dll, Dl3, D21, and D23 4kV buses and emergency diesel generators .

Division 1 and Division 3 Safeguard DC, and

2) The 'A' and 'B' loop of ESW return flow shall be aligned to the operable 'A' RHRSW return header only.

The ESW return valves to the 'A' RHRSW return header (i.e., HV-11-0llA and HV-11 OllB) will be administratively controlled in the open position and de-energized prior to entering the extended AOT. The ESW return valves to the 'B' RHRSW return header (i.e., HV-ll-015A and HV-ll-015B) will be administratively controlled in the closed position and de-energized as part of the work boundary.

4. With both RHRSW subsystems otherwise inoperable, restore at least one subsystem to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Whenever both RHRSW subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by the ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - UNIT 1 3/4 7-la Amendment No . .§g,-89.~.~. 240

PLANT SYSTEMS EMERGENCY SERVICE WATER SYSTEM - COMMON SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.2 At least the following independent emergency service water system loops, with each loop comprised of:

a. Two OPERABLE emergency service water pumps, and

b. An OPERABLE flow path capable of taking suction from the emergency service water pumps wet pits which are supplied from the spray pond or the cooling tower basin and transferring the water to the associated Unit 1 and common safety-related equipment, shall be OPERABLE:

a. In OPERATIONAL CONDITIONS 1, 2, and 3, two loops.

b. In OPERATIONAL CONDITIONS 4, 5, and*, one loop.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, 3, 4, 5, and*

ACTION:

a. In OPERATION CONDITION 1, 2, or 3:

1. With one emergency service water pump inoperable, restore the inoperable pump to OPERABLE status within 45 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With one emergency service water pump in each loop inoperable, restore at least one inoperable pump to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. With one emergency service water system loop otherwise inoperable, declare all equipment aligned to the inoperable loop inoperable**, restore the inoperable loop to OPERABLE status with at least one OPERABLE pump within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s# or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

When andling irradiated fuel in the secondary containment.

- The diesel generators may be aligned to the OPERABLE emergency service water system loop provided confirmatory flow testing has been performed. Those diesel generators no aligned to the OPERABLE emergency service water system loop shall be declared inoperable and the actions of 3.8.1.1 taken.

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for one inoperable emergency service water system loop may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 1 3/4 7-3 Amendment No. -2+,4-0.~,-+/-J.+/-..~. 240

PLANT SYSTEMS 3/4.7.3 REACTOR CORE ISOLATION COOLING SYSTEM 3.7.3 The reactor core isolation cooling (RCIC) system shall be OPERABLE with an OPERABLE flow path capable of automatically taking suction from the suppression pool and transferring the water to the reactor pressure vessel.

APPLICABILITY: OPERATIONAL CONDITIONS l, 2, and 3 with reactor steam dome pressure greater than 150 psig.

ACTION:

a. With the RCIC system inoperable, operation may continue provided the HPCI system is OPERABLE; restore the RCIC system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to less than or equal to 150 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. DELETED

c. Specification 3.0.4.b is not applicable to RCIC.

4.7.3 The RCIC system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by:

1. Verifying locations susceptible to gas accumulation are sufficiently filled with water.

2. Verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.**

3. Verifying that the pump flow controller is in the correct position.

b. In accordance with the Surveillance Frequency Control Program by verifying that the RCIC pump develops a flow of greater than or equal to 600 gpm in the test flow path with a system head corresponding to reactor vessel operating pressure when steam is being supplied to the turbine at 1040 + 13, - 120 psig.*

The prov1s1ons of Specification 4.0.4 are not applicable, provided the surveillance is performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure is adequate to perform the test. If OPERABILITY is not successfully demonstrated within the 12-hour period, reduce reactor steam pressure to less than 150 psig within the following 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

- Not required to be met for system vent flow paths opened under administrative control.

LIMERICK - UNIT 1 3/4 7-9 Amendment No. ~.~.-+/-e-9-.~.~.~. 240

PLANT SYSTEMS 3/4.7.8 MAIN TURBINE BYPASS SYSTEM LIMITING CONDITION FOR OPERATION 3.7.8 The main turbine bypass system shall be OPERABLE as determined by the number of operable main turbine bypass valves being greater than or equal to that specified in the CORE OPERATING LIMITS REPORT.

APPLICABILITY: OPERATIONAL CONDITION 1, when THERMAL POWER is greater than or equal to 25% of RATED THERMAL POWER.

ACTION: With the main turbine bypass system inoperable, restore the system to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the Risk Informed Completion Time Program, or take the ACTION required by Specification 3.2.3.c.

SURVEILLANCE REQUIREMENTS 4.7.8 The main turbine bypass system shall be demonstrated OPERABLE in accordance with the Surveillance Frequency Control Program:

a. By cycling each turbine bypass valve through at least one complete cycle of full travel,

b. By performing a system functional test which includes simulated automatic actuation, and by verifying that each automatic valve actuates to its correct position, and

c. By determining TURBINE BYPASS SYSTEM RESPONSE TIME to be less than or equar to the value specified in the CORE OPERATING LIMITS REPORT.

LIMERICK - UNIT 1 3/4 7-33 Amendment No. ~.-7-+/-.~, 240

3/4.8 ELECTRICAL POWER SYSTEMS 3/4,8.1 A.C. SOURCES A.C. SOURCES - OPERATING 3.8.1.1 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a. Two physically independent circuits between the offsite transmission network and the onsite Class lE distribution system, and

b. Four separate and independent diesel generators, each with:

1. A separate day tank containing a minimum of 250 gallons of fuel,

2. A separate fuel storage system containing a minimum of 33,500 gallons of fuel, and

3. A separate fuel transfer pump.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and at least once per 7 days thereafter. If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining operable diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore the inoperable diesel generator to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

b. With two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. If either of the diesel generators became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least one of the inoperable diesel generators to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s* or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

During the extended Allowed Outage Time (AOT) specified by TS LCD 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for two inoperable diesel generators may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 1 3/4 8-1 Amendment No. Ji'?,4-Q,ig.g.,~.~.

240

3/4.8 ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

c. With three diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter; and perform Surveillance Requirement 4.8.1.1.2.a.4 for the remaining diesel generator, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Restore at least one of the inoperable diesel generators to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

d. With one offsite circuit and one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program from the time of initial loss, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

LIMERICK - UNIT 1 3/4 8-la Amendment No. ~.4-0,+.gg, 240

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION CContinuedl ACTION: (Continued)

e. In addition to the ACTIONS above:

1. For two train systems, with one or more diesel generators of the above required A.C. electrical power sources inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter that at least one of the required two train system subsystem, train, components, and devices is OPERABLE and its associated diesel generator is OPERABLE. Otherwise, restore either the inoperable diesel generator or the inoperable system subsystem to an OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s* or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. For the LPCI systems, with two or more diesel generators of the above required A.C. electrical power sources inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter that at least two of the required LPCI system subsystems, trains, components, and devices are OPERABLE and its associated diesel generator is OPERABLE. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

This ACTION does not apply for those systems covered in Specifications 3.7.1.1. and 3.7.1.2.

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 1 3/4 8-2 Amendment No. ~.4G.~. 240

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

f. With one offsite circuit of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. Restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

g. With two of the above required offsite circuits inoperable, restore at least one of the inoperable offsite circuits to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . With only one offsite circuit restored to OPERABLE status, restore at least two offsite circuits to OPERABLE status wtthin 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program from time of initial loss, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

h. With one offsite circuit and two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirements 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. If either of the diesel generators became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least one of the above required inoperable A.C. sources to OPERABLE status within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or be in a at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Restore at least two offsite circuits and at least three of the above required diesel generators to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from time of initial loss or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

i. Specification 3.0.4.b is not applicable to diesel generators.

LIMERICK - UNIT 1 3/4 8-2a Amendment No. 4-G,-+/-69,-UW, 240

ELECTRICAL POWER SYSTEMS 3/4.8.2 D.C. SOURCES D.C. SOURCES - OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.1 As a minimum, the following D.C. electrical power sources shall be OPERABLE:

a. Division l, Consisting of:

1. 125-Volt Battery lAl (1A1Dl01).

2. 125-Volt Battery 1A2 (1A2Dl01).

3. 125-Volt Battery Charger lBCAl (1AlD103).

4. 125-Volt Battery Charger 1BCA2 (1A2Dl03).

b. Division 2, Consisting of:

1. 125-Volt Battery lBl (lBlDlOl).

2. 125-Volt Battery 1B2 (1B2Dl01).

3. 125-Volt Battery Charger lBCBl (1B1Dl03).

4. 125-Volt Battery Charger 1BCB2 (1B2Dl03).

c. Division 3, Consisting of:

1. 125-Volt Battery lC (lCDlOl).

2. 125-Volt Battery Charger lBCC (1CD103).

d. Division 4, Consisting of:

1. 125-Volt Battery lD (lDDlOl).

2. 125-Volt Battery Charger lBCD (1DD103).

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one or two battery chargers on one division inoperable:

1. Restore battery terminal voltage to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ,

2. Verify associated Division 1 or 2 float currents 2 amps, or Division 3 or 4 float currents 1 amp within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter, and

3. Restore battery charger(s) to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.

b. With one or more batteries inoperable due tq:

1. One or two batteries on one division with one or more battery cells float voltage< 2.07 volts, perform 4.8.2.1.a.l and 4.8.2.1.a.2 within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for affected battery(s) and restore affected cell (s) voltage

~ 2.07 volts within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. Division 1 or 2 with float current> 2 amps, or with Division 3 or 4 with float current> 1 amp, perform 4.8.2.1.a.2 within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for affected battery(s) and restore battery float current to within limits within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

LIMERICK - UNIT 1 3/4 8-10 Amendment No. -+/--84, 240

ELECTRICAL POWER SYSTEMS ACTION: (Continued)

3. One or two batteries on one division with one or more cells electrolyte level less than minimum established design limits, if electrolyte level was below the top of the plates restore electrolyte level to above top of plates within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and verify no evidence of leakage(*) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In all cases, restore electrolyte level to greater than or equal to minimum established design limits within 31 days.

4. One or two batteries on one division with pilot cell electrolyte temperature less than minimum established design limits, restore battery pilot cell temperature to greater than or equal to minimum established design limits within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

5. Batteries in more than one division affected, restore battery parameters for all batteries in all but one division to within limits within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

6. Ci) Any battery having both (Action b.l) one or more battery cells float voltage< 2.07 volts and (Action b.2) float current not within limits, and/or (ii) Any battery not meeting any Action b.l through b.5, Restore the battery parameters to within limits within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

c. With any battery(ies) on one division of the above required D.C. electrical power sources inoperable for reasons other than Action b., restore the inoperable division battery to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(*) *contrary to the prov1s1ons of Specification 3.0.2, if electrolyte level was below the top of the plates, the verification that there is no evidence of leakage is required to be completed regardless of when electrolyte level is restored.

LIMERICK - UNIT 1 3/4 8-lOa Amendment No. ~. 240

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one of the above required Unit 1 A.C. distribution system divisions not energized, reenergize the division within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one of the above required Unit 1 D.C. distribution system divisions not energized, reenergize the division within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With any of the above required Unit 2 and common AC and/or DC distribution system divisions not energized, declare the associated common equipment inoperable, and take the appropriate ACTION for that system.

4.8.3.1 Each of the above required power distribution system divisions shall be determined energized in accordance with the Surveillance Frequency Control Program by verifying correct breaker alignment and voltage on the busses/MCCs/panels.

LIMERICK - UNIT 1 3/4 8-17 Amendment No.~.~. 240

ADMINISTRATIVE CONTROLS PROCEDURES AND PROGRAMS (Continued)

c. The program shall, as allowed by 10 CFR 50.55a, meet Subsection ISTA, "General Requirements," and Subsection ISTD, "Preservi ce and Inservi ce Examination and Testing of Dynamic Restraints (Snubbers) in Light-Water Reactor Nuclear Power Plants," in lieu of Section XI of the ASME B&PV Code ISI requirements for snubbers, or meet authorized alternatives pursuant to 10 CFR 50.55a.

d. The 120-month program updates shall be made in accordance with 10 CFR 50.55a subject to the limitations and conditions listed therein.

l. Explosive Gas Monitoring Program This program provides controls for potentially explosive gas mixtures contained downstream of the off-gas recombiners.

The program shall include:

a. The limit for the concentration of hydrogen downstream of the offgas recombiners and a surveillance program to ensure the limit is maintained. This limit shall be appropriate to the system's design criteria (i.e., whether or not the system is designed to withstand a hydrogen explosion);

The provisions of SR 4.0.2 and SR 4.0.3 are applicable to the Explosi~e Gas Monitoring Program surveillance frequencies.

m. Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance.with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days.

b. A RICT may only be utilized in OPERATIONAL CONDITIONS 1 and 2.

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the ACTION allowed outage time (i.e.,

not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

LIMERICK - UNIT 1 6-14e Amendment No.~.~. 240

ADMINISTRATIVE CONTROLS PROCEDURES AND PROGRAMS (Continued)

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the ACTION allowed outage time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the completion times must be PRA methods approved for use with this program in Amendment No. 240, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

LIMERICK - UNIT 1 6-14f Amendment No. 240

EXELON GENERATION COMPANY, LLC DOCKET NO. 50-353 LIMERICK GENERATING STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 203 Renewed License No. NPF-85

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Exelon Generation Company, LLC (Exelon Generation Company), dated December 13, 2018, as supplemented by letters dated February 14, 2019; August 12, 2019; August 27, 2019; and January 7, 2020, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Renewed Facility Operating License No. NPF-85 is hereby amended to read as follows:

(2) Technical Specifications The Technical Specifications contained in Appendix A and the Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 203, are hereby incorporated into this renewed license. Exelon Generation Company shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

3. Accordingly, the license is amended by changes to the Renewed Facility Operating License and Technical Specifications as indicated in the attachment to this license amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented within 180 days.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

James G. Danna, Chief Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License and Technical Specifications Date of Issuance: February 28, 2020

ATTACHMENT TO LICENSE AMENDMENT NO. 203 LIMERICK GENERATING STATION, UNIT 2 RENEWED FACILITY OPERATING LICENSE NO. NPF-85 DOCKET NO. 50-353 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change.

Page Page 3 3 Replace the following page of the Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Page Page 3/4 1-19 3/4 1-19 3/4 3-1 3/4 3-1 3/4 3-9 3/4 3-9 3/4 3-32 3/4 3-32 3/4 3-36 3/4 3-36 3/4 3-42 3/4 3-42 3/4 3-46 3/4 3-46 3/4 3-54 3/4 3-54 3/4 3-112 3/4 3-112 3/4 4-23 3/4 4-23 3/4 5-2 3/4 5-2 3/4 5-3 3/4 5-3 3/4 6-5 3/4 6-5 3/4 6-15 3/4 6-15 3/4 6-16 3/4 6-16 3/4 6-17 3/4 6-17 3/4 6-44 3/4 6-44 3/4 7-1 3/4 7-1 3/4 7-1a 3/4 7-1a 3/4 7-3 3/4 7-3 3/4 7-9 3/4 7-9 3/4 7-33 3/4 7-33 3/4 8-1 3/4 8-1 3/4 8-1a 3/4 8-1a 3/4 8-2 3/4 8-2 3/4 8-2a 3/4 8-2a 3/4 8-10 3/4 8-10 3/4 8-10a 3/4 8-10a 3/4 8-17 3/4 8-17 6-14e 6-14e

--- 6-14f

(2) Pursuant to the Act and 10 CFR Part 70, to receive, possess and to use at any time special nuclear material as reactor fuel, in accordance with the limitations for storage and amounts required for reactor operation, as described in the Final Safety Analysis Report, as supplemented and amended; (3) Pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess and use at any time any byproduct, source and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required; (4) Pursuant to the Act and 10 CFR Parts 30, 40, 70, to receive, possess, and use in amounts as required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Pursuant to the Act and 10 CFR Parts 30, 40 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility, and to receive and possess, but not separate, such source, byproduct, and special nuclear materials as contained in the fuel assemblies and fuel channels from the Shoreham Nuclear Power Station.

C. This renewed license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I (except as exempted from compliance in Section 2.D. below) and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

( 1) Maximum Power Level Exelon Generation Company is authorized to operate the facility at reactor core power levels of 3515 megawatts thermal ( 100 percent rated power) in accordance with the conditions specified herein.

(2) Technical Specifications The Technical Specifications contained in Appendix A and the Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 203, are hereby incorporated into this renewed license. Exelon Generation Company shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

Renewed License No. NPF-85 Amendment No. 203

REACTIVITY CONTROL SYSTEMS 3/4.1.5 STANDBY LIQUID CONTROL SYSTEM LIMITING CONDITION FOR OPERATION

3.1.5 The standby liquid control system shall be OPERABLE and consist of the following:

a. In OPERATIONAL CONDITIONS 1 and 2, two pumps and corresponding flow paths,

b. In OPERATIONAL CONDITION 3, a minimum of one pump and corresponding flow path.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2 and 3 ACTION:

a. With only one pump and corresponding explosive valve OPERABLE, in OPERATIONAL CONDITION 1 or 2, restore one inoperable pump and corresponding explosive valve to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

b. With standby liquid control system otherwise inoperable, in OPERATIONAL CONDITION 1, 2, or 3, restore the system to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.1.5 The standby liquid control system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by verifying that:

1. The temperature of the sodium pentaborate solution is within the limits of Figure 3.1.5-1.

2. The available volume of sodium pentaborate solution is at least 3160 gallons.

3. The temperature of the pump suction piping is within the limits of Figure 3.1.5-1 for the most recent concentration analysis.

LIMERICK - UNIT 2 3/4 1-19 Amendment No. ~.48,4-9,-+/-4-e,+/-4+,

~ . 203

3/4.3 INSTRUMENTATION 3/4.3.1 REACTOR PROTECTION SYSTEM INSTRUMENTATION l IMITING CONDITION FOR OPERATION 3.3.1 As a minimum, the reactor protection system instrumentation channels shown in Table 3.3.1-1 shall be OPERABLE with the REACTOR PROTECTION SYSTEM RESPONSE TIME as shown in Table 3.3.1-2.

APPLICABILITY: As shown in Table 3.3.1-1.

ACTION:

Note: Separate condition entry is allowed for each channel.

Note: When Functional Unit 2.b and 2.c channels are inoperable due the calculated power exceeding the APRM output by more than 2% of RATED THERMAL POWER while operating at~ 25% of RATED THERMAL POWER, entry into the associated Actions may be delayed up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

a. With the number of OPERABLE channels in either trip system for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, within one hour or in accordance with the Risk Informed Completion Time Program*** for each affected functional unit either verify that at least one* channel in each trip system is OPERABLE or tripped or that the trip system is tripped, or place either the affected trip system or at least one inoperable channel in the affected trip system in the tripped condition.

b. With the number of OPERABLE channels in either trip system less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(s) or the affected trip system** in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program***.

c. With the number of OPERABLE channels in both trip systems for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(s) in one trip system or one trip system in the tripped condition within 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s**

or in accordance with the Risk Informed Completion Time Program***.

d. lf within the allowable time allocated by Actions a, b or c, it is not desired to place the inoperable channel or trip system in trip (e.g., full scram would occur), Then no later than expiration of that allowable time initiate the action identified in Table 3.3.1-1 for the applicable Functional Unit.

For Functional Units 2.a, 2.b, 2.c, 2.d, and 2.f, at least two channels shall be OPERABLE or tripped. For Functional Unit 5, both trip systems shall have each channel associated with the MSIVs in three main steam lines (not necessarily the same main steam lines for both trip systems) OPERABLE or tripped. For Function 9, at least three channels per trip system shall be OPERABLE or tripped.

- For Functional Units 2.a, 2.b, 2.c, 2.d, and 2.f, inoperable channels shall be placed in the tripped condition to comply with Action b. Action c does not apply for these Functional Units.

- - Not applicable when trip capability is not maintained for one or more Functional Units.

LIMERICK - UNIT 2. 3/4 3-1 Amendment No. 17,34,109,139,181,

.J:%., 203

INSTRUMENTATION 3/4.3.2. ISOLATION ACTUATION INSTRUMENTATION I IMITING CONDITION FOR OPERATION 3.3.2 The isolation actuation instrumentation channels shown in Table 3.3.2-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.2.-2 and with ISOLATION SYSTEM RESPONSE TIME as shown in Table 3.3.2-3.

APPLICABILITY: As shown in Table 3.3.2-1.

ACTION:

a) With an isolation actuation instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.2-2, declare the channel inoperable until the channel is restored to OPERABLE status with its trip setpoint adjusted consistent with the Trip Setpoint value.

b) With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirements for one trip system:

1. If placing the inoperable channel Cs) in the tripped condition would cause an isolation, the inoperable channel Cs) shall be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or in accordance with the Risk Informed Completion Time Program**#. If this cannot be accomplished, the ACTION required by Table 3.3.2-1 for the affected trip function shall be taken, or the channel shall be placed in the tripped condition.

or

2. If placing the inoperable channel(s) in the tripped condition would not cause an isolation, the inoperable channel Cs) and/or that trip system shall be placed in the tripped condition within:

a) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program**# for trip functions common* to RPS Instrumentation, b) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program**# for trip functions not common* to RPS Instrumentation.

Trip functions common to RPS Actuation Instrumentation are shown in Table 4.3.2.1-1.

- Not applicable when trip capability is not maintained.

Not applicable for Function}, Secondary Containment Isolation.

LIMERICK - UNIT 2 3/4 3-9 Amendment No.+/-+,~.~. 203

INSTRUMENTATION 3/4.3.3 EMERGENCY CORE COOLING SYSTEM ACTUATION INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.3 The emergency core cooling system CECCS) actuation instrumentation channels shown in Table 3.3.3-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.3-2 and with EMERGENCY CORE COOLING SYSTEM RESPONSE TIME as shown in Table 3.3.3-3.

APPLICABILITY: As shown in Table 3.3.3-1 ACTION:

a. With an ECCS actuation instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.3-2, declare the channel inoperable until the channel is restored to Operable status with its trip setpoint adjusted consistent with the Trip Setpoint value.

b. With one or more ECCS actuation instrumentation channels inoperable, take the ACTION required by Table 3.3.3-1.

c. With either ADS trip system subsystem inoperable, restore the inoperable trip system to OPERABLE status within:

1. 7 days or in accordance with the Risk Informed Completion Time Program, provided that the HPCI and RCIC systems are OPERABLE.

2. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to less than or equal to 100 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.3.3.1 Each ECCS actuation instrumentation channel shall be demonstrated OPERABLE by the performance of the CHANNEL CHECK, CHANNEL FUNCTIONAL TEST and CHANNEL CALIBRATION operations for the OPERATIONAL CONDITIONS shown in Table 4.3.3.1-1 and at the frequencies specified in the Surveillance Frequency Control Program unless otherwise noted in Table 4.3.3.1-1.

4.3.3.2 LOGIC SYSTEM FUNCTIONAL TESTS and simulated automatic operation of all channels shall be performed in accordance with the Surveillance Frequency Control Program.

4.3.3.3 The ECCS RESPONSE TIME of each ECCS trip function shown in Table 3.3.3-3 shall be demonstrated to be within the limit in accordance with the Surveillance Frequency Control Program. Each test shall include at least one channel per trip system such that all channels are tested at least once every N times the frequency specified in the Surveillance Frequency Control Program where N is the total number of redundant channels in a specific ECCS trip system.

LIMERICK - UNIT 2 3/4 3-32 Amendment No. J4,-+/-4-7-, 203

TABLE 3.3.3-1 (Continued)

EMERGENCY CORE COOLING SYSTEM ACTUATION INSTRUMENTATION ACTION STATEMENTS ACTION 30 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the associated system inoperable.

b. With more than one channel inoperable, declare the associated system inoperable.

ACTION 31 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, declare the associated ECCS inoperable within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION 32 - DELETED ACTION 33 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*, or declare the associated ECCS inoperable.

ACTION 34 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. For one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the HPCI system inoperable.

b. With more than one channel inoperable, declare the HPCI system inoperable.

ACTION 35 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*, or declare the HPCI system inoperable.

ACTION 36 - With the number of OPERABLE channels less than the Total Number of Channels, declare the associated emergency diesel generator and the associated offsite source breaker that is not supplying the bus inoperable and take the ACTION required by Specification 3.8.1.1 or 3.8.1.2, as appropriate.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 2 3/4 3-36 Amendment No. -l+,~,-+/--9-0. 203

INSTRUMENTATION 3/4.3.4 RECIRCULATION PUMP TRIP ACTUATION INSTRUMENTATION ATWS RECIRCULATION PUMP TRIP SYSTEM INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.4.1 The anticipated transient without scram recirculation pump trip (ATWS-RPT) system instrumentation channels shown in Table 3.3.4.1-1 shall be OPERABLE with their trip setpoints set consistent with values shown in the Trip SetpoJnt column of Table 3.3.4.1-2.

APPLICABILITY: OPERATIONAL CONDITION 1.

ACTION:

a. With an ATWS recirculation pump trip system instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.4.1-2, declare the channel inoperable until the channel is restored to OPERABLE status with the channel trip setpoint adjusted consistent with the Trip Setpoint value.

b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel(s) in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*.

c. With the number of OPERABLE channels two or more less than required by the Minimum OPERABLE Channels per Trip System requirement for one trip system and:

1. If the inoperable channels consist of one reactor vessel water level channel and one reactor vessel pressure channel, pl ace both inoperable channels in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or if this action will initiate a pump trip, declare the trip system inoperable.

2. If the inoperable channels include two reactor vessel water level channels or two reactor vessel pressure channel5, declare the trip system inoperable.

d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

e. With both trip systems inoperable, restore at least one trip system to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

4.3.4.1.1 Each of the required ATWS recirculation pump trip system instrumentation channels shall be demonstrated OPERABLE by the performance of the CHANNEL CHECK, CHANNEL FUNCTIONAL TEST and CHANNEL CALIBRATION operations at the frequencies specified in the Surveillance Frequency Control Program.

4.3.4.1.2 LOGIC SYSTEM FUNCTIONAL TESTS and simulated automatic operation of all channels shall be performed in accordance with the Surveillance Frequency Control Program.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 2 3/4 3-42 Amendment No. J.J,J4,-l4+, 203

INSTRUMENTATION END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.4.2 The end-of-cycle recirculation pump trip CEOC-RPT) system instrumentation channels shown in Table 3.3.4.2-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.4.2-2 and with the END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM RESPONSE TIME as shown in Table 3.3.4.2-3.

APPLICABILITY: OPERATIONAL CONDITION 1, when THERMAL POWER is greater than or equal to 29.5% of RATED THERMAL POWER.

ACTION:

a. With an end-of-cycle recirculation pump trip system instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.4.2-2, declare the channel inoperable until the channel is restored to OPERABLE status with the channel setpoint adjusted consistent with the Trip Setpoint value.

b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both

. trip systems, place the inoperable channel (s) in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program*.

c. With the number of OPERABLE channels two or more less than required by the Minimum OPERABLE Channels per Trip System requirement for one trip system and:

1. If the inoperable channels consist of one turbine control valve channel and one turbine stop valve channel, place both inoperable channels in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program.

2. If the inoperable channels include two turbine control valve channels or two turbine stop valve channels, declare the trip system inoperable.

d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or take the ACTION required by Specification 3.2.3.

e. With both trip systems inoperable, restore 9t least one trip system to OPERABLE status within one hour or take the ACTION required by Specification 3.2.3.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 2 3/4 3-46 Amendment No. JJ,-1-e-J, 203

TABLE 3.3.5-1 (Continued)

REACTOR CORE ISOLATION COOLING SYSTEM ACTION STATEMENTS ACTION 50 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the RCIC system inoperable.

b. With more than one channel inoperable, declare the RCIC system inoperable.

ACTION 51 - With the number of OPERABLE channels less than required by the minimum OPERABLE channels per Trip System requirement, declare the RCIC system inoperable within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION 52 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program*, or declare the RCIC system inoperable.

ACTION 53 - With the number of OPERABLE channels one less than required by the Minimum OPERABLE channels per Trip System requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or declare the RCIC system inoperable.

Not applicable when trip capability is not maintained.

LIMERICK - UNIT 2 3/4 3-54 Amendment No. J-7., 203

INSTRUMENTATION 3/4.3.9 FEEDWATER/MAIN TURBINE TRIP SYSTEM ACTUATION INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.9 The feedwater/main turbine trip system actuation instrumentation channels shown in the Table 3.3.9-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.9-2.

APPLICABILITY: As shown in Table 3.3.9-1.

ACTION:

a. With a feedwater/main turbine trip system actuation instrumentation channel trip setpoint less conservative than the value shown in the Allowable Values column of Table 3.3.9-2, declare the channel inoper-able and either place the inoperable channel in the tripped condition until the channel is restored to OPERABLE status with its trip set-point adjusted consistent with the Trip Setpoint value, or declare the associated system inoperable.

b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

c. With the number of OPERABLE channels two less than required by the Minimum OPERABLE Channels requirement, restore at least one of the inoperable channels to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program**, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

4.3.9.1 Each of the required feedwater/main turbine trip system actuation instrumentation channels shall be demonstrated OPERABLE* by the performance of the CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION operations at the frequencies specified in the Surveillance Frequency Control Program.

4.3.9.2 LOGIC SYSTEM FUNCTIONAL TESTS and simulated automatic operation of all channels shall be performed in accordance with the Survei 11 ance Frequency Control Program.

A channel may *be pl aced in an inoperable status for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for required surveillance without placing the trip system in the tripped condition.

- Not applicable when trip capability is not maintained.

LIMERICK - UNIT 2 3/4 3-112 Amendment No. JJ,J-4,-+/-47-, 203

REACTOR COOLANT SYSTEM 3/4.4.7 MAIN STEAM LINE ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.4.7 Two main steam line isolation valves (MSIVs) per main steam line shall be OPERABLE with closing times greater than or equal to 3 and less than or equal to 5 seconds.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

With one or more MSIVs inoperable:

a. Maintain at least one MSIV OPERABLE in each affected main steam line that is open and within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program, either:

1. Restore the inoperable valve(s) to OPERABLE status, or

2. Isolate the affected main steam line by use of a deactivated MSIV in the closed position.

b. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.4.7 Each of the above required MSIVs shall be demonstrated OPERABLE by verifying full closure between 3 and 5 seconds when tested pursuant to Specification 4.0.5.

LIMERICK - UNIT 2 3/4 4-23 Amendment No.~. 203

EMERGENCY CORE COOLING SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION:

a. For the core spray system:

1. With one CSS subsystem inoperable, provided that at least two LPCI subsystems are OPERABLE, restore the inoperable CSS subsystem to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With both CSS subsystems inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. For the LPCI system:

1. With one LPCI subsystem inoperable, provided that at least one CSS subsystem is OPERABLE, restore the inoperable LPCI pump to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With one RHR cross-tie valve (HV-51-282 A or B) open, or power not removed from one closed RHR cross-tie valve operator, close the open valve and/or remove power from the closed valves operator within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. With no RHR cross-tie valves (HV-51-282 A, B) closed, or power not removed from both closed RHR cross-tie valve operators, or with one RHR cross-tie valve open and power not removed from the other RHR cross-tie valve operator, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. With two LPCI subsystems inoperable, provided that at least one CSS subsystem is OPERABLE, restore at least three LPCI subsystems to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

5. With three LPCI subsystems inoperable, provided that both CSS subsystems are OPERABLE, restore at least two LPCI subsystems to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

6. With all four LPCI subsystems inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .*

Whenever both shutdown cooling subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - UNIT 2 3/4 5-2 Amendment No. -e&,+-0.~. 203

EMERGENCY CORE COOLING SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

c. For the HPCI system:

1. With the HPCI system inoperable, provided the CSS, the LPCI system, the ADS and the RCIC system are OPERABLE, restore the HPCI system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to~ 200 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With the HPCI system inoperable, and one CSS subsystem, and/or LPCI subsystem inoperable, and provided at least one CSS subsystem, three LPCI subsystems, and ADS are operable, restore the HPCI to OPERABLE within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program, or be in HOT SHUTDOWN in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and in COLD SHUTDOWN in the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. Specification 3.0.4.b is not applicable to HPCI.

d. For the ADS:

1. With one Df the above required ADS valves inoperable, provided the HPCI system, the CSS and the LPCI system are OPERABLE, restore the inoperable ADS valve to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to~ 100 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With two or more of the above required ADS valves inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to~ 100 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

e. With a CSS and/or LPCI header ~P instrumentation channel inoperable, restore the inoperable channel to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or determine the ECCS header ~P locally at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; otherwise, declare the associated CSS and/or LPCI, as applicable, inoperable.

f. DELETED LIMERICK - UNIT 2 3/4 5-3 Amendment No. -&8.~.~.203

CONTAINMENT SYSTEMS PRIMARY CONTAINMENT AIR LOCK 3.6.1.3 The primary containment air lock shall be OPERABLE with:

a. Both doors closed except when the air lock is being used for norma1 transit entry and exit through the containment, then at least one air lock door shall be closed, and

b. An overall air lock leakage rate in accordance with the Primary Containment Leakage Rate Testing Program.

APPLICABILITY: OPERATIONAL CONDITIONS l, 2*, and 3.

ACTION:

a. With one primary containment air lock door inoperable:

1. Maintain at least the OPERABLE air lock door closed and either restore the inoperable air lock door to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or lock the OPERABLE air lock door closed.

2. Operation may then continue until performance of the next required overall air lock leakage test provided that the OPERABLE air lock door is verified to be locked closed at least once per 31 days.

3. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With the primary containment air lock inoperable, except as a result of an inoperable air lock door, maintain at least one air lock door closed; restore the inoperable air lock to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

See Special Test Exception 3.10.1.

LIMERICK - UNIT 2 3/4 6-5 Amendment No. ,8-l.,~. 203

CONTAINMENT SYSTEMS SUPPRESSION POOL SPRAY LIMITING CONDITION FOR OPERATION 3.6.2.2 The suppress.ion pool spray mode of the residual heat removal CRHR) system shall be OPERABLE with two independent loops, each loop consisting of:

a. One OPERABLE RHR pump, and

b. An OPERABLE flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger and the suppression pool spray sparger(s).

APPLICABILITY: OPERATIONAL CONDITIONS l, 2, and 3.

ACTION;

a. With one suppression pool spray loop inoperable, restore the inoperable loop to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With both suppression pool spray loops inoperable, restore at least one loop to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.6.2.2 The suppression pool spray mode of the RHR system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b. By verifying that each of the required RHR pumps develops a flow of at least 500 gpm on recirculation flow through the RHR heat exchanger and the suppression pool spray sparger when tested pursuant to Speci-fication 4.0.5.

c. By verifying RHR suppression pool spray subsystem locations susceptible to gas accumulation are sufficiently filled with water in accordance with the Surveillance Frequency Control Program.

Whenever both RHR subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - WNIT 2 3/4 6-15 Amendment No.

.+/--7,g, 203

~.~.~.-+/-4-7-.

CONTAINMENT SYSTEMS SUPPRESSION POOL COOLING LIMITING CONDITION FOR OPERATION 3.6.2.3 The suppression pool cooling mode of the residual heat removal (RHR) system shall be OPERABLE with two independent loops, each loop consisting of:

a. One OPERABLE RHR pump, and

b. An OPERABLE flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one suppression pool cooling loop inoperable, restore the inoperable loop to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s** or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 .hours.

b. With both suppression pool cooling loops inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.6.2.3 The suppression pool cooling mode of the RHR system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b. By verifying that each of the required RHR pumps develops a flow of at least 10,000 gpm on recirculation flow through the flow path including the RHR heat exchanger and its associated closed bypass valve, the suppression pool and the full fl ow test line when tested pursuant to Specification 4.0.5.

c. By verifying RHR suppression pool cooling subsystem locations susceptible to gas accumulation are sufficiently filled with water in accordance with the Survei 11 ance Frequency Control Program. *

Whenever both RHR subsystems are inoperable, if unable to attain COLD SHUTDOWN a~ required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

- During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for one inoperable suppression pool cooling loop may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 2 3/4 6-16 Amendment No. ~.+G.~,+/-4+.~,

-l-7-8, 203

CONTAINMENT SYSTEMS 3/4.6.3 PRIMARY CONTAINMENT ISOLATION VALVES LIMITING CONDITION FOR OPERATION 3.6.3 Each primary containment isolation valve and each instrumentation line excess flow check valve shall be OPERABLE.

APPLICABILITY: OPERATIONAL CONDITIONS l, 2, and 3.

ACTION:

a. With one or more of the primary containment isolation valves inoperable,**

maintain at least one isolation valve OPERABLE in each affected penetration that is open and within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or in accordance with the Risk Informed Completion Time Program either:

1. Restore the inoperable valve(s) to OPERABLE status, or

2. Isolate each affected penetration by use of at least one de-activated automatic valve secured in the isolated position,* or

3. Isolate each affected penetration by use of at least one closed manual valve or blind flange.*

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one or more of the instrumentation line excess flow check valves inoperable, operation may continue and the prov1s1ons of Specification 3.0.3 are not applicable provided that within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months either: *

1. The inoperable valve is returned to OPERABLE status, or

2. The instrument line is isolated and the associated instrument is declared inoperable.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With one or more scram discharge volume vent or drain valves inoperable, perform the applicable actions specified in Specification 3.1.3.1.

Isolation valves closed to satisfy these requirements may be reopened on an intermittent basis under administrative control.

- Except for the scram discharge volume vent and drain valves.

LIMERICK - UNIT 2 3/4 6-17 Amendment No. -l-0+,-l-J-l.,~.

&J, 203

CONTAINMENT SYSTEMS 3/4.6.4 VACUUM RELIEF SUPPRESSION CHAMBER - DRYWELL VACUUM BREAKERS LIMITING CONDITION FOR OPERATION 3.6.4.1 Three pairs of suppression chamber - drywell vacuum breakers shall be OPERABLE and all suppression chamber - drywell vacuum breakers shall be closed.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one or more vacuum breakers in one of the three required pairs of suppression chamber - drywell vacuum breaker pairs inoperable for opening but known to be closed, restore at least one inoperable pair of vacuum breakers to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one suppression chamber - drywell vacuum breaker open, verify the other vacuum breaker in the pair to be closed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ; restore the open vacuum breaker to the closed position within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With one position indicator of any suppression chamber - drywell vacuum breaker inoperable:

1. Verify the other vacuum breaker in the pair to be closed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 15 days thereafter, or

2. Verify the vacuum breaker(s) with the inoperable position indicator to be closed by conducting a test which demonstrates that the ~Pis maintained at greater than or equal to 0.7 psi for one hour without makeup within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and at least once per 15 days thereafter.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LIMERICK - UNIT 2 3/4 6-44 Amendment No. 9, 203

3/4.7 PLANT SYSTEMS 3/4.7.1 SERVICE WATER SYSTEMS RESIDUAL HEAT REMOVAL SERVICE WATER SYSTEM - COMMON SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.1 At least the following independent residual heat removal service water (RHRSW) system subsystems, with each subsystem comprised of:

a. Two OPERABLE RHRSW pumps, and

b. An OPERABLE flow path capable of taking suction from the RHR service water pumps wet pits which are supplied from the spray pond or the cooling tower basin and transferring the water through one Unit 2 RHR heat exchanger, shall be OPERABLE:

a. In OPERATIONAL CONDITIONS 1, 2, and 3, two subsy~tems.

b. In OPERATIONAL CONDITIONS 4 and 5, the subsystem(s) associated with systems and components required OPERABLE by Specification 3.4.9.2, 3.9.11.1, and 3.9.11.2.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, 3, 4, and 5.

ACTION:

a. In OPERATIONAL CONDITION l, 2, or 3:

1. With one RHRSW pump inoperable, restore the inoperable pump to OPERABLE status within 30 days, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With one RHRSW pump in each subsystem inoperable, restore at least one of the inoperable RHRSW pumps to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. With one RHRSW subsystem otherwise inoperable, restore the inoperable subsystem to OPERABLE status with at least one OPERABLE RHRSW pump within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, unless otherwise specified in a) orb) below**, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

a) When the 'A' RHRSW subsystem is inoperable to allow for repairs of the 'A' RHRSW subsystem piping, with Limerick Generating Station Unit 1 shutdown, reactor vessel head removed and reactor cavity flooded, the 72-hour Allowed Outage Time may be extended to 7 days or in accordance with the Risk Informed Completion Time Program once every other calendar year with the following compensatory measures established:

- Only one of these two Actions, either a.3.a) or a.3.b), may be entered on Unit 2 in a calendar year. However, if either Unit 1 TS LCD 3.7.1.1, Action a.3.a) or a.3.b) has previously been entered in the calendar year, then Unit 2 Action a.3.a) or a.3.b) may not be entered during that same calendar year.

LIMERICK - UNIT 2 3/4 7-1 Amendment No. JG,-7-0,~.~. 203

PLANT SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

1) The following systems and subsystems will be protected in accordance with applicable station procedures:

'B' RHRSW subsystem

'B' ESW loop

'B' and 'D' RHR subsystems

012, 022, and 024 4kV buses and emergency diesel generators

Division 2 and Division 4 Safeguard DC, and

2) The 'A' and 'B' loop of ESW return flow shall be aligned to the operable 'B' RHRSW return header only.

The ESW return valves to the 'B' RHRSW return header (i.e., HV-ll-015A and HV-ll-015B) will be administratively controlled in the open position and de-energized prior to entering the ~xtended AOT. The ESW return valves to the 'A' RHRSW return header (i.e., HV-11-0llA and HV-11-0llB) will be administratively contrblled in the closed position and de-energized as part of the work boundary.

b) When the 'B' RHRSW subsystem is inoperable to all ow for repairs of the 'B' RHRSW subsystem piping, with Limerick Generating Sta ti on Unit 1 shutdown, reactor vessel head removed and reactor cavity flooded, the 72-hour Allowed Outage Time may be extended to 7 days or in accordance with the Risk Informed Completion Time Program once every other calendar year with the following compensatory measures established:

1) The following systems and subsystems will be protected in accordance ~ith applicable station procedures:

'A' RHRSW subsystem

'A' ESW loop

'A' and 'C' RHR subsystems

011, 021, and 023 4kV buses and emergency diesel generators

Division 1 and Division 3 Safeguard DC, and

2) The 'A' and 'B' loop of ESW return flow shall be aligned to the operable 'A' RHRSW return header only.

The ESW return valves to the 'A' RHRSW return header (i.e., HV-11-0llA and HV-11-0llB) will be administratively controlled in the open position and de-energized prior to entering the extended AOT. The ESW return valves to the 'B' RHRSW return header (i.e., HV-ll-015A and HV-ll-015B) will be administratively controlled in the closed position and de-energized as part of the work boundary.

4. With both RHRSW subsystems otherwise inoperable, restore at least one subsystem to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOWN within. the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . *

- Whenever both RHRSW subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - UNIT 2 3/4 7-la Amendment No. JG.,+{f,~.~. 203

- COMMON SYSTEM 3.7.1.2 At least the following independent emergency service water system loops, with each loop comprised of:

a. Two OPERABLE emergency service water pumps, and

b. An OPERABLE flow path capable of taking suction from the emergency service water pumps wet pits which are supplied from the spray pond or the cooling tower basin and transferring the water to the associated Unit 2 and common safety-related equipment, shall be OPERABLE:

a. In OPERATIONAL CONDITIONS 1, 2, and 3, two loops.

b. In OPERATIONAL CONDITIONS 4, 5, and* one loop.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, 3, 4, 5, and*

ACTION:

a. In OPERATION CONDITION 1, 2, or 3:

1. With one emergency service water pump inoperable, restore the inoperable pump to OPERABLE status within 45 days or be in at least HOT SHUTDOWN within the.next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. With one emergency service water pump in each loop inoperable, restore at least one inoperable pump to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. With one emergency service water system loop otherwise inoperable, declare all equipment aligned to the inoperable loop inoperable**, restore the inoperable loop to OPERABLE status with at least one OPERABLE pump within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s# or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

When handling irradiated fuel in the secondary containment.

- The diesel generators may be aligned to the OPERABLE emergency service water system loop provided confirmatory flow testing has been performed. Those diesel generators not aligned to the OPERABLE emergency service water system loop shall be declared inoperable and the actions of 3.8.1.1 taken.

During the extended Allowed Outage Time (AOT) specified by TS LCD 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for one inoperable emergency service water system loop may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 2 3/4 7-3 Amendment No. -+/--8,-7-0,~.~. 203

PLANT SYSTEMS 3/4.7.3 REACTOR CORE ISOLATION COOLING SYSTEM LIMITING CONDITION FOR OPERATION 3.7.3 The reactor core isolation cooling (RCIC) system shall be OPERABLE with an OPERABLE flow path capable of automatically taking suction from the suppression pool and transferring the water to the reactor pressure vessel.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3 with reactor steam dome pressure greater than 150 psig.

ACTION:

a. With the RCIC system inoperable, operation may continue provided the HPCI system is OPERABLE; restore the RCIC system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to less than or equal to 150 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. DELETED

c. Specification 3.0.4.b is not applicable to RCIC.

4.7.3 The RCIC system shall be demonstrated OPERABLE:

a. In accordance with the Surveillance Frequency Control Program by:

1. Verifying locations susceptible to gas accumulation are sufficiently filled with water.

2. Verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.**

3. Verifying that the pump flow controller is in the correct position.

b. In accordance with the Surveillance Frequency Control Program by verifying that the RCIC pump develops a flow of greater than or equal to 600 gpm in the test flow path with a system head corresponding to reactor vessel operating pressure when steam is being supplied to the turbine at 1040 + 13, - 120 psig.*

The prov1s1ons of Specification 4.0.4 are not applicable provided the surveillance is performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure is adequate to perform the test. If OPERABILITY is not successfully demonstrated within the 12-hour period, reduce reactor steam dome pressure to less than 150 psig within the following 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

- Not required to be met for system vent flow paths opened under administrative control.

LIMERICK - UNIT 2 3/4 7-9 Amendment No. -a-l,-lJ.,?,J4..7.,~.

-+/--7,g, 203

PLANT SYSTEMS 3/4.7,8 MAIN TURBINE BYPASS SYSTEM LIMITING CONDITION FOR OPERATION 3.7.8 The main turbine bypass system shall be OPERABLE as determined by the number of operable main turbine bypass valves being greater than or equal to that specified in the CORE OPERATING LIMITS REPORT.

APPLICABILITY: OPERATIONAL CONDITION l, when THERMAL POWER is greater than or equal to 25% of RATED THERMAL POWER.

ACTION: With the main turbine bypass system inoperable, restore the system to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the Risk Informed Completion Time Program, or take the ACTION required by Specification 3.2.3.c.

4.7.8 The main turbine bypass system shall be demonstrated OPERABLE in accordance with the Surveillance Frequency Control Program:

a. By cycling each turbine bypass valve through at least one complete cycle of full travel, b.* By performing a system functional test which includes simulated automatic actuation, and by verifying that each automatic valve actuates to its correct position, and

c. By determining TURBINE BYPASS SYSTEM RESPONSE TIME to be less than or equal to the value specified in the CORE OPERATING LIMITS REPORT.

LIMERICK - UNIT 2 3/4 7-33 Amendment No . .J.-4,-14+, 203

3/4.8 ELECTRICAL POWER SYSTEMS 3/4.8.1 A.C. SOURCES A.C. SOURCES - OPERATING 3.8.1.l As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a. Two physically independent circuits between the offsite transmission network and the onsite Class lE distribution system, and

b. Four separate and independent diesel generators, each with:

1. A separate day tank containing a minimum of 250 gallons of fuel,

2. A separate fuel storage system containing a minimum of 33,500 gallons of fuel, and

3. A separate fuel transfer pump.

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and at least once per 7 days thereafter. If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining operable diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore the inoperable diesel generator to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

b. With two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. If either of the diesel generators became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least one of the inoperable diesel generators to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s* or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, th~ 72-hour AOT for two inoperable diesel generators may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 2 3/4 8-1 Amendment No. -l-e-0,-l-M,~. 203

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

c. With three diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter; and perform Surveillance Requirement 4.8.1.1.2.a.4 for the remaining diesel generator, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Restore at least one of the inoperable diesel generators to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

d. With one offsite circuit and one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least two offsite circuits to OPERABLE status within 7i hours or in accordance with the Risk Informed Completion Time Program from time of initial loss, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

LIMERICK - UNIT 2 3/4 8-la Amendment No.~. 203

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

e. In addition to the ACTIONS above:

1. For two train systems, with one or more diesel generators of the above required A.C. electrical power sources inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter that at least one of the required two train system subsystem, train, components, and devices is OPERABLE and its associated diesel generator is OPERABLE. Otherwise, restore either the inoperable diesel generator or the inoperable system subsystem to an OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s* or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. For the LPCI systems, with two or more diesel generators of the above required A.C. electrical power sources inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter that at least two of the required LPCI system subsystems, trains, components and devices are OPERABLE and its associated diesel generator is OPERABLE. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

This ACTION does not apply for those systems covered in Specifications 3.7.1.1 and 3.7.1.2.

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LIMERICK - UNIT 2 3/4 8-2 Amendment No. e-§., 203

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

ACTION: (Continued)

f. With one offsite circuit of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. Restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

g. With two of the above required offsite circuits inoperable, restore at least one of the inoperable offsite circuits to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . With only one offsite circuit restored to OPERABLE status, restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program from time of initial loss, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

h. With one offsite circuit and two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. If either of the diesel generators became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least one of the above required inoperable A.C. sources to OPERABLE status within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Restore at least two offsite circuits and at l.east three of the above required diesel generators to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from time of initial loss or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

i. Specification 3.0.4.b is not applicable to diesel generators.

LIMERICK - UNIT 2 3/4 8-2a Amendment No.~.~. 203

ELECTRICAL POWER SYSTEMS 3/4.8.2 D.C. SOURCES D.C. SOURCES - OPERATING LIMITING CONDITION FOR OPERATION 3.8.2.1 As a mini~um, the following D.C. electrical power sources shall be OPERABLE:

a. Division l, Consisting of:

1. 125-Volt Battery 2Al (2AlD101).

2. 125-Volt Battery 2A2 (2A2Dl01).

3. 125-Volt Battery Charger 2BCA1 (2A1Dl03).

4. 125-Volt Battery Charger 2BCA2 (2A2Dl03).

b. Division 2, Consisting of:

1. 125-Volt Battery 2Bl (2B1D10l).

2. 125-Volt Battery 2B2 (2B2Dl01).

3. 125-Volt Battery Charger 2BCB1 (2B1Dl03).

4. 125-Volt Battery Charger 2BCB2 (2B2Dl03).

c. Division 3, Consisting of:

1. 125-Volt Battery 2C (2CD101).

2. 125-Volt Battery Charger 2BCC (2CD103).

d. Division 4, Consisting of:

1. 125-Volt Battery 2D (2DD101).

2. 125-Volt Battery Charger 2BCD (2DD103).

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one or two battery chargers on one division inoperable:

1. Restore battery terminal voltage to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ,

2. Verify associated Division 1 or 2 float currents 2 amps, or Division 3 or 4 float currents 1 amp within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter, and

3. Restore battery charger(s) to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.

b. With one or more batteries inoperable due to:

1. One or two batteries on one division with one or more battery cells float voltage< 2.07 volts, perform 4.8.2.1.a.l and 4.8.2.1.a.2 within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for affected battery(s) and restore affected cell(s) voltage

~ 2.07 volts within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. Division 1 or 2 with float current> 2 amps, or with Division 3 or 4 with float current> 1 amp, perform 4.8.2.1.a.2 within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for affected battery(s) and restore battery float current to within limits within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

LIMERICK - UNIT 2 3/4 8-10 Amendment No.~. 203

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION ACTION: (Continued)

3. One or two batteries on one division with one or more cells electrolyte level less than minimum established design limits, if electrolyte level was below the top of the plates restore electrolyte level to above top of plates within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and verify no evidence of leakage(*) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In all cases, restore electrolyte level to greater than or equal to minimum established design limits within 31 days.

4. One or two batteries on one division with pilot cell electrolyte temperature less than minimum established design limits, restore battery pilot cell temperature to greater than or equal to minimum established design limits within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

5. Batteries in more than one division affected, restore battery parameters for all batteries in all but one division to within limits within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

6. (i) Any battery having both (Action b.l) one or more battery cells float voltage< 2.07 volts and (Action b.2) float current not within limits, and/or (ii) Any battery not meeting any Action b.l through b.5, Restore the battery parameters to within limits within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

c. With any battery(ies) on one division of the above required D.C. electrical power sources inoperable for reasons other than Action b., restore the inoperable division battery to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(*) Contrary to the prov1s1ons of Specification 3.0.2, if electrolyte level was below the top of the plates, the verification that there is no evidence of leakage is required to be completed regardless of when electrolyte level is restored.

LIMERICK - UNIT 2 3/4 8-lOa Amendment No.~. 203

ELECTRICAL POWER SYSTEMS LIMITING CONDITION FOR OPERATION (Continued)

APPLICABILITY: OPERATIONAL CONDITIONS 1, 2, and 3.

ACTION:

a. With one of the above required Unit 2 A.C. distribution system divisions not energized, reenergize the division within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. With one of the above required Unit 2 D.C. distribution system divisions not energized, reenergize the division within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

c. With any of the above required Unit 1 and common AC and/or DC distribution system divisions not energized, declare the associated common equipment inoperable, and take the appropriate ACTION for that system.

4.8.3.1 Each of the above required power distribution system divisions shall be determined energized in accordance with the Surveillance Frequency Control Program by verifying correct breaker alignment and voltage on the busses/MCCs/panels.

LIMERICK - UNIT 2 3/4 8-17 Amendment No. 447, 203

ADMINISTRATIVE CONTROLS PROCEDURES AND PROGRAMS (Continued)

c. The program shall, as allowed by 10 CFR 50.55a, meet Subsection !STA, "General Requirements," an.d Subsection !STD, "Preservice and Inservice Examination and Testing of Dyna~ic Restraints (Snubbers) in Light-Water Reactor Nuclear Power Plants," in lieu of Section XI of the ASME B&PV Code ISI requirements for snubbers, or meet authorized alternatives pursuant to 10 CFR 50.55a.

d. The 120-month program updates shall be made in accordance with 10 CFR 50.55a subject to the limitations and conditions listed therein.

l. Explosive ~as Monitorjng Program This program provides controls for potentially explosive gas mixtures contained downstream of the off-gas recombiners.

The program shall include:

a. The limit for the concentration of hydrogen downstream of the offgas recombiners and a surveillance program to ensure the limit is maintained. This limit shall be appropriate to the system's design criteria (i.e., whether or not the system is designed to withstand a hydrogen explosion);

The provisions of SR 4.0.2 and SR 4.0.3 are applicable to the Explosive Gas Monitoring Program surveillance frequencies.

m. Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days.

b. A RICT may only be utilized in OPERATIONAL CONDITIONS 1 and 2.

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the ACTION allowed outage time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

LIMERICK - UNIT 2 6-14e Amendment No. -+/-&4,-+/--9-1-, 203

ADMINISTRATIVE CONTROLS PROCEDURES AND PROGRAMS (Continued)

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the ACTION allowed outage time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the completion times must be PRA methods approved for use with this program in Amendment No. 203, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

LIMERICK - UNIT 2 6-14f Amendment No. 203

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 240 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-39 AND AMENDMENT NO. 203 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-85 EXELON GENERATION COMPANY, LLC LIMERICK GENERATING STATION, UNITS 1 AND 2 DOCKET NOS. 50-352 AND 50-353

1.0 INTRODUCTION

By application dated December 13, 2018 (Reference [1]), as supplemented by letters dated February 14, 2019; August 12, 2019; August 27, 2019; and January 7, 2020 (Reference [2],

Reference [3], Reference [4], and Reference [5]), Exelon Generation Company, LLC (Exelon, the licensee) submitted a license amendment request (LAR) for Limerick Generating Station (Limerick or LGS), Units 1 and 2.

The amendments would revise technical specification (TS) requirements to permit the use of risk-informed completion times (RICTs) for actions to be taken when limiting conditions for operation (LCOs) are not met. The proposed changes are based on Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF [Risk-Informed Technical Specifications Task Force] Initiative 4b, dated July 2, 2018 (Reference [6]). The U.S. Nuclear Regulatory Commission (NRC, the Commission) issued a final model safety evaluation (SE) approving TSTF-505, Revision 2, on November 21, 2018 (Reference [7]).

The licensee has proposed variations from the TS changes described in TSTF-505, Revision 2.

The variations are described in Section 2.2.3 of this SE.

From June 17, 2019, to June 21, 2019, the NRC staff and its contractors from the Pacific Northwest National Laboratory participated in a regulatory audit at the Exelon offices located in Kennett Square, Pennsylvania. The NRC staff performed the audit to ascertain the information needed to support its review of the application and develop requests for additional information Enclosure 3

(RAIs), as needed. On August 23, 2019, the NRC staff issued an audit summary (Reference [8]). By e-mails dated July 10, 2019 (Reference [9]), and December 9, 2019 (Reference [10]), the NRC staff sent two rounds of RAIs to the licensee. By letters dated August 12, 2019 (Reference [3]), and August 27, 2019 (Reference [4]), the licensee responded to the RAIs. By supplemental letters dated February 14, 2019; August 12, 2019; August 27, 2019; and January 7, 2020 (Reference [2], Reference [3], Reference [4], and Reference [5]),

provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staffs original proposed no significant hazards consideration determination as published in the Federal Register on March 26, 2019 (84 FR 11338).

2.0 REGULATORY EVALUATION

2.1 Description of RICT Program The TS LCOs are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO is not met, the licensee must shut down the reactor or follow any remedial or required action (e.g., testing, maintenance, or repair activity) permitted by the TSs until the condition can be met. The remedial actions (i.e., actions) associated with an LCO contain conditions that typically describe the ways in which the requirements of the LCO can fail to be met. Specified with each stated condition are required action(s) and completion times (CTs). The CTs are referred to as the front stops in the context of this SE. For certain conditions, the TSs require exiting the mode of applicability of an LCO.

The licensees TSs are not presented in the standard technical specification (STS) format. The term action statement is conventionally used to describe ways in which the requirements of the LCO can fail to be met (i.e., condition) and the necessary required actions. Throughout this SE, the terms condition and required actions are used to describe action statements. The term allowed outage time (AOT) is conventionally used to describe the length of time that equipment is permitted to be inoperable. For the purposes of this SE, the terms completion time (CT) and allowed outage time are used interchangeably.

Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b: Risk Managed Technical Specification (RMTS)

(Reference [11]) (NEI 06-09 or NEI 06-09-A), and the NRCs Final Safety Evaluation for NEI 06-09 (Reference [12]), provides a methodology for extending existing CTs, and thereby delay exiting the operational mode of applicability or taking required actions, if risk is assessed and managed within the limits and programmatic requirements established by an RICT program.

2.2 Description of TS Changes The licensees submittal requested approval to add an RICT program to the administrative controls section of the TSs and modify selected CTs to permit extending the CTs, provided risk is assessed and managed as described in NEI 06-09-A. The licensees application for the changes proposed to use NEI 06-09-A and included documentation regarding the technical adequacy of the probabilistic risk assessment (PRA) models for the RICT program, consistent with the guidance of Regulatory Guide (RG) 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (Reference [13]).

2.2.1 TS 6.8.4.m, Risk Informed Completion Time Program TS 6.8.4.m, which describes the RICT program, would be added to the TSs and read as follows:

Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A. The program shall include the following:

a. The RICT may not exceed 30 days.

b. A RICT may only be utilized in OPERATIONAL CONDITIONs 1 and 2.

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the ACTION allowed outage time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the ACTION allowed outage time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the completion times must be PRA methods approved for use with this program in Amendment Nos. [240/203], or other methods approved

by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

2.2.2 Application of the RICT Program to Existing LCOs and Action Statements Consistent with TSTF-505, Revision 2 The typical AOT is modified by application of the RICT program as shown in the following example. The changed portion is indicated in italics.

ACTION:

a. With one subsystem inoperable, restore subsystem to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program.

Where necessary, conforming changes are made to AOTs to make them accurate following use of the RICT. For example, most TSs have requirements to close/isolate containment isolation devices if one or more containment penetrations have inoperable devices. This is followed by a requirement to periodically verify the penetration is isolated. By adding the flexibility to use the RICT to determine a time to isolate the penetration, the periodic verifications must then be based on the time following isolation.

Individual LCO actions and AOTs modified by the proposed change are identified below.

LCO 3.1.5 Standby Liquid Control System (Units 1 and 2)

ACTION a. With only one pump and corresponding explosive valve OPERABLE, in OPERATIONAL CONDITION 1 or 2, restore one inoperable pump and corresponding explosive valve to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

LCO 3.3.1 Reactor Protection System Instrumentation (Units 1 and 2)

ACTION b. With the number of OPERABLE channels in either trip system less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(s) or the affected trip system** in the tripped condition(s) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program***.

Footnote *** Not applicable when trip capability is not maintained for one or more Functional Units.

LCO 3.3.2 Isolation Actuation Instrumentation (Units 1 and 2)

ACTION b)1. If placing the inoperable channel(s) in the tripped condition would cause an isolation, the inoperable channel(s) shall be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or in accordance with the Risk Informed Completion Time Program**#. If this

cannot be accomplished, the ACTION required by Table 3.3.2-1 for the affected trip function shall be taken, or the channel shall be placed in the tripped condition.

ACTION b)2.a) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the Risk Informed Completion Time Program**# for trip functions common* to RPS Instrumentation.

ACTION b)2.b) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program**# for trip functions not common* to RPS Instrumentation.

Footnotes ** Not applicable when trip capability is not maintained.

Not applicable for Function 7, Secondary Containment Isolation.

LCO 3.3.3 Emergency Core Cooling System Actuation Instrumentation (Units 1 and 2)

ACTION 30-a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the associated system inoperable.

ACTION 33 With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program,* or declare the associated ECCS

[emergency core cooling system] inoperable.

ACTION 34-a. For one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or declare the HPCI [high pressure coolant injection] system inoperable.

ACTION 35 With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program,* or declare the HPCI system inoperable.

Footnote

Not applicable when trip capability is not maintained.

LCO 3.3.5-1 Reactor Core Isolation Cooling [RCIC] System Actuation Instrumentation (Units 1 and 2)

ACTION 50.a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the

Risk Informed Completion Time Program, or declare the RCIC system inoperable.

ACTION 52 With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program,* or declare the RCIC system inoperable.

Footnote

Not applicable when trip capability is not maintained.

LCO 3.3.9 Feedwater/Main Turbine Trip System Actuation Instrumentation (Units 1 and 2)

ACTION b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

LCO 3.4.7 Main Steam Line Isolation Valves (Units 1 and 2)

ACTION a. Maintain at least one MSIV [main steam isolation valve]

OPERABLE in each affected main steam line that is open and within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , or in accordance with the Risk Informed Completion Time Program either:

LCO 3.5.1 ECCS - Operating (Units 1 and 2)

ACTION a.1. With one CSS [core spray system] subsystem inoperable, provided that at least two LPCI [low pressure coolant injection]

subsystems are OPERABLE, restore the inoperable CSS subsystem to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION b.4. With two LPCI subsystems inoperable, provided that at least one CSS subsystem is OPERABLE, restore at least three LPCI subsystems to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION c 1. With the HPCI system inoperable, provided the CSS, the LPCI system, the ADS [automatic depressurization system] and the RCIC system are OPERABLE, restore the HPCI system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT

SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to 200 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION c.2. With the HPCI system inoperable, and one CSS subsystem, and/or LPCI subsystem inoperable, and provided at least one CSS subsystem, three LPCI subsystems, and ADS are operable, restore the HPCI to OPERABLE within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , or in accordance with the Risk Informed Completion Time Program, or be in HOT SHUTDOWN in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and in COLD SHUTDOWN in the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION d.1. With one of the above required ADS valves inoperable, provided the HPCI system, the CSS and the LPCI system are OPERABLE, restore the inoperable ADS valve to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to 100 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.6.2.2 Suppression Pool Spray (Units 1 and 2)

ACTION a. With one suppression pool spray loop inoperable, restore the inoperable loop to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.6.2.3 Suppression Pool Cooling (Units 1 and 2)

ACTION a. With one suppression pool cooling loop inoperable, restore the inoperable loop to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s** or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.6.3 Primary Containment Isolation Valves (Units 1 and 2)

ACTION a. With one or more of the primary containment isolation valves inoperable,** maintain at least one isolation valve OPERABLE in each affected penetration that is open and within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , or in accordance with the Risk Informed Completion Time Program, either:

LCO 3.6.4.1 Suppression Chamber -Drywell Vacuum Breakers (Units 1 and 2)

ACTION a. With one or more vacuum breakers in one of the three required pairs of suppression chamber - drywell vacuum breaker pairs inoperable for opening but known to be closed, restore at least one inoperable pair of vacuum breakers to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN

within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.7.1.1 Residual Heat Removal Service Water System - Common System (Units 1 and 2)

ACTION a.2. With one RHRSW pump in each subsystem inoperable, restore at least one of the inoperable RHRSW [residual heat removal service water system] pumps to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION a.3. With one RHRSW subsystem otherwise inoperable, restore the inoperable subsystem to OPERABLE status with at least one OPERABLE RHRSW pump within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, unless otherwise specified in a) or b) below**, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.7.1.2 Emergency Service Water System - Common System (Units1 and 2)

ACTION a.3. With one emergency service water system loop otherwise inoperable, declare all equipment aligned to the inoperable loop inoperable**, restore the inoperable loop to OPERABLE status with at least one OPERABLE pump within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s# or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.7.3 Reactor Core Isolation Cooling System (Units 1 and 2)

ACTION a. With the RCIC system inoperable, operation may continue provided the HPCI system is OPERABLE; restore the RCIC system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program. Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to less than or equal to 150 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.7.8 Main Turbine Bypass System (Units 1 and 2)

ACTION With the main turbine bypass system inoperable, restore the system to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the Risk Informed Completion Time Program, or take the ACTION required by Specification 3.2.3.c.

LCO 3.8.1.1 A.C. [Alternating Current] Sources - Operating (Units 1 and 2)

ACTION d. With one offsite circuit and one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential common-mode failure for the remaining diesel generators is determined. Restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program from the time of initial loss, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e.

ACTION f. With one offsite circuit of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C. sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

Restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION g. With two of the above required offsite circuits inoperable, restore at least one of the inoperable offsite circuits to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . With only one offsite circuit restored to OPERABLE status, restore at least two offsite circuits to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, from time of initial loss or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.8.2.1 D.C. [Direct Current] Sources - Operating (Units 1 and 2)

ACTION a.3. Restore battery charger(s) to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program.

ACTION c. With any battery(ies) on one division of the above required D.C.

electrical power sources inoperable for reasons other than Action b., restore the inoperable division battery to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , or in accordance with the Risk Informed Completion Time Program.

LCO 3.8.3.1 Distribution - Operating (Units 1 and 2) (brackets apply to Unit 2)

ACTION a. With one of the above required Unit 1[/2] A.C. distribution system divisions not energized, reenergize the division within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION b. With one of the above required Unit 1 D.C. distribution system divisions not energized, reenergize the division within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2.2.3 Variations from TSTF-505, Revision 2 2.2.3.1 Application of the RICT Program to Modified Action Statements The following conditions are modified to permit the application of an RICT:

LCO 3.3.1 Reactor Protection System Instrumentation (Units 1 and 2)

ACTION c. With the number of OPERABLE channels in both trip systems for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(s) in one trip system or one trip system in the tripped condition within 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s**, or in accordance with the Risk Informed Completion Time Program.***

Footnotes ** For Functional Units 2.a, 2.b, 2.c, 2.d, and 2.f, inoperable channels shall be placed in the tripped condition to comply with Action b. Action c does not apply for these Functional Units.

- - Not applicable when trip capability is not maintained for one or more Functional Units.

LCO 3.3.4.1 ATWS [Anticipated Transient Without Scram] Recirculation Pump Trip System Instrumentation (Units 1 and 2)

ACTION b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel(s) in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program*.

ACTION c.1. If the inoperable channels consist of one reactor vessel water level channel and one reactor vessel pressure channel, place both inoperable channels in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program, or, if this action will initiate a pump trip, declare the trip system inoperable.

Footnote

Not applicable when trip capability is not maintained.

LCO 3.3.4.2 End-of-Cycle Recirculation Pump Trip System Instrumentation (Units 1 and 2)

ACTION b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel(s) in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program*.

ACTION c.1. If the inoperable channels consist of one turbine control valve channel and one turbine stop valve channel, place both inoperable channels in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program.

Footnote

Not applicable when trip capability is not maintained.

LCO 3.3.9 Feedwater/Main Turbine Trip System Actuation Instrumentation (Units 1 and 2)

ACTION c. With the number of OPERABLE channels two less than required by the Minimum OPERABLE Channels requirement, restore at least one of the inoperable channels to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program,** or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Footnote ** Not applicable when trip capability is not maintained.

2.2.3.2 Application of the RICT to Additional Actions Requirements The following individual LCO actions and AOTs identified below are modified by the proposed change to permit the application of an RICT and are in addition to those included in TSTF-505.

LCO 3.3.1 Reactor Protection System Instrumentation (Units 1 and 2)

ACTION a. With the number of OPERABLE channels in either trip system for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, within one hour, or in accordance with the Risk Informed Completion Time Program,*** for each affected functional unit either verify that at least one* channel in each trip system is OPERABLE or tripped or that the trip system is tripped, or place either the affected trip system or at least one inoperable channel in the affected trip system in the tripped condition.

Footnote *** Not applicable when trip capability is not maintained for one or more Functional Units.

LCO 3.3.3 Emergency Core Cooling System Actuation Instrumentation (Units 1 and 2)

ACTION c. With either ADS trip system subsystem inoperable, restore the inoperable trip system to OPERABLE status within:

1. 7 days or in accordance with the Risk Informed Completion Time Program, provided that the HPCI and RCIC systems are OPERABLE.

2. 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program.

LCO 3.3.4.1 ATWS Recirculation Pump Trip System Instrumentation (Units 1 and 2)

ACTION d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

LCO 3.3.4.2 End-of-Cycle Recirculation Pump Trip System Instrumentation (Units 1 and 2)

ACTION d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, or take the ACTION required by Specification 3.2.3.

LCO 3.5.1 ECCS - Operating (Units 1 and 2)

ACTION b.5 With three LPCI [low pressure coolant injection] subsystems inoperable, provided that both CSS subsystems are OPERABLE, restore at least two LPCI subsystems to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.6.1.3 Primary Containment Air Lock (Units 1 and 2)

ACTION a.1 Maintain at least the OPERABLE air lock door closed and either restore the inoperable air lock door to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the Risk Informed Completion Time Program, or lock the OPERABLE air lock door closed.

LCO 3.6.2.3 Suppression Pool Cooling (Units 1 and 2)

Footnote ** During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT for one inoperable suppression pool cooling loop may also be extended to 7 days, or in

accordance with the Risk Informed Completion Time Program, for the same period.

LCO 3.7.1.1 Residual Heat Removal Service Water System - Common System (Units 1 and 2) (brackets apply to Unit 2)

ACTION a.3.a) When the A RHRSW subsystem is inoperable to allow for repairs of the A RHRSW subsystem piping, with Limerick Generating Station Unit 2[1] shutdown, reactor vessel head removed and reactor cavity flooded, the 72-hour Allowed Outage Time may be extended to 7 days or in accordance with the Risk Informed Completion Time Program once every other calendar year with the following compensatory measures established:

ACTION a.3.b) When the B RHRSW subsystem is inoperable to allow for repairs of the B RHRSW subsystem piping, with Limerick Generating Station Unit 2[1] shutdown, reactor vessel head removed and reactor cavity flooded, the 72-hour Allowed Outage Time may be extended to 7 days, or in accordance with the Risk Informed Completion Time Program, once every other calendar year with the following compensatory measures established:

LCO 3.7.1.2 Emergency Service Water [ESW] System - Common System (Units 1 and 2)

Footnote # During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT for one inoperable emergency service water system loop may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LCO 3.8.1.1 A.C. Sources - Operating (Units 1 and 2)

Footnote

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT for two inoperable diesel generators may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

2.3 Regulatory Review 2.3.1 Applicable Regulations Under 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, whenever a holder of a license wishes to amend the license, including TSs in the license, an application for amendment must be filed, fully describing the changes desired.

Under 10 CFR 50.92(a), determinations on whether to grant an applied-for license amendment

are to be guided by the considerations that govern the issuance of initial licenses or construction permits to the extent applicable and appropriate.

The regulation in 10 CFR 50.36(c)(2) requires that TSs contain LCOs, which are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the TSs until the LCO can be met. Typically, the TSs require restoration of equipment in a timeframe commensurate with its safety significance, along with other engineering considerations. The regulation in 10 CFR 50.36(b) requires that TSs be derived from the analyses and evaluation included in the safety analysis report and amendments thereto.

In determining whether the proposed TS remedial actions should be granted, the Commission will apply the reasonable assurance standards of 10 CFR 50.40(a) and 50.57(a)(3). The regulation in 10 CFR 50.40(a) states that in determining whether to grant the licensing request, the Commission will be guided by, among other things, consideration about whether the processes to be performed, the operating procedures, the facility and equipment, the use of the facility, and other TSs, or the proposals, in regard to any of the foregoing collectively provide reasonable assurance that the applicant will comply with the regulations in this chapter, including the regulations in part 20 of this chapter, and that the health and safety of the public will not be endangered.

The regulation in 10 CFR 50.36(c)(5) states that administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner.

The regulation in 10 CFR 50.55a(h), Protection and safety systems, states that protection systems of nuclear power reactors of all types must meet the requirements specified in this paragraph. Each combined license for a utilization facility is subject to the conditions specified in this clause.

With regard to instrumentation and control (I&C) systems, Clause 4.2, Single Failure Criterion, of Institute of Electrical and Electronics Engineers (IEEE) 279-1968, Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, requires that:

Any single failure within the protection system shall not prevent proper protection system action when required.

Clause 4.11, Channel Bypass or Removal from Operation, of IEEE 279-1968 requires that:

The system shall be designed to permit any one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level. During such operation the active parts of the system shall of themselves continue to meet the single failure criterion.

However, the single failure criterion is allowed to be violated by the exception specified in Clause 4.11:

Exception: One-out-of-two systems are permitted to violate the single failure criterion during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.

Appendix A, General Design Criteria for Nuclear Power Plants, of 10 CFR Part 50 (GDC),

Criterion 22, Protection system independence, provides, in part: Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function.

Section 10 CFR 50.65, Requirements for monitoring the effectiveness of maintenance at nuclear power plants (i.e., the Maintenance Rule), requires licensees to monitor the performance or condition of SSCs against licensee established goals in a manner sufficient to provide reasonable assurance that these SSCs are capable of fulfilling their intended functions.

The regulation in 10 CFR 50.65(a)(4) requires the assessment and management of the increase in risk that may result from a proposed maintenance activity.

2.3.2 Policy Statements The NRC provided details concerning the use of PRA in the Final Policy Statement: Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities, published in the Federal Register (60 FR 42622; August 16, 1995). In this publication, the Commission wrote, in part:

The Commission believes that an overall policy on the use of PRA methods in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that would promote regulatory stability and efficiency. In addition, the Commission believes that the use of PRA technology in NRC regulatory activities should be increased to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRCs deterministic approach.

PRA addresses a broad spectrum of initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for multiple and common cause failures. The treatment, therefore, goes beyond the single failure requirements in the deterministic approach. The probabilistic approach to regulation is, therefore, considered an extension and enhancement of traditional regulation by considering risk in a more coherent and complete manner.

Therefore, the Commission believes that an overall policy on the use of PRA in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that promotes regulatory stability and efficiency. This policy statement sets forth the Commissions intention to encourage the use of PRA and to expand the scope of PRA applications in all nuclear regulatory matters to the extent supported by the state-of-the-art in terms of methods and data.

Therefore, the Commission adopts the following policy statement regarding the expanded NRC use of PRA:

(1) The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defense-in-depth philosophy.

(2) PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices. Where appropriate, PRA should be used to support the proposal for additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed. It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

(3) PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

(4) The Commissions safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.

2.3.3 Regulatory Guidance Revision 3 of RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (Reference [14]), describes an acceptable risk-informed approach for assessing the nature and impact of proposed permanent licensing basis changes by considering engineering issues and applying risk insights. This RG also provides risk acceptance guidelines for evaluating the results of such evaluations.

Revision 1 of RG 1.177, An Approach for Plant-Specific, Risk-Informed Decision-Making:

Technical Specifications (Reference [15]), describes an acceptable risk-informed approach specifically for assessing proposed TS changes. This RG identifies a three-tiered approach for a licensees evaluation of the risk associated with a proposed TS completion time change, as follows.

Tier 1 assesses the risk impact of the proposed change in accordance with acceptance guidelines consistent with the Commissions Safety Goal Policy Statement, as documented in RG 1.174 and RG 1.177. The first tier assesses the impact on plant risk as expressed by the change in core damage frequency (CDF) and change in large early release frequency (LERF). It also evaluates plant risk while equipment covered

by the proposed CT is out of service, as represented by incremental conditional core damage probability and incremental conditional large early release probability. Tier 1 also addresses PRA acceptability, including the technical adequacy of the licensees plant-specific PRA for the subject application.

Tier 2 identifies and evaluates any potential risk-significant plant equipment outage configurations that could result if equipment, in addition to that associated with the proposed license amendment, is removed from service simultaneously, or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The purpose of this evaluation is to ensure that there are appropriate restrictions in place such that risk-significant plant equipment outage configurations will not occur when equipment associated with the proposed CT is implemented.

Tier 3 addresses the licensees configuration risk management program (CRMP) to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities, and appropriate compensatory measures are taken to avoid risk-significant configurations that may not have been considered when the Tier 2 evaluation was performed. Compared with Tier 2, Tier 3 provides additional coverage to ensure risk-significant plant equipment outage configurations are identified in a timely manner and that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule, which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance testing and corrective and preventive maintenance, subject to the guidance provided in RG 1.177, Section 2.3.7.1, and the adequacy of the licensees program and PRA model for this application. The CRMP ensures that equipment removed from service prior to or during the proposed extended CT will be appropriately assessed from a risk perspective.

RG 1.200, Revision 2 (Reference [13]), describes an acceptable approach for determining whether the PRA acceptability, in total, or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decisionmaking for light-water reactors. This RG provides guidance for assessing the technical adequacy of a PRA. Revision 2 of RG 1.200, endorses, with clarifications and qualifications, the use of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS)

Standard, RA-Sa-2009, Addenda to ASME RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (i.e.,

the PRA Standard) (Reference [16]).

As discussed in RG 1.177, Revision 1, and RG 1.174, Revision 3, a risk-informed application should be evaluated to ensure that the proposed changes meet the following key principles:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

2. The proposed change is consistent with the defense-in-depth philosophy.

3. The proposed change maintains sufficient safety margins.

4. When proposed changes result in core damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

3.0 TECHNICAL EVALUATION

The licensees adoption of TSTF-505, Revision 2, provides for the addition of an RICT program to the administrative controls section of the TSs and modifies selected required action CTs to permit extending the CTs, provided risk is assessed and managed as described in NEI 06-09-A.

In accordance with NEI 06-09-A, PRA methods are used to justify each extension to a required action CT based on the specific plant configuration that exists at the time of the applicability of the required action and are updated when plant conditions change. The licensees application for the changes proposed in the LAR included documentation regarding the technical adequacy of the PRA models used in the CRMP, consistent with the requirements of RG 1.200.

Most TSs identify one or more conditions for which the LCO may not be met to permit a licensee to perform required testing, maintenance, or repair activities. Each condition has an associated required action for restoration of the LCO or for other actions, each with some fixed time interval, referred to as the CT, which identifies the time interval permitted to complete the required action. Upon expiration of the CT, the licensee is required to shut down the reactor or follow the required action(s) stated in the action requirements. The RICT program provides the necessary administrative controls to permit extension of CTs, and thereby delay reactor shutdown or required actions, if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance level of TS required equipment is unchanged, and the required action(s), including the requirement to shut down the reactor, are also unchanged. Only the CTs for the required actions are extended by the RICT program.

The NRC staff reviewed the licensees PRA methods and models to determine if they are technically acceptable for use in the proposed risk-informed CT extensions. The NRC staff also reviewed the licensees proposed RICT program to determine if it provides the necessary administrative controls to permit CT extensions.

3.1 Review of Key Principles RG 1.177, Revision 1, and RG 1.174, Revision 3, identify five key safety principles to be applied to risk-informed changes to the TSs. Each of these principles is addressed in NEI 06-09-A.

The NRC staffs evaluation of the licensees proposed use of RICTs against these key safety principles is discussed below.

3.1.1 Key Principle 1: Evaluation of Compliance with Current Regulations As stated in 10 CFR 50.36(c)(2)(i):

Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall

shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

When the necessary redundancy is not maintained (e.g., one train of a two-train system is inoperable), the TSs permit a limited period of time to restore the inoperable train to operable status and/or take other remedial measures. If these actions are not completed within the CT, the TSs normally require that the plant exit the mode of applicability for the LCO. With one train of a two-train system inoperable, the TS safety function is accomplished by the remaining operable train. In the current TSs, the CT is specified as a fixed time period (termed the front stop). The addition of the option to determine the CT in accordance with the RICT program would allow an evaluation to determine a configuration-specific CT. The evaluation would be done in accordance with the methodology prescribed in NEI 06-09-A, and TS 6.8.4.m. The RICT is limited to a maximum of 30 days (termed the back stop). The CTs in the current TSs were established using experiential data, risk insights, and engineering judgment. The RICT program provides the necessary administrative controls to permit extension of CTs, and thereby delay reactor shutdown or required actions, if risk is assessed and managed appropriately within specified limits and programmatic requirements.

When the necessary redundancy is not maintained, and the system loses the capability to perform its safety function(s) without any further failures (e.g., two trains of a two-train system are inoperable), the plant must exit the mode of applicability for the LCO or take remedial actions, as specified in the TSs. A configuration-specific RICT may not be used in this condition. With the incorporation of the RICT program, the required performance levels of equipment specified in LCOs are not changed. Only the required CT for the required actions is modified by the RICT program.

3.1.1.1 Key Principle 1 Conclusions Based on the discussion provided above, the NRC staff finds that the proposed changes meet the first key safety principle of RG 1.174, Revision 3, and RG 1.177, Revision 1.

3.1.2 Key Principle 2: Evaluation of Defense in Depth Defense in depth is an approach to designing and operating nuclear facilities that prevents and mitigates accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon.

Defense in depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures.

As discussed throughout RG 1.174, consistency with the defense-in-depth philosophy is maintained by the following measures:

Preserve a reasonable balance among the layers of defense.

Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

Preserve adequate defense against potential CCFs.

Maintain multiple fission product barriers.

Preserve sufficient defense against human errors.

Continue to meet the intent of the plants design criteria.

The proposed change represents a robust technical approach that preserves a reasonable balance among redundant and diverse key safety functions that provides avoidance of core damage, avoidance of containment failure, and consequence mitigation. The three-tiered approach to risk-informed TS CT changes provides additional assurance that defense in depth will not be significantly impacted by such changes to the licensing basis. The licensee is proposing no changes to the design of the plant or any operating parameter, no new operating configurations, and no new changes to the design basis in the proposed changes to the TSs.

The effect of the proposed changes when implemented will be that the RICT program will allow CTs to vary based on the risk significance of the given plant configuration (i.e., the equipment out of service at any given time), provided that the system(s) retain(s) the capability to perform the applicable safety function(s) without any further failures (e.g., one train of a two-train system is inoperable). A configuration-specific RICT may not be used if the system has lost the capability to perform its safety function(s). These restrictions on inoperability of all required trains of a system ensure that consistency with the defense-in-depth philosophy is maintained by following existing guidance when the capability to perform TS safety function(s) is lost.

The proposed RICT program uses plant-specific operating experience for component reliability and availability data. Thus, the allowances permitted by the RICT program are directly reflective of actual component performance in conjunction with component risk significance. In some cases, the RICT program may use compensatory actions to reduce calculated risk in some configurations. Where credited in the PRA, these actions are incorporated into station procedures or work instructions and have been modeled using appropriate human reliability considerations. The increased use of compensatory measures potentially degrades defense in depth through increased reliance on programmatic activities as compensatory measures. The acceptability of potential degradation of defense in depth is discussed below for the applicable TS changes. Application of the RICT program determines the risk significance of plant configurations. It also permits the operator to identify the equipment that has the greatest effect on the existing configuration risk. With this information, the operator can manage the out-of-service duration and determine the consequences of removing additional equipment from service.

The application of the RICT program places high value on key safety functions and works to ensure they remain a top priority over all plant conditions. The RICT will be applied to extend CTs on key electrical power distribution systems. Failures in electrical power distribution systems can simultaneously affect multiple safety functions; therefore, potential degradation to defense in depth during the extended CTs is discussed further below.

3.1.2.1 Use of Compensatory Measures to Retain Defense in Depth Application of the RICT program provides a structure to assist the operator in identifying effective compensatory actions for various plant maintenance configurations to maintain and manage acceptable risk levels. NEI 06-09-A, addresses potential compensatory actions and risk management action (RMA) measures by stating, in generic terms, that compensatory measures may include but are not limited to the following:

Reduce the duration of risk-sensitive activities.

Remove risk-sensitive activities from the planned work scope.

Reschedule work activities to avoid high risk-sensitive equipment outages or maintenance states that result in high-risk plant configurations.

Accelerate the restoration of out-of-service equipment.

Determine and establish the safest plant configuration.

NEI 06-09-A requires that compensatory measures be initiated when the PRA calculated RMA time (RMAT) is exceeded, or for preplanned maintenance for which the RMAT is expected to be exceeded, RMAs shall be implemented at the earliest appropriate time.

The staff evaluated defense in depth as described above for all TS conditions in the scope of the RICT program. For select LCO conditions a detailed evaluation of defense in depth is provided in Sections 3.1.2.2 through 3.1.2.6 below.

3.1.2.2 Evaluation of Electrical Power Systems 3.1.2.2.1 Electrical System Description The offsite power system for Limerick is provided with preferred power from the offsite system through two physically independent and redundant sources of power in accordance with 10 CFR Part 50, Appendix A, GDC 17. Offsite power is supplied to 230 kilovolt (kV) and 500 kV switchyards from the transmission network. In addition to the two offsite sources described above, a third offsite source is available from the 66 kV distribution system to supply power to the engineered safeguard loads. This source can be connected to the safeguard buses within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months if there is a loss of one of the two offsite sources or of one of the safeguard transformers.

The onsite Class 1E alternating current (AC) distribution system for each unit is divided into four load groups (i.e., the Class 1E AC power system for each unit is divided into Divisions A, B, C, and D) so that the loss of any one group does not prevent the minimum safety functions from being performed. Each load group has connections to two offsite power sources and a single diesel generator (DG). Two electrically and physically separated circuits provide AC power, one from each switchyard through either an auxiliary or autotransformer, and then through two safeguards transformers to the 4.16 kV safety buses in both units.

The onsite standby power system includes Class 1E AC and direct current (DC) power supply capability for equipment used to achieve and maintain a cold shutdown of the plant and to mitigate the consequences of a design-basis accident. With regard to the Class 1E AC power,

each of the four (two per division) Class 1E load groups at the 4.16 kV bus level is capable of being powered from an independent DG (one per load group), which functions to provide power in the event of a loss of the preferred (offsite) power source. Undervoltage relays are provided for each 4.16 kV bus to detect an undervoltage condition and automatically start the emergency diesel generator (EDG) in response to such a condition. There are four independent Class 1E DC systems for each unit: two 125/250 V three-wire systems for Divisions I and II and two 125 V two-wire systems for Divisions III and IV. Each 125 V system is comprised of one 125 V battery with its own charger and a fuse box for protection of each of the several 125 V power distribution circuits supplying three 125 V power distribution panels. There is one battery cart that can be connected to bypass defective battery cells in any one of the 125 V systems. The Class 1E DC system supplies Class 1E controls, instrumentation, power, and control inverters.

In the event of a loss-of-coolant accident (LOCA) and/or loss-of-offsite power, the starting of Class 1E electrical loads is controlled by the sequence timers. In the event of a LOCA with preferred (offsite) power available to the 4.16 kV Class 1E bus(es), Class 1E loads are automatically loaded. The associated EDG will be automatically started but not connected to the bus. However, if preferred (offsite) power is lost, EDG(s) automatically start via the DG control circuitry. The sequence timers will function to start the required Class 1E loads in programmed time increments.

The Limerick Updated Final Safety Analysis Report (UFSAR), Chapter 3.1, Conformance with NRC General Design Criteria, design evaluation for electric power systems states:

Either of the two offsite power systems or any three of the four onsite standby DG systems in each unit have sufficient capability to operate safety-related equipment so that specified acceptable fuel design limits and design conditions of the RCPB [reactor coolant pressure boundary] are not exceeded as a result of anticipated operational occurrences and to cool the reactor core and maintain primary containment integrity and other vital functions if there are postulated accidents.

In addition, the Limerick UFSAR, Section 8.1.5.2, Onsite Power System, states:

With the exception of the power supply requirements for the ESW system, the RHRSW system, the SGTS [standby gas treatment system], CSCWS and the control room and control structure ventilation systems, which are common systems, any combination of three-out-of-four divisions of Class 1E power in each unit can shut down the unit safely and maintain it in a safe shutdown condition. Common loads for the ESW and RHRSW systems are split between the Unit 1 and Unit 2 Class 1E power systems. Common redundant loads for the SGTS, CSCWS and the control room and control structure ventilation systems are fed from Unit 1 Class 1E power supplies. Any combination of three-out-of-four divisions (EDGs) is acceptable for a single failure. However, for ECCS requirements (as stated in paragraph 6.3.1.1.2), an EDG operable configuration of 2 out of 4 is also acceptable.

The Limerick UFSAR states that the plant is designed such that the safety functions are maintained assuming a single failure within the electrical power system. By incorporating an electrical power supply perspective, this concept is further reflected in several principal design criteria. Single-failure requirements are typically suspended for the time that a plant is not meeting LCOs (i.e., in an action statement).

3.1.2.2.2 Technical Evaluation The licensee has requested to use the RICT program to extend the existing Limerick, Units 1 and 2, CTs for TS 3.8, Electrical Power Systems, conditions. The NRC staff reviewed information pertaining to the proposed electrical power systems TS conditions in the application, the Limerick UFSAR, and applicable TS LCOs to verify the capability of the affected electrical power systems to perform their safety functions (assuming no additional failures) is maintained.

To achieve that objective, the staff verified whether each proposed TS conditions design-success criteria reflects the redundant or absolute minimum electrical power source/subsystem required to be operable by the LCOs to support the safety functions necessary to mitigate postulated design-basis accidents (DBAs), safely shut down the reactor, and maintain the reactor in a safe shutdown condition. The NRC staff further reviewed the remaining credited power source/equipment to verify whether the proposed condition satisfies its design-success criteria. In conjunction with reviewing the remaining credited power source/equipment, the NRC staff considered supplemental electrical power sources/equipment (not necessarily required by the LCOs and can be either safety- or non-safety-related) that are available at Limerick and capable of performing the same safety function of the inoperable electrical power source/equipment. In addition, the NRC staff reviewed the proposed RMA examples for reasonable assurance that these RMAs are appropriate to monitor and control risk for applicable TS conditions.

GDC 17 of Appendix A to 10 CFR Part 50 requirements are reflected, in part, in the electrical power systems TS LCOs, which require redundant electrical power sources/equipment to be operable (in operating modes). When a TS LCO is not met because an electrical power source or equipment required by a TS LCO is inoperable, the TSs require the licensee to follow any remedial actions permitted by the TSs until the LCO can be met or to exit the mode of applicability for the LCO. The current Limerick TSs permit entry in a TS condition to restore the inoperable power source or equipment to operable status within the CT.

During the RICT program entry for the proposed electrical TS conditions, when the LCO is not met due to the inoperable electrical power source or equipment, the redundancy required by the TS LCO (in operating modes), as specified by GDC 17, will not be maintained. Therefore, the NRC staff finds that the requirements of 10 CFR Part 50, Appendix A, GDC 17, are not met temporarily during the RICT program entry for the proposed electrical power systems TS conditions since the redundancy required by the GDC is not maintained. The NRC staff also finds that operating the plant while remedial actions are being taken during the period the redundancy required by the GDC and LCO is not maintained is allowed by 10 CFR 50.36(c)(2), which states: When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

When the necessary redundancy is not maintained (e.g., one train of a two train system is inoperable), the TSs permit a limited period to restore the inoperable train to operable status and/or take other remedial measures. If these actions are not completed within the CT, the TSs normally require that the plant exit the mode of applicability for the LCO. With one train of a two train system inoperable, the TS safety function is accomplished by the remaining operable train.

In the current TSs, the CT is specified as a fixed time. The addition of the option to determine the CT in accordance with the RICT program would allow an evaluation to determine a configuration-specific CT. The evaluation would be done in accordance with the methodology prescribed in NEI-06-09-A and Limerick TS 6.8.4.m. The RICT is limited to a maximum of 30 days and can only be used when there is no TS or PRA loss of function (LOF). The RICT

program provides the necessary administrative controls to permit extension of CTs, and thereby delay reactor shutdown or required actions, if risk is assessed and managed appropriately within specified limits and programmatic requirements.

The licensee has requested to use the RICT program to extend the existing CTs for several TS 3.8, Electrical Power Systems, condition(s). The NRC staffs evaluation of the proposed changes considered several potential plant conditions allowed by the proposed RICTs. The staff also considered the available redundant or diverse means to respond to various plant conditions. In these evaluations, the NRC staff examined the safety significance of different plant conditions resulting in both shorter and longer CTs. Evaluated plant conditions are discussed in more detail below.

In Attachment 4 of the LAR, the licensee identified the following Limerick plant-specific TSs for electrical power systems to be included as part of an RICT program in accordance with TSTF-505, Revision 2:

AC Sources - Operating 3.8.1.1.b Two [required] diesel generators inoperable 3.8.1.1.d One [required] offsite circuit inoperable 3.8.1.1.e.1 For two train systems, with one or more diesel generators inoperable 3.8.1.1.f One [required] offsite circuit inoperable 3.8.1.1.g Two [required] offsite circuits inoperable 3.8.1.1.h One offsite circuit and two diesel generators inoperable 3.8.1.1.b Footnote

Two diesel generators inoperable during RHRSW subsystem piping repairs 3.8.1.1.e.1 Footnote

For two train systems, with one or more diesel generators inoperable during RHRSW subsystem piping repairs DC Sources - Operating 3.8.2.1.a.3 One or two battery charters on one division inoperable 3.8.2.1.c One or two batteries on one division inoperable Distribution Systems - Operating 3.8.3.1.a One or more AC electrical power distribution subsystems inoperable 3.8.3.1.b One required DC distribution system division not energized In Section 2.3 of the LAR, the licensee listed the following plant-specific electrical power system LCOs and associated actions for which Limerick is proposing to apply the RICT program, which are variations from TSTF-505. The licensee stated these were recognized as acceptable variations in TSTF-505 and the NRC staffs model SE.

TS 3.8.1.1.b, Footnote * - AC Sources - Operating; Two DGs inoperable during RHRSW subsystem piping repair.

TS 3.8.1.1.e.1 - AC Sources - Operating; Two train systems, with one or more DGs inoperable.

TS 3.8.1.1.e.1, Footnote * - AC Sources - Operating; Two train systems, with one or more DGs inoperable during RHRSW subsystem piping repairs.

TS 3.8.1.1.h - AC Sources - Operating; One offsite circuit and two DGs inoperable.

In addition, the NRC staff reviewed Table E1-1 provided in Enclosure 1 of the LAR for each electrical power system TS LCO condition to which the RICT program is proposed to be applied and information regarding the TSs such as proposed TS LCO condition, SSCs covered by TS LCO condition, SSCs modeled in PRA, function covered by TS LCO condition, design-success criteria, and PRA success criteria.

The staff also reviewed the Limerick plant-specific TSs for electrical power systems to be included as part of the RICT program in accordance with TSTF-505, Revision 2. The TSTF-505, Revision 2, model SE states that application of the RICT program requires that there is no TS LOF conditions. The staff noted that any three of the four onsite standby DG systems in Limerick, Units 1 and 2, are required to meet the design functions as stated in the Limerick UFSAR, Sections 3.1 and 8.1.5.2 (i.e., no LOF).

By letter dated August 12, 2019 (Reference [3]), the licensee provided revisions to the proposed changes identified in the original LAR. In its letter, the licensee stated that upon further evaluation, it concluded that the following TS actions represent an LOF condition:

3.8.1.1.b Two [required] DGs inoperable 3.8.1.1.e.1 For two trains systems, with one or more DGs inoperable 3.8.1.1.h One offsite circuit and two DGs inoperable As a result, application of an RICT was removed from these TS LCO conditions.

In its August 12, 2019 letter, the licensee provided the following information to confirm that the proposed changes to TS footnotes 3.8.1.1.b* and 3.8.1.1.e.1* do not represent an LOF condition:

These footnotes are specific to the extended time when Residual Heat Removal Service Water (RHRSW) system piping repairs are being performed in accordance with TS LCO 3.7.1.1. To allow for the RHRSW system piping repairs, the 72-hour allowed outage time for two inoperable DGs (per unit) may be extended to 7 days consistent with TS 3.7.1.1, Actions a.3.a or a.3.b, as described in the footnote. This extension was approved by the NRC in Amendment Nos. 203 and 165 for LGS, Units 1 and 2, respectively (Reference EEOB RAI-01.1).

Under this circumstance, the remaining two EDGs per unit are required to be operable and protected by TS LCO 3.7.1.1, Action a.3.a or a.3.b, whichever is applicable depending on the loop of RHRSW piping being repaired. For TS 3.8.1.1.e, for two train systems, because of the protective actions required by TS LCO 3.7.1.1, Actions a.3.a or a.3.b, the EDG for at least one of the two trains will be operable and protected.

In addition, during the RHRSW system piping repairs, two EDGs per unit are administratively declared inoperable because their associated ESW loop, which provides cooling water support for the EDGs, is administratively declared inoperable to address a postulated passive piping failure in the one remaining operable RHRSW system return header (which provides the return path for the ESW loop) while the other RHRSW system return header is out of service for repair. This does not meet the redundancy and separation requirements in GDC 44 but does not constitute a loss of function.

As documented in the NRC safety evaluation for Amendment Nos. 203 and 165, The ESW loop that is administratively inoperable will, however, remain aligned for automatic initiation and will be capable of performing its intended design function. Therefore, since the ESW loop that functions as cooling water support for the administratively inoperable EDGs (two per unit) is fully functional, and the other EDGs (two per unit) are protected and operable, both ESW loops and all eight Limerick EDGs are fully capable of performing their safety function during the RHRSW system repairs. Therefore, footnotes 3.8.1.1.b* and 3.8.1.1.e.1*, do not constitute a loss of function.

Therefore, the NRC staff finds that the TS markups provided in Attachment 2 of the supplement dated August 12, 2019, are consistent with the guidance provided in TSTF 505, Revision 2.

Based on the above, the staff finds that that the footnotes for TSs 3.8.1.1.b* and 3.8.1.1.e.1* do not constitute an LOF because the ESW loop that functions as cooling water support for the administratively inoperable EDGs (two per unit) is fully functional and is fully capable of performing its safety function during the RHRSW system repairs.

The Limerick UFSAR, Section 8.3.1.1.3, Standby Power Supply, states: Common loads for the ESW and the RHRSW systems are split between Unit 1 and Unit 2 standby power supplies.

Common redundant loads for the SGTS, the CSCWS and the control room and control structure ventilation systems are fed from Unit 1 standby power supplies. The staff notes that TS LCO 3.8.1.1b identifies only four DGs to be operable in each unit during operational Modes 1, 2, and 3 (unitized). The LCO does not identify the minimum number of diesels to be operable from the opposite unit in accordance with 10 CFR 50.36 to meet design-basis safety functions of systems that are shared between two units. Therefore, the staff requested the licensee to explain how the RICT calculations considered minimum required DGs as discussed in the Limerick UFSAR, Sections 3.1, 8.1.5.2, 8.3.1.1.3, and required actions of each unit.

In its letter dated August 12, 2019, the licensee stated:

The ESW and RHRSW systems common equipment and unitized power supplies are modeled in the PRA by including the required power supplies regardless of the unit designation of the power supply. For example, the ESW system has four pumps, A through D. The A and B pumps are powered by Unit 1, Division 1 and 2 4KV buses and associated EDGs. The C and D ESW pumps are powered by the Unit 2, Division 3 and 4 4KV buses and associated EDGs. In each unit specific PRA model, the four buses and EDGs (two from Unit 1 and two from Unit 2) are included explicitly in the PRA model for the ESW pumps. The basic event naming is consistent between both unit models. When one of these buses or EDGs is removed from service, the impact is evaluated for both units online risk and RICT calculations.

For ESW and RHRSW, in the plant system section (3/4.7) of the Technical Specifications, the pairing of pumps and associated diesel generators is explicitly addressed using the concept of a pump-diesel pair (TS 3.7.1.1.a.5, 6, and 7, and 3.7.1.2.a.4 and 5). This associates the pump and diesel regardless of the unit source of the diesel. For those Completion Times included in the scope of the RICT program, the minimum number of diesels required for these systems is addressed by the RICT program, the Technical Specifications and the PRA models.

The Control Enclosure Cooling Water (CECW) system (identified as the CSCWS in the RAI), and control room ventilation are not included in the scope of the RICT program. However, they are addressed under the Action statement in TS Section 3.8.1.1.e regarding two-train systems.

The SGTS also falls under the TS Section 3.8.1.1.e two-train Action statement.

In addition, for Unit 2, the SGTS Technical Specifications explicitly address the inoperability of the Unit 1 diesels for the common SGTS system (Unit 2 TS 3.6.5.3.a.1, 3, and 4) and the Unit 2 Control Room Emergency Fresh Air System (CREFAS) TS addresses inoperability of the Unit 1 diesel power supplies (Unit 2 TS 3.7.2.a.1, 3, and 4). Note that the CREFAS TS was not included in the TSTF in response to the APLA RAI-10 and STSB RAI-1.

The NRC staff determined that the pairing of pumps and associated DGs is explicitly addressed using the concept of a pump-diesel pair in TS 3.7 (TS 3.7.1.1.a.5, 6, and 7, and TS 3.7.1.2.a.4 and 5), and the RICT calculations appropriately considered minimum required DGs required from each unit for common loads. Therefore, the staffs concern is resolved.

The staff noted that Limerick TS LCOs identify one or more conditions for which the LCO may not be met to permit a licensee to perform required testing, maintenance, or repair activities.

Each condition has an associated required action for restoration of the LCO or for other actions, each with some fixed time interval, referred to as the CT. The CT identifies the time interval permitted to complete the required action. Upon expiration of the CT, the licensee is required to shut down the reactor or follow the remedial action(s) stated in the TSs. The RICT program is a risk-informed program that provides the necessary administrative controls to permit extension of CTs, and thereby delay reactor shutdown or remedial actions, if risk is assessed and managed within specified limits and programmatic requirements.

The licensee proposed the addition of TS 6.8.4.m, Risk Informed Completion Time Program, to TS Section 6, Administrative Controls. This section states that the RICT program provides controls to calculate an RICT and must be implemented in accordance with NEI 06-09-A, and the RICT may not exceed 30 days. Therefore, the licensee may have up to 30 days to restore the inoperable electrical power system train or channel equipment while the plant is in operational Modes 1, 2, and 3. The staff reviewed LAR Table E1-2, In Scope TS/LCO Conditions RICT Estimate, and determined that electrical systems RICT estimate does not exceed 30 days.

In addition, the staff noted that when one or more trains (subsystem) in electrical systems become inoperable, either from a failure of equipment or from a voluntary action, an LCO will not be met, and the appropriate TS conditions must be identified and entered by the licensee.

Single failure requirements, surveillance, and maintenance requirements of the redundant trains are typically suspended for the time that a plant is not meeting an LCO for preserving the safety function of an electrical system (i.e., in an action statement). This could introduce unmonitored

failures of redundant components and potential challenge to reliability assumptions for the remaining operable train or channel(s). When an LCO of an electrical system cannot be met at the train level or the subsystem level, it results in a temporary reduction in defense in depth and safety margins (redundancy, capacity, capability, single failure, and testability are reduced) because less equipment is available to fulfill the safety functions until the inoperable train or channel is restored. In addition, the current requirements must be relaxed further from the previously approved CT(s) specified in Limerick TS Section 3.8 LCO and required actions, as discussed above, for up to 30 days.

The NRC staff reviewed information pertaining to the proposed electrical power systems TS conditions in the application, the Limerick UFSAR, and applicable TS LCO and TS Bases to verify the capability of the affected electrical power systems to perform their safety functions (assuming no additional failures) is maintained. To achieve that objective, the staff verified whether each proposed TS condition design-success criteria reflects the redundant or absolute minimum electrical power source/subsystem required to be operable by the LCOs to support the safety functions necessary to mitigate postulated DBAs, safely shut down the reactor, and maintain the reactor in a safe shutdown condition. The staff noted that with both required offsite circuits inoperable, sufficient onsite AC power sources are available to maintain Limerick, Units 1 and 2, in a safe shutdown condition in the event of a DBA or transient. In addition, the staff noted that a third offsite source is available from the 33 kV distribution system to supply power to the engineered safeguard loads. This source can be connected to the safeguard buses within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months if there is a loss of both Limerick offsite power sources.

The staff reviewed Enclosure 12 of the LAR, which describes the process for identification and implementation of RMAs applicable during extended CTs and provides examples of RMAs.

RMAs are governed by plant procedures for planning and scheduling maintenance activities.

The licensee states that procedures will provide guidance for the determination and implementation of RMAs when entering the RICT program consistent with the guidance provided in NEI 06-09-A. The licensee stated in its letter dated August 12, 2019, that the following RMAs are taken for inoperable offsite circuit(s) conditions (TS Condition 3.8.1.1.f, one offsite source inoperable and TS Condition 3.8.1.1.g, two offsite circuits inoperable):

1. Actions to increase risk awareness and control.

Briefing of the on-shift operations crew concerning the unit activities, including any compensatory measures established, and review of the appropriate emergency operating procedures for a Loss of Offsite Power and station blackout including bus crossties.

Notification of the TSO [Transmission System Operator] of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Proactive implementation of RMAs during times of high grid stress conditions prior to reaching the RMAT, such as during high demand conditions.

2. Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase.

Evaluation of weather conditions for threats to the reliability of remaining offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.

Protection of the remaining offsite source, including switchyard and transformer.

Walkdown of operable switchyard for potential wind driven missiles.

Deferral of planned maintenance or testing that affects the reliability of DGs and their associated support equipment which affect common system availability. Treat the remaining offsite source as protected equipment.

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected offsite source.

Additional actions would be as follows:

Maximize and protect the remaining capability of the offsite sources.

Protection of all DGs from both Units.

Protection of HPCI and RCIC on both Units.

Review of the procedure for cross tying 4kV buses within and between Units.

Review of procedure for powering C and D ESW pumps from Unit 1.

Deferral of activities that could increase the likelihood of a plant trip.

If feasible based on the configuration, connection of the non-Tech Spec 66kV offsite source as an incoming power supply.

The NRC staff notes that the Limerick protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation. In addition, the actions specified above would provide additional assurance of the availability of the remaining equipment and adequate defense in depth. The NRC staff finds that the examples of the RMAs associated with inoperable offsite circuit(s) are reasonable.

Based on the NRC staffs review of the information provided in the LAR, the staff determined that the compensatory measures or RMAs for maintaining operability of the remaining train or channel(s) are reasonable and consistent with the guidance provided in NEI 06-09-A and TSTF-505, Revision 2. The staff also determined that at least one operable train (subsystem) is available to support the safety function(s) of an onsite electrical power system and offsite electric power subsystem to permit functioning of SSCs important to safety. The staff recognizes that plant operation for up to 30 days with reduced operable electrical power system is vulnerable to single failures and random failures, while operating outside its original design-basis requirements (i.e., reduced defense in depth, safety margins, and relaxation of NRC requirements). The NRC staff finds that the CT extensions in accordance with the RICT program are acceptable because (a) the capability of the systems to perform their safety

functions (assuming no additional failures) is maintained, and (b) the licensees demonstration of identifying and implementing compensatory measures or RMAs, as discussed in accordance with the RICT program, is appropriate to monitor and control risk.

3.1.2.2.3 Evaluation of Electrical Power Systems Conclusion The NRC staff has determined that the application of an RICT for the Limerick plant-specific electrical power systems LCOs is consistent with TSTF-505, Revision 2, and with the NRCs model SE dated November 21, 2018. Application of an RICT for these plant-specific LCOs will be controlled under the RICT program. The RICT program provides the necessary administrative controls to permit extension of CTs, and thereby delay reactor shutdown or remedial actions, if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance levels of TS required SSCs are unchanged, and the remedial actions, including the requirement to shut down the reactor, are also unchanged. Only the action AOTs are extended by the RICT program.

The NRC staff determined that the proposed change is consistent with 10 CFR 50.36(c)(2) because the lowest functional capability or performance levels of equipment required for safety is maintained. Therefore, the NRC staff concludes that the proposed change is acceptable.

3.1.2.3 Evaluation of I&C Systems In Attachment 2 of the LAR, the licensee, in part, proposes changes to the following:

the CTs of I&C functions pertaining to the RPS instrumentation as summarized in TS Table 3.3.1-1 the isolation actuation instrumentation as summarized in TS Table 3.3.2-1 the ECCS actuation instrumentation as summarized in TS Table 3.3.3-1 the recirculation pump trip (RPT) actuation instrumentation/ATWS recirculation pump trip (ATWS-RPT) system instrumentation as summarized in TS Table 3.3.4.1-1 the end-of-cycle recirculation pump trip (EOC-RPT) system instrumentation as summarized in TS Table 3.3.4.2-1 the reactor core isolation cooling (RCIC) system actuation instrumentation as summarized in TS Table 3.3.5-1 the feedwater/main turbine trip system actuation instrumentation as summarized in TS Table 3.3.9-1 These changes were proposed for Limerick, Units 1 and 2. The analyses and conclusions presented in this SE apply to both units.

The Limerick UFSAR, Chapter 7.1.1.2, Identification of Individual Systems, briefly describes each I&C system, including those associated with proposed TS changes.

The NRC staff followed the guidance in RG 1.174 and further elaborated in RG 1.177 to assess the proposed changes consistency with defense-in-depth criteria. The applicable criteria to the affected I&C systems are:

System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system (e.g., there are no risk outliers).

Defenses against potential common-cause failures (CCFs) are maintained and the potential for the introduction of new CCF mechanisms is assessed.

The intent of the plants design criteria is maintained.

The licensee confirmed, and NRC staff verified, that, in accordance with the Limerick UFSAR, in all applicable operating modes, the affected protective feature would perform its intended function by ensuring the ability to detect and mitigate the associated event or accident when the CT of a channel is extended. Therefore, the NRC staff concludes that the intent of the plants design criteria for the I&C functions identified in the amendments are maintained.

The NRC staff finds that while in an LCO condition, the redundancy of the function will be temporarily relaxed, and consequently, the system reliability will be degraded accordingly. The NRC staff examined the design information from the Limerick UFSAR and the risk-informed LCO conditions for the affected I&C functions. Based on this information, the NRC staff confirmed that under any given DBA evaluated in the Limerick UFSAR, the affected I&C protective features maintains adequate defense in depth by either necessary redundancy (e.g.,

at least one redundant channel) and/or necessary diversity (e.g., at least one alternative safety features).

The licensee confirmed in the LAR that the proposed changes do not alter the Limerick I&C system designs. Consequently, the NRC staff concludes that the proposed changes do not alter the ways in which the I&C systems fail, do not introduce new CCF modes, and the system independence is maintained. The NRC staff finds that while some proposed changes reduce the level of redundancy of the affected I&C systems, this reduction may reduce the level of defense against some CCFs; however, the NRC staff finds, as described below, such reduction in redundancy and defense against CCFs are acceptable due to existing diverse means available to maintain adequate defense in depth against a potential single failure during an RICT for the I&C systems.

The following sections summarize the NRC staffs SE with respect to the defense-in-depth principle for the functions identified in the LAR by identifying associated diverse means that maintain adequate defense in depth against potential single failure during an RICT for the Limerick I&C systems.

3.1.2.3.1 TS 3/4.3.1, Reactor Protection System Instrumentation LCO 3.3.1 requires that:

As a minimum, the reactor protection system instrumentation channels shown in Table 3.3.1-1 shall be OPERABLE with the REACTOR PROTECTION SYSTEM RESPONSE TIME as shown in Table 3.3.1-2.

As described in the Limerick UFSAR, Section 7.2, Reactor Trip System (Reactor Protection System) - Instrumentation and Controls, the RPS is made up of two independent trip systems, which are designated A and B. There are usually four channels to monitor each parameter with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic so that either channel will trip that trip system. The tripping of both trip systems will produce a reactor scram.

The proposed RICT program modifies the following three actions. The changed portion is indicated in italics.

ACTION a. With the number of OPERABLE channels in either trip system for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, within one hour, or in accordance with the Risk Informed Completion Time Program***, for each affected functional unit either verify that at least one* channel in each trip system is OPERABLE or tripped or that the trip system is tripped, or place either the affected trip system or at least one inoperable channel in the affected trip system in the tripped condition.

ACTION b. With the number of OPERABLE channels in either trip system less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(s) or the affected trip system** in the tripped conditions within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program***.

ACTION c. With the number of OPERABLE channels in both trip systems for one or more Functional Units less than the Minimum OPERABLE Channels per Trip System required by Table 3.3.1-1, place either the inoperable channel(s) in one trip system or one trip system in the tripped condition within 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s*** or in accordance with the Risk Informed Completion Time Program***.

The Footnote *** Not applicable when trip capability is not maintained for one or more Functional Units excludes the application of an RICT program to the LOF situations under conditions specified by Actions a, b, and c.

Per the LAR supplement dated August 12, 2019 (Reference [2]), Attachment 3, Limerick RPS SCRAM Instrumentation TS Table 3.3.1-1 Diversity, and Limerick RPS Scram Instrumentation UFSAR References & Trip Functions, the licensee confirmed, and the staff verified, that for each risk-informed individual functional unit functional unit in TS Table 3.3.1-1, for every Chapter 15 DBA that this affected functional unit is credited for, there is at least one diverse means available.

The NRC staff concludes that the proposed RICTs for TS 3/4.3.1 maintain the RPS trip capabilities. The proposed changes are consistent with the defense-in-depth principle and with the TSTF-505, Revision 2, model application, and are, therefore, acceptable.

3.1.2.3.2 TS 3/4.3.2, Isolation Actuation Instrumentation LCO 3.3.2 requires that:

The isolation actuation instrumentation channels shown in Table 3.3.2-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.2.-2 and with ISOLATION SYSTEM RESPONSE TIME as shown in Table 3.3.2-3.

The isolation actuation instrumentation initiates closure of various automatic isolation valves if monitored system variables exceed pre-established limits. In accordance with the Limerick UFSAR, Chapter 7, and LAR Attachment 5, Information Supporting Instrumentation

Redundancy and Diversity (Reference [1]), the isolation trip logics include one-out-of-two taken twice, two-out-of-two taken once, and one-out-of-one taken once.

The proposed RICT program modifies the following actions. The changed portion is indicated in italics.

ACTION b) With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirements for one trip system:

1. If placing the inoperable channel(s) in the tripped condition would cause an isolation, the inoperable channel(s) shall be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , or in accordance with the Risk Informed Completion Time Program**#. If this cannot be accomplished, the ACTION required by Table 3.3.2-1 for the affected trip function shall be taken, or the channel shall be placed in the tripped condition.

or

2. If placing the inoperable channel(s) in the tripped condition would not cause an isolation, the inoperable channel(s) and/or that trip system shall be placed in the tripped condition within:

a) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program**# for trip functions common*

to RPS Instrumentation.

b) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program**# for trip functions not common* to RPS Instrumentation.

The footnote **#Not applicable when trip capability is not maintained. excludes the application of an RICT program to the LOF situations under conditions specified by the affected actions.

In Attachment 3, Limerick Isolation Actuation Instrumentation TS Table 3.3.2-1 Diversity Table, attached to response to EICB RAI-1 (Reference [3]), the licensee confirmed, and the staff verified, that for each risk-informed individual trip function in TS Table 3.3.2-1, for every Chapter 15, DBA that this affected trip function is credited for, there is at least one diverse means available.

The NRC staff concludes that the proposed RICTs for TS 3/4.3.2 maintain the isolation trip capabilities. The proposed changes are consistent with the defense-in-depth principle and with the TSTF-505, Revision 2, model application, and are, therefore, acceptable.

3.1.2.3.3 TS 3/4.3.3, Emergency Core Cooling System Actuation Instrumentation LCO 3.3.3 requires that:

The emergency core cooling system (ECCS) actuation instrumentation channels shown in Table 3.3.3-1 shall be OPERABLE with their trip setpoints set

consistent with the values shown in the Trip Setpoint column of Table 3.3.3-2 and with Emergency Core Cooling System Response Time as shown in Table 3.3.3-3.

The purpose of ECCS actuation instrumentation is to initiate appropriate responses from the system to ensure that the fuel is adequately cooled if there is a DBA. In accordance with the Limerick UFSAR, Chapter 7.3.1.1.1, Emergency Core Cooling Systems - Instrumentation and Controls, the ECCS is a network of the HPCI, ADS, CSS), and LPCI model of the residual heat removal (RHR) system. The ECCS trip logics include one-out-of-two taken twice and two-out-of-two taken once.

The proposed RICT program modifies the following actions. The changed portion is indicated in italics.

ACTION c. With either ADS trip system subsystem inoperable, restore the inoperable trip system to OPERABLE status within:

1. 7 days, or in accordance with the Risk Informed Completion Time Program, provided that the HPCI and RCIC systems are OPERABLE.

2. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program.

Otherwise, be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to less than or equal to 100 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION 30 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program, or declare the associated system inoperable.

ACTION 33 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program *, or declare the associated ECCS inoperable.

ACTION 34 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

b. For one channel inoperable, place the inoperable channel in

the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program, or declare the HPCI system inoperable.

ACTION 35 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program*, or declare the HPCI system inoperable.

In accordance with the Limerick UFSAR, Chapter 7, and LAR Attachment 5, Information Supporting Instrumentation Redundancy and Diversity (Reference [1]), the ADS instrumentation consists of two channels, two trip systems arranged in a two-out-of-two taken once. Given Actions c.1 and c.2 one trip system is inoperable. The taken once logic only requires one trip system to initiate the ADS; therefore, these actions do not include the LOF conditions.

Given Actions 30.a and 33.c, only one channel becomes inoperable for one-out-of-two taken twice logic, both one-out-of-two coincidences function and the trip capability maintains; for two-out-of-two taken once logic, this inoperable channel causes one trip system inoperable, but the trip capability still maintains as only one trip system is required. The footnote ***Not applicable when trip capability is not maintained for one or more Functional Units excludes the application of an RICT program to the LOF situations under conditions specified by the affected Actions 33 and 35.

Under any of the above conditions, the redundancy degrades, but the affected function remains operable.

In Attachment 3, Limerick Emergency Core Cooling System Actuation Instrumentation TS Table 3.3.3-1 Diversity Table, attached to the response to EICB RAI-1 (Reference [3]), the licensee confirmed, and the staff verified, that for each risk-informed individual trip function in TS Table 3.3.3-1, for every Chapter 15 DBA that this affected trip function is credited for, there is at least one diverse means available.

The NRC staff concludes that the proposed RICTs for TS 3/4.3.3 maintain the ECCS trip capabilities. The proposed changes are consistent with the defense-in-depth principle and with the TSTF-505, Revision 2, model application, and are, therefore, acceptable.

3.1.2.3.4 TS 3/4.3.3, Recirculation Pump Trip Actuation Instrumentation ATWS Recirculation Pump Trip System Instrumentation LCO 3.3.4.1 requires that:

The anticipated transient without scram recirculation pump trip (ATWS-RPT) system instrumentation channels shown in Table 3.3.4.1-1 shall be OPERABLE with their trip setpoints set consistent with values shown in the Trip Setpoint column of Table 3.3.4.1-2.

In accordance with the Limerick UFSAR, Chapter 7.2.3.1.4, Recirculation Pump Trip Breakers, the ATWS-RPT is designed to lessen the effects of an ATWS event, and quickly reduce reactor

power to within SRV capacity, by tripping the recirculation pumps, which rapidly adds negative reactivity due to a sudden increase in steam voiding in the core area as core flow decreases.

The proposed RICT program modifies the following actions. The changed portion is indicated in italics.

ACTION b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel(s) in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program*.

ACTION c. With the number of OPERABLE channels two or more less than required by the Minimum OPERABLE Channels per Trip System requirement for one trip system and:

1. If the inoperable channels consist of one reactor vessel water level channel and one reactor vessel pressure channel, place both inoperable channels in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program, or, if this action will initiate a pump trip, declare the trip system inoperable.

ACTION d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

In accordance with the Limerick UFSAR, Chapter 7, and LAR Attachment 5, Information Supporting Instrumentation Redundancy and Diversity (Reference [1]), the ATWS-RPT is arranged in a two-out-of-two taken once logic. The licensee confirmed, and the NRC staff verified, that the trip capability is maintained under the conditions for Actions b, c.1, and d due to:

Under Action b, the footnote *Not applicable when trip capability is not maintained.

excludes the application of the RICT program to the LOF situations. The trip capability is, therefore, maintained under Action b.

Under Action c.1, with the number of operable channels two or more less than required by the minimum operable channels per trip system requirement for one trip system, this trip system does not satisfy the two-out-of-two coincidence. Thus, this trip system is inoperable. Since the ATWS-RPT trip logic is taken once, the other trip system can maintain the trip capability. Consequently, the trip capability is maintained under Action c.1.

Under Action d, with one trip system inoperable, the other trip system can maintain the trip capability. Consequently, the trip capability is maintained under Action d.

Under any of the above conditions, the redundancy degrades, but the affected function remains operable.

In Attachment 3, Limerick Recirculation Pump Trip Actuation Instrumentation TS Tables 3.3.4 Diversity Table, attached to response to EICB RAI-1 (Reference [3]), the licensee confirmed, and the staff verified, that for each risk-informed individual trip function in TS Table 3.3.4.1-1, for every Chapter 15 DBA that this affected trip function is credited for, there is at least one diverse means available.

LCO 3.3.4.2 requires that:

The end-of-cycle recirculation pump trip (EOC-RPT) system instrumentation channels shown in Table 3.3.4.2-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.4.2-2 and with the END-OF-CYCLE RECIRCULATION PUMP TRIP SYSTEM RESPONSE TIME as shown in Table 3.3.4.2-3.

In accordance with the Limerick UFSAR, Chapter 7.2.3.1.4, Recirculation Pump Trip Breakers, the EOC-RPT provides an automatic rapid trip of the recirculation pumps on a main turbine trip or load rejection, if greater than 30% turbine load.

The proposed RICT program modifies the following actions. The changed portion is indicated in italics.

ACTION b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels per Trip System requirement for one or both trip systems, place the inoperable channel(s) in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program*.

ACTION c. With the number of OPERABLE channels two or more less than required by the Minimum OPERABLE Channels per Trip System requirement for one trip system and:

1. If the inoperable channels consist of one reactor vessel water level channel and one reactor vessel pressure channel, place both inoperable channels in the tripped condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , or in accordance with the Risk Informed Completion Time Program, or, if this action will initiate a pump trip, declare the trip system inoperable.

ACTION d. With one trip system inoperable, restore the inoperable trip system to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

In accordance with the Limerick UFSAR, Chapter 7, and LAR Attachment 5, Information Supporting Instrumentation Redundancy and Diversity (Reference [1]), the EOC-PRT is arranged in a two-out-of-two taken once logic. The licensee confirmed, and the NRC staff verified, that the trip capability is maintained under conditions for Action b, c.1, and d, due to:

Under Action b, the footnote *Not applicable when trip capability is not maintained.

excludes the application of the RICT program to LOF situations. The trip capability is, therefore, maintained under Action b.

Under Action c.1, with the number of operable channels two or more less than required by the minimum operable channels per trip system requirement for one trip system, this trip system does not satisfy the two-out-of-two coincidence. Thus, this trip system is inoperable. Since the ATWS-RPT trip logic is taken once, the other trip system can maintain the trip capability. Consequently, the trip capability is maintained under Action c.1.

Under Action d, with one trip system inoperable, the other trip system can maintain the trip capability. Consequently, the trip capability is maintained under Action d.

Under any of the above conditions, the redundancy degrades, but the affected function remains operable.

In Attachment 3, Limerick Recirculation Pump Trip Actuation Instrumentation TS Tables 3.3.4 Diversity Table, attached to response to EICB RAI-1 (Reference [3]), the licensee confirmed, and the staff verified, that for each risk-informed individual trip function in TS Table 3.3.4.2-1, for every Chapter 15 DBA that this affected trip function is credited for, there is at least one diverse means available.

The NRC staff concludes that the proposed RICTs for TS 3/4.3.4 maintain the ATWS-RPT and EOC-RPT trip capabilities. The proposed changes are consistent with the defense-in-depth principle and with the TSTF-505, Revision 2, model application, and are, therefore, acceptable.

3.1.2.3.5 TS 3/4.3.5, Reactor Core Isolation Cooling System Actuation Instrumentation LCO 3.3.5 requires that:

The reactor core isolation cooling (RCIC) system actuation instrumentation channels shown in Table 3.3.5-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.5-2.

In accordance with the Limerick UFSAR, Chapter 7.4.1.1, Reactor Core Isolation Cooling System - Instrumentation and Controls, the RCIC is designed to ensure that sufficient reactor water inventory is maintained in the reactor vessel, thus ensuring continuity of core cooling.

The proposed RICT program modifies the following actions. The changed portion is indicated in italics.

ACTION 50 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip Function requirement:

a. With one channel inoperable, place the inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program, or declare the RCIC system inoperable.

ACTION 52 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels per Trip System requirement, place at least one inoperable channel in the tripped condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , or in accordance with the Risk Informed Completion Time Program*, or declare the RCIC system inoperable.

In accordance with the Limerick UFSAR, Chapter 7.4.1.1.3.2, RCIC Initiating Circuits, and the Limerick TS Table 3.3.5-1, the RCIC Functional Unit a, Reactor Vessel Water Level - Low Low, Level 2, is arranged in a one-out-of-two taken twice logic; the RCIC Functional Unit c, Condensate Storage Tank Water Level - Low, is arranged in a one-out-of-two taken once logic.

Per the Limerick TS Table 3.3.5-1, Action 50.a is only applicable to Functional Unit a. With one channel inoperable, the affected trip system still maintains its trip capability due to the one-out-of-two logic.

Per the Limerick TS Table 3.3.5-1, Action 52 is only applicable to the Functional Unit c. With the footnote *Not applicable when trip capability is not maintained, the licensee excludes the application of the RICT program to the LOF conditions for Functional Unit c.

In Attachment 3, Limerick Reactor Core Isolation Cooling System Actuation Instrumentation TS Table 3.3.5-1 Diversity Table, attached to response to EICB RAI-1 (Reference [3]), the licensee confirmed, and the staff verified, that for each risk-informed individual functional unit in TS Table 3.3.5-1, for every Chapter 15 DBA that this affected functional unit is credited for, there is at least one diverse means available.

The NRC staff concludes that the proposed RICTs for TS 3/4.3.5 maintain RCIC trip capabilities. The proposed changes are consistent with the defense-in-depth principle and with the TSTF-505, Revision 2, model application, and are, therefore, acceptable.

3.1.2.3.6 TS 3/4.3.9, Feedwater/Main Turbine Trip System Actuation Instrumentation LCO 3.3.9 requires that:

The feedwater/main turbine trip system actuation instrumentation channels shown in the Table 3.3.9-1 shall be OPERABLE with their trip setpoints set consistent with the values shown in the Trip Setpoint column of Table 3.3.9-2.

In accordance with Limerick TS Table 3.3.9-1, the feedwater/main turbine trip signal is initiated by the Level 8 high reactor vessel water level. In the Limerick UFSAR, Chapter 7.3.1.1.1.1.3, HPCI Initiating Circuits, the licensee confirmed the turbine trip instrumentation is arranged in one-out-of-two taken twice logic.

The proposed RICT program modifies the following actions. The changed portion is indicated in italics.

ACTION b. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 7 days, or in accordance with the Risk Informed Completion Time Program, or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION c. With the number of OPERABLE channels two less than required by the Minimum OPERABLE Channels requirement, restore at least one of the inoperable channels to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or in accordance with the Risk Informed Completion Time Program** or be in at least STARTUP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Under Action b, with the number of operable channels one less than required by the minimum operable channels requirement, the remaining three operable channels maintain the trip Function 1 in Limerick TS Table 3.3.9-1 due to the one-out-of-two taken twice coincidence.

Under ACTION c, with the footnote ** Not applicable when trip capability is not maintained, the licensee excludes the application of the RICT program to the LOF conditions for ACTION c.

In Attachment 3, Limerick Feedwater/Main Turbine Trip System Actuation Instrumentation Table 3.3.9-1 Diversity Table, attached to response to EICB RAI-1 (Reference [3]), the licensee confirmed, and the staff verified, that for each risk-informed individual trip function in TS Table 3.3.9-1, for every Chapter 15 DBA that this affected functional unit is credited for, there is at least one diverse means available.

The NRC staff concludes that the proposed RICTs for TS 3/4.3.9 maintain the feedwater/main turbine trip capabilities. The proposed changes are consistent with the defense-in-depth principle and with the TSTF-505, Revision 2, model application, and are, therefore, acceptable.

3.1.2.3.7 I&C Evaluation Conclusion The NRC staff reviewed the licensees proposed TS changes and supporting documentation.

The staff finds that while the I&C redundancy is reduced, the CT extensions implemented in accordance with the RICT program are acceptable because: (a) the capability of the I&C systems to perform their safety functions is maintained, (b) diverse means to accomplish the safety functions exist, and (c) the licensee will identify and implement RMAs to monitor and control risk in accordance with the RICT program.

3.1.2.4 Evaluation of the Standby Liquid Control System (SLCS)

According to Section 9.3.5.3 of the Limerick UFSAR, the SLCS is a reactivity control system and is maintained in an operable status whenever the reactor is critical. The system is never expected to be needed for safety reasons because of the large number of independent control rods available to shut down the reactor. The SLCS system consists of three separate and independent pumps and explosive valves. Two of the separate and independent pumps and explosive valves are required to meet the minimum requirements of TS 3.1.5 and, where applicable, satisfy the single failure criterion.

The SLCS is also a chemical control system and is required to be operable whenever the potential for a LOCA exists. The addition of sodium pentaborate to the suppression pool

maintains the pool pH at a minimum of 7.0 to minimize iodine releases from primary containment. SLCS pumps sodium pentaborate to the reactor vessel where it is mixed with the reactor coolant, which flows to the suppression pool through the LOCA pipe break. The SLCS addition must occur before 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months following a LOCA to ensure pH is maintained at 7.0 or above.

According to Section 15.8.3.5 of the Limerick UFSAR, the SLCS is automatically actuated by the redundant reactivity control system or manually initiated by an operator in the main control room upon indication of a failure to scram and in accordance with plant operating procedures.

The system is designed to inject sodium pentaborate solution through a core spray (CS) sparger.

The licensee has requested to use the RICT program to extend the existing CT for Action a. of TS 3/4.1.5, Standby Liquid Control System.

LCO 3.1.5 - STANDBY LIQUID CONTROL SYSTEM LCO 3.1.5 requires that the SLCS shall be operable and consist of the following:

a. In OPERATIONAL CONDITIONS 1 and 2, two pumps and corresponding flow paths, ACTION a. With only one pump and corresponding explosive valve OPERABLE, in OPERATIONAL CONDITION 1 or 2, restore one inoperable pump and corresponding explosive valve to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Action statement a. applies only to Operational Conditions 1 and 2 because according to Sections 7.1.2.1.18.1 and 9.5.3.1 of the Limerick UFSAR, a single pump can satisfy both the non-ATWS reactor control function and the post-DBA LOCA function to control suppression pool pH since boron injection is not required until 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months post-LOCA.

The licensee has proposed to apply the RICT for Action statement a., which will read as follows:

With only one pump and corresponding explosive valve OPERABLE, in OPERATIONAL CONDITION 1 or 2, restore one inoperable pump and corresponding explosive valve to OPERABLE status within 7 days or in accordance with Risk Informed Completion Time programs or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

According to Section 9.3.5.1 of the Limerick UFSAR, only one of the three SLCS pumps is needed to meet the design-basis analysis for the SLCS. Therefore, if only one pump and valve are operable, the SLCS system will continue to meet its design basis while the inoperable SLCS pump and/or valve are repaired.

According to Section 9.3.5.1 of the Limerick UFSAR, two pumps are required to meet the requirements of the 10 CFR 50.62 ATWS rule. The simultaneous operation of at least two of the three pumps at full capacity allows adequate margin to control the power production during an ATWS event. Thus, the staff reviewed the licensees proposal to ensure that it would not

impede the safety function of the SLCS with respect to 10 CFR 50.62. To comply with the requirements of 10 CFR 50.62(c)(4), Exelon chose to use two SLCS pump operation for Limerick, Units 1 and 2. By letter dated July 16, 1985 (Reference [17]), the Boiling Water Reactor Owners Group submitted their position on how the ATWS rule impacts TSs. The letter questioned if two SLCS pumps are needed to meet the 10 CFR 50.62(c)(4) requirement - do action statements in the TSs that allow single pump operation require changes. The NRC staffs August 19, 1985 response (Reference [18]), stated that no changes were needed to the TSs since the SLCS is a backup to a highly reliable safety-related system, and there are additional levels of defense in depth. The licensees request to adopt the RICT for the SLCS does not impact the staffs decision regarding the need to update the TSs for the ATWS rule.

The staff determined that implementation of RICT for the SLCS system would not impede its safety function with respect to 10 CFR 50.62 because it would negligibly impact the overall risk to the plant.

The NRC staff concludes that the proposed RICT for one operable SLCS pump and corresponding valves does not impede accomplishing the specific safety functions because only one of the three SLCS pumps is needed to meet the design basis of the Limerick UFSAR Section 9.3.5.1, and, where applicable, satisfies the single failure criterion. The NRC staff finds these changes are consistent with the defense-in-depth philosophy, and are, therefore, acceptable.

3.1.2.5 Evaluation of the Emergency Core Cooling System - Operating Four independent core standby cooling systems are provided to maintain fuel clad temperatures below the limits of 10 CFR 50.46 in the event of a breach in the reactor coolant pressure boundary (RCPB) that results in a loss of reactor coolant. The four core standby cooling systems are as follows:

a. High Pressure Coolant Injection System (HPCI)

The HPCI system provides and maintains an adequate coolant inventory inside the reactor vessel to limit fuel clad temperatures because of postulated small breaks in the RCPB. A high-pressure system is needed for such breaks because the reactor vessel depressurizes slowly, preventing low-pressure systems from injecting coolant. The HPCI system includes a turbine-driven pump powered by reactor steam. The system is designed to accomplish its function on a short-term basis without reliance on plant auxiliary power supplies other than the DC power supply.

The HPCI system is designed to pump water into the reactor vessel for a wide range of pressures in the reactor vessel. The normal alignment of the HPCI system initially injects water from the condensate storage tank instead of water from the suppression pool. An alternate alignment to the suppression pool is also available during periods when the condensate storage tank is not available. This provides reactor grade water to the reactor vessel. Water is pumped into the reactor vessel through a CS sparger and a feedwater sparger; this flow split is provided by the HPCI flow split modification, which is described in Section 15.8.3.7 of the Limerick UFSAR.

b. Automatic Depressurization System (ADS)

The ADS acts to rapidly reduce reactor vessel pressure in a LOCA situation in which the HPCI system fails to maintain reactor vessel water level. The depressurization provided

enables the low-pressure ECCS to deliver cooling water to the reactor vessel. The ADS uses some of the relief valves that are part of the nuclear system pressure relief system.

The automatic relief valves are arranged to open on conditions indicating that both a break in the nuclear system process barrier has occurred, and the HPCI system is not delivering enough cooling water to the reactor vessel to maintain the water level above a preselected value. The ADS will not be activated unless either the CS or the LPCI system is operating.

The ADS uses five of the nuclear system safety relief valves (SRVs) to reduce reactor pressure during small breaks or after containment isolation in the event of HPCI failure.

The SRVs redirect the high-pressure steam to the suppression pool. When the reactor vessel pressure is reduced to within the design of the low-pressure systems (CS and LPCI), these systems provide inventory makeup so that acceptable post-accident temperatures are maintained.

c. Core Spray System (CSS)

The CSS consists of two independent pump loops that deliver cooling water to spray spargers over the core. The system is actuated by conditions indicating that a breach exists in the RCPB, but water is delivered to the core only after reactor vessel pressure is reduced. This system provides the capability to cool the fuel by spraying water on the core. Either loop functioning in conjunction with the ADS or HPCI can provide enough fuel cladding cooling following a LOCA.

The two CS loops are physically and electrically separated so that no single event makes both loops inoperable. Each CS loop includes two AC motor-driven pumps, each with a separate suction path from the suppression pool, necessary control and instrumentation devices and valves, and a discharge path connected directly to the reactor, which is common to both pumps. Each centrifugal pump supplies 50 percent of the required CS flow so either loop can satisfy 100 percent of the CS design requirements.

d. Low Pressure Coolant Injection (LPCI)

LPCI is an operating mode of the RHR system. LPCI uses the pump loops of the RHR system to inject cooling water into the reactor system. LPCI is actuated by conditions indicating a breach in the RCPB, but water is delivered to the core only after reactor vessel pressure is reduced. LPCI operation provides the capability of core reflooding following a LOCA in time to maintain the fuel cladding below prescribed temperature limits.

The LPCI subsystem is automatically actuated by low water level in the reactor and/or high pressure in the drywell coincident with low reactor pressure. It uses four motor-driven RHR pumps to draw suction from the suppression pool and inject cooling water flow into the reactor core via separate vessel nozzles and core shroud penetrations. Using the suppression pool as the source of water for LPCI establishes a closed-loop for recirculation of water escaping from a pipe break inside containment.

The licensee has requested to use the RICT program to extend the existing CT for LCO 3.5.1, Emergency Core Cooling Systems - Operating.

LCO 3.5.1 requires that:

The emergency core cooling systems shall be OPERABLE with:

a. The core spray system (CSS) consisting of two subsystems with each subsystem comprised of:

1. Two OPERABLE CSS pumps, and

2. An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water through the spray sparger to the reactor vessel.

The licensee has proposed to apply RICT for Action Statement a., which will read as follows:

ACTION a.1 With one CSS subsystem inoperable, provided that at least two LPCI subsystems are OPERABLE, restore the inoperable CSS subsystem to OPERABLE status within 7 days, or in accordance with Risk Informed Completion Time program, or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.5.1.b requires that:

The low-pressure coolant injection (LPCI) system of the residual heat removal system consisting of four subsystems with each subsystem comprised of:

1. One OPERABLE LPCI pump, and

2. An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water to the reactor vessel.

The licensee has proposed to apply RICT for Action Statement b., which will read as follows:

ACTION b.4. With two LPCI subsystems inoperable, provided that at least one CSS subsystem is OPERABLE, restore at least three LPCI subsystems to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time program or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION b.5. With three LPCI subsystems inoperable, provided that both CSS subsystems are OPERABLE, restore at least two LPCI subsystems to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time program or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.5.1.c requires that:

The high-pressure coolant injection (HPCI) system consisting of:

1. One OPERABLE HPCI pump, and

2. An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water to the reactor vessel.

The licensee has proposed to apply RICT for Action Statements c.1 and c.2, which will read as follows:

ACTION c.1 With the HPCI system inoperable, provided the CSS, the LPCI system, the ADS and the RCIC system are OPERABLE, restore the HPCI system to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to 200 psig within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

ACTION c.2 With the HPCI system inoperable, and one CSS subsystem, and/or LPCI subsystem inoperable, and provided at least one CSS subsystem, three LPCI subsystems, and ADS are operable restore the HPCI to OPERABLE within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time or be in HOT SHUTDOWN in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and in COLD SHUTDOWN in the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

LCO 3.5.1.d requires that:

The automatic depressurization system (ADS) with at least five OPERABLE ADS valves.

The licensee has proposed to apply RICT for Action Statement d.1, which will read as follows:

ACTION d.1 With one of the above required ADS valves inoperable, provided the HPCI system, the CSS and the LPCI system are OPERABLE restore the inoperable ADS valve to OPERABLE status within 14 days or in accordance with Risk Informed Completion Time or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reduce reactor steam dome pressure to 100 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The CSS, together with the LPCI mode of the RHR system, is provided to assure that the core is adequately cooled following a LOCA and provides adequate core cooling capacity for all break sizes up to, and including, the double-ended reactor recirculation line break and for smaller breaks following depressurization by the ADS. The CSS is a primary source of emergency core cooling after the reactor vessel is depressurized and a source for flooding of the core in case of accidental draining.

The licensees single failure analysis shows that no single failure prevents the starting of the ECCS and/or the delivery of coolant to the reactor vessel. The most severe effects of single failures with respect to loss of equipment occur if a LOCA occurs in an ECCS pipe coincident with a loss-of-offsite power. The incorporation of RICT will not impact the licensees ECCS LOCA analysis of record.

The NRC staff concludes that the proposed RICT for inoperable ECCS subsystems does not impede accomplishing the ECCS specific safety functions because the ECCS acceptance criteria in 10 CFR 50.46 are maintained. The ECCS is designed to provide protection against postulated LOCAs caused by ruptures in primary system piping. The system functional requirements are such that the ECCS performance under all LOCA conditions postulated in the licensed design satisfies the requirements of 10 CFR 50.46. The applicable ECCS acceptance criteria requirements are also summarized in the Limerick UFSAR, Section 6.3.3.2.

Therefore, the NRC staff finds that the proposed changes are acceptable, as they are consistent with TSTF-505, maintain the design basis, and there is reasonable assurance that the RICT activities will be conducted in compliance with the Commission s regulations.

3.1.2.6 Evaluation of Reactor Coolant, Containment, and Plant Systems The NRC staff reviewed the licensees proposed TS changes and supporting documentation in TS Sections 3/4.4, Reactor Coolant System; 3/4.6, Containment Systems; and 3/4.7, Plant Systems. The NRC staff has determined that the application of an RICT for the Limerick plant-specific reactor coolant, containment, and plant system LCOs is consistent with TSTF-505, Revision 2, and with the NRCs model SE dated November 21, 2018. Application of an RICT for these plant-specific LCOs will be controlled under the RICT program. The RICT program provides the necessary administrative controls to permit extension of CTs, and thereby delay reactor shutdown or remedial actions, if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance levels of TS required SSCs are unchanged, and the remedial actions, including the requirement to shut down the reactor, are also unchanged. Only the action AOTs are extended by the RICT program.

The NRC staff determined that the proposed change is consistent with 10 CFR 50.36(c)(2) because the lowest functional capability or performance levels of equipment required for safety is maintained. Therefore, the NRC staff concludes that the proposed changes are acceptable.

3.1.2.7 Key Principle 2 Conclusions The LAR proposes to modify the TS requirements to permit extending selected CTs using the RICT program in accordance with NEI 06-09-A. The NRC staff has reviewed the licensees proposed TS changes and supporting documentation. The NRC staff finds that extending the selected CTs with the RICT program following loss of redundancy, but maintaining the capability of the system to perform its safety function, is an acceptable reduction in defense in depth, provided that the licensee identifies and implements compensatory measures as appropriate during the extended CT.

As discussed above in this SE, the NRC staff has further evaluated key safety functions in the proposed CT extensions and concluded that the changes are consistent with the defense-in-depth philosophy because:

System redundancy (with the exceptions discussed above), independence, and diversity commensurate with the expected frequency and consequences of challenges to the system is preserved.

Adequate capability of design features without an overreliance on programmatic activities as compensatory measures is preserved.

The intent of the plants design criteria continues to be met.

Therefore, NRC staff finds that this proposed change meets the second key safety principle of RG 1.177, and is, therefore, acceptable. Additionally, the NRC staff concludes that the proposed changes are consistent with the defense-in-depth philosophy as described in RG 1.174.

3.1.3 Key Principle 3: Evaluation of Safety Margins Section 2.2.2 of RG 1.177, Revision 1, states, in part, that sufficient safety margins are maintained when:

Codes and standards or alternatives approved for use by the NRC are met.

Safety analysis acceptance criteria in the final safety analysis report (FSAR) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainties.

The licensee is not proposing in this application to change any quality standard, material, or operating specification. In the LAR, the licensee proposed to add a new program, Risk Informed Completion Time Program, in Section 6.8.4.m, Administrative Controls, of the TSs, which would require adherence NEI 06-09-A.

The NRC staff evaluated the effect on safety margins when the RICT is applied to extend the CT up to a backstop of 30 days in a TS condition with sufficient trains remaining operable to fulfill the TS safety function. Although the licensee will be able to have design-basis equipment out of service longer than the current TSs allow, any increase in unavailability is expected to be insignificant and is addressed by the consideration of the single failure criterion in the design-basis analyses. Acceptance criteria for operability of equipment are not changed and, if sufficient trains remain operable to fulfill the TS safety function, the operability of the remaining train(s) ensures that the current safety margins are maintained. The NRC staff finds that if the specified TS safety function remains operable, sufficient safety margins would be maintained during the extended CT of the RICT program. The NRC staff has evaluated specific proposed changes to the TSs as described in Section 3.2 of this SE.

Safety margins are also maintained if PRA functionality is determined for the inoperable train, which would result in an increased CT. Credit for PRA functionality, as described in NEI 06-09-A, is limited to the inoperable train, loop, or component. The reduced but available functionality may support a further increase in the CT consistent with the risk of the configuration. During this increased CT, the specified safety function is still being met by the operable train, and therefore, requires no evaluation of PRA functionality to meet the design-basis success criteria.

3.1.3.1 Key Principle 3 Conclusions The NRC staff finds that the design-basis analyses for Limerick remain applicable. Although the licensee will be able to have design-basis equipment out of service longer than the current TSs allow, and the likelihood of successful fulfillment of the function will be decreased when redundant train(s) are not available, the capability to fulfill the function will be retained when the available equipment functions as designed. Any increase in unavailability because less

equipment is available for a longer time is included in the RICT evaluation. Therefore, safety margin reductions are minimized by the implementation of the RICT program. Based on the above, the NRC staff concludes that the proposed change meets the third key safety principle of RG 1.177 and is acceptable.

3.1.4 Key Principle 4: Change in Risk Consistent with the Safety Goal Policy Statement TS Section 6.8.4.m Risk Informed Completion Time Program, states that the RICT must be implemented in accordance with NEI 06-09-A.

NEI 06-09-A is a methodology for a licensee to evaluate and manage the risk impact of extensions to TS CTs. Permanent changes to the fixed TS CTs are typically evaluated by using the three-tiered approach described in Chapter 16.1 of the Standard Review Plan, RG 1.177, and RG 1.174, Revision 1. This approach addresses the calculated change in risk as measured by the change in CDF and LERF, as well as the incremental conditional core damage probability and incremental conditional large early release probability, the use of compensatory measures to reduce risk, and the implementation of a CRMP to identify risk-significant plant configurations.

The NRC staff evaluated the licensees processes and methodologies for determining that the change in risk from implementation of RICTs will be small and consistent with the intent of the Commissions Safety Goal Policy Statement, as discussed below. The NRC staff evaluated the licensees proposed changes against the three-tiered approach in RG 1.177, Revision 1, for the licensees evaluation of the risk associated with a proposed TS CT change. The results of the staffs review are discussed below.

3.1.4.1 Tier 1: PRA Capability and Insights The first tier evaluates the impact of the proposed changes on plant operational risk. The Tier 1 review involves two aspects: (1) the technical acceptability of the PRA models and their application to the proposed changes, and (2) a review of the PRA results and insights described in the licensees application.

3.1.4.1.1 PRA Technical Acceptability RG 1.174 states that the scope, level of detail, and technical adequacy of the PRA are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process. The NRCs SE, as described in NEI 06-09-A, states that the PRA models should conform to the guidance in RG 1.200, Revision 1 (Reference [19]). The current version is RG 1.200, Revision 2 (Reference [13]), which clarifies the current applicable ASME/ANS PRA Standard is ASME/ANS RA-Sa-2009 (Reference [16]).

The NRC staff evaluated the PRA acceptability information provided by the licensee in of its submittal (Reference [1]) and in its supplement dated February 14, 2019 (Reference [2]), including industry peer review results and the licensees self-assessment of the PRA models for internal events, including internal flooding and fire, against the guidance in RG 1.200, Revision 2. The licensee screened out all external hazard events, except for seismic, as described in Section 3.1.4.1.2 of this SE, as insignificant contributors to RICT calculations. The Limerick PRA model with modifications is used as the CRMP model as described in Section 3.1.4.1.3 of this SE. The licensees PRA models include credit for diverse

and flexible coping strategies (FLEX). The impact of FLEX modeling uncertainties on the RICT program is discussed in Section 3.1.4.1.4 of this SE.

Internal Events PRA (Including Internal Flooding)

The licensee stated in LAR Enclosure 2 that the last full-scope peer review of the internal events PRA was performed in October 2005 against draft ASME PRA Standard Addenda B (Reference [20]). Subsequently, the licensee performed a gap assessment of the internal events PRA against ASME/American Nuclear Society (ANS) PRA Standard Revision RA-Sa-2009 (Reference [16]) and RG 1.200, Revision 2 (Reference [13]). This gap assessment was previously provided on the docket for the amendment associated with the risk-informed inservice inspection relief request (Reference [21]) (part of the response to APLA RAI-02 (Reference [22])). The gap assessment concluded that there were no deficiencies in the internal events PRA that were not previously identified in a Fact and Observation (F&O).

Additionally, as indicated in the LAR supplement (Reference [2]), a focused-scope peer review was performed in August 2018 that included internal events PRA pre-initiators and addressed high-level requirements HR-A through HR-D and HR-I.

The internal flooding PRA was peer reviewed in May 2008 against the 2005 version of the ASME PRA Standard, RA-Sb-2005 (Reference [23]) and RG 1.200, Revision 1 (Reference [19]). Subsequently, the licensee performed a gap assessment of the internal flooding PRA against ASME/American Nuclear Society (ANS) PRA Standard Revision RA-Sa-2009 (Reference [16]) and RG 1.200, Revision 2 (Reference [13]). This gap assessment was previously provided on the docket for the licensees amendment request to adopt 10 CFR 50.69, risk-informed categorization and treatment of SSCs (Reference [24] and Reference [25]). The gap assessment concluded that there were no deficiencies in the internal flooding PRA that were not previously identified in an F&O.

Further, in July 2016, an independent F&O closure team reviewed the licensees resolutions to the internal events and internal flooding finding-level peer review F&Os. This F&O closure review was a pilot review of a draft process to formally close F&Os. The F&O closure process is documented in Appendix X (Reference [26]) to the peer review process guidelines in NEI 05-04, NEI 07-12, and NEI 12-13 (Reference [27], Reference [28], and Reference [29]).

The NRC staff accepted, with conditions, a final version of Appendix X in the NRC letter dated May 3, 2017 (Reference [30]). This final guidance differed from the guidance used by the licensee in the pilot F&O closure review. Table E2-1 in Enclosure 2 of the LAR provides the finding-level F&Os that were considered open by the F&O closure review team and their associated disposition for this application. In Enclosure 1 of the LAR supplement (Reference [2]), the licensee submitted all the finding-level F&Os from the peer reviews that were considered resolved by the pilot F&O closure review team and their associated resolution.

Additionally, Table 4-1 of the LAR supplement provides one finding-level F&O in the internal events PRA from the 2018 internal events peer review, the licensees resolution, and the closure evaluation by the independent assessment team.

The NRC staff reviewed the licensees resolution of all the peer review findings provided in the LAR and the supplement and assessed the potential impact of the findings on the RICT program. The NRC staff also reviewed, for potential impact on the RICT program, the licensees RAI responses provided during the NRC staff review of the LARs to adopt 10 CFR 50.69 risk-informed categorization and treatment of SSCs (Reference [31] and Reference [32]). Additionally, the staff noted that the implementation items for the 50.69 application included several changes to the internal events and internal flooding PRA, including

update of the human reliability analysis (HRA) pre-initiator analysis, removing credit for recovery of instrument air, updating pipe rupture frequencies, removing credit for core melt arrest in vessel at high-pressure conditions, and updating load shedding modeling. In the LAR supplement (Reference [2]), item 3, the licensee confirmed that all the 50.69 implementation items have been completed and that all the related PRA changes were incorporated into the model of record. The NRC staff concludes that the F&Os have been adequately addressed by the licensee and have no impact on the application.

The NRC staff concludes that the Limerick internal events PRA, including internal flooding, has been appropriately peer reviewed or assessed against the requirements of the ASME/ANS PRA Standard RA-Sa-2009 and in accordance with RG 1.200, Revision 2, and that the licensee has adequately dispositioned the F&Os to support the technical acceptability of the internal events PRA for the RICT program.

Fire Events PRA The last full-scope peer review of the fire PRA was performed in November 2011 against ASME/ANS PRA Standard Revision RA-Sa-2009 (Reference [16]) and RG 1.200, Revision 2 (Reference [13]). Additionally, focused-scope peer reviews were performed in June 2017 on the implementation of the thermally-induced electrical failure (THIEF) model, and in August 2018 on operator response to spurious alarms (covered by high-level requirements HRA-A and HRA-E) and fire quantification (covered by high-level requirements FQ-A through FQ-F).

In July 2016, an independent F&O closure team reviewed the licensees resolutions to the fire events PRA finding-level peer review F&Os. As discussed above, for the internal events PRA, this F&O closure review was a pilot review of a draft Appendix X process to formally close F&Os that have been resolved, and so preceded the NRCs final accepted version of the Appendix X process. Table E2-2 in Enclosure 2 of the LAR provides the finding-level F&Os that were considered open by the F&O closure review team and the finding-level F&Os from the June 2017 focused-scope peer review, along with their associated disposition for this application. In Enclosure 1 of the LAR supplement (Reference [2]), the licensee submitted the finding-level F&Os that were considered resolved by the F&O closure review team and their associated resolution. Table 4-1 of the LAR supplement (Reference [2]) provides the finding-level F&Os resulting from the 2018 focused-scope peer review, the licensees resolution, and the closure evaluation by the independent assessment team.

The NRC staff reviewed the licensees resolution of all the peer review findings provided in the LAR and supplement and assessed the potential impact of the findings on the RICT program.

The NRC staff also reviewed, for potential impact on the RICT program, the licensees RAI responses provided during the NRC staff review of the LAR for adoption of 10 CFR 50.69, risk-informed categorization and treatment of SSCs (Reference [31] and Reference [32]).

Additionally, the staff noted that the implementation items for the 50.69 application included several changes to the fire PRA, including update to MSIV success criteria, modeling of undesired operator actions, update to junction box fire modeling, and incorporating transient fires in the multi-compartment analysis. In the LAR supplement (Reference [2]), item 3, the licensee confirmed that all the 50.69 implementation items have been completed and that all the related PRA changes were incorporated into the model of record. The NRC staff concludes that the F&Os have been adequately addressed by the licensee and have no impact on the application.

The NRC staff concludes that the Limerick fire PRA has been appropriately peer reviewed against the ASME/ANS PRA Standard RA-Sa-2009 and RG 1.200, Revision 2, and that the licensee has adequately dispositioned the F&Os to support the technical acceptability of the fire PRA for the RICT program.

PRA Technical Adequacy Conclusions Based on the NRC staffs review of the licensees submittal and assessments, the NRC staff concludes that the Limerick PRA models for internal events, including internal flooding, and for fire events used to implement the RICT program satisfy the guidance of RG 1.200, Revision 2.

The NRC staff based this conclusion on the findings that the PRA models conform sufficiently to the applicable industry PRA standards for internal events, including internal flooding, and for fire events at an appropriate capability category, considering the licensees acceptable disposition of the peer review of F&Os and NRC staff review.

Based on the review of the provided information, the Limerick PRA models were determined to be of sufficient technical acceptability to support implementation of the RICT program.

Therefore, the NRC staff finds that the licensee has satisfied the intent of RG 1.177, Revision 1 (Sections 2.3.1, 2.3.2, and 2.3.3), and RG 1.174, Revision 3 (Sections 2.3 and 2.5), and that the Limerick PRA acceptability is sufficient to implement RMTS in accordance with NEI 06-09-A.

PRA Update Process Changes to the as-built, as-operated, and maintained plant to reflect the operating experience at the plant are discussed in LAR Enclosure 7. The licensee described its PRA model update process that ensures the PRA models that support the RICT program are maintained consistent with the as-built, as-operated, and maintained plant. The licensee has established a periodic update and review process for the PRA models, including for the CRMP tool, referred to at Limerick as the real-time risk (RTR) tool. The licensee explained that its process is consistent with NEI 06-09-A because it includes (1) reviewing plant changes and discovered conditions for potential impact on the PRA models and tools, (2) establishing criteria for when to incorporate changes into the PRA models and tools immediately or waiting until the next periodic update, (3) updating the PRA models and tools at least once every two refueling cycles, and (4) performing interim analyses or imposing administrative restrictions if significant plant changes or discovered conditions cannot be implemented immediately.

The NRC staff concludes the licensees PRA model update process is consistent with RG 1.200, consistent with the guidance in NEI 06-09-A, and therefore, acceptable.

Risk Assessment Approaches and Methods Changes to the PRA are expected to occur over time to reflect changes in PRA methods, and changes to the as-built, as-operated, and maintained plant to reflect the operating experience at the plant as specified in RG 1.200, Revision 2. Changes in PRA methods are addressed by constraint e. of TS Administrative Section 6.8.4.m:

The risk assessment approaches and methods shall be acceptable to the NRC.

The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the completion times must be PRA methods approved for use with this program in

Amendment Nos. [240/203], or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

The NRC staff finds that this constraint is acceptable because it adequately implements the RICT program using models, methods, and approaches consistent with applicable guidance that are acceptable to the NRC.

PRA Acceptability Conclusion The licensee (1) has reviewed the PRA using endorsed guidance and adequately resolved all identified issues, (2) has established a periodic update and review process to update the PRA and the associated CRMP (real-time risk tool) model to incorporate changes made to the plant and PRA methods and data consistent with the RICT program, and (3) will calculate RICTs using NRC-accepted PRA methods. Therefore, the NRC staff concludes that the licensee has and will maintain a PRA that is technically adequate to support implementation of the RICT program.

3.1.4.1.2 Scope of the PRA NEI 06-09-A requires a quantitative assessment of the potential impact on risk due to impacts from internal and external events, including internal fires, internal floods, and significant external events. As discussed in Section 3.1.4.1.1 of this SE, the Limerick PRA used for the RICT program includes contributions from internal events, including internal flooding and internal fire events. For external hazards for which a PRA is not available, the guidance in NEI 06-09-A allows for the use of bounding analysis of the risk contribution of the hazard for incorporation into the RICT calculation or justification for why the hazard is not significant to the RICT calculation. As discussed below, the licensee determined that all hazards, except seismic, are not significant to the risk calculation. The licensee provided a bounding estimate of the seismic CDF and LERF and included these values into the change-in-risk used to calculate RICTs consistent with the guidance in NEI 06-09-A.

The licensee provided its assessment of external hazard risk for the RICT program in LAR , Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models. In Enclosure 4, the licensee states that this assessment is based on an update of the Limerick Individual Plant Examination of External Events hazard screening evaluation. The licensee states that non-mandatory Appendix 6-A of the ASME/ANS PRA Standard provides a guide for identification of most of the possible external events for a plant site. The NRC staff notes that this list is essentially the same list of hazards as presented in Table 4-1 of NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making (Reference [33]). According to the LAR, the licensee evaluated the following external hazards:

Aircraft Impacts Avalanche Biological Events Coastal Erosion Drought External Flooding Extreme Wind or Tornado

Fog Forest or Range Fire Frost Hail High Summer Temperature High Tide, Lake Level, or River Stage Hurricane Ice Cover Industrial or Military Facility Accident Internal Fires (evaluated in an internal fire PRA)

Internal Flooding (evaluated in the internal events PRA)

Landslide Lightning Low Lake Level or River Stage Low Winter Temperature Meteorite or Satellite Impact Pipeline Accident Release of Chemicals in Onsite Storage River Diversion Sand or Dust storm Seiche Seismic Activity (treated by adding the bounding seismic risk to the RICT calculations)

Snow Soil Shrink-Swell Consolidation Storm Surge Toxic Gas Transportation Accidents Tsunami Turbine-Generated Missiles Volcanic Activity Waves Section 2 of Enclosure 4 of the LAR states:

The overall process for addressing external hazards considers two aspects of the external hazard contribution to risk.

The first is the contribution from the occurrence of beyond design basis conditions, e.g., winds greater than design, seismic events greater than design-basis earthquake (DBE), etc. These beyond design basis conditions challenge the capability of the SSCs to maintain functionality and support safe shutdown of the plant.

The second aspect addressed are the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown, e.g., high winds or seismic events causing loss of offsite power, etc. While the plant design basis assures that the safety related equipment necessary to respond to these

challenges are protected, the occurrence of these conditions nevertheless cause a demand on these systems that presents a risk.

In Table E4-1 in Enclosure 4 of the LAR, the licensee provided a disposition for each non-seismic external hazard, as well as other hazards, and concludes that no unique PRA model for these hazards is required in order to assess configuration risk for the RICT program (with the exception of internal flooding and internal fire, which are addressed by a PRA).

NRC staff notes that the preliminary screening criteria and progressive screening criteria presented in Table E4-2 in Enclosure 4 of the LAR are the same criteria presented in Supporting Requirements EXT-B1 and EXT-C1 for screening external hazards in the 2009 ASME/ANS PRA Standard, as endorsed by RG 1.200, Revision 2.

The NRC staffs SE in NEI 06-09-A states that sources of risk besides internal events and internal fires (i.e., seismic and other external events) must be quantitatively assessed if they contribute significantly to configuration-specific risk. The SE further states that bounding analyses or other conservative quantitative evaluations are permitted where realistic PRA models are unavailable. In addition, the SE concludes that if sources of risk can be shown to be insignificant contributors to configuration risk, then they may be excluded from the RMTS.

The licensee addressed the risk from seismic events and other external hazards in the context of this application in Enclosure 4 of the LAR. This enclosure provided a bounding estimate for the risk from seismic events for use in determining the configuration risk for the RICTs identified in the LAR. The basis for exclusion of certain hazards from consideration in the determination of RICTs due to their insignificance to the calculation of configuration risk was also provided in the same enclosure. The licensee stated that its individual plant examination of external events external screening evaluation was updated to support this LAR. External hazards considered by the licensee were listed in Table E4-4 in Enclosure 4 of the LAR. The staff finds that the list of external hazards considered by the licensee is consistent with the hazards listed in Appendix 6-A of the ASME/ANS RA-Sa-2009 PRA Standard, which is endorsed in RG 1.200, Revision 2.

The NRC staff reviewed Enclosure 4 of the LAR and the information in the supplemental letter dated August 12, 2019, to determine the acceptability of the consideration of risk from seismic events and other external hazards for this application.

Seismic The licensee explained in the LAR that RICT calculations will include a risk contribution from seismic events using a seismic penalty approach. The licensees approach for including the seismic risk contribution in the RICT calculation is to add a constant seismic CDF and LERF to each calculation for Limerick.

The approach used the plant-specific seismic hazard curves developed in response to the Near-Term Task Force Recommendation 2.1 (Reference [34]), and a plant-level high confidence of low probability of failure (HCLPF) capacity of 0.3g referenced to peak ground acceleration. HCLPF is the capacity representing 95 percent confidence that the conditional probability of failure of an SSC is 5 percent or less. The uncertainty parameter for seismic capacity was represented by a combined beta factor of 0.4. The analysis used the hazard curve for peak ground acceleration to determine the seismic CDF estimate of 3.7x10-6 per year.

The NRC staffs evaluation of the licensees approach and estimate determined that the HCLPF value of 0.3g peak ground acceleration, as well as the composite beta factor of 0.4, is consistent with the corresponding values used for Limerick in the Generic Issue (GI)-199 (Reference [35])

evaluation, which represent the most recent information on those parameters for Limerick. The NRC staffs previous assessment (Reference [34]), of the licensees reevaluated seismic hazard states that the licensees methodology was acceptable and that the reevaluated hazard adequately characterized the site. The previous NRC staff conclusion on the reevaluated hazard is applicable here because the same seismic hazard was used for this application. The NRC staff convolved the reevaluated hazard curve (Reference [32]) with the fragility curve derived from the HCLPF parameters mentioned above to reproduce the seismic CDF penalty provided by the licensee.

In the supplemental letter dated August 12, 2019, the licensee stated that the 1983 Limerick Severe Accident Risk Assessment (SARA) study, updated in 1989, was used to estimate an average seismic conditional large early release probability of 0.5 as a conservative value for use in the seismic LERF penalties for the RICT calculations. The RAI response summarized each of the accident sequences analyzed in both the 1983 and 1989 SARA studies and provided the contributions to seismic CDF and associated seismic CLERPs for each sequence. The seismic CLERPs ranged between 1.0x10-2 to 1.0. The licensee then used this information to develop a sequence-weighted seismic CLERP of 0.44 for the 1983 study and 0.48 for the 1988 study. The licensee further stated that in order to address sources of uncertainty in these estimates, a seismic CLERP value of 0.5 during times when the containment is inerted. Per the LAR, the licensee stated that a seismic CLERP of 1.0 would be used in the RICT calculations during times when the containment is not inerted.

The NRC staff reviewed the licensees determination of the seismic CLERP for an inerted containment. However, the NRC staff did not review the SARA PRA for this application and did not evaluate its general applicability of estimating the risk due to seismic events at Limerick.

The NRC staff recognizes that the SARA PRA was previously reviewed by the NRC in support of Limerick licensing (Reference [36]). As part of its review, the NRC staff estimated the seismic CLERP by convolving the seismic CDF penalty with the fragility curve derived from the HCLPF and composite beta values stated above. The staffs estimation was similar to the CLERP provided by the licensee. In addition, the seismic LERF will be determined using the seismic CDF, which is determined using a conservative approach. The staff notes that a seismic CLERP of 1.0 will be used during times when the RICT is implemented and the containment is not inerted. Therefore, without relying on the licensees methodology for calculating the seismic LERF, the NRC staff concluded that the proposed seismic LERF penalty factor reasonably incorporates the corresponding risk into the RICT program.

The NRC staff finds that during RICTs for SSCs credited in the design basis to mitigate seismic events, the licensees proposed methodology captures the risk associated with seismically-induced failures of redundant SSCs because such SSCs are assumed to be fully correlated. By assuming full correlation, the seismic risk for those RICTs will not increase if one of the redundant SSCs is unavailable, because simultaneous failure of all redundant trains would be assumed in a seismic PRA. During RICTs for SSCs not credited in the design-basis seismic event, but which could be used when credited SSCs fail, the proposed methodology for considering seismic risk contributions may be non-conservative because the seismically-induced failure of such SSCs during the RICT may not be included in the risk increase. However, the occurrence and degree of non-conservatism depends on the plant HCLPF value used for the RICT calculations, as compared to the HCLPF values for such SSCs.

The degree of non-conservatism will be low or nonexistent if the plant HCLPF value is lower

than most or all SSCs impacted by a seismic event. During RICTs for SSCs that are not used to mitigate a seismic event, the proposed methodology for considering seismic risk contributions is conservative because the seismically-induced failure of such SSCs would not result in a risk increase associated with the plant configuration during the RICT, but the baseline seismic risk is still included in the calculation.

In summary, the NRC staffs review finds the licensees proposal to use the seismic CDF contributions of 3.7x10-6 per year and a seismic LERF contribution of 1.85x10-6 per year as an addition to the configuration-specific delta CDF and delta LERF from the internal events acceptable for the licensees RICT program for Limerick because (1) the licensee used the most current site-specific seismic hazard information for Limerick; (2) the licensee used an acceptably low plant HCLPF value of 0.3g consistent with the information for Limerick in the GI-199 evaluation; and (3) adding baseline seismic risk to RICT calculations, which assumes the fully correlated failures, is conservative for SSCs credited in seismic events, while any potential non-conservative results for SSCs that are not credited in seismic events is small or nonexistent, as discussed above.

Extreme Winds and Tornado Hazards Section 4 of Enclosure 4 of the LAR discusses the licensees evaluation of the extreme winds and tornadoes impact on this application. Table E4-1 in Enclosure 4 discusses the basis for the insignificant impact of extreme winds and tornados (including tornado-generated missiles) for this application and relies on the design of SSCs.

The licensee stated that the design tornado wind speed for Limerick is 300 miles per hour, which is greater than the wind speed with an occurrence frequency of 1x10-7 per year from NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States (Reference [37]), for Limerick. The licensee further discussed that straight winds and hurricane winds hazard was bounded by tornado winds for Limerick and concluded that the high winds and tornadoes need not be considered in the RICT calculation for Limerick because of the insignificant impact of extreme winds and tornados for this application.

The licensee discussed the configuration-specific risk from tornado-generated missiles hitting and damaging the ultimate heat sink (UHS), which was the only unprotected plant SSCs. In response to APLB RAI-02, the licensee stated that with two units operating, the failure criteria is the loss of three of four spray networks and both cooling towers. The licensee explained that since the TSs allow up to two spray networks to be inoperable, the loss of a single spray pond network and the cooling towers will result in a loss of all UHS with both units operating.

Depending on the intensity of the tornado, it is up to four times more likely that one or more networks are damaged as compared to damaging three or four networks. The licensee used a previously submitted analysis (identified as the UHS Extreme Wind Hazard Analysis; NUS-4507; 1984 PRA in the submittal and supplements) to determine the configuration-specific impact of the loss of all UHS due to tornado-generated missiles on the RICTs. The licensee provided details of the analysis in the August 12, 2019 supplement and stated that the results of the analysis using tornado frequencies used in the 1984 PRA shows that the likelihood of a loss of all UHS was approximately 8x10-7 per year. A comparison was made of tornado frequencies used in the 1984 PRA and updated frequencies provided in NUREG/CR-4461, Revision 2, which showed that estimated tornado frequencies have been reduced by more than a factor of

10. Use of the updated frequencies results in the estimated loss of all UHS due to tornadoes and tornado missiles less than 1x10-6 per year in the most restrictive maintenance configuration, which only requires the loss of a single spray network to result in loss of all UHS.

The NRC staffs review of the information in the submittal and the supplement finds that the licensees design basis can be considered as a bounding or demonstrably conservative analysis. The staffs review also notes that the internal events PRA already includes weather related loss-of-offsite power events as initiators, which capture the impact of high straight winds and tornados. Further, the plants abnormal operating procedures for severe weather include actions in the event of a tornado sighting, tornado warning, or severe thunderstorm. The NRC staff did not review the licensees 1984 PRA for missile strike probabilities on the UHS and did not evaluate its general applicability of estimating the risk from such strikes. The NRC staff recognizes that this method was previously reviewed by the NRC for use at Limerick to address UHS exposure to tornado missiles. Without relying on the licensees methodology for calculating missile strike probabilities, the NRC staff concluded that because of sufficient margin in damage frequencies resulting in a loss of all UHS, configuration-specific tornado-generated missile events will not significantly impact RICT calculations and can be excluded from further consideration. The staffs review also notes that there are no tornado missile targets associated with containment integrity, and therefore, the tornado-generated missile impact on LERF is insignificant for this application. In summary, the NRC staff finds that the high winds and tornados, including tornado missiles, have an insignificant contribution to, and can be excluded from, the calculation of the proposed RICTs.

External Flooding Table E4-1 in Enclosure 4 of the LAR discusses the licensees evaluation of the risk from external flooding hazard. The licensees conclusions of the insignificant impact of the external flooding hazard on this application are based on the results documented in the licensees flood hazard reevaluation report (Reference [38]). The licensees flood hazard reevaluation report demonstrated that the maximum reevaluated flood hazard elevation for local intense precipitation and associated site drainage was bounded by the current design-basis flood hazard except at eight critical doors located on the south side of the DG building, because those doors were not analyzed as part of the current design basis. The licensees analysis in the flood hazard integrated assessment (Reference [39]) showed that even with conservative analysis inputs, adequate physical margin remains for the EDGs, because the amount of water that could enter the EDG rooms was less than the allowable volume in the diesel pit area.

Accordingly, there is no effect on safety-related equipment in the DG rooms, and no compensatory actions are necessary.

The NRC staffs evaluation of the licensees considerations of external flooding hazards for Limerick finds that the external flooding hazard has an insignificant contribution to configuration risk and can be excluded from the calculation of the proposed RICTs because the reevaluated flood hazard in the flood hazard reevaluation report is either bounded by the design-basis flood elevation or has adequate physical margin against flood water intrusion for relevant SSCs, and includes conservatism in the analysis.

Other External Hazards Besides the external flooding and high winds and tornados discussed above, the licensee provided rationale for the insignificant impact of non-seismic external hazards and other hazards for Limerick in Table E4-1 in Enclosure 4 of the LAR. The NRC staffs review of the information in the submittal finds that the contributions from the other external hazards have an insignificant contribution to configuration risk and can be excluded from the calculation of the proposed

RICTs for Limerick because they either do not challenge the plant or they are bounded by the external hazards analyzed for the plant.

External Hazards Conclusion The NRC staff concludes that the licensees approach for considering the impact of seismic events, non-seismic external hazards, and other hazards for Limerick in the RICT calculations is acceptable because the licensee included a technically acceptable quantitative assessment of the seismic risk for Limerick, consistent with the guidance in the NEI 06-09-A, and demonstrated the insignificant contribution to configuration risk from other external hazards on the proposed RICTs.

Shutdown Risk Shutdown risk is not applicable to this LAR since the LAR only applies to Modes 1 and 2.

PRA Scope Conclusions According to the LAR, the proposed RICT program is only applicable to operational conditions (or Modes) 1 and 2; therefore, risk evaluations for Modes 3, 4, and 5 are not relevant to the proposed change.

Based on the above, the NRC staff finds that the licensee has satisfied the intent of RG 1.177, Revision 1 (Section 2.3.2), and RG 1.174, Revision 3 (Sections 2.3 and 2.5), and that the scope of the PRA model and the use of a bounding analysis for seismic events is appropriate for this application.

3.1.4.1.3 PRA Modeling Section 3.2.2 of NEI 06-09-A specifies that to evaluate the RICT for a given required action, the specific systems or components involved should be directly modeled in the PRA or, if not directly modeled, the functions directly correlated to the specific systems or components are modeled in the PRA. TSTF-505, Revision 2, also states required actions for systems that do not affect CDF or LERF or for which the RICT cannot be quantitatively determined are not in the scope of the program. The licensee identified, for each TS LCO required actions for which the RICT program is proposed to apply, the following: (1) the SSCs are included within the scope of the PRA models or surrogate SSCs are modeled that bound the functions of the TS SSCs; (2) the success criteria parameters used to determine PRA functional determination are the same as the design-basis success criteria parameters or, if different, plant-specific analyses that were used to support the PRA are justified; (3) CCFs are appropriately addressed; and (4) the CRMP (real-time risk tool) provides the capability to select the system as out of service in order to calculate the RICT, and the CRMP (real-time risk tool) is maintained consistent with the baseline PRA model.

System and Surrogate Modeling The NRC SE to NEI 06-09 (Reference [12]) and TSTF-505, Revision 2, specify that the LAR is to provide a comparison of the TS functions to the PRA modeled functions and that justification be provided to show that the scope of the PRA model is consistent with the licensing basis assumptions. Table E1-1 in Enclosure 1 of the LAR, as revised in RAI response

(Reference [4]), identifies each TS within the RICT program and identifies how the systems and components are implicitly or explicitly modeled in the PRA.

With regard to modeling of the I&C, Table E1-1 in Enclosure 4 of the LAR describes the design-success criteria for several I&C LCOs as generally, one-out-of-two twice logic and for other I&C LCOs as one of two channels, and that the PRA success criteria is the same.

Table E1-1 further states that some inputs are not modeled in the PRA and are conservatively treated as a loss of channel. In APLA RAI-08.a (Reference [9]), the NRC staff requested the licensee to explain further how I&C is modeled in the PRA. In response to APLA RAI-08.a (Reference [4]), the licensee provided several tables that showed examples of individual components that are specifically modeled for each instrumentation TS function included within the scope of the RICT program. The response indicates that, with few exceptions, most of the RPS, ECCS, ATWS-RPT, EOC-RPT, RCIC, and feedwater/main turbine instrumentation is explicitly modeled in the PRA. For those few exceptions TS functions for which SSCs are not explicitly modeled, the table identified the associated surrogate to be used in the RICT calculations. With regard to the containment isolation initiation instrumentation, the licensee indicated most of the signals related to input to the high-pressure break outside containment are not explicitly modeled and that the signal contribution will be treated as failed for RICT calculations. In response to PRA RAI 8.01 (Reference [5]), the licensee further explained how it expects to use three different surrogates when entering LCO 3.3.2 (related to isolation actuation instrumentation): a preexisting containment leakage, early isolation failure during interfacing systems LOCA (ISLOCA), and break outside containment. The NRC staff reviewed this information and concludes that all instrumentation functions included within the RICT program are either modeled explicitly in the PRA or that conservative surrogates will be used for the non-modeled instruments.

With regard to LCO 3.6.2.2.a, One RHR suppression pool spray subsystem inoperable, Table E1-1 in Enclosure 4 of the LAR states that suppression pool spray is not modeled in the PRA and that, because the drywell and wetwell airspaces are connected by the downcomers, failure of the drywell spray will be used as a surrogate for the failure of the suppression pool spray. The NRC staff notes that separate containment spray systems are provided in each airspace specifically, because different environmental conditions (temperature, pressure) between the two air spaces are expected during severe accidents. In APLA RAI-09.a (Reference [9]), the NRC staff requested the licensee to justify the proposed surrogate. In response to APLA RAI-09.a (Reference [3]), the licensee explained that the only function of the suppression pool sprays is containment heat removal for pressure control and that drywell spray is the backup system for the suppression pool sprays per the emergency operating procedures.

In addition, the modeled PRA accident sequences ultimately rely on the drywell spray mode because, unlike the suppression pool sprays, the drywell sprays have sufficient capacity to provide adequate containment heat removal. The licensee also explained that the drywell sprays are credited in the PRA Level 2 analysis to perform functions that the suppression pool sprays could not perform; thus, it is considered a conservative surrogate for removing the suppression pool sprays from service. The NRC staff concludes that assuming failure of the drywell sprays is an acceptable surrogate for determining the RICT for LCO 3.6.2.2.a because the drywell sprays have a higher capacity for accomplishing the containment heat removal function of the suppression pool sprays, and therefore, the resultant RICT is expected to be conservative.

For LCO 3.6.3.a regarding containment penetrations, Table E1-1 in Enclosure 4 of the LAR states that lines less than 2 inches in diameter are not considered a significant leakage path, and that for containment isolation valves greater than 2 inches that are not modeled in the PRA,

a generic isolation failure event will be used. In APLA RAI-09.b (Reference [9]), the NRC staff requested the licensee provide justification that failure of containment penetration lines less than 2 inches in diameter are insignificant contributors to LERF and provide justification for the proposed surrogate for each containment isolation valve greater than 2 inches that is not modeled in the PRA. In response to APLA RAI-09.b (Reference [3]), the licensee explained that the basis for the determination related to screening of valves less than 2 inches is NUREG/CR-3539 and NUREG/CR-5565 (Reference [40] and Reference [41]), and that the reassessment of these screened valves for fire-induced multiple spurious operations did not identify new containment penetration lines to be added to the fire PRA model. In addition, the licensee stated that for isolation valves greater than 2 inches that are not modeled, the RICT calculation will use a surrogate isolation path whose failure will lead directly to containment failure. The licensees justification for using any penetration regardless of size is that the Limerick PRA model assumes these sequences are mapped directly to LERF. The NRC staff concludes that the proposed surrogate for containment isolation valves is acceptable because it conservatively assumes that these sequences go directly to LERF regardless of penetration line size.

In APLA RAI-09.c (Reference [9]), the NRC staff requested that the licensee provide clarification on how the following systems are modeled in the PRA and how the RICT is determined when the system is removed from service: TS LCO 3.1.5.a (one pump and corresponding explosive valve in the SLCS operable), LCO 3.6.4.1.a (one or more vacuum breakers in one of the three required pairs of suppression chamber to drywell vacuum breakers inoperable, but known to be closed), and LCO 3.7.8 (main turbine bypass system inoperable). In response to APLA RAI-09.c (Reference [3]), the licensee explained that the SLCS (including associated pumps, valves, initiation logic, and required support systems) is explicitly modeled in the PRA and that the RICT is calculated by failing the train(s) that is not functional. The licensee also explained that the vacuum breakers are not modeled individually but at the system level, and that the associated RICT is conservatively calculated by failing the system function when one or more vacuum breakers are out of service. Lastly, the licensee explained that the main turbine bypass valves are modeled at the system level as part of the reactor pressure control function, and that the associated RICT is conservatively calculated by failing the bypass system input to the pressure control function when one or more valves are inoperable. The NRC staff concludes each of these systems are modeled in the PRA and that the RICT can be calculated for each.

Table E-1-1 in Enclosure 4 of the LAR originally included LCO 3.6.5.3, Standby Gas Treatment System (SGTS), within the scope of the proposed RICT program. The NRC staff noted that SGTS does not appear to have any impact on CDF or LERF, and thus, in APLA RAI-10 (Reference [9]), requested the licensee to describe the functions of the SGTS to justify how it impacts CDF or LERF and how the RICT can be quantitatively determined. In response to APLA RAI-10 (Reference [3]), the licensee removed all conditions associated with SGTS from the scope of the RICT program (Unit 1, Condition 3.6.5.3.a.1, and Unit 2, Conditions 3.6.5.3.a.2, 3.6.5.3.a.3, and 3.6.5.3.a.4).

Success Criteria The NRC SE for NEI 06-09 (Reference [12]) specifies that the LAR is to provide a comparison of the TS functions to the PRA modeled functions and that sufficient justification is to be provided to show that the scope of the PRA model, including applicable success criteria, is consistent with the licensing basis assumptions. Table E1-1 in Enclosure 1 of the LAR, as supplemented, identifies each TS within the scope of the RICT program and, as applicable, summarizes how the PRA success criteria differ from the design-basis success criteria. In

some cases, all the design-basis success criteria are not modeled in the PRA or are more restrictive than the PRA success criteria. CTs calculated from the PRA will be based on the PRA success criteria that have been reviewed, consistent with the PRA technical adequacy review process described in RG 1.200. Consistent with NEI 06-09-A, RICTs are not applied to CTs following LOF, so the less restrictive PRA success criteria will never be used in lieu of the design-basis success criteria. When the function may be degraded but still capable of fulfilling the design-basis function, use of less restrictive PRA success criteria solely to extend CTs when the design-basis criteria can still be satisfied is consistent with NEI 06-09-A and the associated SE, and therefore, is acceptable.

Common-Cause Modeling In APLA RAI-06 (Reference [9]), the NRC staff requested explanation for how CCF contribution is addressed in the PRA models used for the RICT program and how the PRA models are adjusted when a component from a CCF group (such as a group of three components from three trains that provide 100 percent of the required function) is removed for planned preventive maintenance. The guidance in RG 1.177, Appendix A, Section A-1.3.1.1, states: If the component is down because it is being brought down for maintenance, the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components (also see Regulatory Position 2.3.1 of RG 1.177).

In response to APLA RAI-06 (Reference [3]), the licensee explained that CCF event probabilities are modeled and quantified using the alpha factor method described in NUREG/CR-5485 (Reference [42]) and that common cause basic events are explicitly modeled in the fault tree. For example, for a group of four components (A, B, C, and D), all common cause basic events combinations (AB, AC, AD, ABC, ABD, ACD, and ABCD) are captured. The licensee stated that, in general, the common cause basic events are not adjusted in the PRA models when a component is taken out of service for planned maintenance. The licensee explained that the unadjusted CCF combinations capture the CCF combinations remaining after one of the like-kind components is taken out of service. The licensee explained that the CCF contribution from the out-of-service component is conservatively retained in two ways:

(1) the independent failure rate used in the PRA models includes both independent and dependent failure events (i.e., the dependent failures should be subtracted from the total population of failures to calculate the independent failure rate), and (2) the CCF event probabilities that include the out-of-service component are retained. The NRC staff notes that this simplification of not adjusting the CCFs for an out-of-service component can also produce non-conservative effects because the alpha factor for a CCF group changes when the total population of components considered is reduced by one. The NRC staff notes that CCF probabilities estimates are uncertain, and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensees general treatment of CCFs for planned maintenance is acceptable because the calculations reasonably include CCFs after removing one train for maintenance consistent with the accuracy of the estimates.

Concerning entering TSs for emergent conditions, consistent with TSTF-505, Revision 2, the administrative TS requirement (TS 6.8.4.m, item d) specifies that in an emergent condition, if the extent of condition for the inoperable SSC is not complete prior to exceeding the action AOT, then the RICT program will account for the increased possibility of CCF by either (1) numerically accounting for the increased possibility of CCF in the RICT calculation or (2) implementing RMAs not already credited in the RICT calculation that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of

initiating events that challenge the function(s) performed by the inoperable SSCs. In APLA RAI-07 (Reference [9]), the NRC staff requested additional information regarding how the numerical adjustment of CCFs for emergent failures will be performed. In response to APLA RAI-07 (Reference [3]), the licensee stated that adjustment of CCF events will not typically be performed for the RICT calculation when entering an emergent condition and that it expects to use option (2) of TS 6.8.4.m, item d, by implementing RMAs. The licensee further stated that if option (1) of TS 6.8.4.m, item d, is exercised, the RICT calculation will be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, Revision 1, as specified in Section A-1.3.2.1 of Appendix A. Because the licensee proposes to use the guidance in RG 1.177 when using option 1 of TS 6.8.4.m, item d, the NRC staff finds the licensees response acceptable.

CRMP (Real-Time Risk Tool) Model The PRA model serves as the model used by the RTR tool, which is used to perform the RICT calculations. (The licensee refers to the CRMP in the LAR as the RTR model.) The tool used to perform the RICT calculations provides a user interface that supports the RICT program by providing a method to evaluate the plant configuration.

In LAR Enclosure 8, the licensee describes the necessary changes to the peer-reviewed baseline PRA models for use in the configuration risk software to support RICT calculations that preserve the CDF and LERF quantitative results, maintain the quality of the peer-reviewed PRA models, and correctly accommodate changes in risk due to configuration-specific considerations. of the LAR explains that the peer-reviewed internal events, including internal flooding, PRA model, and the fire events PRA model, are maintained as separate models.

However, for RICT program implementation, these baseline models are incorporated into the RTR tool software and modified/adjusted as follows for use in configuration risk calculations:

(a) the unit availability factor is set to 1.0 (unit available); (b) maintenance unavailability is set to zero/false unless unavailable due to the configuration; (c) mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration; and (d) for systems where some trains are in service and some in standby, the RTR model addresses the actual configuration of the plant, including defining inservice trains as needed. These adjustments are the same as those used for the evaluation of risk under the Maintenance Rule program (i.e., 10 CFR 50.65(a)(4)). The RTR software is designed to quantify the unit-specific configuration for both internal events, including internal flooding and fire events, and includes the seismic risk contribution when calculating the RMAT and RICT.

The licensee stated in Enclosure 8 of the LAR that the plant procedures specify that an acceptance test is performed after every RTR model update. This test verifies proper translation of the baseline PRA models and acceptance of all changes made to the baseline PRA models into the RTR model. This test also verifies correct mapping of plant components to the basic events in the RTR model. For maintenance of an existing RTR model, changes made to the baseline PRA model in translation to the RTR model are controlled and documented.

In APLA RAI-04.a (Reference [9]), the NRC staff requested the licensee explain how the RTR model accounts for seasonal variations. In response to APLA RAI-04.a (Reference [9]), the licensee stated that two PRA modeled systems must account for seasonal variations. The first, the DG ventilation system, requires both fans when ambient temperatures are greater than

75 degrees Fahrenheit (°F). The licensee explained that the RTR model assumes the ambient temperature is greater than 75 °F and that the operators can indicate in the RTR tool when the temperature is below 75 °F. The second system, the spray pond winter bypass valves, are required to be open when ambient temperatures are below 32 °F. The licensee stated that the RTR model will include an option to allow the operators to activate this requirement when needed. The NRC staff concludes that the licensee appropriately accounts for seasonal variations in its RTR tool.

In response to APLA RAI-04.b (Reference [9]), the licensee indicated that out-of-service equipment is properly reflected in the RTR model initiating event fault trees, as well as plant response fault trees.

In APLA RAI-04.c (Reference [9]), the NRC staff requested the licensee describe how the accuracy of pre-solved cutsets are maintained with changes in plant configuration. In response to APLA RAI-04.c (Reference [3]), the licensee stated the full PRA model quantifications will be used for each plant configuration, and that pre-solved cutsets are only used for configurations that are identical to previously experienced configurations. The licensee further stated that the configuration-specific cutsets are updated in accordance with plant procedures when there are any changes to the underlying PRA model of record.

Finally, in APLA RAI-04.d (Reference [3]), the NRC staff requested the license describe the activities performed to confirm consistency between the PRA model of record and the RTR model. In response to APLA RAI-04.d (Reference [3]), the licensee stated that procedures will be in in effect to ensure that the applicable changes to the internal events or the fire model of record are reflected in the RTR model and to verify that results are consistent between the RTR model and PRA zero maintenance model results, which include quantifying the RTR model for representative maintenance configurations and examining the results for appropriateness. The licensee stated that the RTR model documentation includes changes made to the model of record, along with the verifications of results.

The NRC staff concludes that the CRMP (or RTR) model used to calculate the RICTs is acceptable because the underlying PRA models will remain acceptable and the acceptance test will verify the CRMP (or RTR) model is consistent with the underlying baseline PRA.

PRA Modeling Conclusions The NRC staff reviewed the information provided by the licensee and concluded that the PRA modeling used to support the RICT program can appropriately model alignments of components during periods when the RICT will be calculated. Therefore, the NRC staff finds that the licensee has satisfied the intent of RG 1.177, Revision 1 (Section 2.3.3), and RG 1.174, Revision 3 (Section 2.3), and that the PRA modeling is appropriate for this application.

3.1.4.1.4 Key Assumptions and Sensitivity and Uncertainty Analyses Using PRAs to evaluate TS changes requires consideration of the assumptions made within the PRA that can have a significant influence on the ultimate acceptability of the proposed changes.

Risk-informed analyses of TS changes can be affected by uncertainties regarding the assumptions made during the PRA models development and application. In general, the risk resulting from TS CT changes is expected to be relatively insensitive to most uncertainties because the uncertainties tend to affect similarly both the base case and the case with the TS equipment unavailable. The licensee considered PRA modeling uncertainties and their potential

impact on the RICT program and identified, as necessary, applicable RMAs to limit the impact of these uncertainties. In Enclosure 9 of the LAR, the licensee discussed key assumptions and sources of uncertainty.

The licensee evaluated the Limerick PRA model to identify the key assumptions and sources of uncertainty for this application consistent with the RG 1.200 definitions, using sensitivity and importance analyses to place bounds on uncertain processes, to identify alternate modeling strategies, and to provide information to users of the PRA.

According to the LAR (Reference [1]), the licensee followed the guidance in NUREG-1855, Revision 0 (Reference [43]), and in Electric Power Research Institute (EPRI) TR-1016737 (Reference [44]), in identifying and evaluating key assumptions and sources of uncertainty for the RICT application. The LAR explains that the three types of sources of uncertainty defined in NUREG-1855 are considered in the RICT program, which are as follows: parametric uncertainties, modeling uncertainties, and completeness uncertainties. Parametric uncertainties are specifically addressed in the PRA quantification to develop distributions of the CDF and LERF and associated means (which is a requirement of the PRA standard). No completeness uncertainties were identified that would impact the TSTF-505 application. The LAR further explains that plant-specific modeling uncertainties are documented in the Limerick PRA notebooks, and generic sources of modeling uncertainty are listed in EPRI TR-1016737, and that the sources of modeling uncertainties identified in these references were evaluated for potential impact on the RICT program. The modeling (or epistemic) uncertainties determined to be key sources of uncertainty are identified in Tables E9-1, E9-2, and E9-3 in Enclosure 9 of the LAR, along with the licensees assessment of each.

In RAI-01.a (Reference [9]), the NRC staff requested a description of the process used to identify and evaluate generic and plant-specific key assumptions and sources of uncertainty for the internal events, including internal flooding and fire PRA. In response to RAI-01.a (Reference [3]), the licensee explained that both generic sources of model uncertainty from EPRI TR 1016737 (Reference [44]) and EPRI TR 1026511 (Reference [45]) and plant-specific sources of uncertainty were identified for consideration as key sources of uncertainty. These sources of uncertainty were then screened to those that may be key to the application by reviewing each based on a consensus approach or other applicable guidance and included consideration of whether the uncertainties would challenge the risk guidelines. The licensee further explained that the process for evaluating assumptions and sources of uncertainty followed the guidance in Stage E of NUREG-1855, Revision 1 (Reference [33]). The licensee stated that the key assumptions and sources of uncertainty resulting from implementation of this process were provided in the LAR and provided no additional key assumptions and sources of uncertainty in response to the RAI.

Table E9-1 in Enclosure 4 to the LAR identifies, as a source of uncertainty, that continued injection from control rod drive after containment failure is credited unless a gross rupture of containment occurs. The licensees disposition states that RMAs will be implemented to address the uncertainty with this assumption for RICTs that are pertinent to loss of containment heat removal scenarios. Because the guidance in NEI 06-09-A requires analysis of the assumptions and accounting for their impact to the RICTs, the NRC staff asked the licensee in APLA RAI-02.a (Reference [9]) to provide results of sensitivity studies of the impact on the RICTs and describe and justify the RMAs to be implemented to minimize the potential adverse impact. In response to APLA RAI-02.a (Reference [4]), the licensee provided a list of TS LCO conditions that were directly impacted by the containment heat removal function, such as those related to suppression pool spray and RHRSW. For these LCO conditions, the licensee

provided the results of a bounding sensitivity case that assumed that control rod drive fails after containment failure. The results showed no impact on the resultant RICTs, which were all estimated to be greater than the 30-day backstop in each case. The licensee identified one RMA to perform pre-job briefs on the importance of operator actions associated with preventing loss of containment heat removal.

Table E9-1 in Enclosure 4 of the LAR identifies that, given an uncontrolled flooding of the steam lines, a nominal failure probability of 1E-3 is assigned to safety relief valves (SRVs) being permanently disabled, which precludes the ability to depressurize the reactor pressure vessel through the SRVs. The disposition states that the 1E-3 failure probability provides a slight conservative bias to the results such that the impact on RICT calculations is not unduly influenced. The LAR identifies that this uncertainty affects the RICTs for the LCOs associated with the high-pressure injection systems. The disposition states that while the SRVs are designed to pass water, they are never tested in this fashion. In APLA RAI-02.b (Reference [9]), the NRC staff requested the licensee provide the results of a sensitivity study of the impact on the RICT application of this assumption. In response to APLA RAI-02.b (Reference [4]), the licensee explained that this failure probability is applied in very unlikely scenarios in which the SRVs first pass water because of flooding in the steam lines, which requires numerous failures of other systems and operator actions (such as HPCI, RCIC, and feedwater), and then subsequently fail to open when needed to depressurize the reactor. The licensee provided the results of a sensitivity study in which the nominal failure probability of the SRVs was increased by a factor of 10 to 1E-2. The results showed no impact on the resultant RICTs for impacted LCOs that were estimated to be greater than the 30-day backstop.

The NRC memorandum dated May 30, 2017 (Reference [46]), provides the NRC staffs assessment of challenges to incorporating diverse and flexible coping strategies (FLEX) into a PRA model in support of risk-informed decisionmaking in accordance with the guidance in RG 1.200, Revision 2. In RAI-03 (Reference [9]), the NRC staff requested the licensee to discuss if FLEX equipment and mitigating actions are credited in the Limerick PRA. In response to RAI-03 (Reference [4]), the licensee stated that credit is taken in the internal events and fire PRA models for FLEX equipment such as deploying and aligning the portable FLEX 480 volt (V) generators, deploying and aligning the portable FLEX pumps, and prolonged RCIC operation via partial reactor pressure vessel depressurization and venting containment using the permanently installed hardened containment vent system. The NRC memo dated May 30, 2017 (Reference [46]), highlights two main areas of uncertainties for crediting FLEX in the PRA:

equipment failure probabilities and HRA of the credited operator actions for deploying FLEX.

The guidance in NEI 06-09-A states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties that could potentially impact the results of the RICT calculation, and that the insights from the sensitivity studies should be used to develop appropriate compensatory RMAs, including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions.

Therefore, in RAI-03 (Reference [9]), the NRC staff requested the licensee to provide justification for FLEX credit and to provide the results of sensitivity studies of the impact on the RICT application of FLEX credit, consistent with the guidance in NEI 06-09-A.

With regard to equipment reliability, the licensee stated in response to RAI-03.b.iii (Reference [4]), that the FLEX equipment failure rates were developed by selecting generic industry values for the most similar components and then doubling these values. In response to APLA RAI-03.d (Reference [4]), the licensee provided the results of a sensitivity study in which the equipment failure probabilities were assumed to be a factor of five greater than the generic

industry values. The results showed minor impact on the resultant RICTs for impacted LCOs, which are those that are most likely impacted by an extended loss of AC power, specifically, LCOs 3.8.1.1.d (one offsite circuit and one DG inoperable), 3.8.1.1.f (one offsite circuit inoperable), 3.8.1.1.g (two offsite circuits inoperable), 3.8.2.1.a.3 (two battery chargers on one division inoperable), 3.8.2.1.c (any battery(ies) on one division of required DC electrical power sources inoperable), 3.8.3.1.a (one required AC distribution system divisions not energized),

and 3.8.3.1.b (one required DC distribution system divisions not energized).

With respect to the HRA of the credited operator actions, Section 7.5 of NEI 16-06 (Reference [47]) recognizes that the current HRA methods do not translate directly to human actions required for implementing mitigating strategies. Sections 7.5.4 and 7.5.5 of NEI 16-06 describe such actions to which the current HRA methods cannot be directly applied, such as debris removal; transportation of portable equipment; installation of equipment at a staging location; routing of cables and hoses; and those complex actions that require many steps over an extended period, multiple personnel and locations, evolving command and control, and extended time delays. The licensees response to RAI 3.b.ii (Reference [4]) listed the following FLEX operator actions credited in the PRA:

Success of the FLEX generators includes required operator actions for DC load shed, deploy and start the FLEX generators, align the FLEX generators to the battery chargers, and refuel the FLEX generators.

Success of the FLEX pumps includes required operator actions for aligning the FLEX pumps from the fire water system, aligning the FLEX pumps for reactor pressure vessel injection from the spray pond, and refueling the FLEX pumps.

Success of prolonged RCIC operation includes required operator actions for performing partial reactor pressure vessel depressurization, opening of the hardened vent at the hardened containment vent system panel, aligning the FLEX pumps for suppression pool makeup from the spray pond, and refueling the FLEX pumps.

The licensee stated in response to APLA RAI-03.d (Reference [4]), that all human error probabilities (HEPs) for FLEX actions were evaluated with the same method used for all other internal event operator actions. The NRC staff notes that the actions listed in the RAI response appear to contain actions described in Sections 7.5.4 and 7.5.5 of NEI 16-06 to which the current HRA methods perhaps could not be directly applied. Therefore, in follow-up APLA RAI 3.01.a (Reference [10]), the NRC staff requested the licensee investigate and address the source of uncertainty associated with FLEX operator actions.

In response to APLA RAI 3.01 (Reference [5]), the licensee performed sensitivity studies to assess impact on RICTs from the FLEX operator actions. The licensee stated that for the sensitivity studies, the base independent FLEX HEP values associated with portable FLEX equipment were increased by a factor of 10, and the joint HEPs that contained independent FLEX HEPs were increased by a factor of 5 in the internal events PRA model. The licensee explained that there were no joint HEPs in the fire PRA model. The licensee justified that these selected HEP values are bounding because it results in a 40 percent chance of failure of aligning the FLEX generator and about 30 percent chance of failure of aligning the FLEX pumps, resulting in approximately 50 percent likelihood of success of the FLEX equipment. The NRC staff finds the licensees justification of selected bounding values reasonable for the RICT application at Limerick.

The licensees reported sensitivity study results showed minor impact on the resultant RICTs for impacted LCOs, which are those that are most likely impacted by an extended loss of AC power, specifically LCOs 3.8.1.1.d (one offsite circuit and one DG inoperable), 3.8.1.1.f (one offsite circuit inoperable), 3.8.1.1.g (two offsite circuits inoperable), 3.8.2.1.a.3 (two battery chargers on one division inoperable), 3.8.2.1.c (any battery(ies) on one division of required DC electrical power sources inoperable), 3.8.3.1.a (one required AC distribution system divisions not energized), and 3.8.3.1.b (one required DC distribution system divisions not energized).

The licensee stated that no specific global RMAs were identified from these sensitivity studies, but that during a certain plant configuration based on the RTR tool, configuration-specific RMAs candidates would be identified. (The description of the licensees process for identifying RMAs is reviewed in Section 3.1.4.2 of this SE). Because the licensee performed and justified sensitivity studies on FLEX equipment failure probabilities and HEPs consistent with the guidance in NEI 06-09-A and showed minor impact on the RICTs, the NRC staff finds the licensees credit for FLEX acceptable for use for the RICT program for Limerick. Consistent with the guidance in NEI 06-09-A, the licensee will follow the guidance in NEI 06-09-A to identify RMAs on a case by case basis.

During the NRC staff audit of the Limerick TSTF-505 LAR, the NRC staff learned that the Limerick PRA credits digital I&C systems. The NRC staff noted that the lack of consensus industry guidance for modeling digital I&C systems in plant PRAs is a source of uncertainty. To address this concern, the NRC staff requested, in APLA RAI-08.b (Reference [9]), the licensee perform a sensitivity study to assess its impact of this uncertainty on the RICT program. In response to APLA RAI-08.b (Reference [4]), the licensee identified that Limerick has a digital feedwater control system that is modeled in the PRA. The licensee provided the results of a sensitivity study in which the failure probabilities for each of the basic events associated with the digital feedwater system were increased by a factor of 100 relative to the failure probabilities assumed in the model of record. The results showed no impact on the resultant RICTs for impacted LCOs (specifically, LCOs 3.5.1.c.1, HPCI system inoperable, and 3.7.3.a, RCIC system inoperable), which are greater than the 30-day backstop in each case.

The NRC staffs review indicates the licensee performed an adequate assessment to identify the potential sources of uncertainty, and the identification of the key assumptions and sources of uncertainty was appropriate and consistent with the guidance in NUREG-1855 and associated EPRI TR-1016737 and EPRI TR-1026511. Therefore, the NRC staff finds that the licensee has satisfied the guidance in RG 1.177, Revision 1 (Sections 2.3.4 and 2.3.5), and RG 1.174, Revision 3 (Section 2.2.2), and that the identification of assumptions and treatment of model uncertainties for risk evaluation of extended CTs is appropriate for this application and consistent with the guidance identified in NEI 06-09-A.

3.1.4.1.5 PRA Results and Insights The proposed change implements a process to determine TS RICTs rather than specific changes to individual TS CTs. NEI 06-09-A requires periodic assessment of the risk incurred due to operation beyond the front stop CTs due to implementation of the RICT program and comparison to the guidance of RG 1.174, Revision 3, for small increases in risk.

As with other unique risk-informed applications, supplemental risk acceptance guidelines that complement the RG 1.174 guidance are appropriate. NEI 06-09-A requires that configuration risk be assessed to determine the RICT and establishes the criteria for ICDP and ILERP on which to base the RICT. An ICDP of 1E-5 and an ILERP of 1E-6 are used as the risk measures for calculating individual RICTs. These limits are consistent with NUMARC 93-01, Revision 4A,

Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants (Reference [48]). The use of these limits in NEI 06-09-A aligns the TS CTs with the risk management guidance used to support plant programs for the Maintenance Rule, and the NRC staff accepted these supplemental risk acceptance guidelines for RMTS programs in its approval of NEI 06-09-A.

NEI 06-09-A, as modified by the limitations and conditions in the associated SE, requires that the cumulative impact of implementation of an RMTS be periodically assessed and shown to result in: (1) a total risk impact below 1E-5/year for changes to CDF, (2) a total risk impact below 1E-6/year for changes to LERF, and (3) the total CDF and total LERF must be reasonably shown to be less than 1E-4/year and 1E-5/year, respectively. The licensee indicated in of the LAR that the estimated total CDF and LERF meet the 1E-4/year CDF and 1E-5/year LERF criteria of RG 1.174, consistent with the guidance in NEI 06-09-A, and that these guidelines be satisfied whenever the RICT is implemented.

The licensee has incorporated NEI 06-09-A in the RICT program of TS 6.8.4.m, and therefore, can calculate the RICT consistently with its criteria and assess the RICT program to assure any risk increases are small per the guidance of RG 1.174, Revision 3, and intent of RG 1.177, Revision 1. Also, the estimate of the current total CDF and LERF meets the intent of RG 1.174, Revision 3, acceptance guidelines. Therefore, the NRC staff finds that the licensees RICT program is consistent with NEI 06-09-A guidance and is acceptable.

3.1.4.1.6 Implementation of the RICT Program Because NEI 06-09-A involves the real-time application of PRA results and insights by the licensee, the NRC staff reviewed the licensees description of programs and procedures associated with implementation of the RICT program in Enclosure 10 of its submittal. The administrative controls on the PRA and on changes to the PRA should provide confidence that the PRA results are reasonable and the administrative controls on the plant personnel using the RICT should provide confidence that the RICT program will be appropriately applied.

The means for demonstrating the technical acceptability of the PRA models include assessment against the ASME/ANS PRA Standards and RG 1.200, which include guidance for performing peer reviews and focused-scope peer reviews. The technical adequacy of the PRA model is discussed in Enclosure 2, Information Supporting Consistency with Regulatory Guide 1.200, Revision 2, and Enclosure 7, PRA Model Update Process, of the LAR. According to , Attributes of the Real-Time Risk Model, future changes made to the baseline PRA model, changes made to the baseline PRA model for translation to the online model, and changes made to the online model configuration files are controlled and documented by plant procedures.

NEI 06-09-A specifies that the RMTS risk assessment process should be integrated into station-wide work control processes and define the necessary attributes of the RMTS program structure. In the conduct of RMTS, procedural guidance is required for conducting and using the results of the risk assessment. These procedures should specify the station functional organizations and personnel, including operations, engineering, work management, and PRA personnel responsible for each step of the procedures. The procedures should also clearly specify the process for calculating the applicable RICT; implementing RMAs; conducting, reviewing, and approving decisions to exceed the front-stop CT; and removing equipment from service.

Enclosure 10, Program Implementation, of the LAR describes the implementing programs and procedures and the associated personnel training. The licensee explained that the RICT program description and implementing procedures will be developed. The program description will establish the management responsibilities and general requirements for risk management, training, implementation, and monitoring of the RICT program. More detailed procedures will provide specific responsibilities, limitations, and instructions for implementing the RICT program.

The program description and implementing procedures will incorporate the programmatic requirements for RMTS included in NEI 06-09-A. The program will be integrated with the existing Limerick online work control process. Entry into the RICT program will require management approval prior to pre-planned activities and as soon as practicable following emergent conditions. These and other attributes that will be addressed in the RICT program are identified in the LAR.

The NRC staff found that the licensee will establish appropriate programmatic and procedural controls for its RICT program, consistent with the guidance of NEI 06-09-A, Section 3.2.1.

NEI 06-09-A specifies that stations implementing an RMTS program shall provide training in the programmatic requirements associated with the RMTS program and of the individual RICT evaluations to personnel responsible for determining TS operability decisions or conducting RICT assessments. Training of plant personnel shall be provided for those organizations with functional responsibilities for performing or administering the CRMP (or RTR) commensurate with each positions responsibilities in accordance with 10 CFR 50.120(b)(3) and other applicable regulations within the RICT program, as described in NEI 06-09-A.

In Enclosure 10 of the LAR, the licensee described its program for providing training to its staff.

The licensee identified the attributes that the RICT program procedures will address, which are consistent with NEI 06-09-A. The licensee also identified the categories of plant personnel that will be trained and the different types of training that the different categories of plant personnel receive. This includes detailed or Level 1 training for individuals who will be directly involved in the implementation of the RICT program, Level 2 training for plant management positions with authority to approve entry into the RICT program and other management and personnel who closely support the RICT program, and Level 3 training for personnel who need basic knowledge of RICT program requirements and procedures.

The NRC staff reviewed the description of the training program provided in the LAR and concluded that the program is consistent with the training requirements set forth in NEI 06-09-A.

Therefore, the NRC staff finds that the licensee has proposed acceptable administrative controls on the PRA and on the personnel that will use the RICT program.

3.1.4.2 Tier 2: Avoidance of Risk-Significant Plant Configurations The second tier provides that a licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is taken out of service in accordance with the proposed TS change.

NEI 06-09-A does not permit voluntary entry into high-risk configurations, which would exceed instantaneous CDF and LERF limits of 1E-3/year and 1E-4/year, respectively. The guidance in NEI 06-09-A specifies that if the instantaneous CDF and LERF limits are exceeded for emergent conditions, then implementation of RMAs is required. It further requires implementation of RMAs when the actual or anticipated risk accumulation during the RICT will exceed one-tenth of the ICDP or ILERP limit (the RMAT). Such RMAs may include rescheduling planned activities to lower risk periods or implementing risk-reduction measures. The limits established for entry

into the RICT and for RMA implementation are consistent with the guidance of NUMARC 93-01, Revision 4A, endorsed by RG 1.160, Revision 3, as applicable, to plant maintenance activities.

The RICT program requirements and criteria are consistent with the principle of Tier 2 to avoid risk-significant configurations.

Consistent with NEI 06-09-A, Enclosure 12 of the LAR identifies three kinds of RMAs (i.e.,

actions to provide increased risk awareness and control, actions to reduce the duration of maintenance activities, and actions to minimize the magnitude of the risk increase). 2 of the LAR also provides examples of RMAs for a few selected LCO conditions.

In APLA RAI-05 (Reference [9]), the NRC staff requested a description of the criteria and insights that will be used to determine the compensatory measures and RMAs to apply in specific instances for specific plant configurations. In response to APLA RAI-05.a (Reference [3]), the licensee explained that determination of RMAs is performed using plant procedures and involves both qualitative and quantitative considerations for specific plant configuration and the consideration of the practical means available to manage risk. The licensee stated that development of RMAs is performed in a graded manner and considers RMAs developed for the Maintenance Rule, 10 CFR 50.65(a)(4) program. Besides the three kinds of RMAs cited above, the licensee stated it uses general, configuration-specific, and common cause RMAs. The licensee stated that general RMAs include:

Consideration of rescheduling maintenance to reduce risk, Discussion of RICT in pre-job briefs, Consideration of proactive return-to-service of other equipment, and Efficient execution of maintenance.

The licensee stated that configuration-specific RMAs are also developed based on the RTR tool to identify candidates to manage the risk associated with internal events, internal flooding, and fire events. These actions include:

Identification of important equipment or trains for protection, Identification of important operator actions for briefings, Identification of key fire initiators and fire zones for RMAs in accordance with the site fire RMA process, Identification of dominant initiating events and actions to minimize potential for initiators, and Consideration of insights from PRA model cutsets, through comparison of importance.

Further, the licensee stated that common cause RMA candidates include:

Performance of non-intrusive inspections on alternate trains, Confidence runs performed for standby SSCs, Increased monitoring for running components, Expansion of monitoring for running components, Deferring maintenance and testing activities that could generate an initiating event, which would require operation of potentially affected SSCs, Readiness of operators and maintenance to respond to additional failures, and Shift briefs or standing orders which focus on initiating event response or loss of potentially affected SSCs.

In response to RAI-05.b (Reference [3]), the licensee explained that common cause RMAs are additional RMAs focused on (1) ensuring the availability of redundant components, (2) ensuring availability of diverse or alternate systems, (3) reducing the likelihood of initiating events that require operation of the out-of-service components, and (4) ensuring the readiness of plant personnel to respond to additional failures. The licensee also stated that these RMAs can include pre-identified RMAs as described above, as well system specific RMAs. The NRC staff concludes the licensees process for developing RMAs is in accordance with NEI 06-09-A because it utilizes configuration-specific risk insights and specifically considers the potential for CCFs in emergent conditions.

Based on the licensees incorporation of NEI 06-09-A in the TS as discussed in LAR and use of RMAs as discussed in LAR Enclosure 12 and the RAI supplemental information, and because the proposed changes are consistent with the guidance of RG 1.174; Revision 3; and RG 1.177, Revision 1, the NRC staff finds the licensees Tier 2 program is acceptable and supports the proposed implementation of the RICT program.

3.1.4.3 Tier 3: Risk-Informed Configuration Risk Management The third tier provides that a licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity.

NEI 06-09-A addresses Tier 3 guidance by requiring assessment of the RICT to be based on the plant configuration of all SSCs that might impact the RICT, including safety-related and non-safety-related SSCs. If a risk-significant plant configuration exists based on the expectation of exceeding a threshold of one-tenth of the risk on which the RICT is based, compensatory measures and RMAs are required to be implemented. Thus, the RICT program provides an acceptable methodology to assess and address risk-significant configurations. Further, reassessment of any plant configuration changes is also required to be completed in a timely manner based on the more restrictive limit of any applicable TS action requirement or a maximum of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the configuration change occurs.

Based on the licensees incorporation of NEI 06-09-A in the TSs, as discussed in LAR , and use of RMAs as discussed in LAR Enclosure 12, as supplemented in the RAI response, and because the proposed changes are consistent with the Tier 3 guidance of RG 1.177, Revision 1, the NRC staff finds that the proposed changes are acceptable.

3.1.4.4 Key Principle 4 Conclusions The licensee has demonstrated the technical acceptability and scope of its PRA models and that the models can support implementation of the RICT program for determining CTs. The licensee has made proper consideration of key assumptions and sources of uncertainty. The risk metrics are consistent with the approved methodology of NEI 06-09-A and the acceptance guidance in RG 1.177 and RG 1.174. The RICT program is controlled administratively through plant procedures and training. The RICT program follows the NRC-approved methodology in NEI 06-09-A. The NRC staff concludes that the RICT program satisfies the fourth key safety principle of RG 1.177, and is, therefore, acceptable.

3.1.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program RG 1.177, Revision 1, and RG 1.174, Revision 3, establish the need for an implementation and monitoring program to ensure that extensions to TS CTs do not degrade operational safety over time and that no adverse degradation occurs due to unanticipated degradation or common cause mechanisms. An implementation and monitoring program is intended to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the change. Revision 3 of RG 1.174 states that monitoring performed in conformance with the Maintenance Rule, 10 CFR 50.65, can be used when the monitoring performed is sufficient for the SSCs affected by the risk-informed application. According to LAR 1, the SSCs in the scope of the RICT program are also in the scope of the Maintenance Rule. The Maintenance Rule monitoring programs will provide for evaluation and disposition of unavailability impacts that may be incurred from implementation of the RICT program.

Section 3.3.3 of NEI 06-09-A instructs the licensee to track the risk associated with all entries beyond the front stop CT, and Section 2.3.1 provides a requirement for assessing cumulative risk, including a periodic evaluation of any increase in risk due to the use of the RMTS program to extend the CTs. According to LAR Enclosure 11, the licensee calculates cumulative risk at least every refueling cycle, but the recalculation period does not exceed 24 months, which is consistent with NEI 06-09-A. The licensee converts the cumulative ICDP and the ILERP into average annual values, which are then compared to the acceptance guidelines of RG 1.174. If any acceptance guidelines are exceeded, corrective actions are taken to ensure that future plant operational risk is within the acceptance guidelines. This evaluation assures that RMTS program implementation meets RG 1.174 guidance for small risk increases.

The NRC staff concludes that the RICT program satisfies the fifth key safety principle of RG 1.177, Revision 1, and RG 1.174 by, in part, by monitoring the average annual cumulative risk increase as described in NEI 06-09-A and using this average annual increase to ensure the program as implemented meets RG 1.174 guidance for small risk increases, and therefore, is acceptable. Additionally, the NRC staff concludes that the RICT program satisfies the fifth key safety principle of RG 1.177, Revision 1, and RG 1.174 because, in part, all the affected SSCs are within the Maintenance Rule program that can be used to monitor changes to the reliability and availability of these SSCs.

3.2 Variations from TSTF-505 The NRC staff evaluated the proposed use of RICTs in the variations stated above in Section 2.2.4 in conjunction with evaluating the proposed use of RICTs in each of the individual LCO actions and CTs stated above in Section 2.2.2. The NRC staffs evaluation of the licensees proposed use of RICTs in the variations against the key safety principles is discussed above in Sections 3.1.1 through 3.1.5. Based on the above Sections 3.1.1 through 3.1.5, the NRC staff finds that each of the five key principles in RG 1.177, Revision 1, and RG 1.174, Revision 3, have been met and concludes that the proposed variations are acceptable.

3.2.1 Deletion of Time in TS Footnotes The licensee proposes to delete the 7-day time in TS 3.6.2.3 footnote **, TS 3.7.1.2 footnote #,

and both footnotes

in TS 3.8.1.1. The current footnotes are shown above in Section 2.2.4.2.

The proposed footnotes will state:

LCO 3.6.2.3 Suppression Pool Cooling (Units 1 and 2)

Footnote ** During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for one inoperable suppression pool cooling loop may also be extended to 7 days, or in accordance with the Risk Informed Completion Time Program, for the same period.

LCO 3.7.1.2 Emergency Service Water [ESW] System - Common System (Units 1 and 2)

Footnote # During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for one inoperable emergency service water system loop may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

LCO 3.8.1.1 A.C. Sources - Operating (Units 1 and 2)

Footnote

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT for two inoperable diesel generators may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

Footnote

During the extended Allowed Outage Time (AOT) specified by TS LCO 3.7.1.1, Action a.3.a) or a.3.b) to allow for RHRSW subsystem piping repairs, the 72-hour AOT may also be extended to 7 days or in accordance with the Risk Informed Completion Time Program for the same period.

These TS footnotes were implemented as a result of Amendment Nos. 203 and 165 for Limerick, Units 1 and 2, respectively. Currently, these TS footnotes allow the AOT for the suppression pool cooling mode of the RHR system in TS 3.6.2.3 Action a, the ESW system in TS 3.7.1.2 Action a.3, and the AC sources for the EDGs in TS 3.8.1.1 Actions b and e.1 to be extended up to 7 days when the extended AOT for TS 3.7.1.1 Action a.3.a) or Action a.3.b) is entered. The extended AOT allows time for the licensee to accomplish the repairs on the RHRSW subsystem piping.

When the RICT program is used to extend the TS 3.7.1.1 AOT for Action a.3.a) or Action a.3.b) beyond the 7-day front stop, this causes the referenced 7-day AOT in these footnotes to be inaccurate and in conflict with TS 3.7.1.1. Deletion of the referenced 7-day AOT for TS 3.7.1.1 in these footnotes removes the conflict between the TSs when utilizing the RICT program. The allowance to extend the AOT to 7 days in TS 3.6.2.3 Action a, TS 3.7.1.2 Action a.3, and TS 3.8.1.1 Actions b and e.1 is not affected by the deletion of 7-day in the footnotes because the 7-day AOT is stated in TS 3.7.1.1 Actions a.3.a) and a.3.b). Because the footnote allowance to extend the AOT in TS 3.6.2.3 Action a, TS 3.7.1.2 Action a.3, and TS 3.8.1.1 Actions b and e.1 to 7 days, when the RICT is not applied, is unchanged, and the potential TS conflict while utilizing the RICT program is removed, the NRC staff finds the proposed change to

be acceptable. The NRC staffs evaluation of the application of the RICT to these footnotes is discussed separately in this SE.

3.3 TS Administrative Controls Section The NRC staff reviewed the licensees proposed addition of a new program, the RICT program, to the administrative controls section of the TSs. The NRC staff evaluated the elements of the new program to ensure alignment with the requirements in 10 CFR 50.36(c)(5) and to ensure the programmatic controls are consistent with the RICT program described in NEI 06-09-A.

TS 6.8.4.m requires that the RICT program be implemented in accordance with NEI 06-09-A.

This is acceptable because NEI 06-09-A establishes an appropriate framework for an acceptable RICT program.

The TS states that the RICT may not exceed 30 days. The NRC staff determined that 30-day limit is appropriate because it allows sufficient time to restore SSCs to operable status while avoiding excessive out-of-service times for TS SSCs.

The TS states that the RICT may only be used in operational conditions (or Modes) 1 and 2.

This provision ensures that the RICT is only used for determination of CDF and LERF for modes of operation modeled in the PRA.

The TSs require that while in the RICT, any change in plant configuration as defined in NEI 06-09-A must be considered for the effect on the RICT. The TSs also specify time limits for determining the effect on the RICT. These time limitations are consistent with those specified in NEI 06-09-A.

The TSs contain requirements for the treatment of CCFs for emergent conditions in which the common cause evaluation is not complete. The requirements are to either (a) numerically account for the increased probability of CCF or (b) to implement RMAs that support redundant or diverse SSCs that perform the functions of the inoperable SSCs and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs. Key Principle 2 of risk-informed decisionmaking is to assure that the change is consistent with defense-in-depth philosophy. The seven considerations supporting the evaluation of the impact of the change on defense in depth are discussed in RG 1.174, including one to preserve adequate defense against potential CCF. The NRC staff finds that numerically accounting for an increased probability of failure will shorten the estimated RICT based on the particular SSCs involved, thereby limiting the time when a CCF could affect risk. Alternatively, implementing actions that can increase the availability of other mitigating SSCs or decrease the frequency of demand on the affected SSCs will decrease the likelihood that a CCF could affect risk. The NRC staff concludes that both the quantitative and the qualitative actions minimize the impact of CCF, and therefore, support meeting Key Principle 2 as described in RG 1.174.

These methods either limit the exposure time, help ensure the availability of alternate SSCs, or decrease the probability of plant conditions requiring the safety function to be performed. The NRC staff finds that these methods contribute to maintaining defense in depth because the methods limit the exposure time or ensure the availability of alternate SSCs.

The TSs contain a provision that risk assessment approaches and methods used shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant, and reflect the operating experience at the plant, as specified in RG 1.200, Revision 2. Methods to assess the risk from extending the CTs must be PRA methods used to

support this LAR or other methods approved by the NRC for generic use. As stated in the NRC staffs SE of NEI 06-09:

TR NEI 06-09, Revision 0, requires an evaluation of the PRA model used to support the RMTS against the requirements of RG 1.200, Revision 1, and ASME RA-S-2002, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, for capability Category II. This assures that the PRA model is technically adequate for use in the assessment of configuration risk. This capability category of PRA is sufficient to support the evaluation of risk associated with out of service SSCs and establishing risk-informed CTs.

TS 6.8.4.m was updated to reflect the current revision, Revision 2 of RG 1.200. RG 1.200 incorporates ASME RA-S-2002 by reference.

The NRC staffs SE of NEI 06-09 also states:

As part of its review and approval of a licensees application requesting to implement the RMTS, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods approved by the NRC staff for use in the plant-specific RMTS program. If a licensee wishes to change its methods, and the change is outside the bounds of the license condition, the licensee will need NRC approval, via a license amendment, of the implementation of the new method in its RMTS program. The focus of the NRC staffs review and approval will be on the technical adequacy of the methodology and analyses relied upon for the RMTS application.

This limitation and condition is being relocated from a license condition to the administrative controls section of the TSs. Proposed TS 6.8.4.m restates this limitation and condition from the NRC staffs SE in language that is appropriate for the administrative controls section of the Limerick TSs. This constraint appropriately requires the licensee to utilize the risk assessment approaches and methods previously approved by the NRC and/or incorporated in the RICT program and requires prior NRC approval for any change in PRA methods to assess risk that is outside those approval boundaries. The NRC staff finds that this requirement is appropriately reflected in the administrative controls section of the Limerick TSs.

The regulations in 10 CFR 50.36(c)(5) require the TSs to contain administrative controls providing provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner.

The NRC staff has determined that the administrative controls section of the TSs will assure operation of the facility in a safe manner when the facility uses the RICT program. Therefore, the NRC staff has determined that the requirements of 10 CFR 50.36(c)(5) are satisfied.

4.0

SUMMARY

4.1 NRC Staff Findings and Conclusions The NRC staff finds that the licensees proposed implementation of the RICT program for the identified scope of RMAs is consistent with the guidance of NEI 06-09-A, subject to the limitations and conditions evaluated in Section 4.0 of this SE. The licensees methodology for assessing the risk impact of extended CTs, including the individual CT extension impacts in terms of ICDP and ILERP, and the overall program impact in terms of CDF and LERF, is

accomplished using PRA models of sufficient scope and technical adequacy based on consistency with the guidance of RG 1.200, Revision 2, with completion of the implementation items. The RICT calculation uses the PRA model as translated into the CRMP tool, and the licensee has an acceptable process in place to ensure the PRA model continues to use NRC accepted methods and is appropriately updated to reflect changes to the plant or operating experience. In addition, the NRC staff finds that the proposed implementation of the RICT program addresses the RG 1.177 defense-in-depth philosophy and safety margins to ensure that they are adequately maintained and includes adequate administrative controls, as well as performance monitoring programs.

The regulation in 10 CFR 50.36(a)(1) states, in part: A summary statement of the bases or reasons for such specifications other than those covering administrative controls shall also be included in the application, but shall not become part of the technical specifications.

Accordingly, along with the proposed TS changes, the licensee also submitted TS Bases changes that correspond to the proposed TS changes to provide the reasons for the TSs. The NRC staff finds that the TS Bases changes are consistent with the Bases changes in the model SE.

4.2 Technical Evaluation Conclusions The NRC staff has evaluated the proposed changes against each of the five key principles in RG 1.177, Revision 1, and RG 1.174, Revision 3.

The proposed changes to the LCO conditions and the CTs for remedial actions are acceptable and will continue to meet 10 CFR 50.36(c)(2), 50.57(a)(2), and 50.57(a)(6). Therefore, the NRC staff concludes that the proposed change meets Key Principle 1 - change meets current regulations.

For LCO conditions in the existing TSs, some reduction in defense in depth has already been evaluated and accepted for a limited period of time during the current CT, and the RICT provides solely a risk-informed extension for operating in that plant condition. Therefore, the NRC staff concludes that the proposed change meets Key Principle 2 - change is consistent with defense-in-depth philosophy.

Implementation of the methodology as described in the licensees TS 6.8.4.m provides confidence that the licensee can extend the CTs without any unanalyzed reductions in safety margins because the design-basis success criteria parameters will be at the same level and provided by the same equipment as has been currently accepted. Therefore, the NRC staff concludes that the proposed change meets Key Principle 3 - maintains sufficient safety margins.

The licensee has demonstrated the technical acceptability and scope of its PRA models after completion of the limitations in the license condition, and that the models can support implementation of the RICT program for determining the identified CTs. The licensee has considered the impacts of seismic events, non-seismic external hazards, and other hazards in the RICT calculations. In accordance with NEI 06-09-A, the licensee will include a conservative penalty for seismic risk in the RICT calculations, as discussed in Section 3.1.4.1.2 of this SE.

The risk metrics will be consistent with the NRC-approved methodology of NEI 06-09-A; RG 1.174, Revision 3; RG 1.177, Revision 1; and the RICT program is controlled administratively through plant procedures and training. Therefore, the NRC staff concludes that the proposed change meets Key Principle 4 - proposed increases in CDF or risk are small and are consistent with the Commissions Safety Goal Policy Statement.

The licensee takes the sum of the contributors to risk associated with each application of the RICT program, and that change in CDF or LERF above the zero maintenance baseline levels is converted into average annual values, which are then compared to the limits of RG 1.174. If any limits are exceeded, corrective actions are taken to ensure future plant operational risk is within the acceptance guidance. The SSCs in the scope of the RICT program that have their CTs extended by entry into the RICT program are monitored to ensure their safety performance is not degraded because the SSCs in the scope of the RICT program are also in the scope of the Maintenance Rule. Revision 3 of RG 1.174 states that monitoring performed in conformance with the Maintenance Rule, 10 CFR 50.65, can be used when the monitoring performed is sufficient for the SSCs affected by the risk-informed application. The NRC staff, therefore, concludes that the proposed change meets Key Principle 5 - use performance measurement strategies to monitor the change.

The NRC staff concludes that the proposed changes satisfy the key principles of risk-informed decisionmaking identified in RG 1.174, Revision 3, and RG 1.177, Revision 1, and therefore, the requested adoption of the proposed changes to the TSs, implementation items, and associated guidance is acceptable.

The regulation in 10 CFR 50.36(a)(1) states, in part: A summary statement of the bases or reasons for such specifications shall also be included in the application, but shall not become part of the technical specifications. Accordingly, along with the proposed TS changes, the licensee also submitted TS Bases changes that corresponded to the proposed TS changes for information only.

5.0 STATE CONSULTATION

In accordance with the Commissions regulations, the State of Pennsylvania official was notified of the proposed issuance of the amendments on December 31, 2019. The State official had no comments.

6.0 ENVIRONMENTAL CONSIDERATION

The amendments changes requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on March 26, 2019 (84 FR 11338). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the

amendment(s) will not be inimical to the common defense and security or to the health and safety of the public.

8.0 REFERENCES

[1] Barstow, J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, December 13, 2018 (ADAMS Accession No. ML18347B366).

[2] Helker, D. P., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Supplement to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b'", February 14, 2019 (ADAMS Accession No. ML19045A011).

[3] Gudger, D.T., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Response to Request for Additional Information, License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, August 12, 2019 (ADAMS Accession No. ML19224B705).

[4] Gudger, D.T., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Response to Request for Additional Information, License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, August 27, 2019 (ADAMS Accession No. ML19239A004).

[5] Shannon Rafferty-Czincila, Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Response to Request for Additional Information, License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, January 7, 2020 (ADAMS Accession No. ML20008D203).

[6] TSTF-505, Revision 2, TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk-Informed Extended Completion Times and Submittal of TSTF-505, Revision 2", July 2, 2018 (ADAMS Package Accession No. ML18183A493).

[7] U.S. NRC, Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, "Provide Risk Informed Extended Completion Times - RITSTF Initiative 4B," November 21, 2018 (ADAMS Accession No. ML18269A041).

[8] Sreenivas, V., U.S. Nuclear Regulatory Commission, letter to Bryan C. Hanson, Exelon Generation Company, LLC, Limerick Generating Station, Units 1 and 2; Braidwood Station, Units 1 and 2; and Byron Station, Units 1 and 2, Audit Summary in Support of the License Amendment Request to Adopt Risk Informed Completion Times Technical Specification Task Force-505, Revision 2, Provide Risk-Informed Completion Times -

RITSTF Initiative 4b, for Exelon Generation Company (EPID L-2018-LLA-0567 and EPID L-2018-LLA-0727), September 30, 2019 (ADAMS Accession No. ML19253A963).

[9] Sreenivas, V., U.S. Nuclear Regulatory Commission, email to Stewart, G., Exelon Generation Company, LLC, Limerick - Request for Additional Information: Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Completion Times -

RITSTF Initiative 4b, July 10, 2019 (ADAMS Accession No. ML19192A031).

[10] Sreenivas, V., U.S. Nuclear Regulatory Commission, email to Stewart, Glenn, Exelon Generation Company, LLC, Request for additional information (RAI) - Limerick Units 1 and 2: TSTF-505, Use of risk informed completion times (RICTs) for actions to be taken when limiting conditions for operation (LCOs) are not met", December 9, 2019 (ADAMS Accession No. ML19344A024 and ML19344A033).

[11] Topical Report NEI 06-09, Risk Informed Technical Specifications Initiative 4b: Risk Managed Technical Specification (RMTS), Revision 0-A, October 2012 (ADAMS Accession No. ML122860402).

[12] Final Safety Evaluation For Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06 09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).

[13] Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009 (ADAMS Accession No. ML090410014).

[14] Regulatory Guide 1.174, Revision 3, An Approach for Plant-Specific, Risk-Informed Decision-making: Technical Specifications, January 2018 (ADAMS Accession No. ML17317A256).

[15] Regulatory Guide 1.177, Revision 1, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, May 2011 (ADAMS Accession No. ML100910008).

[16] ASME/ANS, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, PRA Standard ASME/ANS RA-Sa-2009, June 2005.

[17] Boiling Water Reactor Owner's Group, letter to the U.S. Nuclear Regulatory Commission regarding the ATWS rule (ADAMS Legacy Accession No. 8508220249), July 16, 1985.

[18] Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 1, January 2017 (ADAMS Accession No. ML070240001).

[19] ASME, Draft Addenda B to ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, June 2005.

[20] Limerick Generating Station, Units 1 and 2, Renewed Facility Operating License Nos.

DPR-39 and DPR-85, NRC Docket Nos. 50-352 and 50-353, Submittal of Relief Requests Associated with the Fourth 10-Year Interval lnservice Inspection (ISI) Program", April 13, 2016 (ADAMS Accession No. ML16104A122).

[21] "Limerick Generating Station, Units 1 and 2, Renewed Facility Operating License Nos.

NPF-39 and NPF-85, NRC Docket Nos. 50-352 and 50-353, Response to Request for Additional Information Regarding Proposed Relief Request 14R-01 for Limerick Generating Station, Units 1 and 2," September 19, 2016 (ADAMS Accession No. ML16263A218).

[22] ASME, Addenda to ASME RA-S-2002 Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, PRA Standard ASME RA-Sb-2005.

[23] Barstow J., Exelon Generation Company, LLC, letter to U.S. NRC, "Limerick Generating Station, Units 1 and 2, Renewed Facility Operating License Nos. NPF-39 and NPF-85, NRC Docket Nos. 50-353 and 50-353, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants," June 28, 2017 (ADAMS Accession No. ML17179A161).

[24] Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, "Limerick Generating Station, Units 1 and 2, Renewed Facility Operating

License Nos. NPF-39 and NPF-85, NRC Docket Nos. 50-353 and 50-353, Supplement to Application to Adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of SSCs for NPPs," August 14, 2017 (ADAMS Accession No. ML17226A336).

[25] Andersen, Victoria, Nuclear Energy Institute, letter to Rosenberg, Stacey, U.S. Nuclear Regulatory Commission, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations", February 21, 2017 (ADAMS Package Accession No. ML17086A431).

[26] NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, November 2008 (ADAMS Accession No. ML083430462).

[27] NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Draft Version H, Revision 0, Nuclear Energy Institute, Washington, DC, November 2008 (ADAMS Package Accession No. ML17086A431).

[28] Nuclear Energy Institute, "External Hazards PRA Peer Review Process Guidelines," NEI 12-13, dated August 2012 (ADAMS Package Accession No. ML122400044).

[29] U.S. NRC letter to Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations (F&Os)", May 3, 2017 (ADAMS Accession No. ML17079A427).

[30] Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, "Limerick Generating Station, Units 1 and 2, Renewed Facility Operating License Nos. NPF-39 and NPF-85, NRC Docket Nos. 50-353 and 50-353, Response to Request for Additional Information, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants," January 19, 2018 (ADAMS Accession No. ML18019A091).

[31] Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, "Limerick Generating Station, Units 1 and 2, Renewed Facility Operating License Nos. NPF-39 and NPF-85, NRC Docket Nos. 50-353 and 50-353, Response to Request for Additional Information, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants," April 23, 2018 (ADAMS Accession No. ML18113A870).

[32] NUREG-1855, Revision 1, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2017 (ADAMS Accession No. ML17062A466).

[33] Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Seismic Hazard and Screening Report (Central and Eastern United States (CEUS) Sites), Response to NRC Request for Information Pursuant to 10 CFR 50.54(f)

Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident, March 31, 2014 (ADAMS Accession No. ML14090A236).

[34] U.S. NRC, Generic Issue 199, Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants, August 2010 (ADAMS Package Accession No. ML100270582).

[35] PECO letter to NRC, Limerick Generating Station, Units 1 and 2, Response to Request for Additional Information Regarding Consideration of Severe Accident Mitigation Design Alternatives, June 23, 1989.

[36] Pacific Northwest National Laboratory, prepared for U.S. NRC, NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States, February 2007 (ADAMS Accession No. ML070810400).

[37] Exelon Generation Company, LLC, RS-15-064, "Exelon Generation Company, LLC Response to March 12, 2012, Request for Information Enclosure 2, Recommendation 2.1, Flooding, Required Response 2, Flood Hazard Reevaluation Report", March 12, 2015 for Limerick Generating Station (ADAMS Accession No. ML15084A586).

[38] Barstow J., Exelon Generation Company, LLC, letter to U.S. Nuclear Regulatory Commission, Exelon Generating Company, LLC Response to March 12, 2012, Request for Information Enclosure 2, Recommendation 2.1, Flooding, Required Response 2, Flood Hazard Reevaluation Report, March 12, 2015 (ADAMS Accession No. ML15084A586).

[39] NUREG/CR-3539, Impact of Containment Building Leakage on LWR Accident Risk, April 1984.

[40] NUREG/CR-5565, The Response of BWR Mark II Containments to Station Blackout Severe Accidents, May 1991.

[41] NUREG/CR-5485, Guidelines on Modeling Common Cause Failures in Probabilistic Risk Assessment, November 1998.

[42] NUREG-1855, Revision 0, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009 (ADAMS Accession No. ML090970525).

[43] Electric Power Research Institute, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, TR-1016737, December 2008.

[44] Electric Power Research Institute, Practical Guidance of the Use of Probabilistic Risk Assessment in Risk-informed Applications with a Focus on the Treatment of Uncertainty, TR-1026511.

[45] U.S. Nuclear Regulatory Commission, Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-informed Decision Making,' Guidance for Risk-informed Changes to Plants Licensing Basis", May 30, 2017 (ADAMS Accession No. ML17031A269).

[46] Anthony R. Pietrangelo, Nuclear Energy Institute (NEI), letter to U.S. Nuclear Regulatory Commission, Transmittal of NEI 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, August 26, 2016 (ADAMS Accession No. ML16286A297).

[47] NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 4A, (ADAMS Accession No. ML11116A198).

[48] U. N. R. Commission, letter to Boiling Water Reactor Owner's Group regarding ATWS rule (ADAMS Legacy Accession No. 8508220244), August 19, 1985.

Principal Contributors: M. Biro S. Dinsmore S. Vasavada M. Li R. Mathew K. Bucholtz T. Brimfield K. Tetter V. Sreenivas Date: February 28, 2020

ML20034F637 *by memorandum **by e-mail OFFICE NRR/DORL/LPL1/PM NRR/DORL/LPL1/LA NRR/DSS/SNSB/BC(A)*

NAME VSreenivas LRonewicz JBorromeo DATE 02/06/2020 02/06/2020 01/06/2020 OFFICE NRR/DRA/APLC/BC* NRR/DRA/APLA/BC* NRR/DSS/STSB/BC**

NAME SRosenberg RPascarelli VCusumano DATE 1/31/2020 01/31/2020 12/03/2019 OFFICE NRR/DEX/EEOB/BC(A)* NRR/DEX/EICB/BC(A)** OGC- NLO**

NAME DWilliams WMorton AGhosh Naber DATE 09/25/2019 10/30/2019 02/20/2020 OFFICE NRR/DORL/LPL1/BC NRR/DORL/LPL1/PM NAME JDanna VSreenivas DATE 02/28/2020 02/28/2020

v t e Letter Sequence Approval
EPID:L-2018-LLA-0567, TSTF-505 (Approved, Closed)
Initiation Request, Request, Request Acceptance, Acceptance Supplement, Supplement Administration Questions 10 July 2019 10 December 2019 Answers 12 August 2019 27 August 2019 7 January 2020 13 June 2018 Results Approval, Approval Other: ML19133A086, ML19253A963
MONTHYEAR2019-03-04 [Table View]

ML20034F637

Text

SUBJECT:

Dear Mr. Hanson:

Enclosures:

Attachment:

Attachment:

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

SUMMARY

5.0 STATE CONSULTATION

6.0 ENVIRONMENTAL CONSIDERATION

7.0 CONCLUSION

8.0 REFERENCES

Navigation menu

Search