Text

Proposed Tech Specs,Revising ITS Bases That Will Update NRC Copies of ITS
	ML20195B809
Person / Time
Site:	Crystal River
Issue date:	05/26/1999
From:	; FLORIDA POWER CORP.
To:	;
Shared Package
ML20195B806	List: 3F0599-10, Submits Changes Made to Crystal River,Unit 3 Its,As Required by ITS 5.6.2.17.Encl Provides Revs to Plant ITS Bases That Will Update NRC Copies of Its.Instructions for Updating ITS, Encl; ML20195B809;
References
	NUDOCS 9906030062
	Download: ML20195B809 (97)
	v • d • e

n ,

1 a .

I l

i

\

f FLORIDA POWER CORPORATION 1 l

CRYSTAL RIVER UNIT 3 WKET NUMBER 50-302/ LICENSE NUMBER DPR-72 ATTACHMENT C REPLACEMENT ITS BASES PAGES 000 q :]

PDR

T . 3 RCS Pressure SL B 2.1.2

. t'%

(j BASES

. SAFETY LIMIT 2,2.6~

VIOLATIONS (continued) If the RCS pressure SL is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in i accordance with 10 CFR 50.73 (Ref. 9). A copy of the report !

shall also be provided to the NGRC, the Director, Nuclear l Plant Operations, and the Chief Nuclear Officer. l The 10 CFR 50.73 part against which a Safety Limit violation would be reported is: 1) completion of a plant shutdown required by Technical Specifications, (10 CFR 50.73(a)(2)(1)(A)),'2) an event which resulted in an unana'lyzed condition that significantly compromised plant safety, (10 CFR 50.73(a)(2)(iv)).

2,2,7 If the RCS pressure SL is violated, operation of the plant shall not be resumed until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, l analyses, and actions are completed by establishing

[] -

limitations on ascending MODES or other specified conditions Q in the Applicability until the NRC review is coniplete.

REFERENCES 1. FSAR, Section 1.4.

l

2. ASME Boiler and Pressure Vessel Code,Section III, I' l Article NB-7000.

3. ASME Boiler and Pressure Vessel Code,Section XI, Articles IWA-5000 and IWB-5000.

4. BAW-10043, May 1972. I

5. FSAR, Section 14.

l 6. ASME USAS B31.7, Code for Pressure Piping, Nuclear l

! Power Piping, February 1968 Draft Edition. '

l 1

l (continued)

Crystal River Unit 3 B 2.0 11 Amendment No. 168 E

v RCS Pressure SL B 2.1.2 BASES REFERENCES 7. 10 CFR 100.

(continued)

8. 10 CFR 50.72.

9. 10 CFR 50.73.

O Crystal River Unit 3 B 2.0-12 Revision 11

" SDM B 3.1.1 BASES APPLICABLE during secondary system chemistry control and steam SAFETY ANALYSIS generator cleaning, the initial SDM in the core must be (continued) adjusted. The basis for the SDM shutdown requirement when high steam generator levels exist is the heat removal potential in the secondary system fluid and the negative reactivity added via MTC. At any given initial primary system temperature and its associated secondary system pressure, the secondary system liquid levels can be equated to a final primary system temperature assuming the entire mass is boiled. The resulting RCS temperature determines the required SDM.

SDM satisfies Criterion 2 of the NRC Policy Statement.

LCO SDM requirements assume the highest worth rod is stuck in the fully withdrawn position to account for a postulated untrippable rod prior to reactor shutdown.

The figure in the COLR is used to define the SDM when high steam generator levels exist during secondary system

, chemistry control and steam generator cleaning .in MODES 3, 1 4, and 5 and represents a series of initial conditions that ensure the core will remain subcritical following an MSLB accident initiated from those conditions.

1 APPLICABILITY In MODES 3, 4, and 5, the SDM requirements ensure sufficient negative reactivity to meet the assumptions of the safety analysis discussed above. In MODES 1 and 2 SDM is ensured i by complying with LCO 3.1.5 and LCO 3.2.1. In MODE 6, the !

shutdown reactivity requirements are given in LCO 3.9.1,

" Boron Concentration." i ACTIONS 6.d If the SDM requirements are not met, boration must be i initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration to restore SDM will be continued until the SDM requirements are met. If the SDM is less than the limit n (continued)

U Crystal River Unit 3 B 3.1-3 Amendment No. 149

SDM B 3.1.1 BASES ACTIONS a.d (continued) for the steam generator level and RCS temperature specified in the COLR or 1% A k/k, RCS boration must be continued until the applicable limit is met.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid storage tank or the barated water storage tank.

The operator should borate with the best source available given the existing plant conditions.

In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS baron concentration is at the beginning of cycle, when the boron concentration may approach or exceed 2000 ppm. For examp e, pumping a boric acid solution with 11,600 ppm boron at 0 m will result in the addition of 1% A k/k negative reactivi in approximately 120 minutes at typical BOC conditions. l Sligh ly shorter times can be achieved when ther same <

negat ve reactivity addition is made later in the fuel cycle when the initial RCS boron concentration is lower. Other flowrates and boric acid supply concentrations can be used to provide equivalent results.

SURVEILLANCE SR 3.1.1.1 REQUIREMENTS The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:

a. RCS boron concentration;

b. Regulating rod position;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration; and

f. Samarium concentration.

(continued)

Crystal River Unit 3 8 3.1-4 Revision No. 17 1

u a

RPS Instrumentation B 3.3.1 O

%J BASES APPLICABLE 6.

SAFETY ANALYSES, Reactor Buildina Hiah Pressure (continued)

LCO, and the other RCS parameters have varied significantly; APPLICABILITY thus, minimizing accident consequences. This trip Function also provides a backup to RPS trip strings exposed to an RB HELB environment.

The Allowable Value for RB High Pressure trip is at the lowest value consistent with avoiding spurious trips during normal operation. The electronic components of the RB High Pressure trip are located in an area outside the RB and are not exposed to high temperature steam environments during a LOCA.

However, the components would be potentially exposed to high radiation levels. Therefore, the determination of the setpoint Allowable Value accounts for errors induced by the high radiation.

7. Reactor Coolant Pumo Power Monitors The Reactor Coolant Pump Power Monitor (RCPPM) trip

, provides protection for changes in the reac'.:r cochnt O< flow due to the loss of multiple RCPs. Because the flow reduction lags loss of power indications due to the inertia of the RCPs, the trip initiates protective action earlier than a trip based on a measured flow signal.

The trip also prevents single loop operation (operation with both pumps in an RCS loop tripped).

Under these conditions, core flow and core fluid l mixing are insufficient for adequate heat transfer.

The RCPPM trip has been credited in the accident I analysis calculations for the loss of four RCPs. The monitors were added as part of the power level upgrade (2452 to 2544 MW greater than 97% t R r)TP.to providehas Analyses DNB protection shown this tripat Function is not necessary when conditions are such that THERMAL POWER is less than 2475 MW,3 and four 2 are in operation (Ref. 8).

r (continued) i .

Crystal River Unit 3 B 3.3-15 Revision No. 7

RPS Instrumentation B 3.3.1 BASES APPLICABLE 7. Reactor Coolant Pumo Power Monitors SAFETY ANALYSES, (continued) l LCO, and The Allowable Value for the Reactor Coolant Pump to APPLICABILITY Power trip setpoint is selected to prevent normal (continued) power operation unless at least three RCPs are operating. RCP status is monitored by two power transducers on each pump. The allowable values for the Reactor Coolant Pump Power Monitors are selected to trip the reactor if more than one RCP is drawing 2 14,400 kW or s 1152 kW. The overpower setpoint is selected low enough to detect locked rotor conditions (although credit is not allowed for this capability) but high enough to avoid a spurious trip due to the current associated with start of an RCP. The underpower Allowable Value is selected to reliably trip on loss of voltage to the RCPs. The RCPPM setpoints do not account for instrumentation errors caused by harsh environments because the trip Function is not required to respond to events that could create harsh environments around the equipment.

There are two pump power monitors provided for each RCP. Both monitors are required to satisfy th' g instrumentation channel requirements of this LCO.

(continued)

Crystal River Unit 3 D 3.3-16 Revision No. 17

CRD Trip Devices B 3.3.4

( BASES ACTIONS E.1 and E.2 (continued)

If the Required Actions of Condition A, B, or C are not met within the associated Completion Time while the plant is in MODE 4 or 5, the plant must be placed in a MODE in which the LCO does'not' apply. To~ achieve this status, all CRD trip breakers must be opened or all power to the CRDCS removed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers or remove all power to the CRDCS without.

challenging plant systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS SR 3.3.4.1 is a CHANNEL FUNCTIONAL TEST to the CRD trip devices once every 31 days. This test verifies the OPERABILITY of the trip devices by actuation of the end devices. Also, this test independently verifies the undervoltage and shunt trip mechanisms of the CRD trip breakers. The Frequency of 31 days is based on Oper ning

& . . experience, which has demonstrated that failure of more than

-k one trip device in any 31 day interval is unlikely.

REFERENCES 1. FSAR, Chapter 7.

l l

l Crystal River Unit 3 B 3.3-43 Amendment No. 149

ESAS Instrumentetion B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation BASES BACKGROUND The ESAS initiates Engineered Safeguards (ES) Systems, based on the values of selected plant parameters, to protect core design and reactor coolant pressure boundary limits and to mitigate accidents.

ESAS actuates the following:

a. High Pressure Injection (HPI);

b. Low Pressure Injection (LPI);

c. Reactor Building (RB) Isolation and Cooling;

d. RB Spray;

e. Emergency Diesel Generator (EDG) Start; and

. f. Control complex normal recirculation. h ESAS also provides an "A" train and "B" train HPI actuation signal to the EFIC Channel A and B Trip Modules to initiate emergency feedwater when both ESAS HPI trains are actuated.

In addition, ESAS "A" train actuation Channel provides load management for EDG-1A concurrent with a los of offsite power. This is accomplished by preventing the starting of EFP-1 or tripping EFP-1 if it has already started, when LPI actuates. In addition, the LPI pump is prohibited from starting on a RB isolation concurrent with a loss of offsite power.

This trip signal may be manually defeated in certain small break LOCA scenarios. Assuming the single failure of the turbine driven feedwater pump or associated flow path in such circumstances, defeating this trip signal would maintain steam generator cooling with the motor driven N emergency feedwater pump. Prior to defeating the trip signal, sufficient capability on the emergency diesel generators to power the required loads would be established as discussed in the BASES for Technical Specification 3.7.5. ,

(continued)

Crystal River Unit 3 8 3.3-44 Revision No. 17 NOTE - Valid Until Cycle 12 Only l

-y _

Source Range Neutron Flux B 3.3.9 l l

r3 B '3.3 INSTRUMENTATION-b B 3.3.9. Source Range Neutron Flux

)

BASES 1

BACKGR0VND The source range neutron flux channels provide the operator with an indication of the approach to criticality at lower neutron power levels than can be monitored by the intermediate range neutron flux instrumentation. These channels also provide the operator indication of changes in reactivity that may occur during other shutdown operations.

The normally relied upon source range instrumentation (NI-1 and -2) consist of two redundant count rate channels originating in two high sensitivity proportional counters.

The two detectors are externally located on opposite sides of the core 180' apart. These channels are used over a neutron count rate range of 0.1 cps to IE6 cps and are displayed on the main control board (MCB) in terms of log count rate. The channels also measure the rate of change of the neutron flux level, which is displayed on the MCB in terms of startup rate from -0.5 decades to +5 decades per minute. An interlock provides a control rod withdraw O 4 h " inhibit" on a high startup rate of +2 decades per minute in either channel.

The proportional counters of the source range channels are BF3 chambers. High voltage will be turned off automatically when the flux level on a start-up (count rate increasing) is above IE-9 amp as seen by both intermediate range channels, or 10% RTP in NI-5 or -6 and NI-7 or -8 power range channels. Conversely, the high voltage is turned on automatically when the flux level returns _to within !

approximately one decade of the detectors' maximum useful range.

Although not normally relied upon to perform the source range neutron flux level monitoring function, the post- i accident monitoring instrumentation (NI-14. -15) has been j shown to be functionally equivalent to NI-1 and NI-2 and may be used to comply with this LCO.

l n

(continued)

Crystal River Unit 3- B 3.3-73 Revision No. 17.

r ,

C Source Range Neutron Flux B 3.3.9 BASES (continued)

APPLICABLE The source range neutron flux channels are necessary to I

SAFETY ANALYSES monitor core reactivity changes. They are also the primary l

i raeans for detecting and triggering operator actions to respond to reactivity transients initiated from conditions in which the Reactor Protection System (RPS) is not required to be OPERABLE. However, the monitors are not assumed as part of any accident analysis sequence.

1 LC0 Two source range neutron flux channels are required to be OPERABLE during MODE 2 with each intermediate range channel s SE-10 amps or NI-5 or NI-6, and NI-7 or NI-8 1 5% RTP; and MODES 3, 4 and 5 since they are the primary indication of core neutron power at low power levels.

\

Above the neutron power level specified for MODE 2, the I source range instrumentation is not the primary neutron power level indication and the high voltage to the detector has been removed. The setpoints are based upon the power levels where the instrumentation is re-energized on decreasing flux levels.

APPLICABILITY Two source range neutron flux channels are required in MODES 2, 3, 4 and 5. In MODE 2, OPERABILITY of the instrumentation ensures redundant indication during an approach to criticality. The intermediate range and power range instrumentation provide sufficient neutron flux level indication with the reactor critical; therefore, source range instrumentation i! not required in MODE 1 (the instrumentation is de-snergized and cannot function anyway).

In MODES 3, 4, and 5, source range neutron flux instrumentation provide the operator with a means of monitoring changes in SDM and provides an indication of reactivity changes.

The requirements for source range neutron flux instrumentation during MODE 6 are addressed in LCO 3.9.2,

" Nuclear Instrumentation."

(continued) 9 Crystal River Unit 3 8 3.3-74 Revision No. 7

EFIC Instrumentation B 3.3.11

/~ BASES

(

BACKGROUND b.

OTSG Level-low (continued)

The signals are also used by EFIC after EFW has been actuated to control OTSG level at the low level setpoint of 30 inches above the lower tubesheet when one or more RCPs are operational.

The lower and upper taps for the low range level transmitters are located at 6 inches and 277 inches, respectively, above the upper face of the OTSG's lower tube sheet. The string is calibrated such that only the first 150 inches of indication are used. OTSG Level-Low was chosen as an EFW automatic initiation parameter because it represents a condition where feedwater is insufficient to meet the primary heat removal requirements and additional cooling water is necessary.

c. OTSG pressure-Low Four transmitters provide the EFIC Sassociated with each OTSG of OTSG Pressure Low.

ystem with channels A through D These same transmitters provide input signals to EFIC MFW and Main Stead Line Isolation Functions. When OTSG pressure drops below the bistable setpoint of 600 psig on a given channel, an EFW Initiation signal is sent t to both trains of automatic actuation logic. The low pressure Function may be manually bypassed when pressure in either OTSG is less than 750 psig. The EFIC channel bypass is automatically removed when both OTSGs outlet ,

pressure increases above 750 psig. The low l pressure operational bypass allows for normal cooldown without EFIC actuation.

OTSG Pressure-Low is a primary indication and actuation signal for steam line breaks (SLBs) or feedwater line breaks. For small breaks, which do not depressurize the OTSG or take a long time to depressurize, automatic actuation is not required. The operator has time to diagnose the problem and take the appropriate actions.

i p

Q . (continued)

Crystal River Unit 3 B 3.3-85 Revision No. 17

EFIC Instrumentation B 3.3.11 l BASES BACKGROUND d. RCP Status (continued)

A loss of power to all four RCPs is an immediate indication of a pending loss of forced flow in the Reactor Coolant System. The RPS acts as the sensor for this EFIC Function by providing a loss of RCP indication for each pump to each EFIC channel.

When a minimum of two EFIC channels recognize the loss of all RCPs, EFIC will automatically actuate EFW and control level to natural circulation value in the OTSG. This higher setpoint provides a thermal center in the OTSG at a higher elevation than that of the reactor to ensure natural circulation as long as adequate subcooling margin is maintained.

To allow RCS heatup and cooldown without actuation, a bypass permissive of 10% RTP is used. The 10% bypass permissive was chosen because it was an available, qualified Class IE signal at the time the EFIC System was designed.

When the first RCP is started, the " loss of four RCPs" initiation signal may be manually reset.

If the bypass is not manually reset, it will be automatically reset at 10% RTP. During cooldown, the bypass may be inserted at any time THERMAL POWER has been reduced below 10%. However, for most operating conditions, it is recommended that this trip function remain active until after the Decay Heat Removal System has been placed in operation and just prior to tripping the last RCP. This trip function must be bypassed prior to stopping the last RCP in order to avoid an EFW actuation.

(continued)

Crystal River Unit 3 B 3.3-86 Revision No. 17

EFIC Instrumentation B 3.3.11 BASES l

BACKGROUND Bvoass (continued)

EFIC channel maintenance bypass does not bypass EFW Initiation from Engineered Safeguards Actuation System (ESAS) Channel A and Channel B high pressure injection (HPI) actuation. However, the EFIC initiation on HPI actuation is bypassed'when ESAS is bypassed.

The operational bypass provisions were discussed as part of the individual Functions described earlier.

3, 4. Main Steam Line and MFW Isolation FSAR Figure 7-26, (Ref. 3) illustrates one channel of the EFIC Main Steam Line and MFW Isolation logic.

Four pressure transmitters per OTSG provide EFIC with cnanneis A i.nrcagh D of U bG g ca ure. iiie description of the channels was described earlier for EFW Initiation.

Once isolated, manual action is required to defeat the

, isolation command if desired. The EFIC System is O"

x. designed to perform its intended function with one channel in maintenance bypass (in effect, inoperable) and a single failure in one of the remaining channels.

This design complies with IEEE-279-1971 (Ref. 4) due to the redundancy and independence in the EFIC design. ;

l l

APPLICABLE 1. EFW Initiation SAFETY ANALYSES The DBA which forms the basis for initiation of EFW is a loss of MFW transient. In the analysis of this transient, SG Level-Low is the parameter assumed to !

automatically initiate EFW. Although loss of both MFW pumps is a direct and immediate indicator of loss of MFW, there are other scenarios (such as valve closure) that could potentially cause a loss of feedwater.

Therefore, the loss of MFW analysis conservatively assumed EFW actuation on low OTSG level. This assumption yields the minimum OTSG inventory available for heat removal and is, therefore, conservative for

/

(continued)

Crystal River Unit 3 8 3.3-89 Revision No. 7.

\

EFIC Instrumentation B 3.3.11 BASES O

APPLICABLE 1. EFW Initiation (continued)

SAFETY ANALYSES f evaluation of this event. If the loss of feedwater is {

1 a direct result of a loss of the MFW pumps EFW will be actuated much earlier than assumed in the analysis.This would increase OTSG heat transfer capability sooner in the event and would lessen the severity of the transient.

OTSG Pressure-Low is a primary indication and provides the actuation sional for SLBs or MFW line breaks.

Only one of the four SLB cases examined in the FSAR assumes normal automatic actuation of EFW. The other three cases assume manual initiation after 15 minutes.

For small breaks, which do not depressurize the OTSG or take a long time to depressurize, automatic actuation is not required. The operator has sufficient time to diagnose the problem and take the appropriate actions.

Loss of four RCPs is a primary indicator of the need for EFW in the safety analyses for loss of electric power and loss of coolant flow.

2. EFW Vector Valve Coatrol The SLB analysis was re-performed crediting all "as built" systems and their associated response times.

This is documented in FTI Summary Analysis Rep' ort 86-1266223-00 "CR-3 MSLB with MFP Trip Failure. In this analy is, EFIC isolation of Main Feedwater and Main Steam were credited. The Feed Only Good Generator (F0GG) logic was also credited for termination of an overfeed condition for either OTSG during postulated DC power failures.

3, 4. Main E eam Line and MFW Isolation The SLB analysis was re-performed crediting all "as built" systems and their associated response times.

ThisisdocumentedinFTISummaryAnalysisRegort86-1266223-00, "CR-3 MSLB with MFP irip Failure. In this analysis, EFIC isolation of Main Feedwater and Main Steam were credited. The worst case evaluated single failure of the feedwater isolation system was determined to be a failure of the MFP to trip. This accident is terminated by the closing of the MFP suction valves.and the downstream block valves are not credited because the block valves can not close (continued)

O s

Crystal River Unit 3 B 3.3-90 Revision No. 17

1

- I

~

EFIC Instrumentation I B 3.3.11 A BASES U

APPLICABLE 3, 4.

Main Steam Line and MFW Isolation SAFETY ANALYSES (continued) against MFP discharge pressure. However, because of the slower closing low load block valves, the startup and main block can close because the pressure drop is occurrin valves. g across the slower closing low load block Once the suction valves close, terminating feedwater flow, the slower closing low load block valves will close. The single failure of the suction valve failing to close, with a MFP trip and reliance upon the slower closiij low load block valves for accident termination, is bounded by the MFP failing to trip. The mass and energy release for the MFP failin to trip is the bounding accident response for a SLB. g The EFIC System satisfies Criterion 3 of the NRC Policy Statement.

LC0 All instrumentation performing an EFIC System Function listed in Table B 3.3.11-1 shall be OPERABLE. Four channels are required OPERABLE for all EFIC instrumentation channels to ensure that no single failure prevents actuation of a r train. Each EFIC instrumentation channel is considered to include the sensors and measurement channels for each

(' Function, the operational bypass switches and permissives.

Failures that disable the capability to place a channel in operational bypass, but which do not disable the trip Function, do not render the protection channel inoperable.

The Bases for the LCO requirements of each specific EFIC Function are discussed next.

Loss of MFW Pumos

I FourEFICchannelsshallbeOPERABLEwithMFWpu$pturbines A a setpoints of > 55 psig. The 55 psig setpoint is about half of the normal operating control oil pressure. The 55 psig setpoint Allowable Value appears to have been arbitrarily chosen as a good indication of the loss of MFW Pumps.

Analysis only assumes Loss of MFW Pumps and a specific value of MFW pump control oil pressure is not used in the analysis. Further, since the setpoint is so much less than Vp .

(continued)

Crystal River Unit 3 B 3.3-91 Revision No. 17

EFiC Instrumentation B 3.3.11 BASES LC0 Loss of MFW Pumos (continued) operating control oil pressure, instrument error is not a consideration. The Loss of MFW Pumps Function includes a bypass enable and removal function utilizing the same bistable and auxiliary relay used in the NI/RPS bypass reactor trip on loss of both MFW pumps. However, the EFIC bypass is a logic requiring neutron flux to be < 20% RTP and the RPS to be in shutdown bypass. Practically speaking, the status of the bypass is strictly a function of the RPS shutdown bypass (4.e., required to be OPERABLE down into MODE 3).

OTSG Level-Low Four EFIC dedicated low range level transmitters per OTSC shall be OPERABLE with OTSG Level-Low actuation setpoints of 2 0 inches indicated (6 inches above the top of the bottom tube sheet , to generate the signals used for detection for low) level conditions for EFW Initiation.

There is one transmitter for each of the four channels A, B, C, and D. The signals are also used after EFW is actuated to control at the low level setpoint of 30 inches above the l ,

lower tubesheet when one or more RCPs are in operation. In I the determination of the low level setpoint, it is desired to place the setpoint as low as possible, considering instrument errors, to give the maximum operating margin between the ICS low load control setpoint and the EFW initiation setpoint. This minfmizes spurious or unwanted initiation of EFW. To meet this criteria, a nominal setpoint of 6 inches indicated was selected, adjusted for potential instrument error, and shown to be conservative to the specified Allowable Value. Credit is only taken for low level actuation for those transients which do not involve a degraded environment. Therefore, normal environment errors only are used for determining the OTSG Level-Low Allowable Value.

OTSG Pressure-Low Four OTSG Pressure-Low EFIC channels per OTSG shall be OPERABLE with an allowable value of 2 600 psig. The actual plant setpoint is set higher to account for instrument loop uncertainties and calibration tolerances. The setpoint is chosen to avoid actuation under (continued)

Crystal River Unit 3 B 3.3-92 Revision No. 17

EFIC Instrumentation B 3.3.11 y BASES LC0 OTSG Pressure-Low (continued) transient conditions not requiring secondary system isolation, and has been shown to be an appropriate indicator of secondary side breaks.for ensuring automatic EFW actuation. The OTSG Pressure-Low Function includes a bypass enable and removal function. The bypass removal Allowable Value is chosen to allow sufficient operating margin (time) for the operator to bypass the actuation during plant cooldown prior to reaching the actuation setpoint. The 750 psig setpoint allows at least a 10 minute window to perform the bypass assuming the maximum allowed cooldown rate and instrument error.

OTSG Differential Pressure-Hiah Four EFIC channels for OTSG differential pressure shall be OPERABLE with an allowable value of s 125 psid. The actual plant setpoint is set lower than 125 psid to account for instrument loop uncertainties and setability. The setpoint ensures that automatic EFW isolation to a depressurized 0TSG O . occurs for the range of sizes of SLBs or feedwater line breaks that require rapid actuation early in the event. The setpoint has also been chosen to avoid spurious isolation of EFW during conditions due to relatively small deviations in OTSG pressures that can be caused by primary system conditions. The OTSG Differential Pressure-High Function is bypassed when the OTSG Pressure-Low Function is bypassed.

RCP Status Four EFIC channels for RCP status are required to be OPERABLE to ensure that upon the loss of all four RCPs, EFW will be automatically initi ..e . Additionally, EFW will automatically raise and cor tre, level to natural circulation value providing a higher driving head for establishing and maintaining natural circulation conditions when forced RCS flow is lost. No setpoint is specified since the status j indication used by EFIC is binary in nature. The RCP Status J Function includes a bypass enable and removal function from

~

the RPS. The Allowable Value for the bypass removal is set high enough to avcid spurious actuations during low power operation.

I \

V (continued)

Crystal River Unit 3 B 3.3-93 Revision No. 17

\

l EFIC Instrumentation B 3.3.11 {

j BASES (continued)

I APPLICABILITY EFIC instrumentation OPERABILITY requirements are applicable during the MODES and specified conditions listed in Table 3.3.11-1. Each Function has its own requirements based on the specific accidents and conditions for which it is designed to provide protection.

The initiation of EFW on the Loss of MFW Pumps is applicable in MODE 1 and in MODES 2 and 3 when not in shutdown bypass.

Below these plant conditions, EFW initiatior on low OTSG 1evel occurs fast enough to prevent primary system overheating.

EFW Initiation on low OTSG level shall be OPERABLE at all times the OTSG is required for heat removal. These conditions include MODES 1, 2, and 3. To avoid automatic actuation of the EFW pumps during heatup and cooldown, the low OTSG pressure Function can be bypassed at or below a secondary pressure of 750 psig. This secondary-side pressure occurs during MODE 3 operation.

EFW initiation on loss of all RCPs is required to be OPERABLE at 2 10% RTP. This power level coincides with the bypass permissive signal provided by RPS.

The MFW, Main Steam Line Isolation, and EFW Vector Valve Control Functions shall be OPERABLE in MODES 1, 2, and 3 with OTSG pressure 2 750 psig because OTSG inventory can be high enough to contribute significantly to the peak pressure following a secondary side break. Both the normal feedwater and the EFW must be isolatable on each OTSG to limit overcooling of the primary and mass and energy releases to the RB. Once OTSG pressures decrease below 750 psig, the Main Steam Line and MFW Isolation Functions can be bypassed to prevent actuation during cooldown. The EFW Vector Valve Control logic will not perform any function when both OTSG pressures are low; thus, the logic is also bypassed at the same time the OTSG pressure low Functions is bypassed. In MODES 4, 5, and 6, primary and secondary side energy levels are reduced and the feedwater flow rate is low or nonexistent. Because of this, EFIC instrumentation is not required to be OPERABLE in these MODES.

(continued) i Crystal River Unit 3 B 3.3-94 Revision No. 7

}

i EFIC Instrumentation 1

B 3.3.11 7 .s BASES l (W/) ~

l ACTIONS l D.1. 0.2.1. 0.2.2 E.1. and F.1 i

(continued)

If the Required Actions cannot be met within the associated Completion Time, the plant must be placed in a MODE or condition in which the requirement for the particular Function does not apply.

the CRD trip breakers for Function 1.a, MODE 4 forlhis requir Function 1.b, reduce power to less than 10% RTP for Function 1.d, and reduce OTSG pressure to less than 750 psig for all other Functions. The allowed Completion Times are reasonable, based on operating experience, to reach the specified conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS A Note indicates that the SRs for each EFIC instrumentation i

Function are identified in the SRs column of Table 3.3.11-1.

All Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION. The SG-Low Level Function is modeled in transient analysis, and is subject to response time testing. Response time testing is also fq .

required for Main Steam L;..e R.o 16 1 solation. Indiviaual l "kj EFIC subgroup relays must also be tested, one at a time, to verify the individual EFIC components will actuate when required.

Some components cannot be tested at power since their actuation might lead to reactor trip or equipment damage.

l These are specifically identified and must be tested when shut down. The various SRs account for

individual functional differences and for test frequencies l applicable specifically to the Functions listed in Table 3.3.11-1. The operational bypasses associated with each EFIC instrumentation channel are also subject to these SRs to ensure channel OPERABILITY of the EFIC instrumentation when required.

SR 3.3.11.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred.

l A CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels ;

(continued)

Crystal River Unit 3 B 3.3-97 Revision No. 17 l

i EFIC Instrumentation B 3.3.11 BASES 0l 1 SURVEILLANCE SR 3.3.11.1 (continued)

REQUIREMENTS monitoring the same parameter should read approximately the I same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more !

serious.

Acceptance criteria are determined by plant staff and are presented in the Surveillance Procedure. The criteria are based on a combination of the channel instrument uncertainties.

The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is unlikely.

Thus, performance of the CHANNEL CHECK ensures that undetected overt channel failure is limited to time intervals between subsequent performances of the SR.

SR' 3.3.11.2 A CHANNEL FUNCTIONAL TEST verifies the function of the required trip, interlock, and alarm functions of the -

channel. The Frequency of 31 days is based on operating experience and industry accepted practice.

SR 3.3.11.3 CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The test verifies the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channels adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. The 24 month Frequency is based on the results of a review of instrument drift data conducted in accordance with NRC Generic Letter 91-04.

(continued)

Crystal River Unit 3 8 3.3-98 Revision No. 7-

EFIC Manual Initiation '

l B 3.3.12

- BASES l LCO _

occurs. When both manual switches are depressed, a full l (continued) trip of channel A actuation occurs for that particular Function. Similarly, channel. B actuation logic for each Function has two manual trip switches. Both switches per actuation channel must be OPERABLE and must be depressed to get a. full manual trip of that channel. The use of two manual trip switches for each channel of actuation logic allows for testing without actuating the end devices and i

also reduces the possibility of accidental manual actuation.

1 APPLICABILITY- The MFW and Main Steam Line Isolation manual initiation Functions shall be OPERABLE in MODES 1, 2, and 3 because OTSG inventory can be at a sufficiently high energy level-to contribute significantly to the peak containment pressure l and reactor overcooling during a secondary side break. In MODES 4,.5, and 6, the primary and secondary side energy levels are reduced and feedwater flow rate is low or nonexistent, and the Function.is not required to be OPERABLE.

. The EFW manual initiation Function shall be OPERABLE in s MODES I, 2, and 3 because the OTSGs are relied on as a imet sink for the Reactor Coolant System and the core itself. In MODES 4, 5, and 6, heat removal requirements are reduced and 1 can be provided by the Decay Heat Removal System.

l ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC manual initiation Function.

I S.d With one manual initiation switch of one or more EFIC Function (s) inoperable in one actuation channel, the trip module for the associated EFIC Function (s) must be placed in ;

the. tripped condition within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With the channel in the tripped condition, the single-failure criterion is met

-and the operator can still initiate one actuation channel given a single failure in the other channel. Failure to-i

)

A (continued) l

!V , . j Crystal River Unit 3 B 3.3-101 Revision No. 17

^

EFIC Manual Initiation B 3.3.12 BASES O I ACTIONS J1 A (continued) perform Required Action A.1 could allow a single failure of a switch in the other manual initiation channel to prevent manual actuation of the Function from the MCB. The Completion Time allotted to trip the trip module allows the operator to take all the appropriate actions for the failed switch and still ensure that the risk involved in operating with the failed switch is acceptable.

k.1 With both manual initiation switches of one or more EFIC Function (s) inoperable in one actuation channel, one manual initiation switch must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the operator has the capability to manually initiate the affected EFIC Function from the MCB utilizing the manual initiation switches in the other actuttion channel. However, the systems single failure provisions are no longer provided and must be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The assoc'iated Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is acceptable based upon engineering judgment and is consistent with similar EFW-related Required Actions addressing a loss of redundancy.

From a functional perspective, this Condition is equivalent to Condition A since each actuation channel is a two-out-of-two logic (i.e., the actuation channel will not function with one or both switches inoperable). The difference between the two Conditions lies in the specified Required Actions. The trip modules associated with both inoperable manual initiation switches in a given actuation channel cannot be simultaneously placed in trip without receiving an EFIC actuation.

L.1 With one manual initiation switch of one or more EFIC Function (s) inoperable in both actuation channels, the EFIC trip modules associated with the inoperable manual initiation switch must be placed in trip within I hour. In this Condition, the operator does not have the capability to manually initiate the affected EFIC Function from the MCB.

(continued)

Crystal River Unit 3 B 3.3-102 Amendment No. 149

~

EFIC Automatic Actuation Logic B 3.3.13 B 3.3 INSTRUMENTATION B 3.3.13 Emergency Feedwater Initiation and Ontrol (EFIC) Automatic Actuation Logic BASES 1

l BACKGROUND Main Steam line and Main Feedwater (MFW) Isolation i

The four Emergency Feedwater Initiation and Control (EFIC) !

channels monitoring each Once Through Steam Generator (OTSG) outlet pressure condition input initiate commands to the actuation channels. FSAR Figure 7-26, (Ref.1) illustrates l the Main Steam Line and MFW Isolation Logics. The trip i logic modules are physically located in the "A" and "B" EFIC channel cabinets. Channel "A" actuation logic initiates when instrumentation channel "A" or "B" initiates and channel "C" or "D" initiates, which in simplified logic is:

"A" actuation = (A and C) or (A and D) or (B and C) or (B and D).

- Channel "B" actuation logic initiates when instrumentation channel "A" or "C" initiates and channel "B" or "0"

(]

v initiates, which in simplified logic is: j i

"B" actuation - (A and B) or (A and D) or (C and B) or (C and D) i Each of the four Functions (OTSG A Main Feedwater Isolation, OTSG B Main Feedwater Isolation, OTSG A Main Steam Line Isolation, and 0TSG B Hain Steam Line Isolation) has a channel "A" and a channel "B" of automatic actuation logic.

Both channels "A" and "B" of the OTSG A Main Feedwater Isolation automatic actuation logic send closure signals to the OTSG A main feedwater pump suction valve, the three OTSG A block valves, and the MFW pump discharge cross connect valve. In addition, the instrumentation trips MFW pump "A."

Both channels "A" and "B" of the OTSG A Main Steam Line Isolation automatic actuation logic send closure signals to both of the OTSG A Main Steam Isolation valves.

[^')

v (continued)

Crystal River Unit 3 8 3.3-105 Amendment No. 149

EFIC Automatic Actuation Logic B 3.3.13 BASES BACKGROUND Main Steam Line and Main Feedwater (MFW) Isolation (continued)

OTSG B MFW and Main Steam Line Isolation automatic actuation logics respond similarly for the OTSG B valves and MFW pump "B."

Emeraency Feedwater (EFW) Actuation The four EFIC instrumentation channels for each of the parameters being sensed input their initiate commands to the trip logic modules. FSAR Figure 7-26 (Ref.1) illustrates the EFW initiation logic. These trip :o ic modules are physically located in the "A" and "B' EF C channel cabinets.

EFW Actuation functions are the same logic combinations as MFW and Main Steam Line Isolation. Although not part of this Specification, EFW initiation also occurs on hi h pressure injection (HPI) actuation. Both channels o HPI actuation are input into each EFW actuation trip logic channel.

Vector Valve Enable looic The EFW module logic is responsible for sending open or close signals to the EFW control and block valves. FSAR Figure 7-26, (Ref. 1 illustrates the vector valve logic.

The vector module lo ic outputs are in a neutral state (neither commanding open nor close until a signal is received from the vector valve ena le lo ic. The vector valve enable logic monitors the channel and B EFW Actuation logics. When an EFW Actuation occurs, the vector enable logic enables the vector valve lo ic to generate open or close signals to the EFW valves depen ing on the relative values of OTSG pressures.

APPLICABLE Automatic isolation of MFW and main steam line is assumed SAFETY ANALYSES in the safety analyses to miti steam line or MFW line: breaks. gateThethe conse SLB analuences sis wasofre-main performed crediting all "as built" systems and their associated response times. This is documented in FTI Summary Analysis Report 86-1266223-00, "CR-3 MSLB with MFP Tri Failure." In this analysis EFIC isolation of Main Fee water and Main Steam were cre,dited. The worst case-evaluated single failure of the feedwater isolation system was determined to be a failure of the MFP to trip. This accident is terminated by the closing of the MFP suction valves and the downstream block valves are.not credited (continued)

Crystal River Unit 3 8 3.3-106 Revision No. 17

EFIC Automatic Actuation Logic )

B 3.3.13 l s

BASES v

]

APPLICABLE because the block valves can not close against MFP l SAFETY ANALYSES discharge pressure. However, because of the slower closing (

(continued) low load block valves, the startup and main block can close because the pressure drop is occurring across the slower closing low load block valves. Once the suction valves close, terminating feedwater flow, the slower closing low load block valves will close. The single failure of the suction valve failing to close, with a MFP trip and reliance upon the slower closing low load block valves for accident termination, is bounded by the MFP failing to trip. The mass and energy release for the MFP failing to trip is the bounding accident response for a SLB.

1 The Vector Valve control lo The feed Only Good Generator (FOGG) gic was logic was also credited.

credited for termination of an overfeed condition for either OTSG during postulated DC power failures. No operator action was credited or required.

Automatic initiation of EFW is credited in the loss of main feedwater analysis. The automatic actuation was based on the SG low level function of EFIC, although EFIC would initiate EFW based on the loss of both MFW pumps as well.

EFIC logic satisfies Criterion 3 of the NRC PolMy

/_3 -

Statement.

'I

'v LC0 Two channels each of MFW and Main Steam Line Isolation, Vector Valve Enable, and EFW Actuation logics shall be OPERABLE. There are only two channels of automatic actuation logic per Function. Therefore, failure to meet this LCO would make the plant susceptible to a single j

failure in the OPERABLE actuation channel precluding the 1 Function.

APPLICABILITY The MFW and Main Steam Line Isolation automatic actuation logics shall be OPERABLE in MODES 1, 2 and 3 because OTSG inventorycanbeatahighenergylevelandcancontribute significantly.to the peak containment pressure and reactor overcooling during a secondary system line break. In 5 and 6 the energy level is low, feedwater flow MODES rate is 4, low, or non, existent, and the Function is not require; to be OPERABLE. ;

l l

Q Q) .

(continued)

Crystal River Unit 3 B 3.3-107 Revision No. 17

EFIC-Automatic Actuation Logic B 3.3.13 BASES APPLICABILITY The EFW automatic actuation ar 1 vector valve enable logics (continued) shall be OPERABLE in MODES 1, 2, and 3 because the OTSGs are relied upon for heat removal from the primary system.

During these MODES, the core power and heat removal requirements are at their highest. If the normal source of feedwater is lost, EFW must be initiated rapidly to minimize the overheating of the primary system.

For portions of MODE 4 and for all of MODES 5 and 6, the primary system temperatures are too low to allow the OTSGs to effectively remove energy.

ACTIONS For this LCO, a Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC Automatic Actuation logic Function.

lb.1 Condition A applies when one or more EFIC logic Functions in

, a single channel is inoperable (i.e., all four channel A EFIC logic Functions could be inoperable and Condition A would still be applicable) with all Functions in the other channel 0PERABLE.

With one automatic actuation logic channel of one or more EFIC Functions inoperable, the associated EFIC train must be restored to OPERABLE status. Since there are only two automatic actuation logic channels per EFIC Function, the condition of one channel inoperable is analogous to having one train of EFW inoperable. The system safety function can be accomplished; however, a single failure cannot be taken.

Therefore, the failed channel (s) must be restored to OPERABLE status in order to re-establish the system's single-failure tolerance.

The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months has been chosen to be consistent with Completion Times for restoring an inoperable EFW System train to OPERABLE status.

(continued)

Crystal River Unit 3 8 3.3-108 Amendment No. 149

7 EFIC'-EFW-Vector Valve Logic B 3.3.14 BASES' -

a BACKGROUND The valve open/cluse commands are determined by the relative (continued) values of OTSG pressures as follows.:

VECTOR VALVES PRESSURE STATUS "A" "B" If 0TSG "A" & OTSG "B" Open Open

> 600 psig If.OTSG "A" > 600 psig & Open Close OTSG "B" < 600 psig If OTSG "A" < 600 psig & Close Open OTSG "B" > 600 psig If OTSG "A" & OTSG "B"

< 600 psig 4 S.ND OTSG "A" & OTSG "B" within Open Open 125 psid 0TSG "A" 125 psid > OTSG "B" Open Close OTSG "B" 125 psid > OTSG "A" Close Open APPLICABLE The SLB analysis was re-performed crediting all "as built" SAFETY ANALYSES systems and their associated response times. This is documented in FTI Summary Analysis Report 86-1266223-00, "CR-3 MSLB with MFP Trip Failure." In this analysis, EFIC isolation of Main Feedwater and Main Steam were credited.

The Vector Valve Logic, Feed Only Good Generator (F0GG) was ;

l credited for termination of an overfeed condition for either OTSG during postulated DC power failures. No operator action was credited or required.

EFW vector valve logic response time is included in the response time for each EFW instrumentation Function and is not specified separately. )

1 l (continued)

Crystal River Unit 3 B 3.3-111 Revision No. 17

EFIC-EFW-Vector Valve Logic B 3.3.14 BASES 91 APPLICABLE The EFIC-EFW-vector valve logic satisfies Criterion 3 of SAFETY ANALYSES the NRC Policy Statement. l (continued) I LC0 Four channels of the EFIC-EFW- vector valve logic are required to be OPERABLE in order to provide the dual function of the valves while meeting single failure criteria. Refer to the ACTIONS for further discussion of the two functions. The 600 psig and 125 psid Allowable Values were chosen as discussed in the Bases for Specification 3.3.11, "EFIC System Instrumentation." The feed only good generator verification study assumed a differential pressure vector value of 150 psid. The 125 psid setpoint conservatively assumes a 25 psi margin for instrument error. Failure to meet this LCO results in not being able to meet the single-failure criterion.

APPLICABIL.ITY EFIC-EFW-vector valve logic is required in MODES 1, 2, and 3 because the OTSGs are relied on in these MODES for RCS heat removal. In MODES 4, 5, and 6, heat removal requirements are reduced and may be provided by the Decay Heat Removal System. Therefore, vector valve logic is not required to be OPERABLE in these MODES.

ACTIONS AJ The function of the EFIC-EFW control / block valves and the vector valve logic is to meet the single-failure criterion while maintaining the capability to:

a. Provide EFW to an intact OTSG on demand; and

b. Isolate a faulted OTSG when required.

These conflicting requirements result in the necessity for two valves in series, in parallel with two valves in series, and a four channel valve command system.

(continued) 9^ 4 Crystal River Unit 3 8 3.3-112 Amendment No. 149

p.

EFIC-EFW-Vector Valve Logic B 3.3.14

..g) BASES ACTIONS A.1 (continued)

With one channel inoperable, the system cannot meet the single-failure criterion and still satisfy the dual functional criteria described above. Therefore, when one vector valve logic channel is inoperable, the channel must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition is analogous to having one EFW train inoperable; wherein a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is provided by the Required Actions of LCO 3.7.4, "EFW System." As such, the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is. based on engineering judgment.

B.1 and B.2 If Required Action A.1 cannot be met within the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within.12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are

,-- reasonable, based on operating experience, to reach the (

required plant conditions from full power conditions in an orderly manner and without challenging plant systems. j j

SURVEILLANCE SR 3.3.14.1 REQUIREMENTS SR 3.3.14.1 is the performance of a CHANNEL FUNCTIONAL TEST every 31 days. This test demonstrates that the EFIC-EFW-vector valve logic is capable of performing its intended function. The Frequency is based on operating experience that demonstrates failure of more than one channel within the same 31 day interval is unlikely.

REFERENCES None.

1' v.. .. . .

l i

l

. Crystal River Unit 3 B 3.3-113 Amendment No. 149.

u

RB Purge Isolation-High Radiation B 3.3.15 8 3.3 INSTRUMENTATION B 3.3.15 Reactor Building (RB) Purge Isolation-High Radiation BASES BACKGROUND The RB Purge Isolation-High Radiation Function closes the RB purge and RB mini-purge valves to isolate the RB atmosphere from the environment and minimize releases of radioactivity in the event an accident occurs.

The radiation monitoring system (RMA-1) measures the activity in a representative sample of air drawn in succession through a particulate sampler, an iodine sampler, and a gas sampler. The sensitive volume of the gas sampler is shielded with lead and monitored by a Geiger-Mueller detector. The air sample is taken from the center of the purge exhaust duct through a nozzle installed in the duct.

The monitor will alarm and initiate closure of the valves prior to exceeding the noble gas limits specified in the Offsite Dose Calculation Manual.

The closure of the purge and mini-purge valves ensures the RB remains as a barrier to fission product release. There is no bypass for this function.

APPLICABLE FSAR Chapter 14 LOCA analysis assumes RB purge and mini-SAFETY ANALYSES purge lines are isolated within 60 seconds following initiation of the event. Since the early 1980's, this isolation time has only been practically applicable to the mini-purge valves since the large purge valves are required to be sealed closed during the MODES of plant operation (1, 2, 3, and 4) in whi:h LOCAs are postulated to occur. Even (continued)

Crystal River Unit 3 B 3.3-114 Revision No.17

RB Purge Isolation-High Radiation B 3.3.15

.( BASES SURVEILLANCE SR 3.3.15.1 (continued)

REQUIREMENTS something even more serious. Internal check sources may also be used to satisfy the CHANNEL CHECK requirement. l Acceptance criteria are determined by plant staff and are presented in the Surveillance Procedures. The criteria are based on a combination of the channel instrument uncertainties. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency, about once every shift, is based on operating experience.that demonstrates channel failure is an unlikely event. Additionally, control l room alarms and annunciators are provided to alert the I operator to various " trouble" conditions associated with the instrument.

SR 3.3.15.2 This SR requires the performance of a CHANNEL FUNCTIONAL TEST once every 92 days to ensure that the channel can perform its intended function. This test verifies the 1 capability of the instrumentation to provide the RB purge (s^/j . and mini-purge valve isolation on a high radiation signal.

As with any CHANNEL FUNCTIONAL TEST, this SR need not include actuation of the end devices (purge and mini-purge valves). The 92 day Frequency is based on the recommendations of NUREG-1366 (Ref. 2).

SR 3.3.15.3 l

CHANNEL CALIBRATION is a complete check of the instrument string including the sensor. The test verifies that the channel responds to a measured parameter within the !

necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains OPERABLE between successive tests. j l

The Allowable Value for the RB Purge Isolation-High Radiation is determined in accordance with the requirements of the Offsite Dose Calculation Manual (ODCM). l 1

[]

v .

(continued) 4 Crystal River Unit 3 B 3.3-117 Revision No. 17

c .

RB Purge Isolation-High Radiation B 3.3.15 BASES SURVEILLANCE SR 3.3.15.3 (continued)

REQUIREMENTS The 18 month Frequency is based on engineering judgment and industry-accepted practice.

REFERENCES 1. 10 CFR 100.

2. NUREG-1366, December 1992.

O.

e, Crystal River Unit 3 B 3.3-118 Amendment No. 149

)

l l

f I PAM Instrumentation B 3.3.17 BASES APPLICABLE c. Determine whether systems important to safety are i SAFETY ANALYSES performing their intended functions; (continued)

d. Determine the potential for a gross breach of the barriers to radioactivity release;

e. Determine if a gross breach of a barrier has occurred; and

f. Initiate action necessary to protect the public and.

estimate the magnitude of any impending threat.

PAM instrumentation that is determined to display a Regulatory Guide 1.97 Type A variable, satisfies Criterion 3 of the NRC Policy Statement. Category 1, non-Type A, instrumentation does not meet any of the criterion in the ,

NRC Policy Statement. However, it is retained in Technical Specifications because it is considered important to reducing risk to the public.

O LC0

LCO 3.3.17 requires redundant channels be OPERABLE to ensure no single failure prevents the operators from being presented with the information necessary to determine the status of the unit and to bring the unit to, and maintain it 1

.in, a safe condition.following that accident. The provision of two channels also allows for relative comparison of the channels (a CHANNEL CHECK type of qualitative assessment) during the post accident phase to confirm the validity of displayed information.

The exception to the two channel requirement is containment isolation valve position. In this case, the important information is the status of the containment penetration.

The LCO requires one position indicator for each automatic containment isolation valve. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the automatic

, valve and prior knowledge of the passive valve or via system boundary status. If a normally active containment isolation valve is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.

(continued)

Crystal River Unit 3 B 3.3-125 Revision No. 11 L

6 PAM Instrumentation B 3.3.17 BASES The Tabtefollowing 3.3.17 1.table identifies the specific instrument tag runbers for PAM instrumentation identified in FUNCTION CHANNEL A CHANNEL B

1. Wide Range Neutron Flux NI-15 N!-1 or N!-15 4!R N!-14 N!-1

2. RCS Hot Leg Terrperature RC-4A T!4 1 RC 48 T!R1

3. RCS Pressure (Wide Range) RC-158 P!2 or RC-158 P!R RC 159-P!2

4. Reactor Coolant RC-163A-LR1 (Hot leg level) and inventory RC-163B-LR1 (Hot leg level) and RC 164A-LR1 (Vessel Head levet) RC-1648-LR1 (Vessel Head levet)

5. Borsted Water Storage CH-7-L! or DH 7-1 IR1 Tank Level D H L !

6. High Pressure Injection A1: MU 23-FJ8-1 Flow A1: MU-23-FI12 A2: MU-23 F110 A2: MU 23 F16-1 81: MU-23 FI9 81: MU 23 F15-1 B2 MU 23 F t 7-1 B2: MU 23 Ft11 7 Containment Sump Water WD-303 L! or 00-303 LR Level (Flood Level) WD-304 LI or WD 304 tR

8. Containment Pressure BS-16-PI (Expected Post Accident 8517 PI Range) 9 Containment Pressure BS-90 PI or BS 90 PR (Wide Range) BS-91 PI or BS-91-PR 10.ContaltEentIsolation ES Light katrix "A": AHV-18/1C; Valve Position ES Light Matrix "B": ANV-1A/1D; CAV 1/3/4/5/126/429/430/433/434; CAV 2/6/7/431/432/435/436; CFV 11/12/15/16; LRV 70/72; MUV- CFV 29/42;tRV 71/73:MUV 49/253; 258 thru -261/567;WDV-3/60/94/ WDV 4/61/62/405; WSV 4/6/26/

406; WSV 3/5/28 thru 31/34/35/ 27/32/33/38/39/40/41 42/43 ES Light Matrix "As": CFV 25 thru-28; CIV 34/35/40/41; DW-160; Msv-130/148; MUV 27; sW-47 thru 50/79 thru 86/109/110

11. Contairvnent Area RM-G29 RI or RM-G29 RIR Radiation (HIOh Range) RM G30-RI

12. Containment Hydrogen WS 11 CR Concentration WS 10 CR

13. Pressurfrer Level RC 1 LfR 1 RC 1 LIR 3

14. Steam Generator Water OT!4 As SP 25-L11 or Level (Startip Range) OTSG A: SP 26-L11 SP 25 LIR OTSG 3: SP-30 L11 OYss 3: SP-29-LII or SP 29-LIR (continued)

Crystal River Unit 3 8 3.3-125A Revision No. 17

c.

! /*

l PAM Instrumentation i

B 3.3.17 BASES FUNCTION CHANNEL &

CN M EL 9

15. Steam Generator Water OTSG A: SP-17-L11 or Level (Operating Range) OTSG A: SP 18 L11 SP-17-LIR OTSG B: SP-22 L11 OTSG B: SP-21-L11 or SP 21-LIR l

16. Steam Generator OTSG As MS 106-P11 or Pressure OTSG A: MS 107-P!1 or MS 106-PIR, MS 107-PIR OTSG B: MS 110-P11 or OTSG B: MS-111-P11 or MS 110 PIR MS 111-PIR

17. Emergency Feedwater EF-98 LI1 Tank Level EF 99 L11 i 18. Core Exit Tenperature (Backup) Three detectors from each of the following groups:

Quadrant nat: IM 2G TE /IM-5G-TE /IM 6C TE /IM 7F TE oundrant XY: IM 9E TE /IM-10C TE/IM-11G-TE/1M 13G TE Ouadrant YZ: IM-9H TE /IM-10M TE/IM 100-JE/IM-13L TE Quadrant 2W: IM-3L TE /IM-4N TE /IM 6L TE /IM 60-TE 1

and Recorders RC 171 TR, RC-172 TR, RC-173-TR

19. Emergency Feedwater OTSG A: EF 25*F!l Flow OTSG A: EF 26-F!1 OTSG 5: EF 23 Ft1 Dise a: EF 24 FI1

20. Low Pressure Injection' DHV-110 Hand / Auto station flow Flow DNV-111 Hand / Auto station flow I indication (DH 1*FK3 1) indication (DH 1 FK4-1) I

21. Degrees cf Subcooling RC-4 Tf4 and RC 4 TIS and

%./

SPDS "A" or SPDS "B"

22. Emergency Diesel EGDG-1A Wattmeter SSF AN Main EGDG 1B Wattmeter SSF AX Main Generator kW Indication control board indicator contrcl board indicator NOTES: i For Function 18, CPERABILITY of only two detectors (and associated recorder) for any group constitutes entry into Condition A of LCO 3.3.17. Any group with only one OPERABLE l 4

detector / recorder concination constitutes entry into Condition C of LCO 3.3.17. Separate Condition entry is allowed for each grow.

For Function Action 21, with both channels of SPDS inoperable, LCO Cordition C and its associated Required are applicable.

l l

l i

p (continued)

U -

Crystal River Unit 3 B 3.3-1258 Revision No. 17

r- .

PAM Instrumentation B 3.3.17 BASES LC0 The following list is a discussion of the specified (continued) instrument Functions listed in Table 3.3.17-1.

1. Wide Ranae Neutron Flux Two wide-range neutron flux monitors are provided for post-accident reactivity monitoring over the entire range of expected conditions. E.ach monitor provides indication over the range of 10" to 100% log rated power covering the source, intermediate, and power ranges. Each monitor utilizes a fission chamber neutron detector to provide redundant main control board indication. A single channel provides recorded information in the control room. The control room indication of neutron flux is considered one of the primary indications used by the operator following an accident. Following an event the neutron flux is monitored for reactivity control. The operator ensures that the reactor trips as necessary and that emergency boration is initiated if required. Since the operator relies upon this indication in order to take specified manual action, the variable is included in this LCO. Therefore, the LCO deals specifically with this portion of the string.

2. Reactor Coolant System (RCS) Hot Lea Temperature Two wide range resistance temperature detectors (RTD's), one per loop, provide indication of reactor coolant system hot leg temperature (T ) over the range of 120* to 920*F. Each Tg measuremenf provides an input to a control room indicator. Channel B is also recorded in the control room. Since the operator relies on the control room indication following an accident, the LC0 deals specifically with this portion of the string.

Tg is a Type A variable on which the operator bases manual actions required for event mitigation for which no automatic controls are provided.

(continued)

Crysta.1 River Unit 3 B 3.3-126 Amendment No. 162

1., -

PAM Instrumentation B 3.3.17

) BASES LCO 13. Pressurizer level (continued) small break LOCAs, the pressurizer will void. For the case of a loss of main feedwater, the pressurizer could potentially be made water-solid. This is undesirable in that RCS pressure control is degraded and the potential for passing liquid through the pressurizer safety valves is increased. Studies have shown the safeties have 'a higher potential to fail to re-seat (creating an unisolable LOCA) if this condition were to occur.

Two channels of pressurizer level, each covering a range of 0 to 320 inches, are indicated and recorded in the control room. These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the safety analysis. As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LC0 based upon this consideration.

N 14,15. Steam Generator Water level (Start-up Rance and

) '

Operatina Ranae The CR-3 Type A/ Category 1 indication of steam generator level is the startup range and operating range EFIC level instrumentation. The combined instrument ranges cover a span of 6 to 394 inches above the lower tubesheet. The measured low range differential pressure is displayed in inches of water. ;

The low range-indicates a range of 0 to 150 inches, ;

where 0 inches indicates an actual level of 6 inches l above the lower tubesheet. The high range steam !

nenerator level instrumentation indicates a span of 0 l fo 100%, where 0% corres)onds to a 102 inch actual '

level above the lower tu sesheet. Redundant monitoring capability is provided by two channels of each range of instrumentation per OTSG.

The level signals are displayed on control room l indicators. The steam generator level signals are l calculated from differential pressure signals which are pressure compensated by a module in the EFIC l

(continued) l Crystal River Unit 3 B 3.3-135 Revision No. 11

f

( PAM Instrumentation B 3.3.17 BASES LC0 14,15. Steam Generator Water level (Start-up Ranae and Doeratino Range (continued)

System cabinets. Compensation is based on the densities of the water and steam assuming the OTSGs '

are normally operating at saturation. Each operating range level transmitter also inputs to a recorder in the control room. Since operator action is based on I

the control room indication, the LC0 deals specifically with this portion of the instrument string.

16. Steam Generator Pressure Steam generator pressure is measured on each main '

steam line between the respective main steam safety valves and the main steam isolation valve. Redundant

nonitoring capability is provided by two pressure transmitters per OTSG. Each pressure transmitter provides an input signal to pressure indicators and a recorder in the control room. The control room indication of OTSG pressure is one of the primary &

' indications used by the operator during an accident. W Therefore, the LC0 deals specifically with the control rooni indication portion of the OTSG pressure instrument string. The range of the indication is 0 l to 1200 psig.

OTSG pressure decreases rapidly during a design basis steani line break accident. This rapid decrease in pressure is a positive indication of a breach in the se:ondary system pressure boundary. In order to minimize the primary system cooldown caused by the decreasing secondary system pressure, feedwater flow to the affected 0TSG must be terminated. OTSG pressure is -considered a Type A variable because it is the primary indication used by the operator to identify and isolate the affected GTSG. In addition, OTSG pressure is a key parameter used by the operator to evaluate primary-to-secondary heat transfer. For example, the operator may ase this indication to control the )rimary system cooldown following a steam generator tu3e rupture or a small break loss of coolant accident (LOCA).

(continued) .

Crystal River Unit 3 B 3.3-136 Revision No. 17

RCS Leakage Detection Instrumentation B 3.4.14 8 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.14. RCS Leakage Detection Instrumentation BASES BACKGROUND 10 CFR 50, Appendix A, GDC 30, (Ref. 1) requires means be provided for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE.

Regulatery Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.

The containment sump collects unidentified LEAKAGE and is instrumented to alarm on increasing level and has the capability to detect a leakage rate of 1 gpm in less than I hour. This sensitivity is acceptable for detecting C

\_N increases in unidentified LEAKAGE. !

The reactor coolant contains radioactivity that, when released to the containment,'can be detected by radiation monitoring instrumentation. Reactor coolant radioactivity levels will te low during initial reactor startup and for a few weeks threafter until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. Instrument sensitivities of 10\yCi/cc radioactivity for particulate monitoring and of 10 pCi/cc radioactivity for gaseous monitoring are adequate for these leakage detection systems.

The detector is capable of detecting a change in RCS leak rate of I gpm within one hour on both the particulate and gaseous radioactivity monitoring systems, based on Rb-88 and activity levels assumed in the environmental report (0.1%

failed fuel).

Other installed instrumentation such as RB pressure and Containment Cooling Fan condensate flow also indicate leakage into containment. These are potentially valuable (continued)

Crystal River Unit 3 B 3.4-65 Revision No. 17.

r .

RCS Leakage Detection Instrumentation B 3.4.14 BASES O'~

BACKGROUND diagnostic tools but they are not capable of accurately (continued) detecting leak rates of I gpm and below. As such, they are not acceptable leakage detection systems for the purposes of satisfying this LCO.

APPLICABLE The safety significance of RCS LEAKAGE varies widely SAFETY ANALYSES depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is very important. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leak occur.

Leakage detection capability is also a fundamental aspect of the " leak before break" concept of piping design. This concept is based on the premise that main loop RCS piping will not fail catastrophically, but will leak prior to the failure. Demonstrating this to be true (shown probabilistically) and that this leakage can be detected, allows the dynamic effects associated with RCS pipe breaks to be excluded from the design basis of the RCS (Ref. 3). .

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

LCO One method of protecting against large RCS LEAKAGE derives from the instruments ability to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition when RCS LEAKAGE indicates possible RCP8 degradation. OPERABILITY of the atmospheric radiation monitors include the proper operation of the sample pump.

This pump is common to both monitors such that its failure can affect the plant's capability to monitor the containment atmosphere.

(con.tinued)

Crystal River Unit 3 8 3.4-66 Amendment No. 149 <

l 1

d

j CFTs B 3.5.1

( BASES APPLICABLE No operator action is assumed during the blowdown stage of SAFETY ANALYSIS a large break LOCA.

(continued)

The small break LOCA analysis also assumes a time delay after ESAS actuation before pumped flow reaches the cope.

For the larger range of small breaks (between - 0.2 ft and 2

0.5 ft ), the rate of blowdown is such that the increase in fuel clad temperature is terminated by the CFTs, with pumped flow then providing pontinued co,oling. As break size decreases (- 0.02 ft and 0.2 ft ), the CFTs and HPI pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the CFTs continues to decrease until the tanks are not required and the HPI pumps, with the help of EFW for steam generator cooling, become responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria for the ECCS established by 10 CFR 50.46 (Ref. 2) will be met following a LOCA:

a. Maximum fuel element cladding temperature of 2200'F; f)

V

b. Maximum cladding oxidation of s 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction of s 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d. Core maintained in a coolable geometry.

Since the CFTs discharge during the blowdown and reflood phases of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.

The limits for operation with a CFT that is inoperable for any reason other than the boron concentration not being within limits minimize the time that the plant is exposed to a LOCA event occurring coincident with inoperability of a CFT, which might result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be opened, )

i (continued) I Crystal River Unit 3 8 3.5-3 Revision No. 17

CFTs' .

B 3.5.1 BASES h

APPLICABLE or the proper water volume or nitrogen cover pressure cannot SAFETY ANALYSIS be restored, the full capability of one CFT is not available (continued) and prompt action is required to place the reactor in a MODE in which this capability is not required.

The minimum volume requirement for the CFTs ensures that both CFTs can provide adequate inventory to reflood the core and downcomer following a LOCA. The downcomer then remains flooded until the HPI and LPI systems start to deliver flow.

The maximum volume limit is based upon the need to maintain adequate gas volume to ensure proper injection, ensure the ability of the CFTs to fully discharge, and limit the maximum amount of boron inventory in the CFTs. Values of 7255 gallon: and 8005 gallons are specified.

The minimum nitrogen cover pressure requirement of 577 psia ensures that the contained gas volume will generate discharge flow rates during injection that are consistent with those assumed in the safety analysis. The maximum nitrogen cover pressure limit of 653 psia ensures that the amount of CFT inventory that is discharged while the RCS depressurizes, and is therefore lost through the break, will not be larger than that predicted by the safety analysis.

The minimum boron requirement of 2270 ppm is selected to ensure that the reactor will remain subcritical during the reflood stage of a large break LOCA. The maximum allowable boron concentration of 3500 ppm in the CFTs ensures that the sump pH will be maintained between 7.0 and 11.0 following a LOCA (Ref. 5). l The numerical values of the parameters stated in the LC0 are analysis values and do not include a specific allowance for instrument error. However, the nitrogen cover pressure and tank volume limits were subsequently re-analyzed to address the issue. These re-analyses were performed in order to error-adjust the surveillance procedure acceptance criteria while maintaining an acceptable operating band for the parameter. The nitrogen cover pressure analysis limits include approximately 12 psig allowance for instrument error. Tank volume analysis (Ref. 4) opened up the operating band by approximately 300 gallons, although the upper limit was unchanged.

(continued)

Crystal River Unit 3 B 3.5-4 Revision No. 17 i

}

p ., l l

! .,- i

~

CFTs B 3.5.1

, .n l (.(a) BASES 1 ACTIONS C.1 and C.2-l (continued)

If the CFT cannot be returned to OPERABLE status within the associated Completion Time of Condition A or B, the plant must be placed in a MODE in which the LCO does not apply.

To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and RCS pressure reduced to s 750 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

l l

SURVEILLANCE SR 3.5.1.1 l REQUIREMENTS l Verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that each CFT isolation valve is i fully open, as indicated in the control room, ensures that l the CFTs are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to n the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed (u) valve could result in accident analysis assumptions not being met. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in view of administrative controls that ensure that a 1 mispositioned isolation valve is unlikely.

SR 3.5.1.2 and SR 3.5.1.3 l

Verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of each CFT's nitrogen cover pressure and the borated water volume is sufficient to ensure adequate injection during a LOCA. Due to the static design of the CFTs, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency usually allows the i

operator to identify changes before the limits are reached.

l Operating experience has shown that this Frequency is l appropriate for early detection and correction of off normal trends.

SR 3.5.1.4 l

1 o Surveillance once every 31 days is reasonsble to verify that the CFT boron concentration is within the required limits because the static design of the CFT limits the ways in (continued)

Crystal River Unit 3 B 3.5-7 Amendment No. 149 l

~

CFTs B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4 REQUIREMENTS (continued) which the concentration can be changed.

adequate to identify changes that could occur fromThe Frequency is mechanisms such as stratification or in-leakage.

within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after an 80 gallon volume increase willSampling identify whether inleakage from the RCS or addition from another the outside source has caused required limit. the boron concentration to be It is not necessary to verify boron concentration if the added water inventory is from the borated water storage tank (BWST), because the water contained requirements.in the BWST is within CFT boron concentration This is consistent with the recommendations of NUREG-1366 (Ref. 3).

SR 3.5.1.5 Verification every 31 days that power is removed from each CFT isolation valve operator ensures that an active failure could not result in the undetected closure of a CFT motor operated isolation valve coincident with a LOCA. If this closure CFT were to occur, this would result in a loss of safety function. Since power is removed under administrative control, the 31 day Frequency will provide adequate assurance that the power is removed.

REFERENCES 1. FSAR, Section 6.1.2.1.3.

2. 10 CFR 50.46.

3. NUREG-1366, December 1992.

4.

B&W Document 51-1223368-00.

5.

B&W Document 51-1172533-01.

I crystal River Unit 3 B 3.5-8 Revision No. 17

+

ECCS-Operating B 3. 5. 7.

BASES THIS PAGE INTENTIONALLY LEFT BLANK O e Crystal River Unit 3 (continued)

B 3.5-98 Amendment-No. 163

.l ECCS-Operating B 3.5.2 BASES h

BACKGROUND safety valves. The LPI pumps are capable of discharging to (continued) the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the LPI pumps is manually transferred to the reactor building emergency sump. The HPI pumps cannot take suction directly from the sump. If HPI is still needed, a cross connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as " piggy backing" HPI to LPI, and enables continued HPI to the RCS, if needed, after the BWST is emptied to the switchover point.

In the long term cooling period, flow paths in the LPI System can be established to preclude the possibility of boric acid in the core region reaching an unacceptably high concentration. LPI can be aligned to provide for two active methods of boron diiation. In one method, the decay heat system drop line is aligned to the RB sump to allow gravity feed from the hot leg. The other method consists of aligning the Auxiliary Pressurizer Spray to provide injection of boron dilute water into the hot leg.

HPI also functions to supply borated water to the reactor core following increased heat removal events, such as large SLBs. g During a large break LOCA, RCS pressure will decrease to

< 200 psia in < 20 seconds. The ECCS is actuated upon receipt of an Engineered Safeguards Actuation System (ESAS) signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately (in the programmed sequence). If offsite power is not available, the engineered safety feature (ESF) buses shed normal operating loads and are connected to the diesel generators. Safeguard loads are then actuated in the programmed time sequence.

The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required (continued)

Crystal River Unit 3 B 3.5-10 Revision No. 17

s * '

ECCS-Operating B 3.5.2

'( BASES SURVEILLANCE SR 3.5.2.1 (continued)

REQUIREMENTS it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an inoperable valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.2 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural oamage or other hydraulic component problems is required by Section XI of the American Society of Mechanical Engineers (ASME) Code (Ref. 4).. This type of testing may be accomplished by measuring the pump's developed head at only one point of the pump's characteristic curve and this point may be anywhere on the curve. This verifies both that the measured performance is within an acceptable tolerance of the

,. original pump baseline performance and that the performance

/ at the test flow is greater than or equal to the performance assumed in the plant accident analysis. SRs are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR 3.5.2.3 and SR 3.5.2.4 l These SRs demonstrate that each automatic ECCS valve that is not locked, sealed, or otherwise secured in position, actuates to its required position on an actual or simulated ESAS signal and that each ECCS pump starts on receipt of an actual or simulated ESAS signal. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESAS testing, and equipment performance is monitored as part of the Inservice Testing Program.

hJ (continued)

Crystal River Unit B 3.5-17 Revision No. 6

p .!

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 REQUIREMENTS (continued) This Surveillance ensures that these valves are in the proper position to prevent the HPI pump from exceeding its runout limit. This 24 month Frequency is acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

SR 3.5.2.6

{

This Surveillance ensures that the flow controllers for the LPI throttle valves will automatically control the LPI train flow rate in the desired range and prevent LPI pump runout as RCS pressure decreases after a LOCA. The 24 month Frequency is acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

SR 3.5.2.7 Periodic inspections of the reactor building emergency sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and to preserve -

access to the location. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

REFERENCES 1. 10 CFR 50.46.

2. FSAR, Section 6.1.

3. NRC Memorandum to V. Stello, Jr., from R.L. Baer,

" Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

4. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Article IWP-3000,

5. FTI 51-1266138-01, Safety Analysis Input to Startup Team Safety Assessment. NOTE

6. FSAR, Section 4.3.10.1.

l l Crystal River Unit 3 8 3.5-18 9

Revision No. 17 NOTE - Valid Until Cycle 12 Only

^

c.

Containment Isolation Valves B 3.6.3

./mI V

BASES '

SURVEILLANCE SR 3.6.3.5 REQUIREMENTS (continued) Verifying that the isolation time of each power operated and automatic containment isolation valve that is not locked, sealed, or otherwise secured in the isolation position is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.6 For 48 inch containment purge valves, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, is required to ensure OPERABILITY. Operating experience has demonstrated that this type of valve seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment),

jG . additional purge valve testing was established a.s part of Q the NRC resolution of Generic Issue B-20, " Containment Leakage Due to Seal Deterioration" (Ref. 7).

The specified Frequencies are based on plant-specific as-found/as-left leakage rate data for these valves. The data. indicates the CR-3 purge valve resilient seals do not degrade during the operating cycle with the valves in the ,

sealed closed position. The 92 day Frequency after opening l che valves recognizes the seals are prone to excessive '

leakage following use and is consistent with the NRC resolution of B-20.

A Note to this SR requires the results to be evaluated against the Containment Leakage Rate Testing Program. This l ensures that excessive containment purge valve leakage is properly accounted for in determining the overall containment leakage rate to verify containment OPERABILITY.

(continued) l i G -

Crystal River Unit 3 B 3.6-27 Amendment No. 156.

~

Containment Isolation Valves B 3.6.3 BASES l

i 1

SURVEILLANCE SR 3.6.3.7 REQUIREMENTS (continued) Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures each automatic containment isolation valve that is not locked, sealed, or oth2rwise secured in the isolation position, will actuate to its isolation position on an actual or simulated actuation signal. The 24 month Frequency is based on the need to perform this Surveillance !

under the conditions that apply during a plant outage and j the potential for an unplanned transient if the Surveillance t were performed with the reactor at power. Operating I experience has shown that these components usually pass this Surveillance when performed at the 24 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (Ref. 4 and 9) l The SR is modified by a note indicating the SR is not applicable in the identified MODE. This is necessary in order to make the requirements for automatic system response consistent with those for the actuation instrumentation.

REFERENCES 1. FSAR, Section 5.3.1.

2. FSAR, Section 5.2.1.1 l

3. FSAR, Sections 14.2.2. I

4. FSAR, Table 5-9.

5. FSAR, Section 5.3.3.1

6. Generic Issue B-24.

7. Generic Issue B-20.

1

8. 10 CFR 100.

9. FSAR, Section 5.3.2. l Crystal River Unit-3 8 3.6-28 Revision No.17-u 4

i Reactor Building Spray and Containment Cooling Systems B 3.6.6 B 3.6 CONTAINMENT SYSTEMS (V)-

B 3.6.6 Reactor Building Spray and Containment Cooling Systems 1

BASES l

BACKGROUND The Reactor Building (RB) Spray and Containment Cooling Systems are Engineered Safeguards (ES) systems. They provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduces the release of fission product radioactivity from containment to' the environment, in the event of a Design Basis Accident (DBA), to within limits. The Reactor Building Spray and-Containment Cooling Systems were designed consis ring the applicable proposed 10 CFR 50.34, Appendix A, " General Design Criteria for Nuclear Power Plant Construction Permits", (Ref.1) criteria. Refer to FSAR Section 1.4 for a more detailed description of these design criteria.

Reactor Buildina (RB) Sorav System o

C The RB Spray System consists of two separate trains of equal capacity, each capable of meeting the design bases. Each train includes an RB spray pump, spray headers, nozzles, valves, and piping. Each train is powered from a separate ES bus. The borated water storage tank (BWST) supplies borated water to the RB Spray System during the ECCS i injection mode of operation. In the recirculation mode of I

' operation, RB Spray System pump suction is manually transferred from the BWST to the containment sump.

During the injection mode of ECCS operation, the RB Spray System provides a spray of relatively cold barated water

, into the upper regions of containment to reduce the containment pressure and temperature and to reduce the i concentration of fission products in the containment I

atmosphere. Each header contains nozzles which are arranged to provide maximum " washing" of the RB atmosphere. The headers are located in the RB dome, more than 96 feet above ,

any floor level. Spray nozzles are spaced in the header to '

l give uniform spray coverage of the RB volume above the operating floor with one or both spray header systems in operation. CR-3 iodine removal effectiveness analysis (continued) i Crystal River Unit 3 8 3.6-35 Revision No. 2

Reactor Building Spray and Containment Cooling Systems B 3.6.6 BASES BACKGROUND Reactor Buildina Sorav System (continued) quotes a value of 65.2% for RB volume covered by the spray, based on the location of the uppermost spray ring to the operating floor at elevation 160 feet. In the recirculation mode sump isofmixed operation, water phosphate with trisodium in the reactor building emer dodecahydrate TSP-Cency )

in order to raise the pH of the sump water to at least 7.0.

Heat is removed from the containment sump water by the decay heat removal (DHR/LPI) coolers. Each train of the RB Spray System provides adequate spray coverage to meet the system design requirements for containment heat removal.

The RB Spray System is actuated automatically by a High-High reactor buildin pressure signal (30 psig) coincident with a hi pressure i ection start permit actuation signal. A Hi reactor bui din ressure signal (4 psig) opens the RB Spray System pump di c arge valves to correspond to a pre-set flowrate while a Hi h-High reactor building pressure signal starts the two R Spray System pumps.

Containment Coolino System

. The Containment Coolin cooling units (AHF-1A,gIB System consiststoofathree IC connected containment common duct suction header with four v,ert cal return air ducts. Each cooling train is equipped with demisters, cooling coils, and an axial flow fan driven by a two speed water cooled electric motor. Each unit connection two per unit common header is provided with a backpr(essure damper) for to the isolation purposes.

During normal operation, two containment cooling units are required to operate to maintain containment average air temperature less than 130 F With two units operating, the plant has reco(Ref. 3.6.5).

rded temperatures as high as 129 F. The third unit is on standby and isolated from the operating units b Fan

/ cooler unit AHF ylCmeans of pped is equ the backpressure dampers.

with a transfer switch which allows it to be manually p aced to either the "A" or "B" power train to operate in case one of the operating units fails. The containment coolin SW S stem supp y valve closed.gThis unit not in use action has abecause is taken manual the mergency fesel Generators have limitations on their electrical capacity. This capacity limitation will not ermit more than two cooling coils to be supplied by a SW ump. Otherwise, the SW Pump could require more power than has been accounted for in the Emergency Diesel Generator loading calculations. For normal operation, cooling water to the operating coils is provided by the Industrial Cooling (CI) System.

(continued)

Crystal River Unit 3 B 3.6-36 Revision No. 1

,' Reactor Building Spray and Containment Cooling Systems

~B 3.6.6 (m)

Lj BASES BACKGROUND Containment Coolino System (continued)

Upon receipt of a high reactor building pressure ES signal (4 psig), the two operating cooling fans running at high speed will automatically stop. One cooling unit fan will automatically restart and run at low speed, provided normal or emergency power is available. In post accident operation following an actuation signal, one Containment Cooling System fan will start automatically in slow speed if one is not already running. If the lead fan fails to start or trips, a second fan will automatically start in slow speed. A fan is operated at the lower speed during accident conditions to prevent motor overload from the higher density atmosphere. The automatic changeover valves operate to provide Nuclear Service Closed Cycle Cooling (SW) System flow to the cooling units and isolate the CI System flow. I i

APPLICABLE The RB Spray System and Containment Cooling System limit the SAFETY ANALYSES temperature and pressure that could be experienced following m a DBA. The limiting DBAs considered are the loss of coolant j i , accident (LOCA) and. the steam line break. The postulated

( ,/ DBAs are analyzed, with regard to containment ES systems, assuming the loss of one ES bus. This is the worst-case single active failure, resulting in one train of the RB Spray System and one train of the Containment Cooling System being inoperable.

The analysis and evaluation show that, under the worst-case scenario, the highest peak containment pressure is 54.2 psig (experienced during a LOCA). The analysis shows that the peak containment temperature is 278.4*F (experienced during a LOCA). Both results are less than the design values.

(See the Bases for LCO 3.6.4, " Containment Pressure," and LC0 3.6.5, " Containment Air Temperature," for a detailed discussion.) The analyses and evaluations assume a power level of 2568 MWt, one RB spray train and one RB cooling train operating, and initial (pre-accident) conditions of 130*F and 17.7 psia. The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses.

l (continued)

Crystal River Unit 3 B 3.6-37 Amendment No. 165 l

I

Reactor Building Spray and Containment Cooling Systems -

, B 3.6.6 BASES APPLICABLE The effect of an inadvertent RB spray actuation has also SAFETY ANALYSIS been analyzed. An inadvertent spray actuation results in a (continued) 2.5 psic containment pressure drop and is associated with the sudcen cooling effect in the interior of the leak tight containment. Additional discussion is provided in the Bases for LCO 3.6.4.

The modeled RB Spray System actuation from the containment analyses is based on a response time associated with exceeding the RB pressure High-High setpoint coincident with a high pressure injection start permit actuation signal to achieve full flow through the containment spray nozzles. l The Containment Spray System total response time of 90 startu seconds (for loss includes of offsiteemergency) diesel power , block generator loading of equ(EDG)ipment,p spray pump startup, and spray line filling (Ref. 2).

Containment cooling train performance for post accident conditions is given in Reference 3. The result of the analysis is that one train of RB cooling will contribute sufficient peak cooling capacity during the post accident condition in conlunction with one RB spray train to successfully limit peak containment pressure and temperature to less than design values. The train post accident cooling capacity under varying containment ambient conditions, required to perform the accident analyses, is also shown in Reference 4.

The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the containment pressure high setpoint to achieve full Containment Cooling System air and safety grade cooling water flow. The Containment Cooling System total response time of 25 seconds includes signal delay, EDG startup (for loss of offsite power), and service water pump startup times (Ref. 3).

The Reactor Building Spray System and the containment Cooling System satisfy Criterion 3 of the NRC Policy Statement.

LCO During a DBA, a minimum of one containment cooling train and one RB spray train are required to maintain the containment peak pressure and temperature below the design limits.

Additionally, one RB spray train is required to remove (continued)

Crystal River Unit 3 B 3.6-38 Revision 16

.i Reactor Building Spray and Cont'ainment Cooling Systems B 3.6.6 e

x BASES l LC0 iodine from the containment atmosphere and maintain (c'ontinued) concentrations below those assumed in the safety analysis.

To ensure that these requirements are met, two RB spray trains and two containment cooling units must be OPERABLE.

Therefore, in the event of an accident, the minimum requirements are met, assuming the worst-case single active failure occurs.

I Each RB Spray System train includes a spray pump, spray I

headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an Engineered Safeguards Actuation System signal and manually transferring suction to the reactor l building emergency sump.

Each Containment Cooling System train includes demisters, cooling coils, dampers, an axial flow fan driven by a two l

speed writer cooled electrical motor, instruments, and I

controls to ensure an OPERABLE flow path.

.[

^

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature, requiring the operation of the RB spray trains and containment cooling trains.

In MODES 5 and .6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the RB Spray System and the Containment Cooling System are not required to be OPERABLE in MODES 5 and 6 ACTIONS JL1 With one RB spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE spray and cooling trains are adequate to perform the iodine removal and containment cooling functions. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant heat i

f~

/ >

(continued) !

\

Crystal River Unit 3 8 3.6-39 Revision 2 l

m

. 1 Rsactor Building Spray and Containment Cooling Systems B 3.6.6 BASES ACTIONS A1 (continued) removal capability afforded by the OPERABLE RB spray train and cooling system train (s), reasonable time for repairs, and the low probability of a DBA occurring during this period.

The 10 day portion of the Completion Time for Required Action A.1 is based upon engineering judgment. It takes into account the low probability of coincident entry into two Conditions in this LCO coupled with the low probability of an accident occurring during' this time. Refer to Section 1.3, " Completion Times , for a more detailed discussion of the purpose of the "from discovery of failure to meet the LC0" portion of the Completion Time.

B.,1 and 'B.2 If the inoperable RB spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in

' at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows additional time to attempt restoration of the RB spray train and is reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.

L.1 l With one of the required containment cooling trains inoperable, the inoperable containment cooling train must be restored to OPERABLE status within 7 days. The components in this degraded condition provide iodine removal l capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 7 day Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the RB S) ray System and Containment Cooling System and the low pro) ability of a DBA occurring during this period.

_ (continued)

Crystal River Unit 3 B 3.6-40 Revision No. 17

___ -------_--_--------------J

v4

! Reactor Building Spray and Containment Cooling Systems B 3.6.6 r3

-ly BASES ACTIONS C.1 (continued) l

'(continued)

The 10 day portion of the Completion Time for Required Action C.1 is based upon engineering judgment. It takes into account the low probability of coincident entry into two Conditions in this LCO coupled with the low probability of an accident occurring during this time. Refer to Section 1.3 for a more detailed discussion of the purpose of the "from discovery of failure to meet the LC0" portien of the Completion Time.

D_d With two of the required containment cooling trains inoperable, one of the required containment cooling trains must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The components in this degraded condition (both spray trains are OPERABLE or else Condition E is entered) provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was developed taking into account the redundant heat removal capabilities afforded by

('

i

. combinations of t!.e Es .4; ., ..,,,;.a u.d Ccnw n:acnt Celin3 System and the low probability of a DBA occurring during this period.

E.1 and E.2 If the Required Actions and associated Completion Times of Condition C or D of this LCO are not met, the plant must be 1 l

placed in a MODE in which the LCO does not apply. To !

achieve this status, the plant must be placed in at least l MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The i allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

I M With two RB spray trains or any combination of three or more RB spray and required containment cooling trains inoperable, the unit is in a condition outside the accident analysis.

Therefore, LCO 3.0.3 must be entered immediately.

l T

(continued)

Crystal River Unit 3 B 3.6-41 Revision 17 1

Reactor Building Spray and Containm:nt Cooling Systems B 3.6.6 BASES (continued)

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RB spray flow path provides assurance that the proper flow paths will exist for RB Spray System operation. This SR does not apply to valves that are locked, sealed, or otherwise securec in position, since these were verified to be in the correct position prior to locking, sealing, or securing. Thrase valves include valves in the main flow paths and the first normally closed valve in a branch line. In lieu of the first normally closed valve in the branch line, credit may be taken for verifying valve position of another valve downstream, providing the isolation of the flow path is achieved. Verifying correct valve alignment of valves immediately downstream of an unsecured valve still assures isolation of the flow path.

There are several exceptions for valve position verification due to the low potential for these types of valves to be mispositioned. The valve types which are not verified as part of this SR include vent or drain valves (both inside and outside the RB), relief valves outside the RB, instrumentation valves (both inside and outside the RB),

check valves (both inside and outside the RB), and sample . .

line valves (inside and outside the RB). A valve that -

receives an actuation signal is allowed to be in a non-accident position provided the valve will automatically reposition within the proper stroke time. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position.

SR 3.6.6.2 Operating each required containment cooling train fan unit for ;t 15 minutes ensures that all trains are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action.

The 31 day Frequency was developed considering the known reliability of the fan units and controls, the two train redundancy available, and the low probability of a sign *ficant degradation of the containment cooling trains (continued)

Crystal River Unit 3 B 3.6-42 Revision 2

r c._

a

'i

-Reactor Building Spray and Containment Cooling Systems B 3.6.6

[ .

BASES 4

SURVEILLANCE SR 3.6.6.2 (continued)

REQUIREMENTS. ._

occurring between surveillances and has been shown to be acceptable through operating experience.

It is preferable to run'the fans in slow speed for this SR since this provides additional confidence the post-accident containment cooling train circuitry'is OPERABLE.

'SR 3.6.6.3

_* Verifying that each RB spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the' cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by Section XI of the ASME Code (Ref. 5). Since the RB Spray System pumps cannot be tested with flow through the spray headers, . they are tested on recirculation flow. This test confirms one point.on the pump design curve and is indicative of overall performance. -Such inservice tests O ' confir:a compenent OPERASILITY, trend performase, and detect incipient' failures' by indicating abnormal- performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.4 Verifying an emergency design cooling water flow rate of 1 1780 gpm to any 2 of 3 containment cooling system heat exchangers (fan cooling coils) ensures the design flow rate l assumed in the safety. analysis is being achieved. The SR verifies that, with the SW System in the post-accident ES alignment, adequate flow is provided to the heat exchangers to remove the design basis reactor building heat load. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage. While the cooling units can be aligned to the SW System during normal operations, other critical normal-running SW loads make it impractical to verify accident flow rate to the coolers with the plant on-line. On an ES actuation, these normal-running loads are isolated and the SW flow P

-Q (continued)

.) .

. Crystal River Unit 3_ B 3.6-43 Revision 17 1

i

c .

Reactor Building Spray and Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.4 (continued)

REQUIREMENTS normally supplied to them re-directed to the post-accident loads. The 24 month Frequency was also considered acceptable based upon the existence of other Technical Specification Surveillance Requirements. A degradation in cooling unit performance between performinces of this SR would likely be seen as an increase in RB temperature (monitored once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months in accordance with SR 3.6.5.1).

SR 3.6.6.5 and SR 3.6.6.6 .

These SRs require verification that each automatic RB spray valve that is not locked, sealed, or otherwise secured in the correct position, actuates to its correct position and that each RB spray pump starts upon receipt of an actual or simulated actuation signal. The 24 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillances when performed at the 24 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

The SR is modified by a note indicating the SR is not applicable in the identified MODE. This is necessary in order to make the requirements for automatic system response consistent with those for the actuation instrumentation.

SR 3.6.6.7 This SR requires verificaticn that each required containment cooling train actuates upon receipt of an actual or simulated actuation signal. In the event of a LOCA, the air steam mixture density is much higher than normal air density. The units are not designed to handle the full flow rate at this condition. To operate the unit at full flow (motor at high speed) at this condition, will cause the motor to overload and trip. To guard the motor from overloading, the volumetric flow rate must be cut (continued) ..

Crystal River Unit 3 B 3.6-44 Revision 2 I

- )

- i j

Reactor Building Spray and Containment Cooling Systems I B 3.6.6 l l

BASES SURVEILLANCE SR 3.6.6.7 (continued) I REQUIREMENTS approximately in half (motor at low speed). Thus, this SR i ensures that one of the running motors automatically switches to low speed upon receipt of the containment cooling engineered safeguards actuation signal and the other running motor trips. To prevent exceeding SW design temperatures, by having two RB fans in service, this SR also ensures that only one RB fan will start on an ES actuation signal. The 24 month Frequency is based on engineering judgment and has been shown to be acceptable through operating experience. See SR 3.6.6.5 and SR 3.6.6.6, above, for further discussion of the basis for the 24 month Frequency.

The SR is modified by a note indicating the SR is not applicable in the identified MODE. This is necessary in order to make the requirements for automatic system response consistent with those for the actuation instrumentation.

SR 3.6.6.8 O . With the containr.ient spray header isolated and drained of V any solution, low pressure air or smoke can be blown through test connections. Performance of this Surveillance demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Due to the passive nature of the design of the nozzles, a test at 10 year intervals is considered adequate to detect obstruction of the spray nozzles.

)

REFERENCES 1. FSAR, Section 1.4.

2. FSAR, Section 14.2.2.5.9.

3. FSAR, Section 6.3.

4. R0-2787 Requirement Outline, Reactor Building Fan Assemblies, Addendum B, February 19, 1971.

ASME, Boiler and Pressure Vessel Code,Section XI.

5.

G(3 Crystal River Unit 3 B 3.6-45 Amendment No. 165

.~ l Containment Emcrgency Sump pH Control .'

B 3.6.7 i

8 3.6 CONTAINMENT SYSTEMS B 3.6.7 Containment Emergency Sump pH Control (CPCS)

BASES BACKGROUND The CPCS raises the pH of water in the containment emergency sump to at least 7.0 following a Design Basis Accident (DBA). In the event of a loss of coolant accident (LOCA),

the trisodium phosphate dodecahydrate (TSP-C) contained in the CPCS storage baskets will be automatically dissolved in the reactor coolant and BWST inventory lost through the break. The CPCS performs no function during normal plant operations.

Radioiodine in its various forms is the fission product of primary concern in the evaluation of a DBA. It is absorbed by the spray from the containment atmosphere. To reduce the potential for elemental iodine re-evolution, the spray solution during the ECCS recirculation phase is adjusted (buffered) to an alkaline pH. This promotes iodine hydrolysis, in which iodine is converted to nonvolatile forms. TSP-C, because of its stability when exposed to

, radiation and elevated temperature and its non-toxic nature, is the preferred buffer material. '

_/

The TSP-C storage baskets are designed and located to permit the contents of the baskets to be dissolved into the inventory in the RB sump as water level increases post-LOCA.

To ensure the desired range of pH is achieved, the stainless steel mesh screen storage baskets are located at the 95' elevation of the RB.

The design of the CPCS was established to provide a spray solution during the ECCS recirculation phase with a pH between 7.0 and 11.0 (Ref. 1). This range of alkalinity was established not only to ensure elemental iodine does not re-evolve, but also to minimize the long-term stress corrosion of mechanical system components that would occur if the acidic borated water were not buffered. The pH range also considers the environmental qualification of equipment in containment that may be subjected to the spray.

(continued)

Crystal River Unit 3 B 3.6-46 Amendment 149

7 MSIVs l B 3.7.2 !

/^)

%)

B 3.7 PLANT SYSTEMS -

B 3.7.2 Main Steam Isolation Valves (MSIVs) )

. BASES BACKGROUND The principal function of the main steam isolation valves (MSIVs) is to isolate steam flow from the secondary side of the steam generators (OTSGs) following a steam line break (SLB). A transient such as increased steam flow through the !

turbine bypass valves causing low steam generator pressure '

would-also be terminated by closure of the MSIVs.

One MSIV is located in each of four main steam lines outside, but close to, containment. The MSIVs are located downstream of the main steam safety valves (MSSVs) and steam pump turbine supply to prevent lines to theofemergency isolation feedwater these critical steam (EFW) loads in the event of MSIV closure. Closure of the MSIVs isolates the OTSGs from the turbine, turbine bypass valves, and other auxiliary steam loads.

The MSIVs are spring actuated, pneumatically-operated valves which are opened / assisted-closed by instrument air pressure )

{

O -(Ref. 1). These valves close on receipt of a main steam line isolation signal generated by the Emergency Feedwater (h

Initiation and Control (EFIC) System based upon low OTSG j pressure. The main steam lines can also be manually isolated from the control room.

A description of the MSIVs is contained in FSAR, Section 10.2.1.4 (Ref. 2 .

MSIVs satisfy 10)CFR 50 Appendix A General Design CriteriaI (GDC) 57 requirements for isolation of closed system lines which penetrate containment (Ref. 3).

APPLICABLE The SLB analysis was reperformed crediting all "as built" SAFETY ANALYSIS systems and their associated response times. This is documented in FTI Summary Analysis Report 86-1266223-00, "CR-3 MSLB with MFP Trip Failure". In this analysis, EFIC isolation of Main Feedwater and Main Steam were credited.

The raquired stroke time of the MSIVs is six seconds which !

includes an EFIC signal process delay and valve closure from i the time of OTSG low pressure of 585 psig. The required ITS l EFIC actuation on 10TSG low pressure is greater than or equal {

to 600 psig. The lower analysis pressure is conservative.

1 (continued) v Crystal River Unit 3 B 3.7-7 Revision No. 17 !

m

l MSIVs B 3.7.2 BASES l

APPLICABLE There are several reasons why all MSIVs are isolated on an SAFETY ANALYSIS EFIC MS isolation, including those on the intact generator.

(continued) Restricting the blowdown to a single OTSG is necessary to limit the positive reactivity effects associated with the resulting Reactor Coolant System (RCS) cooldown, as well as to prevent containment overpressurization in the event of a break within the reactor building coincident with the failure of feedwater to isolate. (Ref. 4). Additionally, MSIV closure ensures that at least one OTSG remains available for RCS cooldown and capable of supplying steam to the turbine driven EFW pump.

Several SLB variations are considered in the accident analysis. Steam line isolation prevents a single break from affecting both OTSGs, allowing the unaffected OTSG to be used for RCS heat removal. A controlled cooldown can then be maintained, through operation of the EFW system and steam relief through the atmospheric dump valves or turbine bypass valves.

In the event of a single MSIV failure coincident with an SLB accident, closure of the three remaining MSIVs will prevent continued, simultaneous blowdown of both OTSGs. Thus, the accident analysis has shown the SLB can be mitigated even with the failure of a single MSIV.

In contrast with the postulated SLB events, the MSIVs are assumed to be open following a steam generator tube rupture (SGTR) accident. Following a SGTR, activity and inventory contained within the RCS is leaked into the MS System, where it is then available for release to the environment. In the evaluation of offsite dose following a SGTR, the turbine bypass valves (TBVs) were used to establish and maintain RCS cooldown, directing the leaked reactor coolant to the condenser. Within the condenser, a partial removal of iodine was considered, effectively reducing the total quantity of radioactivity contributing to the post-accident offsite dose. Although the resultant offsite dose is predicted to be considerably less than the guidelines of 10 CFR 100, the ability to maintain the MSIVs open is essential to keeping offsite doses within analyzed values (Ref. 5). l The MSIVs satisfy Criterion 3 of the NRC Policy Statement. i l

l O'

(continued)

Crystal River Unit 3 B 3.7-8 Revision No. 17

MSIVs B 3.7.2 O

g BASES LCO This LC0 requires that all four MSIV be OPERABLE. The MSIVs are considered OPERABLE, for this Specification, when the isolation times are within limits and they close on an EFIC isolation actuation signal. Containment isolation requirements for the MSIVs are addressed in LCO 3.6.3.

MSIVs that are closed and deactivated are considered OPERABLE since they are already performing the safety function and the administrative controls to ensure function are adequate. However, the TBVs may not be OPERABLE under these circumstances. The Required Actions of LC0 3.7.4 are required to be entered in this situation if the TBV are determined to be inoperable as a result of MSIV closure and deactivation.

This LC0 provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 limits (Ref. 6).

APPLICABILLTY The HSIVs must be OPERABLE in MODES 1, 2, and 3 since there V) is significant mass and energy in the RCS and OTSG and the potential for a SLB exists.

In MODES 4, 5, and 6 the pressure and temperature in the OTSGs is markedly reduced. Therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

(continued)

Crystal River Unit 3 B 3.7-9 Amendment No. 149

MSIVs B 3.7.2 BASES ACTIONS The ACTIONS are modified by a Note which ensures appropriate remedial actions are taken in the event the turbine bypass valves, addressed in LC0 3.7.4, are rendered inoperable by a closed MSIV (MSV-411 or MSV-413).

This Note is an LC0 3.0.6 type exception, since LC0 3.0.6 )

would dictate the ACTIONS of Specification 3.7.4 should not be taken if the TBV is rendered inoperable solely as a result of the inoperable MSIV. In this case, it is appropriate to enter the Conditions and Required Actions of Specification 3.7.4 when one or more TBV is inoperable.

A.1 and A.2 i With one or more MSIV inoperable on one OTSG, action must be I taken to restore the component (s) to OPERABLE status or close the valve (s) within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, considering the probability of an accident that would require actuation of the MSIVs occurring during this time interval. The turbine stop valves are available as backup to provide the required isolation for the majority of postulated accidents which require OTSG isolation.

Valves closed in accordance with Required Action A.1 must be I

verified to be closed on a periodic basis. This is necessary given the valves are not required to be deactivated, to ensure the assumptions of the safety analysis remain valid. The 7 day Completion Time is reasonable, based upon engineering judgement, in view of MSIV status indication in the control room, and other administrative controls, to ensure the valves remain in the closed position.

(continued)

Crystal River Unit 3 B 3.7-10 Revision No. 18

t MFIVs B 3.7.3 B 3.7 PLANT SYSTEMS O)

("

B 3.7.3 Main Feedwater Isolation Valves (MFIVs) i BASES BACKGROUND The main feedwater isolation valves (MFIVs) are designated valves in the Main Feedwater (MFW) System which function in conjunction with other a;;uiptent to isclate MFW to the steam generators (OTSGs) in accordance with assumptions used in the high energy line break accident analyses.

At CR-3, the MFIVs for each OTSG consist of the MFW pump suction valve, the main /startup/ low load block valves (in parallel), and the MFW pump discharge cross connect valve between OTSG A and B (Ref. 1). All the OTSG A valves receive a signal to close on low OTSG pressure from EFIC OTSG A MFW isolation automatic actuation logic channels A and B. OTSG B valves similarly receive signals from EFIC OTSG B MFW isolation automatic actuation logic channels A and B. The crossover valve receives closure signals from both channels of EFIC's OTSG A and 0TSG B MFW isolation logics (Ref. 2).

t 1 In addition to the above, the EFIC OTSG A MFW isolation V logic trips MFW pump A on a OTSG A low pressure signal.

OTSG B EFIC logic trips MFW pump B on OTSG B low pressure.

EFIC also provides a trip of the opposite side MFW pump and closure of its suction valve on a single side feedwater isolation signal when the crossover valve is open. This logic is enabled by manual key switches which are administratively controlled during times when both OTSGs are being fed from one MFW pump (typically below 55% power).

This reduces the system pressure on the MFW pump startup, crosstie MFW pump discharge valve, and low load block valves I and assures these MFIVs can perform their intended function.

The tripping of the other train assures main feedwater isolation for the case where the EFIC initiation is for the opposite side from the orerating MFW pump.

This results in several layers of redundancy in that not only are the fluid system components (valves, pumps) redundant, but the automatic closure signals to each component are also redundant.

G (continued)

Crystal River Unit 3 8 3.7-13 Revision No. 17

.1 MFIVs B 3.7.3 BASES l

APPLICABLE Closure of the MFIVs terminates the addition of feedwater to SAFETY ANALYSES an affected 0TSG. This limits the mass and energy releases for breaks within containment, reduces cooldown effects, and reduces the potential for a return to power due to a return to critical following reactor trip.

The SLB analysis was reperformed crediting all "as built" systems and their associated response times. This is documented in FTI Summary Analysis Report 86-1266223-00, "CR-3 MSLB with MFP Trip Failure". In this analysis, EFIC isolation of Main Feedwater and Main Steam were credited.

The required stroke time of the MSIVs, except for the low load block valves FWV-31 and FWV-32, is 34 seconds which includes an EFIC signal process delay and valve closure from the time of OTSG low pressure of 585 psig. The actual EFIC actuation on OTSG low pressure is greater than or equal to 600 psig. The lower analysis pressure is conservative. The low load block valves FWV-31 and FWV-32 are required to stroke close in 67 seconds which includes an EFIC signal process delay and valve closure.

The MFIVs satisfy Criterion 3 of the NRC Policy Statement.

LC0 O

This LC0 ensures that the MFIVs will isolate MFW flow to the OTSGs following a FWLB or a main steam line break. The following valves are addressed by this LCO:

OTSG A OTSG B FWV-30 Main block valve FWV-29 FWV-31 Low load block valve FWV-32 FWV-36 Startup block valve FWV-33 I FWV-14 MFW pump suction valve FWV-15 FWV-28 MFW cross connect valve i

O (continued)

Crystal River Unit 3 B 3.7-14 Revision No. 17 4

a. ,

l l

MFIVs B 3.7.3 BASES l O' LC0 EFIC Channel A (continued) Main FW Isolation Main FW Pump Trip Switch Function EFIC Channel B Main FW Isolation Main FW Pump Trip Switch Function Two MFIVs in each flow path are required to be OPERABLE.

The MFIVs are considered OPERABLE when all MFIVs are capable of automatically closing within their respective isolation time on an isolation actuation signal. The function of the EFIC Channel A and B manual key switches is part of the OPERABILITY of the MFIVs. The failure of a switch (s) to be in the correct position or to be functional may constitute a condition which renders MFIVs not OPERABLE. Refer to the ACTIONS section for a description of what constitutes a flowpath for the purposes of this Specification.

A MFIV that is closed and deactivated is considered OPERABLE since it is already performing its safety function under an appropriate level of administrative control. Failure to D . meet the LCO re;uirerents can result in additional mass and energy being released to containment following an SLB or FWLB inside containment.

APPLICABILITY In MODES 1, 2, and 3, the MFIVs are required to be OPERABLE in order to limit the amount of available fluid that would be added to containment in the case of a secondary system pipe break inside containment. This need to limit inventory is based on the energy associated with secondary coolant during these MODES of operation.

In MODES 4, 5, and 6, OTSG energy is low. Therefore, the MFIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

(continued)

Crystal River Unit 3 B 3.7-15 Revision No. 17

a A

MFIVs B 3.7.3 BASES (continued)

ACTIONS The ACTIONS table is modified by three Notes. Note 1 indicates that separate Condition entry is allowed for each flowpath. A flowpath is defined as any connected system piping, beginning upstream of the MFW pump suction valve, through which feedwater can travel to an OTSG. Note 2 allows MFW flow paths to be un-isolated under administrative control. This Note provides for plant cooldown with MFW in its normal operating configuration, despite the MFIV being inoperable. The risk of not having redundant isolation capability during this brief transition period was considered acceptable when compared to the risks of an abnormal cooldown or MFW transient. Note 3 limits operation with a MFW start-up control valve isolated, consistent with Condition D of this Specification. This limit is necessary since other MFIV flow paths may be isolated in accordance with the Required Actions of Condition A and B such that the startup flow path is also isolated.

A.1 and A.2 With one or more MFW flow paths with one MFIV inoperable, action must be taken to restore the affected valves to OPERABLE status, or to isolate the affected flow path within '

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When isolated, the valves are performing their safety function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valve in the flowpath, the MFW pump trip feature provided on low OTSG pressure, and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on operating experience.

Isolated MFW flow paths must be verified to be in the correct position on a periodic basis. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.

(continued) .. /

Crystal River Unit 3 8 3.7-16 Revision No. 1

r-J MFIVs B 3.7.3 BASES ACTIONS B.1 and B.2 (continued)

With one or more flow paths not capable of isolating within the required isolation time, action must be taken to restore one valve to within the required closure time or to isolate the affected flow path. The Required Actions are the same as those specified in Condition A of this Specification, except the Completion Time for B.1 is reduced to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time reflects analysis that demonstrated reduced stroke times will not likely challenge )

the containment analysis. However, the level of degradation represented by this Condition is considered more serious than Condition A.

When in Condition B, the Required Actions of Condition A are I also applicable. l L1 O

With two inoperable valves in the same flow path, valve b

isolation capability has been lost. Under these conditions, at least one of the affected valves in each flow path must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, based on operating experience.

ACTIONS L1 (continued)

With a startup block valve (FWV-33, -36) in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, valve closure or isolation is not an acceptable alternative action because the ICS controlled startup control valves are necessary to provide and control main feedwater following a reactor trip. Closure of the startup block valves would preclude this function post-trip and potentially challenge Emergency Feedwater System operation.

(continued)

Crystal River. Unit 3 8 3.7-17 Revision No. 1

MFIVs B 3.7.3 BASES ACTIONS Rd (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundanc flowpath,y the afforded by thetrip MFW pump remaining OPERABLE feature provided valve on low OTSGin the pressure, and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.

E.1 and E.2 If the MFIVs cannot be restored to OPERABLE status, or closed, or isolated within the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable basedonoperatingexperience,toreachtherequiredplant conditions from full power conditions in an orderly manner and wi.thout challenging plant systems.

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that MFIV closure time is within the acceptance criteria in the Inservice Testing Program. In order to be consistent with the safety analysis as documented in FTI Summary Analysis Report 86-1266223-00, "CR-3 MSLB with MFP Trip Failure " the required stroke time of the MFIVs, except for the low, load block valves FWV-31 and FWV-32 is 34 seconds which includes an EFIC signal process deiay and valve closure from the time of 0TSG low pressure of 585 psig. The actual EFIC actuation on OTSG low pressure is greater than or equal to 600 psig. The lower analysis pressure is conservative. The low load block valves FWV-31 and FWV-32 are required to stroke close in 67 seconds which includes an EFIC signal process delay and valve closure. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. The MFIVs should not be tested at power since even a part stroke exercise increases the risk of a valve closure, and the risk of a plant transient with the plant generating power. As these valves are not tested at power, they are exempt from the ASME Code,Section XI (Ref. 2) quarterly valve stroke requirements.

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows delaying testing until MODE 3 in order to establish the test conditions most representative of those under which the acceptance criterion was generated.

(continued)

Crystal River Unit 3 8 3.7-18 Revision No. 17

ng

TBVs

. B 3.1. 4 - -

00, B 3.7 PLANT SYSTEMS q

Q B 3.7.4 . Turbine Bypass Valves (TBVs)

BASES BACKGROUND TheoTBVs provide a method for cooling the plant to Decay Heat Removal (DHR) System entry conditions via the main condenser. Following an accident, this'is done in conjunction with the Emergency Feedwater.(EFW) System, providing flow from the EFW tank (EFT-2). There are four air-operated TBVs, two per steam generator.(OTSG). The T Vs are located downstream of the main steam isolation valves (MSIVs) and other remote power-operated isolation valves to permit the valves to be isolated if necessary.

Each TBV is sized to pass 3.75% of rated main steam flow (418,500 lbm the valves a/hr at normalofsteam re capable conditions) cooling down theand combined, plant at the design rate of 100*F/ hour (Ref.1). All four TBVs are controllable from the Main Control Board as well as local manual at the valves themselves. The TBVs are not available following a loss of offsite power (LOOP) due to the loss of the Circulating Water System and eventually the condenser. However, the licensing basis for the Steam Generator Tube Rupture (SGTR) accident does not require a LOOP be assumed.

/_\

V In the event of a LOOP, the Atmos 3heric Dump Valves (ADVs) would be relied upon to perform tie secondary side heat removal function. The Technical Bases Document supporting the Emergency Operating Procedure for SGTR indicates that the ADVs can be used to cool down the plant and still meet 10 CFR 100 limits. However, the offsite dose would be I significantly higher than those associated with a TBV-based cooldown.

The ADVs are air-operated ' valves equipped with pneumatic controllers to permit control of the cooldown rate. The valves are provided with a backup supply of bottled air.

Manual valve alignment is necessary to use this air to operate the ADVs on loss of pressure in the normal instrument air supply. The air supply is sized to provide sufficient pressurized gas.to operate the ADVs for four hours, the time required to cope with a Station Blackout event. This also 3rovides the capability to operate the ADVs to minimize tie radiological consequences of a Steam Generator Tube Rupture with a LOOP (a beyond design and licensing basis scenario).

b Q (continued)

Crystal River Unit 3 B 3.7-19 Revision No. 19 p..._..

. 1 l

TBVs , I B 3.7.4 '. l l

BASES (continued)

APPLICABLE The TBVs are assumed to be used by the operator to cool down SAFETY ANALYSIS the plant following the design basis SGTR event (Ref. 2).

The. initiating event is a double-ended rupture of a single OTSG tube, resulting in a primary to secondary leak rate of 435 gpm; too large for normal makeup to compensate. RCS pressure decreases to the Reactor Protection System (RPS) low-pressure trip setpoint and the reactor is automatically shut down. In turn, the turbine trips and the OTSGs are isolated. Prior to operator actions to cool down the unit, the TBVs, ADVs, and the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the OTSG's pressure and temperature below the design value. This is assumed to occur over a period of one minute, 8 minutes following initiation of an event.

At 9 minutes into the event, the analysis assumes secondary side pressure has decreased to below the ADV and MSSV setpoints and that the direct release to the environment is terminated. From this point in time until 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months after the start of the event, both OTSGs are continuously steamed to the condenser in order to remove decay heat and cooldown/

de-pressurize the RCS to DHR System entry conditions. The analysis assumes all four TBVs are available to perform this ^

function. At 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months into the event, offsite radioactivity releases are terminated as DHR is assumed to be in operation.

The proper operation of the TBVs allows both OTSGs, both the faulted and intact (assumed to have a 1 gpm primary to secondary leak rate), to be steamed to the condenser. This is significant in terms of offsite dose consequences resulting from the SGTR. A gas-liquid partition factor for iodine of 1.0 E-4 was assumed for releases occurring through the condenser. Releases directly to the atmosphere assume a partition factor of 1.0. Offsite doses calculated from the event are directly proportional to the value assumed for the partition factor. Thus, proper operation of the TBVs is j

necessary to maintain dose consequences associated with a i SGTR to a minimum. I The TBVs satisfy Criterion 3 of the NRC Policy Statement.

l (continued)

Crystal River Unit 3 8 3.7-20 Revision No. 12 1

~

B f y BASES (continued) gj ...--- - -- - ---

O LC0 Each TBV (two per OTSG) is requirbtFttPb# GPbmutt ror tnis LCO. Failure to meet the LCO can result in the inability to cooldown to DHR System entry conditions following a SGTR event while maintaining offsite doses to a minimum. A TBV is considered OPERABLE when it is capable of providing a controlled relief of the main steam flow, and is capable of fully opening and closing when manually commanded to do so by the operator.

APPLICABILITY In MODES 1, 2, and 3, the pressurcs and temperatures in the RCS are high enough to initiate a SGTR and require secondary side depressurization. Therefore, the TBVs are required to be OPERABLE in these MODES.

In MODES 4, 5, and 6, a SGTR is not a credible event due to the reduced stresses in the generator tubes and low driving head for release to the environment.

ACTIONS A.1 and A.2 With one or more TBV(s) inoperable, action must be taken to restore all TBVs to OPERABLE status. The 7 day Completion Time is reasonable to repair inoperable TBVs, based on the '

availability of other means of depressurizing the RCS following a SGTR, and the low probability of this event occurring during the 7 day period. As an alternative to restoring the TBV(s) to OPERABLE status, the associated 0TSG t ADV must be verified to be OPERABLE within 7 days. This i entails verifying that SR 3.7.4.1 is " current" for the ADV, or performing the Surveillance. Reliance on the ADV to satisfy the ACTIONS of this Specification is considered acceptable based on the early analysis.

1 l

B.1 and B.2 If the TBVs cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a ,

MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allovted (continued)

Crystal River Unit 3 B 3.7-21 Revision No. 12

E .

l TBVs ,

,i B 3.7.4 -l l

BASES -

ACTIONS B.1 and B.2 (continued) )

Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full 1 power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7,4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the TBVs must be able to be opened remotely and throttled through their full range. This SR ensures that tha TBVs are tested through a full control cycle at least once per fuel cycle.

Cycling TBVs during plant heatup satisfies this requirement.

Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 10.2.1.4.

2. FSAR, Section 14.2.2.2.

3. E0P Technical Bases Document, Volume 3, Technical Bases, FTI Technical Document 74-1152414-08, November 1, 1996.

Crystal River Unit 3 B 3.7-22 6

Revision No. 19

EFW System B 3.7.5

,Q Q BASES

' SURVEILLANCE SR 3.7.5.5 (continued)

REQUIREMENTS of EFW flow paths must be demonstrated before sufficient core heat is generated that would require the operation of the EFW System during a subsequent shutdown. The Frequency is reasonable, based on engineering judgment, in view of other administrative controls to ensure that the flow paths are OPERABLE. To further ensure EFW System alignment, flow path OPERABILITY is verified, following extended outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the EFW tank to the OTSGs is properly aligned. This requirement is based upon the recommendation of NUREG 0737. The Frequency was modified slightly during ITS development (prior to entering MODE 2) to provide an SR 3.0.4 type exception. As written, the SR allows the plant to achieve and maintain MODE 3 conditions in order to perform the verification.

REFERENCES 1. ' Enhanced Design Basis Document for the Emergency Feedwater and Emergency Feedwater Initiation and Control Os System, Revision 1, dated September 27, 1991 with i

V .

Temporary Changes 156, 230, 247, and 249.

2. BAW-10043, " Overpressure Protection for B&W Reactors",

dated May 1972.

3. FSAR, Section 10.5. .

1

4. 10 CFR 50, Appendix A.

5. ASME, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Subsection IWP.

6. FTI 51-1266138-01, Safety Analysis Input to Startup Team Safety Assessment. N TE l

7. FPC calculation 187-0008, Rev. 6. l O,

V Crystal River Unit 3 B 3.7-31 Revision No. 17 NOTE - Valid Until Cycle 12 Only

Emergency Feedwater Tank B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Emergency Feedwater Tank (EFT-2)

BASES BACKGROUND The function of the emergency feedwater (EFW) tank is to provide a safety grade source of water for the removal of decay and sensible heat from the Reactor Coolant System (RCS) and reactor core following an event requiring EFW System operation. The EFW tank provides a gravity feed to the EFW pumps, which supply the driving head necessary to inject the water into the steam generators (OTSGs). Within the OTSGs, heat from the RCS is transferred to the secondary coolant, which boils and is subsequently discharged to the atmosphere via the main steam' safety valves (MSSVs) or atmospheric dump valves. If the main steam isolation valves (MSIVs) are open, the preferred, non-safety grade means of decay heat removal is to discharge the generated steam to the main condenser via the turbine bypass valves. This has the advantage of conserving condensate while minimizing radioactivity releases to the environment.

The EFW tank provides the secondary coolant necessary for

the Emergency Feedwater System to function to remove heat from the RCS during accident conditions. It is tornado hardened, Seismic Category I and, therefore, designed to withstand earthquakes (Ref. 1). Additionally, the tank is enclosed by a missile protected, seismically qualified concrete structure which provides not only tornado missile protection, but also protection from environmental effects such as wind and wave loads (Ref. 2 . The EFW tank has an overall capacity of 184,000 gallons), and a minimum dedicated volume of 150,000 gallons of condensate quality water. Two other sources of condensate quality water are available to effect the removal of decay heat and sensible heat: the condenser hotwells (150,000 gallon combined surveillance {

capacity) and the condensate storage tank (120,000 gallon )

surveillance capacity . Fire Service Water Storage Tanks have a 600,000 gallon) surveillance water capacity available for natural circulation cooldown after using condensate quality water.

APPLICABLE The EFW System provides water to the OTSGs to remove decay SAFETY ANALYSIS heat and establish RCS natural circulation conditions following certain design basis events. Although the capacity of the EFW tank (continued)

Crystal River Unit 3 B 3.7-32 Revision No. 16

G )

DC System B 3.7.8

. B 3 . 7. PLANT SYSTEMS I B 3.7.8 Decay Heat. Closed Cycle Cooling Water System i BASES BACKGROUND The Decay Heat Closed Cycle Cooling Water (DC) System facilitates .the removal of decay heat.from the reactor core.

The system.also removes process and operating heat from

. safety related. components associated with decay heat removal during normal plant cooldown and following a transient or

accident. During plant cooldown below approximately 250*F the DC system provides core heat removal by transferring.

heat from the Decay Heat Removal (DHR) System to the Decay

. Heat Seawater System. The system ~is divided into two

' independent and redundant trains, each capable of supplying 100 percent of the' required normal-and post-accident '

cooling. Each train contains a pump, a surge tank pressurized with nitrogen for volume and pressure control, and a heat exchanger which removes heat from the DHR system and rejects it to:the Decay Heat Seawater System.

The design and operation of the DC system, along with a list O -

of the components served, can be found'in FSAR Section 9.5.2.2 (Ref. 1).' For normal operation the DC aumps are started manually. However, in an emergency bot 1 DC pumps start automatically upon receipt of an Engineered Safeguards Actuation System (ESAS). The DC system supports long-term reactor decay heat removal following.a loss of coolant accident (LOCA) when the Emergency Core Cooling System (ECCS) is recirculating water from the'RB sump to the reactor core through the DH heat exchanger. The DC System also supports post-accident containment cooling by supplying cooling water to the reactor building spray pump motor coolers and-bearings. Other loads supplied by this system are the DHR (LPI) pumps and motors, DC and decay heat seawater pump motors and two of the'three make-up and purification-(HPI) pump motors. The DC System supplies cooling to these pump motor heat exchangers, lube oil coolers, gear lube oil coolers, bearings, or air handling units to prevent overheating of the associated components 4 (Ref. 2). I j Certain small break LOCA scenarios require emergency feedwater to maintain steam generator cooling until core m 1 decay heat can be removed solely by ECCS cooling.

-Further, with the turbine driven EFW pump or associated

' flow path 1 (continued) ;

Crystal River Unit 3' B 3.7-41 Revision No. 17 NOTE - Valid Until Cycle 12 Only j n .

E .

DC System B 3.7.8 BASES I

BACKGROUND inoperable, SWP-1B, train "B" of the Nuclear Services (continued) Seawater System, CHHE-18, and CHP-1B, as well as both f trains of ECCS, Decay Heat Closed Cycle Cooling Water, Decay Heat Seawater, Emergency Diesel Generators, AC WE Electrical Power Distribution Subsystems, and AC Vital Bus Subsystems are required OPERABLE.

As a closed system, the DC System also serves as an intermediate barrier to radioactivity releases to the environment from potential leaks in interfacing systems.

APPLICABLE The DC system provides cooling for components essential to SAFETY ANALYSIS the mitigation of plant transients and accidents. An ESAS

' initiation signal will start both DC pumps. This ensures that the required cooling capacity is provided to the essential equipment following a steam line break, steam generator tube rupture, makeup system letdown line failure, or LOCA. The running pumps (100 percent capacity each , in conjunction with an associated DC heat exchanger, rejec)t heat to the Decay Heat Seawater System to ensure the necessary cooling flow to components required for reactor decay heat removal. By cooling the RB spray pumps and pump motors following a LOCA or SLB, the DC system supports the RB Spray System by ensuring the pressure and temperature in containment are maintained within acceptable limits. The OPERABILITY of the RB Spray System is addressed in LCO 3.6.6, " Reactor Building Spray and Containment Cooling Systems".

During normal and post-accident cooldown operations, when RCS temperature and pressure are reduced to allow the alignment of the DHR System to the RCS, DC System operation facilitates core heat removal by transferring heat from the DHR System to the Decay Heat Seawater System.

The Decay Heat Closed Cycle Cooling Water System satisfies Criterion 3 of the NRC Policy Statement.

LC0 The requirement for two DC trains to be OPERABLE assures adequate normal and post-accident heat removal from the reactor core and essential components, considering a worst case single active failure. One of the OPERABILI Y considerations regarding these independent and redundant trains is that each valve in the flow path be in the correct post-accident position. Additionally, each DC pump must be capable of being powered from its emergency power supply and be capable of automatically starting on an ESAS actuation.

O, Crystal River Unit 3 (continued) 8 3.7-42 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

, c DC System B 3.7.8 O BASES

. (g SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the DC flow-to individual components may render those components inoperable, but does not affect the OPERABILITY of the DC System.

Verifying the correct alignment for manual and power operated valves in the DC flow path provides assurance that l the proper flow paths exist for DC operation. This SR does

not apply.to valves that are locked, sealed,-or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.

The valves verified by this SR include valves in the main flow paths and the first normally closed valve in a branch' line. There are several other exceptions for valve position I verification due to the low potential for these types of valves to be mispositioned. The valve types which are not verified as part of this SR include vent or drain valves outside the RB, relief valves outside the RB, and O -

l l

4 l

l p (continued)

Crystal' River Unit 3 B 3.7-44A Revision No. 17. .

~

DC System B 3.7.8 BASES THIS PAGE INTENTIONALLY LEFT BLANK 1

l l

1 (continued)

Crystal River Unit 3 8 3.7-44B Amendment No. 163-

'r Decay Heat Seawater System B 3.7.10 p BASES SURVEILLANCE SR 3.7.10.1 (continued)

REQUIREMENTS be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.10.2 This SR verifies proper automatic operation of the decay heat seawater pumps on an actual or simulated actuation signal. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

() The SR is modified by a note indicating the SR is not applicable in the identified MODE. This is necessary in Q order to make the requirements for automatic system response consistent with those for the actuation instrumentation.

REFERENCES 1. Enhanced Design Basis Document for Decay Heat Closed Cycle Cooling Water System, Revision 2, November 21, 1991 including Temporary Change 193.

2. FSAR, Section 9.5.2.2.

(.

Crystal River Unit 3 8 3.7-55 Amendment No. 149

v .

UHS B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Ultimate Heat Sink (VHS)

BASES BACKGROUND The function of the ultimate heat sink (VHS) is to provide the source of water necessary to safely operate, shutdown, and cooldown the plant. The UHS supports dissipation of decay heat following either a normal reactor shutdown or an accident. This function is provided via the Nuclear Services Seawater and Decay Heat Seawater (RW) Systems (Ref.

1). The UHS at Crystal River Unit 3 (CR-3) consists of the Gulf of Mexico, connected to an intake structure by a man made intake canal.

The RW System has been shown to provide adequate post-accident cooling with a maximum UHS temperature of 95'F (Ref. 2). The nuclear services and decay heat RW subsystems are connected to the UHS via underground intake conduits that connect the intake canal to the suction of the sea water pumps. These pumps are located in two separate compartments comprising the sea water pump pit with a floor elevation of 61.0 feet (CR-3 plant datum). l To provide sufficient Ni'SH to the safety-related RW pumps at the flow rates necessary to reach and maintain the plant in a safe shutdown condition, a minimum intake canal water level of 73.7 feet (Ref. 3) must be maintained.

Additionally, although not part of this LCO, CR-3 periodically surveys the intake canal to ensure dimensions, in conjunction with the minimum level, provide adequate volume to meet the assumptions of the analysis.

The CR-3 UHS design is consistent with the recommendations of Regulatory Guide 1.27 (Ref. 4), providing assurance that the plant can reach and be maintained in a safe shutdown condition for at least 30 days following an accident.

APPLICABLE The UHS is required to support the removal of heat from the SAFETY ANALYSIS reactor core, plant buildings, and safety equipment by providing the heat sink to the RW Systems. Particularly required is the capability to provide sufficient heat removal capacity to these systems during their emergency modes of operation. An Engineered Safeguards Actuation System (ESAS) signal automatically starts both emergency l

(continued) 4 7

Crystal River Unit 3 8 3.7-56 Revision No. 17 i

o . . . . . . . _ . . - . . -. . . -- --

f, 7 Steam Generator Level B 3.7.17

[O

.Q B 3.7 PLANT SYSTEMS B 3.7.17 Steam Generator Level i

BASES BACKGROUND The principal operational function of the steam generators (OTSGs) is to provide superheated steam at a constant pressure (900 psia) over the power range. OTSG water inventory is maintained large enough to provide adequate primary to secondary heat transfer. Mass inventory and indicated water level in tne OTSG increases with load as the length of the four heat transfer regions within the OTSG vary. Inventory is controlled indirectly as a function of power and maintenance of a constant average primary system temperature by the feedwater controls in the Integrated Control System.

The maximum operating OTSG 1evel is based primarily on preserving the initial condition assumptions for OTSG inventory used in the FSAR steam line break (SLB) analysis (Ref. 1). An inventory of 62,600 lbm was used in this initial analysis. The 62,600 lbm was based upon concerns of a possible return to criticality because of primary side l

m ~

cooling following an SLB and the maximum pressure in the

) reactor building. Subsequently, the SLB was re-analyzed to reflect updated information which indicated it was not

{'

possible to put 62,600 lbm in the OTSG without putting water in the steam lines. A value of 56,340 lbm was used in the i re-analysis of the previously listed concerns.

For a clean OTSG, the mass inventory in the OTSG operating at 100f. >ower is approximately 39,000 lbm to 40,000 lbm. As an OTSG secomes fouled and the operating level approaches the limit of 96%, the mass inventory in the downcomer region increases-approximately 10,000 lbm, and adds to the total mass inventory of the OTSG. In matching unit data of startup level versus power, OTSG performance codes have shown that fouling of the lower tube sup) ort plates does not significantly change the heat transfer claracteristics of generator. Thus, the steam temperature, or superheat, is not degraded due to the fouling of the tube su) port plates, and mass inventory changes are mainly due to tie added level in the downcomer.

Analytically, increasing the fouling of the OTSG tube !

surfaces degrades the heat transfer capability, increases !

the mass inventory, and decreases the steam superheat at (continued)

% i Crystal River Unit 3 B 3.7-81 Revision No. 17- I

+

Steam Generator Level B 3.7.17 BASES BACKGROUND 100% power. The results were presented as the amount of (continued) mass inventory in each steam generator versus operating range level and steam superheat.

The limiting curve, which was determined from several steam generator performance code runs at a power level of 100%,

conservatively bounds steam generator mass inventory value.

when operating at power levels < 100%.

The LCO, points displayed are the intercept inofFigure points 3.7.17-1, the 56,340 in the accompa lb mass value and the operating range level and steam superheat values.

The OTSG performance analysis also indicated that startup and full range level instruments are inadequate indicators of steam generator mass inventory at high power levels due to the combination of static and dynamic pressure losses.

If the water level should rise above the 96% upper limit, the steam superheat would tend to decrease due to reduced feedwater heating through the aspirator ports. Normally, a reduction in water level is manually initiated to maintain steam flow through the aspirator port by reducing the power level. Thus, the superheat versus level limitation also

tends to ensure that, in normal operation, water level will

' remain clear of the aspirator ports. -

Feedwater nozzle flooding would impair feedwater heating, and could result in excessive tube to shell temperature differentials, excessive tubesheet temperature differentials, and large variations in pressurizer level.

APPLICABLE The limiting Design Basis Accident with respect to OTSG l SAFETY ANALYSES operating level is a steam line break (Reference 1). The parameter of interest is the mass of water, or inventory, contained in the steam generator due to its role in lowering ,

Reactor Coolant System RCS) temperature (return to criticality concern), an(d in raising containment pressure l during an SLB accident. A larger inventor effects of the accident to be more severe.y causes Figure the 3.7.17-1, in the accompanying LCO, was developed based upon maintaining inventory < 56,340 lb, which was 10% less than i the inventory used in the original 'FSAR accident analysis.

This figure was reviewed following re-analysis of the SLB and considered to remain bounding. )

(continued) ,

Crystal River Unit 3 B 3.7-82 Revision No. 17

)

AC Sources-Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-0perating I

BASES BACKGROUND The Crystal River Unit 3 (CR-3) Class IE AC electrical power system sources consist of the offsite power circuits s (offsite power transformer and backup ES transformer lines) l and the onsite standby power sources (Train A and Train B i emergency diesel generators (EDGs)). The design and construction of the CR-3 electrical system preceded 10 CFR 50 Appendix A. However, the general design criteria (GDCs) issued in 1971 were considered in the design and construction of CR-3. The electric power system for CR-3 is' 3 in compliance with the intent of 10 CFR 50 Appendix A, GDC 17, Electric Power Systems (Ref.1), in that it provides independence and redundancy to ensure an available source of l power to the Engineered Safeguards (ES) systems.

The onsite Class IE AC distribution system is divided into redundant trains so that the loss of any one train does not A prevent the minimum safety functions from being performed.

Each train has connections to three offsite power sources d ,

and a single EDG.

The 230 kV. substation is connected to the FPC transmission network by five lines and from Crystal River Units 1, 2 and

4. Offsite power is also supplied to the 500 kV substation from the FPC transmission network by two full capacity lines '

and from the output of CR-5.

{

The source of offsite power to the CR-3 ES buses comes from the 230 kV substation via the offsite power transformer and the backup ES transformer (BEST).

I With the plant on-line, power to the ES buses may also be '

supplied from the CR-3 unit generator via the unit auxiliary transformer. In this configuration the unit auxiliary transformer cannot be credited as an offsite source for the purposes of meeting this LCO, since it is being fed from the output of the unit. Therefore, the offsite power transformer and the BEST are the only offsite sources qualified for supplying the ES buses while the CR-3 unit generator is operating.

^

(continued)

Crystal River Unit 3 B 3.8-1 Amendment No. 149 4

e O

AC Sources-Operating B 3.8.1 BASES BACKGROUND When the CR-3 generator is not producing power, the back (continued) feed from the 500 kV substation through the Unit 3 step up transformers and the Unit 3 auxiliary transformer can be used as a source of offsite power, subject to certain voltage and loading contraints, and administrative controls.

In order to make use of this power source the step up transformer must first be manually disconnected from the CR-3 main generator by disengaging the disconnect links, and the backfeed ground fault protection scheme enabled. A detailed description of the offsite power network and the circuits to the Class IE ES buses is found in the FSAR, Chapter 8 (Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, nonsegregated-phase bus, and controls required to transmit power from the offsite transmission network (230 kV substation or 500 kV substation and the segregated bus) to the onsite Class IE ES bus (es).

The onsite standby power source for each 4160 V ES bus is a dedicated EDG. EDGs 3A and 3B are dedicated to ES buses 3A and 3B, respectively. An EDG starts automatically on an Engineered Safeguard Actuation System (ESAS) signal or on an ES bus degraded voltage or undervoltage signal (refer to LC0 3.3.5, " Engineered Safeguard Actuation System (ESAS)

Instrumentation" and LCO 3.3.8, " Emergency Diesel Generator (EDG) Loss of Power Starts LOPS)" . After the EDG has started as a consequence of(ES bus)undervoltage or degraded voltage, independent of or coincident with an ESAS signal, it will automatically tie to its respective bus after offsite power is tripped. Following the trip of offsite power, an undervoltage signal strips non-permanent loads from the ES bus. When the EDG is tied to the ES bus, block -

1 permanently connected loads are automatically loaded and -

additional loads are then sequentially connected to their respective ES bus by automatic sequencing relays, provided )

an ES signal is present. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the EDG by automatic load ap)lication. The EDGs will also start and operate in the stand)y mode without tying to the ES bus on an ESAS signal alone. l In the event of a loss of offsite power, the ES electrical loads are automatically connected to the EDGs in sufficient '

time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).

(continued)

O Crystal River Unit 3 B 3.8-2 Revision No. 17

i:. r .

y, AC Sources-Operating B 3.8.1 BASES I

l 1

1 THIS PAGE INTENTIONALLY LEFT BLANK pc i (continued)

Crystal River Unit 3 .B 3.8-3B Amendment No. 163

-1

-l AC Sources-Operating B 3.8.1 i BASES O ;,

APPLICABLE b. A worst-case single failure.

SAFETY ANALYSES (continued) The AC Sources satisfy Criterion 3 of the NRC Policy Statement.

LC0 Two qualified circuits between the offsite transmission network and the onsite Class 1E electrical power distribution system and separate and independent EDGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (A00) or a postulated DBA.

Qualified offsite circuits are those that are described in the FSAR. Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ES buses.

The qualified circuits, both of which are required to be l &

OPERABLE to satisfy this LCO, consist of: W

a. The offsite power transformer, cabling through breakers 3211, and 3212, connecting to ES bus 3A and 3B respectively.

b. The BEST transformer, nonsegregated-phase bus through breakers 3205, and 3206, connecting to ES bus 3A and 3B respectively.

~

(continued)

Crystal River Unit 3 B 3.8-4 Revision No. 17

V, r.

AC Sources-Operating B 3.8.1 p)

(, BASES ACTIONS F.2 and F.3 (continued)

Refer to the Bases for Actions E.2 and E.3 for the NOTE discussion for the corresponding Bases of Required Actions F.2 and F.3.

M l NOTE With the Train A and Train B EDGs inoperable, there are no

- qualified onsite standby AC sources. Thus, with an assumed loss of offsite electrical power, there would not be sufficient standby AC sources available to power the minimum required ES systems. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time is balanced with that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). However, since any inadvertent generator trip could also result in a total loss of offsite AC power, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated

[D V /

with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is consistent with the recommendations of Reference 6.

H.1 and H.2 INTE If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 5 l within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging plant systems.

m (continued)

Crystal River Unit 3 B 3.8-14A Revisio'n No. 17 NOTE - Valid until Cycle 12 Only.

AC Sources-Operating B 3.8.1 BASES h THIS PAGE INTENTIONALLY LEFT BLANK (continued)

Crystal River Unit 3 8 3.8-148 Amendment No. 163'

, l

. J

,o -

-- AC Sources--Shutdown B 3.8.2 s f~.

, () B 3.8 ELECTRICAL' POWER SYSTEMS

-B 3.8.2 AC Sources-Shutdown BASES 1

BACKGROUND A description of the AC sources is provided in the Bases for i LCO 3.8.1, "AC Sources-0perating."

APPLICABLE The OPERABILITY of the minimum'AC sources during MODE 5 5 SAFETY ANALYSES 'and 6 ensures that:

a. The plant can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining plant status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown.

Technical Specification requirements during shutdown ensure the plant has the capability to mitigate the consequences of ,

postulated accidents. However, the assumption of a single failure and concurrent loss of all offsite or all onsite power is not required to demonstrate this capability. The rationale for this is that many Design Basis Accidents (DBAs) are.only analyzed assuming MODES 1 conditions and have no specific analyses in other MODES. This approach was taken since the MODE 1 events were considered " bounding" or not credible in MODES 5 and 6 because the energy contained within the reactor coolant pressure boundary,' reactor coolant temperature and pressure, and the corresponding stresses result in' the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the required systems' LCOs. j During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed

. provided the plant complies with the applicable Required Actions. ;

/ (continued)

Crystal River Unit 3 8 3.8-24 Amendment No. 149

t

]

. .. : 1

~

AC Sources-Shutdown B 3.8.2 j BASES 1

APPLICABLE This allowance is in recognition that certain testing and SAFETY ANALYSES maintenance activities must be conducted during power

' (continued) operation in order to provide an acceptable overall level of risk. During MODES 5 and 6, performance of a significant number of testing and maintenance activities is also required. The activities are generally planned and administratively controlled to minimize the risk during shutdown.

In the event of an accident during shutdown, this LC0

( ensures the capability to support systems necessary to avoid immediate adverse consequences, assuming either a loss of all offsite power or a loss of all onsite emergency diesel generator (EDG) power.

AC sources satisfy Criterion 3 of the NRC Policy Statement.

i LC0 Maintaining one offsite circuit capable of supplying the onsite Class IE power distribution subsystem (s) of LC0 3.8.10, " Distribution Systems-Shutdown," ensures that all required loads are powered from offsite power. An OPERABLE EDG, associated with a distribution system train required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and EDG ensures the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated event:; during shutdown. j The qualified offsite circuit must be capable of maintaining rated frequacy and voltage, and accepting required loads ,

during an accident, while cornoted to the Engineered 1 Safeguard (ES) bus (es). Cert;ia voltage and loading I constraints exist when backfeeding from the 500 kV substation, and administrative controls must be applied to maintain design limits. Qualified offsite circuits are those that are described in the FSAR.

I M.

(continued)

Crystal River Unit 3 B 3.8-25 Revision No. 17

6; ,

Inverters-Operating B 3.8.7

[ B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Inverters-Operating BASES i '

BACKGROUND' The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they provide by being sowered from the 125 VDC battery source.

The function of.tle inverter is to convert DC electrical power to AC electrical power, thus providing an uninterruptible power source (UPS). The 120 VAC vital bus distribution system is used to supply four separate channels of 120 volt instrument power to equipment such as the Nuclear Instrumentation (NI) System, the Engineered Safeguards Actuation System (ESAS) and the Reactor Protection System (RPS). Other loads fed by 120 volt vital AC power include communication equipment, valves and relays essential to safe plant operation and shutdown.

Each of the four UPS bus sections are supplied through a dual input' inverter (with internal auctioneering circuit),

or.a 480 V ES motor control center (MCC) through a regulating transformer. The dual input static inverters 3A, 3B, 3C, and 3D are normally supplied from a 480 V ES MCC with an uninterrupted transfer to a 125 V battery source on O(/._ loss of normal supply. Static inverters B and D are normally fed from MCC 382 or alternately fed from the B battery train. Static inverters A and C are normally fed from MCC 3Al or alternately from the A battery train. The power supplied through the regulating transformers to the UPS buses comes from MCCs 3A2 or 3Bl.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the FSAR, Chapter 6 Ref. 1), and Cha)ter 14 (Ref. 2), assume Engineered Safe (guard systems are OPE MBLE. The DC to AC inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESAS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail (continued)

J Crystal River Unit 3 B 3.8-59 Revision No.17-L _ _ _ _ _ _ _ _ _ _ _ _ _

.. .I Inverters-Operating B 3.8.7 BASES APPLICABLE in the Bases for Section 3.2, Power Distribution Limits:

SAFETY ANALYSES Section 3.4, Reactor Coolant System (RCS); and Section 3.6, (continued) Containment Systems.

The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the design basis of the plant. This includes maintaining required AC vital buses OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power; and

b. A worst-case single failure.

Inverters are a part of the electrical power distribution system. As such, they satisfy Criterion 3 of the NRC Policy Statement.

LCO The inverters ensure the availability of AC electrical power for the camponents and instrumentation required to shut down

- the reactor and maintain it in a safe condition'after an anticipated operational occurrence (A00) or a pbstulated DBA.

Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RPS and ESAS instrumentation and controls is maintained. The four battery powered inverters (two per train) ensure an uninterruptible supply of AC electrical power to the AC vital buses in the event the 4160 V ES buses are de-energized.

In order to consider inverters OPERABLE, the associated AC vital bus must be powered by the inverter and the correct DC voltage applied from a battery to the auctioneering circuit.

The inverter, via the internal auctioneering circuit, is normally powered from the associated Class IE 480 V ES bus.

In this case, the auctioneering circuit must also be capable of switching to the required DC supply (i.e., the associated 125 VDC Class IE battery .

voltage and frequency smu)t be within established tolerances. Additi (continued)

Crystal River Unit 3 B 3.8-60 Amendment No. 149

ML20195B809

Text

Navigation menu

Search