Text

Revised Pages Constituting Rev 3 to CPS TS Bases,Consisting of Pages Annotated with Rev Numbers 3-1,3-2,3-3,3-4 & 3-5. Changes to Text Identified with Rev Bars.No Rev Bars Included for Changes to Format
	ML20196A150
Person / Time
Site:	Clinton
Issue date:	11/20/1998
From:	; ILLINOIS POWER CO.
To:	;
Shared Package
ML20196A138	List: ML20196A150; U-603111, Forwards Revised Pages Constituting Rev 3 to CPS TS Bases, Consisting of Pages Annotated with Rev Numbers 3-1,3-2,3-3, 3-4 & 3-5.Changes to Text Identified with Rev Bars.No Rev Bars Included for Changes to Format;
References
	NUDOCS 9811270068
	Download: ML20196A150 (61)
	v • d • e

..- . . - . . . . . . - . - . - . . . ~ . - . . . . - . _ . - . . . . . . - . . . - - . _ _ - . . - - .-

I Enclosure 1 to U-603111 Page1of61 Revision 3 to the CPS TechnicalSpecification Bases l

l l

t l

I i

)

9811270068 981120 T PDR ADOCK 05000461 O

i. P PDR ,il

. . . .~. . - - -- . - -. --- .- - --

TABLE 0F CONTENTS' (continued) 3.7 PLANT SYSTEMS ....................... 3.7-1 3.7.1 Division 1 and 2 Shutdown Service Water (SX) Subsystems and Ultimate Heat Sink (UHS) . . . . . . . . . . . . 3.7-1 3.7.2. Division 3 Shutdown Service Water (SX)

Subsystem . . . . . . . . . . . . . . . . . . . . . - 3.7-3 '

3.7.3 Control Room Ventilation System ............ 3.7-4 3.7.4 Control Room Air Conditioning (AC) System ....... 3.7-8 3.7.5 Main Condenser Offgas' . . . . . . . . . . . . . . . . . 3.7-11 3.7.6 Main Turbine Bypass System . . . . . . . . . . . . . . . 3.7-13 3.7.7 Fuel Pool Water Level . . . . . . . . . . . . . . . . . 3.7-14 B 3.7 PLANT SYSTEMS ....................... B 3.7-1 B 3.7.1 Division 1 and 2 Shutdown Service Water (SX) !

Subsystems and Ultimate Heat Sink (UHS) ...... ' B 3.7-1 B 3.7.2 Division 3 Shutdown Service Water Subsystem (SX) . . . . B 3.7-7 ,

B 3.7.3 Control Room Ventilation System ............ B 3.7-10

.B 3.7.4 Control Room Air Conditioning (AC) System ....... B 3.7-17 8 3.7.5 -Main Condenser Offgas ................. B 3.7-22 B 3.7.6 Main Turbine. Bypass System . . . . . . . . . . . . . . . B 3.7-25 B 3.7.7 fuel Pool Water Level ................. B 3.7-28 3.8 . ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . . . 3.8-1 3.8.1 AC Sources-Operating ................. 3.8-1 '

3.8.2 AC Sources-Shutdown . . . . . . . . . . . . . . . . . . 3.8-16 3.8.3_ Diesel Fuel Oil, Lube Oil, and Starting Air. ...... 3.8-20 3.8.4 DC Sources-Operating ................. 3.8-24 3.8.5 DC Sources-Shutdown . . . . . . . . . . . . . . . . . . 3.8-27 3.8.6 Battery Cell Parar.aters ................ 3.8-30 3.8.7 Inverters -Operating . . . . . . . . . . . . . . . . . . 3.8-34 3.8.8 Inverters-Shutdown .................. 3.8-36 3.8.9 Distribution Systems-Operating ............ 3.8-39 3.8.10 Distribution Systems-Shutdown . . . . . . . . . . . . . 3.8-42 l 3.8.11 Static VAR Compensator (SVC) Protection Systems .... 3.8-44 8 3.8 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . . . B 3.8-1 B 3.8.1 AC Sources-Operating ................. B 3.8-1 B 3.8.2 AC Sources-Shutdown . . . . . . . . . . . . . . . . . . B 3.8-33 B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air ...... B 3.8-40 8 3.8.4 DC Sources-Operating ................. B 3.8-49 B 3.8.5 DC Sources-Shutdown . . . . . . . . . . . . . . . . . . B 3.8-58 B 3.8.6 Battery Cell Parameters ................ B 3.8-62 B 3.8.7 Inverters-Operating . . . . . . . . . . . . . . . . . . B 3.8-69 B 3.8.8 Inverters-Shutdown .................. B 3.8-74 l

B 3.8.9 Distribution Systems-Operating ............ B 3.8-78 8 3.8.10 Distribution Systems-Shutdown . . . . . . . . . . . . . B 3.8-89 l B 3.8-11 Static VAR Compensator (SVC) Protection Systems .... B 3.8-93

(continued) i f CLINTON vi Revision No. 3-5 r-

Remote Shutdown System B 3.3.3.2 i

! BASES l

SURVEILLANCE SR 3.3.3.2.1 (continued)

REQUIREMENTS

l outside the criteria, it may be an indication that'the l sensor or the signal processing equipment has drifted I outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those c.'.annels that are normally energized.

The Frequency is based upon plant operating experience that demonstrates channel failure is rare.

, SR -3.3.3.2.2 SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended I function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel and the local control stations are not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote

! shutdown panel and the local control stations. However, this Surveillance is not required to be performed only during a plant outage. Operating experience demonstrates that Remote Shutdown System control channels usually pass the Surveillance when performed at the 18 month Frequency.

SR 3.3.3.2.3 i CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds i to measured parameter values with the necessary range and I l accuracy.

i

( The 18 month Frequency is based upon operating experience and is consistent with the typical industry refueling cycle.

i REFERENCES .. 10 CFR 50, Appendix A, GDC 19.

2. Operational Requirements Manual, Attachment 1.

3. NUREG-0853, " Safety Evaluation Report Related to the Operation of Clinton Power Station, Unit No. 1,"

Supplement No. 6, July 1986, Section 7.4.3.1.

J CLINTON B 3.3-64 Revision No. 3-5

l l

SPMU System Instrumentation ,

B 3.3.6.4 l BASES I APPLICABLE 3. Suppression Pool Water level-Low low (continued)

SAFETY ANALYSES LCO, and Suppression pool water level signals are from four APPLICABILITY transmitters that sense pool level at four different locations (two per trip system). Four Suppression Pool I Water Level-Low Low channels (two per trip system) are required to be OPERABLE to ensure that no single instrument failure can preclude the SPMU System function.

The Allowable Value is set high enough to ensure coverage of

, the suppression pool vents. The Allowable Value is l referenced from an instrument zero of 727 ft. O inches mean sea level.

4. Timer The SPMU System valves open on a Drywell Pressure-High l l and/or Reactor Vessel Water Level-Low Low Low, Level 1 signal after about a 30 minute timer delay, where the timer l itself is started by these signals. The minimum suppression l pool volume, without an upper pool dump, is adequate to meet all heat sink requirements for 30 minutes during a small l l break LOCA.

l There are two SPMU System timers (one per trip system). Two timers are available and are required to be OPERABLE to ensure that no single timer failure can preclude the SPMU System function. The Allowable Value is chosen to be short enough to ensure that the suppression pool will serve as an adequate heat sink during a small break LOCA.

5. Manual Initiation l The SPMU System Manual Initiation hand switch channels l produce signals to provide manual initiation capabilities that are redundant to the automatic protective

instrumentation. The Manual Initiation Function is not

! assumed in any transient or accident analysis in the USAR.

l However, the Function is retained for the SPMU. System as l required by the NRC in the approved licensing basis.

i Four manual initiation hand switches (one per SPMU dump l valve) are available and required to be OPERABLE. There is no Allowable Value for this function since the channels are mechanically actuated based solely on the position of the hand switches.

4 (continued)

CLINTON B 3.3-201 Revision No. 3-4

SPMU System Instrumentation B 3.3.6.4 BASES-(continued)

ACTIONS A Note has been provided to modify the ACTIONS related to i

SPMU System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been*

l entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each i additional failure, with Completion Times based on initial

j. entry into the Condition. However, the Required Actions for j inoperable SPMU System instrumentation channels provide .

i appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable SPMU System instrumentation channel.

l A.1 l Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.6.4-1. The applicable Condition specified in the Table is Function dependent.

Each time a channel is discovered inoperable, Condition A is l entered for that channel and provides for transfer to the

appropriate subsequent Condition.

l l l B.1 and B.2 i

Required Action 8.1 is intended to ensure appropriate l actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the SPMU System. In !

this case, automatic initiation capability is lost if (a) one Function I channel in both trip systems is i' inoperable and untripped,. (b) one Function 2 channel in both trip systems is inoperable and untripped, or (c) one Function 3 channel in both trip systems is inoperable and untripped. In this situation (loss of automatic initiation .

capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is (continued)

I i

I CLINTON B 3.3-202 Revision No. 3-4 l

4 l

l l LOP Instrumentation l B 3.3.8.1 BASES L

ACTIONS B.1 (continued)

If any Required Action and associated Completion Time is not met, the associated Function may not be capable of performing the intended function. Therefore, the associated DG(s) are declared inoperable immediately. This requires entry into applicable Conditions and Required Actions of ;

LC0 3.8.1 and LCO 3.8.2, which provide appropriate actions i for the inoperable DG(s). j l

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each LOP REQUIREMENTS Instrumentation Function are located in the SRs column of Table 3.3.8.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for 4 performance of required Surveillances, entry into associated .

Conditions and Required Actions may be delayed for up to t

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains DG initiation capability. Upon completion of the Surveillance, l or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be ,

returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

su 3.3.8.1.1 This SR has been deleted.

SR 3.3.8.1.2 i

i A CHANNEL FUNCTIONAL TEST is performed on each required

! channel to ensure that the entire channel will perform the intended function. For series Functions, i.e., for the degraded voltage relays in series with their associated delay timers, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested.

Any setpoint adjustment shall be consistent with the

! assumptions of the current plant specific setpoint methodology.

The Frequency of 31 days is based on plant operating

experience with regard to channel OPERABILITY that i demonstrates that failure in any 31 day interval is rare.

l (continued) i CLINTON B 3.3-228 Revision No. 3-4 L . . _-

l RCS PIV Leakage B 3.4.6 BASES (continued) l l

SURVEILLANCE SR 3.4.6.1 )

l REQUIREMENTS !

Performance of leakage testing on each RCS PIV is required i l to verify that leakage is below the specified limit and to l identify each leaking valve. The leakage limit of 0.5 gpm ;

per inch of nominal valve diameter up to 5 gpm maximum 1 applies to each valve. Leakage testing requires a stable pressure condition. For the two PIVs in series, the leakage .

requirement applies to each valve individually and not to l the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series l meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.

The Frequency required by the Inservice Testing Program is within the ASME Code,Section XI, Frequency requirement.

Therefore, this SR is modified by a Note that states the leakage Surveillance is only required to be performed in MODES I and 2. Entry into MODE 3 is permitted for leakage

testing at high differential pressures with stable conditions not possible in the lower MODES.

l t

! REFERENCES 1. 10 CFR 50.2.

! 2. 10 CFR 50.55a(c).

l l 3. 10 CFR 50, Appendix A, GDC 55.

4. ASME, Boiler and Pressure Vessel Code,Section XI,

! Subsection IWV.

5. NUREG-0677, "The Probability of Intersystem LOCA:

Impact Due to Leak Testing and Operational Changes,"

May 1980.

l

6. CPS ISI Program Manual.

7. ASME Operations and Maintenance Code, Part 10, Inservice Testing of Valves in Light-Water Reactor Power Plants, 4.2.2.3(b)(4).

. 8. NEDC-31339, "BWR Owners Group Assessment of ECCS Pressurization in BWRs," November 1986.

CLINTON B 3.4-32 Revision No. 3-2 I

l

i l

RCS Leakage Detection Instrumentation B 3.4.7 l i

l B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Leakage Detection Instrumentation i

j BASES BACKGROUND GDC 30 of 10 CFR 50, Appendix A (Ref.1), requires means for l detecting and, to the extent practical, identifying the '

location of the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

l Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2).

Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of rates. The Bases for LC0 3.4.5, "RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE I rates. I Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action. l LEAKAGE from the RCPB inside the drywell is detected by at least one of three independently monitored variables, such as sump level changes and drywell gaseous and particulate radioactivity levels. The primary means of quantifying LEAKAGE in the drywell is the drywell floor drain sump monitoring system.

The drywell floor drain sump monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges or packings, floor drains, the Component Cooling Water System, and drywell air cooling unit l

condensate drains, and any LEAKAGE not collected in the drywell equipment drain sump.

I -

s (continued) i CLINTON B 3.4-33 Revision No. 3-1 ,

RCS Leakage Detection Instrumentation -

j B 3.4.7 BASES BACKGROUND 'The drywell floor drain sump has two flow monitoring (continued) systems: 1) a magnetic flow meter installed on the discharge piping of the drywell floor drain pumps and a flow totalizer converter installed in the vicinity of the flow element; and 2) a bubbler type level sensing system i installed in the drywell floor drain sump pit. ]

I l

The flow totalizer converter provides local indication of i total pump discharge flow and discharge flow rate. It also !

provides a signal representing actual pump discharge flow j

rate to a programmable logic controller (PLC), in the main -

t control room. The PLC calculates the average (total) and

! actual- pump discharge flow by integrating the signal from the flow totalizer converter and dividing the result by the total time between pump cycles. When the sump in the drywell reaches a high level, one of the two pumps start (the pumps alternate each cycle) pumping water to the drain sump collector tank. This operation continues until the sump level reaches a low level setting. When the pump stops, the PLC senses a "no flow" signal and resets the timer, performs the average flow rate calculation; and transmits the resulting signal to a recorder, an analog computer point and a totalizer (counter). The PLC also generates main control room alarms to indicate high flow (3.6 gpm), and large flow increase (2 gpm/24 hours). This ,

operation is repeated every time a sump pump completes its l cycle. The sump pumps can also be operated with the control switch in " manual" which automatically controls starting and stopping of both pumps within a smaller range.

The bubbler type level sensor provides a pneumatic level signal to a differential pressure transmitter installed in the containment building. The level transmitter provides a level signal to the PLC in the main control room. The PLC calculates the total inleakage flow rate by measuring the level and calculating a rate of change once every minute and provides alternating pump operation. From this signal, the PLC generates three analog output signals representing total inleakage flow rate and sump pit level. These signals are transmitted to a recorder, analog computer point, and to a digital counter. The' PLC also generates main control room annunciators to indicate high flow rate (3.6 gpm), sump Hi-Hi water level, and large flow increase (2 gpnV24 hours),

and produces a computer alarm for system inoperable (PLC diagnostic fault, or level signal out of range).

l (continued)

L CLINTON B 3.4-34 Revision No. 3-5

_ _ _ . . _ . 2 +4. . . ~

. 1-.-s- . _ ~ sm m- .~t. - .-. - . - ~-- .. ..-- -

l L

RCS Leakage Detection Instrumentation 8 3.4.7 l

BASES BACKGROUND The drywell floor drain sump also has level switches that (continued) start and stop the sump pumps when required. A timer starts each time the sump is pumped down to the low level setpoint.

If the sump fills to the high level setpoint before the timer ends, an alarm sounds in the control room, indicating a LEAKAGE rate into the sump in excess of a preset limit. A

, second timer starts.when the sump pumps start on high level.

Should this timer run out before the sump level reaches the low level setpoint, an alarm is sounded in the control room indicating a LEAKAGE rate into the sump in excess of a preset limit.

Because proper functioning of the drywell floor drain sump monitoring instrumentation is dependent upon the ability to collect the LEAKAGE in the drywell floor drain sump, the drywell floor drain sump inlet piping is periodically verified to be unblocked, as described in Ref. 7.

The drywell atmospheric monitoring systems continuously monitor the drywell atmosphere for airborne particulate and gaseous radioactivity. A sudden increase of radioactivity, which may be attributed to RCPB steam or reactor water LEAKAGE, is annunciated in the control room. The drywell atmospheric particulate and gaseous radioactivity monitoring l systems are not capable of quantifying leakage rates.

(Ref.3)'

Condensate from two of the four drywell cooling system coil cabinets is routed to the drywell floor drain sump and is monitored by an in-line rotometer that provides alarms in the control room. This drywell air cooler condensate flow rate monitoring system serves as an added indicator, but not quantifier, of RCS unidentified LEAKAGE.

(continued)

I l

l CLINTON B 3.4-34a Revision No. 3-4

RCS Leakage Detection Instrumentation B 3.4.7 )

BASES APPLICABLE and 5). Each of the leakage detection systems inside the SAFETY ANALYSES drywell is designed with the capability of detecting LEAKAGE (continued) less than the established LEAKAGE rate limits.

Identification of the LEAKAGE allows the operators to evaluate the significance of the indicated LEAKAGE and, if necessary, shut down the reactor for further investigation and corrective action. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 6).

Therefore, these actions provide adequate response before a significant break in the RCPB can occur.

RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.

l LCO The drywell floor drain sump flow monitoring system is required to quantify the unidentified LEAKAGE from the RCS.

Thus, for the system to be considered OPERABLE, either the sump level rate of change, or the sump pump discharge flow ;

monitoring portion of the system must be OPERABLE. The l other monitoring systems provide qualitative indication to l the operators so closer examination of other detection '

systems will be made to determine the extent of any corrective action that may be required. With the leakage detection systems inoperable, monitoring for LEAKAGE in the RCPB is degraded.

APPLICABILITY In MODES 1, 2, and.3, leakage detection systems are required to be OPERABLE to support LCO 3.4.5. This Applicability is

, consistent with that for LCO 3'.4.5.

ACTIONS M l With both drywell floor drain sump flow monitoring systems inoperable, no other form of sampling can provide the equivalent information to quantify leakage. However, the drywell atmespheric activity monitor and the drywell air cooler condensate flow rate monitor will provide' indications of changes in leakage.

l With both drywell floor drain sump monitoring systems inoperable, but with RCS unidentified and total LEAKAGE being determined every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (SR 3.4.5.1), operation may (continued)

CLINTON B 3.4-35 Revision No. 3-1

l RCS Leakage Detection Instrumentation B 3.4.7

\

BASES ACTIONS A.1 (continued) continue for 30 days. The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available. Required Action A.1 is i modified by a Note that states that the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when both drywell floor drain sump flow monitoring systems are inoperable. This allowance is provided because other instrumentation is available to monitor RCS leakage.

i L1 With both gaseous and particulate drywell atmospheric monitoring channels inoperable, grab samples of the drywell atmosphere shall be taken and analyzed to provide periodic leakage information. Provided a sample is obtained and analyzed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the plant may continue operation since at least one other form of drywell leakage detection (i.e., air cooler condensate flow rate monitor) is available. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic l information that is adequate to detect LEAKAGE.

C.1 With the required drywell air cqoler condensate flow rate monitoring system inoperable, SR 3.4.7.1 is performed every

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to provide. periodic information of activity in the

! drywell at a more frequent interval than the routine Frequency of SR 3.4.7.1. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval provides periodic information that is adequate to detect LEAKAGE and recognizes that other forms of leakage detection are available. However, this Required Action is modified by a Note that allows this action to be not applicable if the required drywell atmospheric monitoring system is inoperable. Consistent with SR 3.0.1, Surve111ances are not required to be performed on inoperable equipment.

(continued)

CLINTON D 3.4-36 Revision No. 3-1

_. . . _ _ . _ _ _ . . _ . . ___ _ _ . ~ _ _ . . _ _ - - _ _ _

RCS P/T Limits B 3.4.11 j BASES (continued) {

BACKGROUND 10 CFR 50, Appendix G (Ref.1), requires the establishment (continued) of P/T limits for material fracture toughness requirements ;

of the RCPB materials. Reference 1 requires an adequate t margin to brittle failure during normal operation, :

anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of 3 Mechanical Engineers (ASME) Code,Section III, Appendix G (Ref. 2).

The actual shift in the RTuor of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance i with ASTM E 185 (Ref. 3) and 10 CFR 50, Appendix H (Ref. 4). I The operating P/T limit curves will be adjusted, as 1 necessary, based on the evaluation findings and the i recommendations of Reference 5.

With regard to the reactor vessel material specimen capsule !

withdrawal schedule, NRC staff review and approval of any change to this schedule is required prior to implementation. 1 Furthermore, changes to the capsule removal schedule that do '

not conform with ASTM E-185 (Ref. 3) require NRC approval in )

l the forn of a license amendment as described in NRC Administrative Letter 97-04 (Ref. 10).

(continued) l l

l l

I 4

l l

i l

4 CLINTON B 3.4-53a Revision No. 3-4

. - _ - . .~. --. . . - . . - . . . . - - . . - - .-

RCS P/T Limits l B 3.4.11 BASES i BACKGROUND The P/T limit curves are composite curves established by (continued) superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and ,

temperature rate of change, one location within the reactor '

vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more i restrictive, and, thus, the curves are composites of the most restrictive regions.

The heatup curve represents a different set of restrictions '

than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters.the location of the tensile stress between the outer and inner walls.

The criticality limits include the Reference I requirement that they be at least 40*F above the heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leak and hydrostatic testing.

1 The consequence of violating the LC0 limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code,Section XI, Appendix E

_ (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

APPLICABLE The P/T limits are not derived from Design Basis Accident SAFETY ANALYSES (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws j to propagate and cause nonductile failure of the RCPB, a

~

condition that is unanalyzed. Reference 7 establishes the i (continued) j 2

CLINTON B 3.4-54 Revision No. 3-4 J

l

1 RCS P/T Limits B 3.4.11 4 BASES SURVEILLANCE SR 3.4.11.5. SR 3.4.11.6. and SR 3.4.11.7 REQUIREMENTS (continued) Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS j i

temperature less than or equal to certain specified values requim 2ssurance that these temperatures meet the LCO limits.

The flange temperatures must be verified to be above the ;

limits 30 minutes before and while tensioning the vessel '

l head bolting studs to ensure that once the head is tensioned j the limits are satisfied. SR 3.4.11.5 allows up to 10% of

. the reactor vessel head bolting studs to be fully tensioned

with flange temperatures < 70 *F. This allows the closure flange 0-rings to be sealed to support raising reactor water

level to assist in warming the flanges. When in MODE 4 with

. RCS temperature s 80*F, 30 minute checks of the flange temperatures are required because of the reduced margin to

the limits. When in MODE 4 with RCS temperature s 90*F, monitoring of the flange temperature is required every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure the temperatures are within limits.

The 30 minute Frequency reflects the urgency of maintaining the temperatures within limits, and also limits the time that the temperature limits could be exceeded. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable based on the rate of temperature '

change possible. at these temperatures. l

\

SR 3.4.11.8 and SR 3.4.11.9 l

Differential temperatures within the applicable limits '

ensure that thermal stresses resulting from increases in THERMAL POWER or recirculation loop flow during single recirculation loop operation will not exceed design allowances. Performing the Surveillance within 15 minutes i before beginning such an increase in power or flow rate provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.9 is to compare the temperatures of the operating recirculation loop and the idle loop.

(continued)

CLINTON B 3.4-60 Revision No. 3-4

RCS P/T Limits B 3.4.11 BASES l

~

SURVEILLANCE SR 3.4.11.8 and SR 3.4;11.9 (continued)

REQUIREMENTS Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 30% of RTP and with any single loop flow rate greater than or equal to 30% of l rated loop flow. Therefore, SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for.SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop i temperature if the idle loop is isolated from the RPV since

-the water in the loop cannot be introduced into the ]

remainder of the Reactor Coolant System.

l l

REFERENCES _ 1. 10 CFR 50, Appendix G. l i

2. ASME, Boiler and Pressure Vessel Code,Section III, 4 Appendix G. j i

3. ASTM E 185-82, " Standard Practice for Conveting I Surveillance Tests For Light-Water Cooled Nuclear !

Power Reactor Vessels." i

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

i

7. NED0-21778-A, " Transient Pressure Rises Affecting l Fracture Toughness Requirements for BWRs," December i 1978.

l 8. USAR, Section 15.4.4. ,

1

9. USAR, Section 5.3.

10. NRC Administrative Letter 97-04, "NRC Staff Approval for Changes to 10 CFR Part 50, Appendix H, Reactor Vessel Surveillance Specimen Withdrawal Schedules." J i

CLINTON B 3.4-61 Revision No. 3-4 L

A ECCS-Shutdown B 3.5.2 BASES ACTIONS A.1 and B.1 (continued)

'With the inoperable subsystem not restored to OPERABLE status within the required Completion Time, action must be initiated immediately to suspend operations with a potential for draining the reactor vessel (0PDRVs) to minimize the probability of a vessel draindown and the subsequent potential for fission product release. Actions must continue until OPDRVs are suspended.

C.1, C.2. D.1, D.2 D.3, and D.4

{

If both of the required ECCS injection / spray subsystems are inoperable, all coolant inventory makeup capability may be i unavailable. Therefore, actions must be initiated immediately to suspend OPDRVs in order to minimize the !

probability of a vessel draindown and the subsequent l potential for fission product release. Actions must continue until OPDRVs are suspended. One ECCS injection / spray subsystem must also be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

If at least one ECCS injection / spray subsystem is not restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time, additional actions are required to minimize any l potential fission product release to the environment. This !

includes ensuring secondary containment is OPERABLE; one i standby gas treatment subsystem is OPERABLE; and secondary 1 containment isolation capability (i.e., at least one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative. controls to assure isolation capability) in each secondary containment and secondary containment bypass penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to ' perform the Surveillances needed to demonstrate.

the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillances may need to be performed to restore the component to OPERABLE status.

(continued)

CLINTON B 3.5-17 Revision No. 3-3

' ENS-Shutdown B 3.5.2 BASES ACTIONS C.I. C.2. D.I. D.2. D.3. and D.4 (continued)

' Secondary containment isolation capability as descF1 bed above, can be achieved by identifying all secondary containment and secondary containment bypass penetration flow paths that remain open (e.g., not isolated by at least one closed isolation valve or damper) and determining which of these penetrations involve manual isolation valves and which involve valves (or dampers) that are designed to close automatically upon receipt of an applicable isolation signal. If automatic isolation capability for any open penetration (s) is desired, then a sufficient number of automatic isolation instrument channels should be verified to be available for at least one of the isolation devices '

for that penetration. It is not necessary for all of the normal LC0 requirements associated with the applicable isolation devices and their associated instrumentation to be fully met as long as isolation capability exists with consideration given to existing plant conditions.

For open penetrations that must be isolated manually (including open penetrations for which automatic isolation i capability is not being maintained), isolation capability may be accomplished by ensuring that the associated controls are readily available and accessible (locally or remotely) for at least one isolating mechanism (e.g., valve or damper) in the event isolation becomes necessary. This includes assigning responsibility particularly for closing such valves or dampers to ensure prompt isolation in the event of a demand.

In addition to the above actions, Required Action D.4 requires action to be taken to close at least one door in the upper containment personnel air lock. The closed air lock door completes the boundary for control of potential radioactive releases. With the appropriate administrative controls, however, the closed door can be opened intermittently for entry and exit. This allowance is acceptable due to the need for containment access and due to the slow progression of events, such as an inadvertent vessel draindown, that may occur during the identified Conditions.

The lack of available ECCS during shutdown conditions would not be expected to result in the immediate release of (continued)

CLINTON B 3.5-18 Revision No. 3-3

ECCS-Shutdown B 3.5.2 BASES ACTIONS C. l . C. 2. D.1. 0. 2. D.3. and 0.4 (continued)

. appreciable fission products to the containment atmosphere.

Actions must continue until all requirements of this Condition are satisfied.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time to restore at least one ECCS injection / spray subsystem to OPERABLE status ensures that prompt action will be taken to provide the required cooling capacity or to initiate actions to place the plant in a condition that minimizes any potential fission product '

release to the environment.

SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2 REQUIREMENTS The minimum water level of 12 ft 8 inches required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the ECCS pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, all ECCS injection / spray subsystems are inop OPERABLE RCIC stora,erable ge tank. unless they are aligned to an When the suppression pool level is < 12 ft 8 inches, the HPCS System is considered OPERABLE only if it can take suction from the RCIC storage tar.k and the RCIC storage tank water level is sufficient to provide the required NPSH for the HPCS pump. Therefore, a verification that either the suppression pool water level is a 12 ft 8 inches or the HPCS System is aligned to take suction from the RCIC storage tank and the RCIC storage tank contains a 125,000 available gallons of water ensures that the HPCS System can supply makeup water to the RPV. Verification that the RCIC storage tank contains k 125,000 available gallons of water may be performed by verifying that the trip light for IE51-N801 is on.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency of these SRs was developed considering .

operating experience related to suppression pool and RCIC storage tank water level variations during the applicable MODES. Furthermore, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal '

suppression pool or RCIC storage tank water level condition.

(continued) l CLINTON . B 3.5-19 Revision No. 3-3

ECCS-Shutdown B 3.5.2 BASES (continued) i SURVEILLANCE SR 3.5.2.3. SR 3.5.2.5. and SR 3.5.2.6 REQUIREMENTS The Bases provided for SR 3.5.1.1, SR 3.5.1.4, and -

SR 3.5.1.5 are applicable to SR 3.5.2.3, SR 3.5.2.5, and SR 3.5.2.6, respectively. l SR 3.5.2.4 i

l Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides l assurance that the proper flow paths will exist for ~ECCS operation. This SR does not apply to nives that are locked, sealed, or otherwise secured la position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position '

provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or

! valve manipulation; rather, it involves verification that those valves-capable of potentially being mispositioned are -

in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is appropriate because the valves are operated under procedural control and the probability of their being mispositioned during this time period is low.

In MODES 4 and 5, the RHR System may operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore, RHR valves that are required for LPCI subsystem operation may be aligned for decay heat removal.

This SR is modified by a Note that allows one LPCI subsystem of the RHR System to be considered OPERABLE for the ECCS ftmetion if all the required valves in the LPCI flow path can be manually realigned (remote or local) to allow injection into the RPV and the system is not otherwise inoperable. This will ensure adequate core cooling if an inadvertent vessel draindown should occur.

REFERENCES 1. USAR, Section 6.3.3.

l l

i l

CLINTON B 3.5-20 Revision No. 3-3

- =. . . .- - - - _ . .. .. - _. - .

. l l

SCIDs l l B 3.6.4.2 i

BASES l l

SURVEILLANCE SR 3.6.4.2.1 (continued)

REQUIREMENTS Since these SCIDs are readily accessible to personnel during normal unit operation and verification of their position is

. relatively easy, the 31 day Frequency was chosen to provide I

added assurance that the SCIDs are in the correct positions.

Two Notes have been added to this SR. The first Note applies to valves, dampers, and blind flanges located ir l high radiation areas and allows them to be verified by use l of administrative controls. Allowing verification by l administrative contro1r is considered acceptable, since l

access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the

probability of misalignment of these SCIDs, once they have i been verified to be in the proper position, is low.

l A second Note has been included to clarify that SCIDs that are open under administrative controls are not required to meet the SR during the time the SCIDs are open.

l l SR 3.6.4.2.2 l

l Verifying the isolation time of each power operated and each .

l automatic SCID is within limits is required to demonstrate 1

! OPERABILITY. The isolation time test ensures that the SCID l l will isolate in a time period less than or equal to that l l assumed in the safety analyses. The Frequency of this SR is ,

92 days.

SR 3.6.4.2.3 Verifying that each automatic SCID clo?es on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a DBA or other accident. This SR ensures that each automatic SCID will actuate to the isolation position on a j

secondary containment isolation signal. The LOGIC SYSTEM r FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide

( complete testing of the safety function. Ihc 18 month l Frequency is based on the need to perform this Surveillance l- under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

(continued) i CLINT,0N B 3.6-94 Revision No. 3-4 I

AC Sources-Operating B 3.8.1 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating BASES BACKGROUND The unit Class IE AC Electrical Power Distribution System AC sources consist of the offsite power sources and the onsite standby power sources (diesel generators (DGs) 1A, IB, and IC). As required by 10 CFR 50, Appendix A, GDC 17 (Ref.1),

the design of the AC electrical power system provides independence and redundancy to ensure an available, source of

,gower to the Engitatered Safety Feature (ESF) systems.

The Class IE AC distribution system supplies electrical power to three divisional load groups, with each division powered by an independent Class IE 4.16 kV ESF bus (refer to LC0 3.8.9, " Distribution Systems-0perating").

Each ESF bus i has two separate and independent offsite . sources of power.

Each ESF bus has a dedicated onsite DG. The ESF systems of any two of the three divisions provide for the minimum safety functions necessary-to shut down the unit and maintain it in a safe shutdown condition.

Offsite power is supplied to the switchyard from the transmission network. From the switchyard one 345 kV circuit provides AC power to each 4.16 kV ESF bus. An electrically and physically independent 138 kV power source provides a second completely independent circuit to each 4.16 kV ESF bus. The offsite AC electrical power sources are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental l conditions. A detailed description of the offsite power !

network and circuits to the onsite Class IE ESF buses is found in USAR, Chapter 8 (Ref. 2). ;

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class IE ESF bus (es). An onsite, permanently installed static VAR compensator (SVC) is also available for connection to the offsite circuit to support required voltage for the ESF busses.

The onsite standby power source for each 4.16 kV ESF bus is a dedicated DG. A DG starts automatically on loss of coolant accident (LOCA) signal (i.e., low reactor water (continued)

CLINTON B 3.8-1 Revision No. 3-5

a l

AC Sources-Operating j B 3.8.1 )

BASES (continued)

LCO Two qualified circuits between the offsite transmission network and the onsite Class 1E Distribution System and

'three separate and independent DGs (1A, 18, and IC), ensure i availability of the required power to shut down the reactor J and maintain it in a safe shutdown condition after an anticipated operational occurrence (A00) or a postulated DBA.

Qualified offsite circuits are those that are described in '

the USAR and are part of the l'. censing basis for the unit.

Each offsite circuit must he capable of maintainincirated j frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses. Each offsite circuit consists of incoming breaker and disconnect to the respective reserve auxiliary transformer (RAT) or emergency reserve auxiliary transformer (ERAT) and the respective circuit path including feeder breakers _to each of the ,

4.16 kV ESF buses. An onsite, permanently installed SVC is also available for connection to each offsite circuit to support required voltage for the ESF busses. Connection of the SVCs to the offsite circuits is via circuit breakers to the secondary side of the RAT and/cr ERAT.

Connection and operation of the SVCs is dictated by the existing need for voltage support of the offsite electrical power sources based on prevailing grid conditions. Thus, OPERABILITY of the offsite electrical power sources is _

normally supported by, but is not necessarily dependent on, )

connection and operation of the SVCs. The resultant impact 1 on OPERABILITY of the offsite electrical sources from'- ;

disconnecting the SVCs from the offsite circuits can be i determined by analysis based on use of.an established model of the offsite transmission network and existing grid i conditions, including available generating sources, which i can be updated on a daily or more frequent basis. The model provides the capability to predict or determine what the onsite voltages would be at the RAT and/or ERAT (while connected to the offsite electrical sources)-in the event of a DBA LOCA, including consideration of the loss of grid voltage support that would occur with a plant trip.

1 (continued)

CLINTON B 3.8-3 Revision No. 3-5

AC Sources--Operating B 3.8.1 BASES l

l LCO Each DG must be capable of starting, accelerating to rated l (continued)- . speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This sequence must be l accomplished within 12 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of l initial conditions such as DG in standby with engine hot and DG in standby with engine at ambient conditions. Additional DG capabilities must be demonstrated to meet requir.ed Surve111ances, e.g., capability of the DG to revert to

! standby status on an ECCS signal while operating in parallel l test mode.

l l Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG 1A and DG 1B OPERABILITY.

l The AC sources in one division must be separate and

! independent (to the extent possible) of the AC sources in the other division (s). For the DGs, the separation and independence are complete. For the offsite AC sources, the

< separation and independence are to the extent practical. A l circuit may be connected to more than one ESF bus, with fast transfer capability to the other circuit OPERABLE, and not

! violate separation criteria. A circuit that is not connected to an ESF bus is required to have fast transfer capability for the circuit to be considered OPERABLE.

l l

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:

! a. Acceptable fuel design limits and reactor coolant l pressure boundary limits are not exceeded as a result l of A00s or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

(continued)

CLINTON B 3.8-4 Revision No. 3-5 l

l

. -. _- _ - - - . -. --- ..---- -~- .. -- .

AC Sources-Operating B 3.8.1 BASES APPLICABILITY A Note has been added taking exception to the Applicability (continued) , requirements for Division 3 sources, provided the HPCS System is declared inoperable. This exception is'lntended to allow declaring of the HPCS System inoperable either in lieu of declaring the Division 3 source inoperable, or at any time subsequent to entering ACTIONS for an inoperable Division 3 source. This exception is acceptable since, with the HPCS System inoperable and the associated ACTIONS entered, the Division 3 AC sources provide no additional assurance of meeting the above criteria.

AC power requirements for MODES 4 and 5 'arercovereii in !

LCO 3.8.2, "AC Sources :. Shutdown."

ACTIONS A.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining offsite circuits on a more frequent basis. Since the Required Action only specifies " perform," a failure of SR 3.8.1.1 acceptance criteria does not result in the Required Action not met. However, if a second circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

M According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the 4 potential for a loss of offsite power is increased, with I attendant potential for a challenge to the plant safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical l power to the onsite Class IE distribution system.

The Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued) l CLINTON B 3.8-5 Revision No. 3-5

AC Sources-Operating l

B 3.8.1 l

BASES i ACTIONS M (continued) l

'The second Completion Time for Required Action A.2~

establishes a limit on the maximum time allowed for any !

combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet l the LCO. If Condition A is entered while, for instance, a I DG is inoperable and that DG is subsequently returned-OPERABLE, the LC0 may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This situation could lead to a total of l 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore l the offsite circuit. At this time, a DG could again become i inoperable, the circuit restored OPERABLE, and an additional- 1 l 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to complete l restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after .

discovery of failure to meet the LCO. This limit is '

l considered reasonable for situations in which Conditions A ;

i and B are entered concurrently. The "AND" connector between !

the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times means that both !

Completion Times apply simultaneously, and the more restrictive must be met.

l The Completion Time allows for an exception to the normal I

! " time zero" for beginning the allowed outage time " clock."

i This exception results in establishing the " time zero" at l the time the LCO was initially not met, instead of at the l time that Condition A was entered.

l u

To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since l

the Required Action only specifies " perform," a failure of I SR 3.8.1.1 acceptance criteria does not result in a Required ,

Action being not met. However, if a circuit fails to pass 1

l SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

(continued) l CLINTON B 3.8-6 Revision No. 3-5

AC Sources-Operating B 3.8.1 BASES ACTIONS L1 (continued) ,

' Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included, although, for this Required Action, Division 3 is considered redundant to Division 1 and 2 Emergency Core Cooling System (ECCS)).

Redundant required features failures consist of inoperable l features associated with a division redundant to the j division that has an inoperable DG.

l l The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal l

" time zero"- for beginning the allowed outage time " clock."

In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature on another division is inoperable. 1 If, at any time during the existence of this Condition (one DG inoperable), a required feature subsequently becomes l inoperable, this Completion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or more required support or supported features, or both, that are associated with the OPERABLE DG(s), results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

(continued)

I CLINTON B 3.8-7 Revision No. 3-5.

l AC Sources-Operating l B 3.8.1 i

BASES ACTIONS B.2 (continued) l

'The remaining OPERABLE DGs and offsite circuits are adequate

! to supply electrical power to the onsite Class 1E l Distribution System. Thus, on a component basis, single failure protection for the required feature's function may ;

have been lost; however, function has not been lost. The '

4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable - l required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time l l takes into account the capacity and capability of the i i remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during-this period.

1 B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid i unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not

! exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be j performed. If the cause of inoperability exists on other l DG(s), the other DG(s) are declared inoperable upon ,

j discovery, and Condition E and potentially Condition G of i L LC0 3.8.1 is entered. Once the failure is repaired, and the l l common cause failure no longer exists, Required Action B.3.1 i is satisfied. If the cause of the initial -inoperable DG cannot be confirmed not to exist on the remaining DG(s), ,

! performance of SR 3.8.1.2 suffices to provide assurance of '

continued OPERABILITY of those DG(s).

In the event the inoperable DG is restored to OPERABLE l status prior to completing either B.3.1 or B.3.2, the l Condition Report Program will continue to evaluate the i common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

l l According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is l reasonable time to confirm that the OPERABLE DG(s) are not i affected by the same problem as the inoperable DG.

L (continued) i CLINTON B 3.8-8 Revision No. 3-5 l

l AC Sources-Operating l B 3.8.1 BASES ACTIONS B.4 (continued)

' According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition B for a period that should not exceed I 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class IE distribution system. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period. .

l l

The second Completion Time for Required Action B.4 established a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LC0 may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . h.is situation could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

(continued)

CLINTON B 3.8-9 Revision No. 3-5 1

l AC Sources-Operating B 3.8.1 BASES ACTIONS L4 (continued)

' As in Required Action B.2, the Completion Time albs for an exception to the normal " time zero" for beginning the i allowed outage time " clock." This exception results in establishing the " time zero" at the time the LC0 was-initially not met, instead of the time Ccndition B was

! entered.

i C.1 and C.2 RequiredActionC.1addressesactionstobetakeninthe event of concurrent failure of redundant required features.

Required Action C.1 reduces the vulnerability to a loss of function. The rationale for the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.

l When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related divisions (i.e.,

single division systems are not included in the list, although, for this Required Action, Division 3 is considered redundant to Division 1 and 2 ECCS). Redundant required features failures consist of any of these features that are inoperable, because any inoperability is on a division redundant to a division with inoperable offsite circuits.

(continued) l l

CLINTON B 3.8-10 Revision No. 3-5

t' AC Sources-0perating 8 3.8.1 l

BASES l

ACTIONS C.1 and C.2 (continued)

'The Completion Time for Required Action C.1 is intinded to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed outage time " clock." In this Required i Action, the Completion Time only begins on discovery that I both: l

a. All offsite circuits are inoperable; and ,.

b. A required feature is inoperable.

l

! If, at any time during the existence of this Condition (two i offsite circui_ts inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

1 According to Regulatory Guide 1.93 (Ref. 6), operation may j continue in Condition C for a period that should not exceed l

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite

electrical power system does not have the capability to

effect a safe shutdown and to mitigate the effects of an !

l accident; however, the onsite AC sources have not been L degraded. This level of degradation generally corresponds l

to a total loss of the immediately accessible offsite power i sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable 1 l that involve one or more DGs inoperable. However, two '

l factors tend to decrease the severity of this degradation l 1evel:

l a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and l

(continued) i i

L CLINTON B 3.8-10a Revision No. 3-5 i

t. _ _ . . _ _ . -

l '

l

AC Sources--Operating l B 3.8.1 l -

i BASES l

ACTIONS C.1 and C.2 (continued)

' b. The time required to detect and restore an u'navailable offsite power source is generally much less than that l

required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, l sufficient onsite AC sources are available to maintain the l'

unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst cese single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months CLapletion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importence of maintaining an AC electrical power system capable of mseting its design criteria.

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite

! sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

l l (continued) l l

4

L l CLINTON B 3.8-10b Revision No. 3-5

AC S@urces-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)

REQUIREMENTS To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by Notes (the Note for SR 3.8.1.7 and Note 2 for SR 3.8.1.2) to indicate that all DG starts for these l Surve111ances may be preceded by an engine prelube period l

and followed by a warmup period prior to loading.

For the purposes of this testing, the DGs are started from i standby conditions. Standby conditions mean that the lube !

oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. For the purposes of these SRs, the DG may be started using a manual start signal, a simulated loss of offsite power test signal by itself, a simulated loss of offsite power test signal in conjunction with an ECCS actuation test signal, or an ECCS actuation test signal by itself.

In order to reduce stress and wear on diesel engines, the manufacturer recommends that the starting speed of DGs be i

limited, that warmup be limited to this lower speed, and that DGs be gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of

, Note 3, which is only applicable when such procedures are l used.

l . ' .

SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage l and frequency within 12 seconds. The DG's ability to maintain the required voltage and frequency is tested by

!. those SRs which require DG loading. The 12 second start requirement supports the assumptions in the design basis LOCA analysis (Ref. 5). The 12 second start requirement may l not be applicable to SR 3.8.1.2 (see Note 3 of SR 3.8.1.2),

! when a modified start' procedure as described above is used.

If a modified start is not used, the 12 second start requirement of SR 3.8.1.7 applies. Since SR 3.8.1.7 does require a 12 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.

This is the intent of Note 1 of SR 3.8.1.2. Similarly, the

. performance of SR 3.8.1.12 or SR 3.8.1.19 also satisfies the requirements of SR 3.8.1.2 and SR 3.8.1.7.

(continued)

CLINTON B 3.8-14 Revision No. 3-1

. - -.. .- ._.. . . . - . - . - ___ - - __ - -. - - .- ~ - -

AC Sources-Operating-B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued) 1 REQUIREMENTS is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

Credit may be taken for unplanned events that satisfy this 1 SR. Examples of unplanned events may include: l

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of I

this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

, SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (12 seconds) from the design basis actuation signal (LOCA signal) and operates for 2: 5 minutes.

l The 5 minute period provides sufficient time to demonstrate stability. The DG's ability to maintain the required voltage and frequency is tested by those SRs which require DG loading. ,

The Frequency of: 18 months takes into consideration plant I conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these l- components usually pass the SR when performed at the L

18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For l

the purposeiof this testing, the DGs must be started from l standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a (continued) o CLINTON B 3.8-22 Revision No. 3-1

l

AC Sources-Operating 8 3.8.1

BASES i !

j SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS

! maximum limit on engine temperatures. The reason for Note 2 i is that during operation with the reactor critical, l performance of this SR could cause perturbations to the i electrical distribution systems that could challenge 1 continued steady state operation and,' as a result, plant i safety systems. Credit may be taken for unplanned events j that satisfy this SR. Examples of unplanned events may include:

i

} 1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

! 2) Post maintenance testing that requires performance of j this Surveillance in order to restore the component to 1

OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

i SR 3.8.1.13 i This Surveillance demonstrates that DG non-critical l protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal and critical

protective functions trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during 4 DBAs and provide alarms on abnormal engine conditions.

l These alarms provide the operator with necessary information !

I to react appropriately. The DG availability to mitigate the

DBA is more critical than protecting the engine against

minor problems that are not immediately detrimental to

emergency operation of the DG.

! The 18 month Frequency is based on engineering judgment, j taking into consideration plant conditions required to

. perform the Surveillance, and is intended to be consistent

! with expected fuel cycle lengths. Operating experience has 4 shown that these components usually pass the SR when i performed at the 18 month Frequency. Therefore, the

Frequency was concluded to be acceptable from a reliability standpoint.

i

(continued) l CLINTON B 3.8-23 Revision No. 3-1

]

1

AC Sources-Operating 8 3.8.1 4

BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS The SR is modified by a Note. The reason for the Note is that performing the Surveillance removes a required DG from service. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or perfonned in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.14 Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), requires demonstration once per 18 months that the DGs can start and I run continuously at full load capability for an interval of I not less than 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s-22 hours of which is at a load

-equivalent to the continuous rating of the DG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 110% of the continuous duty rating of the DG. The.DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this.SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor

s: 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience.

The 18 month Frequency is consistent with the reconmendations of Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(3); takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

(continued)

CLINTON 8 3.8-24 Revision No. 3-1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS This Surveillance is modified by two Notes. Note I states that momentary transients due to changing bus loads do not I invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. The reason for Note 2 is that during operation with the reactor l critical, performance of this SR could cause perturbations ,

to the electrical distribution systems that would challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events I that satisfy this SR. Examples of unplanned events may I

include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the i required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to i OPERABLE, provided the maintenance was required, or

! performed in conjunction with maintenance required to i maintain OPERABILITY or reliability.

SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 12 seconds. The 12 second time is ,

derived from the requirements of the accident analysis to l respond to a design basis large break LOCA. The DG's ability to maintain the required voltage and frequency is i tested by those SRs which require DG loading.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(5). i This SR has been modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The

'quirement that the diesel has operated for at least I hour l at full load conditions prior to performance of this 4

(continued) j l

CLINTON B 3.8-25 Revision No. 3-1

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQVIREMENTS The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(2); takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES may j perturb the electrical distribution system, and challenge l plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the l

equipment to perform the function specified by this Surveillance, for which adequate documentation of the l required performance is available; and

2) Post maintenance testing that requires performance of l

this Surveillance in order to restore the component to 6

OPERABLE, provided the maintenance was required, or l performed in conjunction with maintenance required to l maintain OPERABILITY or reliability.

I SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to l ESF systems so that the fuel, RCS, and containment design ;

limits are not exceeded.

This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. For load shedding effected via shunt trips that are actuated in response to a LOCA signal (i.e., "ECCS initiation signal"), this surveillance includes verification of the shunt trips (for Divisions 1 and 2 only)

! in response to LOCA signals originating in the ECCS

initiation logic as well as the Containment and Reactor Vessel Isolation and Control System actuation logic. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the

DG system to perform these functions is acceptable. This (continued)

CLINTON B 3.8-29 Revision No. 3-4

l I

AC Sources-0perating B 3.8.1 ;

l BASES

)

SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into consideration plant l conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 18 months.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.20 This Surveillance is performed with the plant shut down and demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each i engine can achieve proper speed within the specified time l

l (continued) o CLINTON B 3.8-30 Revision No. 3-4

1 AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.20 (continued)

REQUIREMENTS when the DGs are started simultaneously. The DG's ability to maintain the required voltage and frequency is tested by those SRs which require DG loading.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9).

This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures.

Diesel Generator Test Schedule The DG test schedule (Table 3.8.1-1) implements the industry guidelines for assessment of diesel generator performance (Ref. 12). The purpose of this test schedule is to provide timely test data to establish a confidence level associated with the goal to maintain DG reliability at > 0.95 per test.

According to the industry guidelines (Ref. 12), each DG unit should be tested at least once every 31 days. Whenever a DG has experienced 4 or more valid-failures in the last 25 valid tests, the maximum time between tests is reduced to 7 days. Four failures in 25 valid tests is a failure rate of 0.16, or the threshold of acceptable DG performance, and hence may be an early indication of the degradation of DG reliability. When considered in the light of a long history of tests, however, 4 failures in the last 25 valid tests may only be a statistically probable distribution of random events. Increasing the test Frequency allows a more timely accumulation of additional test data upon which to base judgment of the reliability of the DG. The increased test Frequency must be maintained until seven consecutive failure free tests have been performed.

(continued)

CLINTON B 3.8-31 Revision No. 3-4

AC Sources--Operating B 3.8.1 l

l BASES SURVEILLANCE Diesel Generator Test Schedule (continued) l REQUIREMENTS The Frequency for accelerated testing is 7 days, but no less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Tests conducted at intervals of less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months may be credited for compliance with Required Actions. However, for the purpose of re-establishing the normal 31-day Frequency, a successful test at an interval of less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months should be considered an invalid test and not count towards the seven consecutive failure free starts, and the consecutive test count is not reset.

A test interval in excess of 7 days (or 31 days, as appropriate) constitutes a failure to meet SRs and results in the associated DG being declared inoperable. It does not, however, constitute a valid test or failure of the DG, and any consecutive test count is not reset.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. USAR, Chapter 8.

3. Regulatory Guide 1.9.

4. USAR, Chapter S.

5. USAR, Chapter 15.

6. Regulatory Guide 1.93.

7. Generic Letter 84-15, July 2, 1984.

8. 10 CFR 50, Appendix A, GDC 18.

9. Regulatory Guide 1.108.

10. Regulatory Guide 1.137.

11. ANSI C84.1, 1982.

12. NUMARC 87-00, Revision 1, August 1991.

13. IEEE Standard 308.

14. IP Calculation 19-AN-19.

r 1

i CLINTON B 3.8-32 Revision No. 3-4 i

i

1 AC Sources-Shutdown l B 3.8.2 1 BASES LC0 electrical power support, assuming a loss of the offsite ;

(continued) circuit. Similarly, when the high pressure core spray '

(HPCS)-is required to be OPERABLE, a separate offsite circuit to the Division 3 Class IE onsite electrical power distribution subsystem, or an OPERABLE Division 3 DG, ensure an additional source of power for the HPCS. Together, OPERABILITY of the required offsite circuit (s) and DG(s) ensure the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents, reactor vessel draindown). _

The qualified offsite circuit (s) must be capable of maintaining rated frequency and voltage while connected to their respective ESF bus (es), and accepting required loads during an accident. Qualified offsite circuits are those ,

that are described in the USAR and are part of the licensing ;

basis for the plant. The offsite circuit consists of '

incoming breaker and disconnect to the respective reserve auxiliary transformer (RAT) or emergency reserve auxiliary transformer (ERAT), and the respective circuit path including feeder breakers to all 4.16 kV ESF buses required by LC0 3.8.10. In addition, an onsite, permanently installed static VAR compensator (SVC) is available for connection to the offsite circuits to support. required voltage for the ESF busses. Connection of the SVC to the offsite circuit is via circuit breakers to the secondary side of the RAT and/or ERAT.

Connection and operation of the SVC(s) is dictated by the existing need for voltage support of the offsite electrical power source (s) based on prevailing grid conditions. Thus, OPERABILITY of the offsite electrical power source (s) is normally supported by, but is not necessarily dependent on, connection and operation of the SVC(s). The resultant impact on OPERABILITY of the offsite electrical source (s) from disconnecting the SVC(s) from the offsite circuit (s) can be determined by analysis based on use of an established model of the offsite transmission network and existing grid conditions, including available generating sources, which can be updated on a daily or more frequent basis. The model provides the capability to predict or determine what the onsite voltages would be at the RAT and/or ERAT (while connected to the offsite electrical sources) under maximum postulated load conditions.

(continued)

CLINTON B 3.8-35 Revision No. 3-5

. -. -. - . - - - _ - - _ . . - . - - - - . - - - . - - - . . . - - . . . ~ _ - . .

AC Sources-Shutdown 8 3.8.2 BASES l

LC0 The required DG must be capable of starting, accelerating to (continued) , rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage, and accepting

required loads. This sequence must be accomplished within l 12 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are '

required to be met from a. variety of initial conditions such l as: DG in standby with the engine hot and DG in standby l l'

with the engine at ambient conditions. Additional AG ;

capabilities must be demonstrated to meet required 1 Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode. j Proper sequencing of loads, including tripping of ,

nonessential loads, is a required function for DG '

OPERABILITY.

It is acceptable for divisions to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required AC electrical power ,

distribution subsystems. No fast transfer capability is l required for offsite circuits to be considered OPERABLE for this LCO.

As described in Applicable Safety Analyses, in the event of l an accident during shutdown, the TS are designed to maintain i the plant in a condition such that, even with a single failure, the plant will not be in immediate difficulty.

APPLICABILITY The'AC sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident 1 are available; l

(continued) i

! l CLINTON B 3.8-36 Revision No. 3-5 ,

- _ _ _ _ .._ _ ~ _ _ _ _ _ _ _ .... _ __ _._ _ ___ . _ __._._._. _ _

AC Sources-Shutdown B 3.8.2 BASES APPLICABILITY c. Systems necessary to mitigate the effects of events (continued) , that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC power requirements for MODES 1, 2, and 3 are covered in LC0 3.8.1.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.

A.1 A required offsite circuit'is considered inoperable if no qualified circuit is supplying power to one required ESF division. If two or more ESF 4.16 kV buses are required per LC0 3.8.10, division (s) with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and

operations with a potential for draining the reactor vessel.

l By the allowance of the option to declare required features inoperable which are not powered from offsite power, appropriate restrictions can be implemented in accordance with the required feature (s) LCOs' ACTIONS. Required features remaining powered from offsite power (even though

that circuit may be inoperable due to failing to power other features) are not declared inoperable by this Required Action.

l A.2.1. A.2.2. A.2.3. A.2.4. B.I. B.2. B.3. and B.4 With the offsite circuit not available to all required divisions, the option still exists to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for l sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC l

! (continued)

CLINTON B 3.8-37 Revision No. 3-5 I

, v - . - .

, , --m ,. . -

AC Sources-Shutdown !

B 3.8.2 I BASES ACTIONS A.2.1. A.2.2. A.2.3 A.2.4. B.l. B.2. B.3, and B.4

, (continued) ..

power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the primary and secondary containment, and activities that could potentially result in inadvertent draining of the reactor vessel.

i Suspension of these activities shall not preclude completion l of actions to establish a safe conservative condition.

L

These actions minimize probability of the occurrence of

postulated events. It is further required to initiate l action immediately to restore the required AC sources and to l continue this action until restoration is accomplished in i order to provide the necessary AC power to the plant safety i systems. l The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The i restoration of the required AC electrical power sources l should be completed as quickly as possible in order to i minimize the time during which the plant safety systems may l be without sufficient power. l l 1

< Pursuant to LC0 3.0.6, the Distribution System ACTIONS are l not entered even if all AC sources to it are inoperable,

! resulting in de-energization. Therefore, the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power l to any required ESF bus, ACTIONS for LC0 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a division is de-energized. LCO 3.8.10 l provides the appropriate restrictions for the situation involving a de-energized division.

i

)- C.1 When the HPCS is required to be OPERABLE, and the additional required Division 3 AC source is inoperable, the required diversity of AC power sources to the HPCS is not available.

Since these sources only affect the HPCS, the HPCS is declared inoperable and the Required Actions of the affected Emergency Core Cooling Systems LC0 entered.

(continued)

[

CLINTON B 3.8-38 Revision No. 3-5 i

i

. .- --. .- - - .. - - = - - - . . - - - . . . . - . - - - -

AC Sources-Shutdown B 3.8.2 BASES ACTIONS C.1 (continued)

' In the event all sources of power to Division 3 ave lost, Condition A will also be entered and direct that the ACTIONS of LC0 3.8.10 be taken. If only the Division 3 additional '

required AC source is inoperable, and power is still i supplied to HPCS, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the l

additional required AC source to OPERABLE. This is ,

reasonable considering HPCS will still perform its function, absent an additional single failure. l l

l SURVEILLANCE' SR 3.8.2.1 REQUIREMENTS l SR 3.8.2.1 requires the SRs from LC0 3.8.1 that are l necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, and 3. SR 3.8.1.8 is not required to i be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.17 is not required to be met because the

, required OPERABLE DG(s) is not required to undergo periods l

of being, synchronized to the offsite circuit. SR 3.8.1.20 l is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of ;

each SR. i 1 1 This SR is modified by a Note. The Note provides for certain SRs to not be performed during the MODES specified per the Applicability of LC0 3.8.2. The provisions of the Note preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during the performance of SRs, and l preclude de-energizing a required 4.16 kV ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It 4 is the intent that these SRs must still be capable of being ;

met, but actual performance is not required for any DG or l offsite circuit.

REFERENCES None.

i e

l

! CLINTON 3 3.8-39 Revision No. 3-5 l

.~. . . . - --- _

Diesel fuel Oil, Lube Oil, and Starting Air B 3.8.3 8 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that DG for a period of 7 days while the DG is supplying maximum post loss of coolant accident load demand (Ref.1). This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.

Fuel oil is transferred from each storage tank to its respective day tank by a transfer pump associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All tanks, pumps, and piping are located within the DG building. The fuel oil level in the storage tank is indicated in the control room.

For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory i Guide 1.137 (Ref. 2) addresses the recommended fuel oil

~

practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level.

The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG l under all loading conditions. The syste'm is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. Each engine oil sump contains an inventory capable of supporting a minimum of 7 days of operation.

This supply is sufficient to allow the operator to replenish lube oil from outside sources.

Each DG has an air start system with adequate capacity for five successive start attempts on the DG without recharging the air start receiver (s). The diesel generator starting systems for the Divisions I, II, and III diesel engines are independent and redundant for each division. Each DG starting system consists of two full-capacity air starting (continued)

CLINTON B 3.8-40 Revision No. 3-2

l Diesel Fuel Oil. Lube Oil, and Starting Air i

B 3.8.3 BASES BACKGROUND subsystems. Each subsystem has a rated air capacity capable (continued) of starting its respectivo engine set five times without

recharging the associated air receiver. The rated air

( capa.,ty is 93 ft* at 250 psig for the Division I and.II DGs

! and 64 ft8 at 240 psig for the Division III DG. All three l DGs are capable of multiple successive starts without recharging the air receiver tank when the air receiver .

pressure is below the rated air pressure but above 200 psig.

l l

l APPLICABLE The initial conditir.. s of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in 'JSM, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume Engineered Safety Feature-(ESF)

, systems are OPERABLE. The DGs are designed to provide l sufficient capacity, capability, redundancy, and reliability l to ensure the availability of necessary power to ESF systems i j so that fuel, reactor coolant system, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution l l Limits; Section 3.4, Reactor Coolant System (RCS); and )

Section 3.6, Containment Systems. '

l Since diesel' fuel oil, lube oil, and starting air subsystems j support the operation of the standby AC power sources, they satisfy Criterion 3 of the NRC Policy Statement.

l l

l LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full load, i.e., maximum expected post LOCA load, operation. It is also required to meet specific standards for quality. Additionally, sufficient lube oil supply must be available to ensure the capability to operate at full load for 7 days. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for a.: antic! pated operational occurrence (A00) or a postulated j DBA with loss of offsite power. DG day tank fuel l requirements, as well as transfer capability from the storage tank to the day tank, m a addressed in LCO 3.8.1, "AC Sources-Operating," and LCu 3.8.2, "AC Sources-Shutdown." i

!- The starting air system is required to have a sufficient i capacity for multiple OG start attempts without recharging i the air start receivers.

I !

i 3 (continued) i

! CLINTON B 3.8-41 Revision No. 3-2 I

F

_ m -. ,, -

__..m _ . . _ . _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ . _ _ _ . _ _ _ _ _

Diesel Fuel Oil, tube Oil, and Starting Air B 3.8.3 I

l BASES (continued)

( i APPLICABILITY The AC sources, LCO 3.8.1 and LCO 3.8.2, are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition l after an A00 or a postulated DBA. Since stored diesel fuel oil, lube oil, and starting air subsystem support LCO 3.8.1 and LC0 3.8.2, stored diesel fuel oil, lube oil, and starting air are required to be within limits when the associated DG is required to be OPERABLE.

l_ ACTIONS The Actions Table is modified by a Note indicating that

! separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory acticns for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG ~ subsystem (s) are governed by separate Condition entry and application of associated Required Actions.

1 A.1 In this Condition, the 7 day fuel oil supply for a DG is not

available. However, the Condition is restricted to fuel oil l 1evel reductions that maintain at least a 6 day supply.

These circumstances may be caused by events such as:

i

a. Full load operation required after an inadvertent >

start while at minimum required level; or

b. Feed and bleed operations that may be necessitated by i increasing particulate levels or any number of other

oil quality degradations.

This restriction allows sufficient time for obtaining the i requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that procedures will l be initiated to obtain replenishment, and the low l probability of an event during this brief period.

l (continued) l l

[

i CLINTON 8 3.8-42 Revision No. 3-2

l Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS 8.1 (continued)

With lube oil- inventory less than required, sufficient lube oil to support 7 days of continuous DG operation at full load conditions may not be available. However, the Condition is restricted to lube oil volume reductions that

. maintain at least a 6 day supply. This restriction allows sufficient time for obtaining the requisite replacement volume. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration .of _the required volume prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the low rate of usage, the fact that procedures will be initiated to obtain >

replenishment, and the low probability of an event during this brief period.

$1 This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, <

trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),

, contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend.

Since the presence of particulate does not mean failure of the fuel oil to burn properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has ueen recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil.

0.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits, a period of l 30 days is allowed for restoring the stored fuel oil

! properties. This period provides sufficient time to test

! the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, to restore the stored fuel oil properties. This restoration l

(continued)

(

l CLINTON B 3.8-43 Revision No. 3-2

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS D.1 (continued) may involve feed and bleed procedures, filtering, or a combination of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is high likelihood that the DG would still be capable of performing its intended function.

E.1 L With the required starting air receiver pressure < 200 psig, sufficient capacity for multiple DG start attempts may not exist. However, as long as the receiver pressure is

t: 140 psig, there is adequate capacity for at least one start attempt, and the DG can be considered OPERABLE while the air receiver pressure is restored to the required limit.

A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete

, restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period.

F.1 With a Required Action and associated Completion Time not met, or the stored diesel fuel oil, lube oil, or starting air subsystem not within limits for reasons other than addressed by Conditions A through E, the associated DG may be incapable of performing its intended function and must be j immediately declared inoperable.

SURVEILLANCE- SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 7 days at maximum expected post LOCA loading. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

I (continued)

J l

CLINTON B 3.8-44 Revision No. 3-2

1 Diesel fuel Oil, Lube Oil, and Starting Air

, B 3.8.3 I

I BASES 1

SURVEILLANCE SR 3.8.3.1 (continued)

REQUIREMENTS l The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are

, provided and unit operators would be aware of any ;

large uses of fuel oil during this period. .

SR 3.8.3.2 l

l

This Surveillance ensures that sufficient lube oil inventory 1

is available to support at least 7 days of maximum expected post LOCA load operation for each DG. This minimum volume requirement is based on the DG manufacturer's consumption values for the run time of the DG. Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the DG when the DG

' lube oil sump does not hold adequate inventory for 7 days of )

maximum expected post LOCA load operation without the level ;

reaching the manufacturer's recommended minimum level. !

l A 31 day Frequency is adequate to ensure that a sufficient j lube oil supply is onsite, since DG starts and run times are closely monitored by the plant staff.

1 SR 3.8.3.3 l The tests of fuel oil prior to addition to the storage tanks

are a means of determining whether new fuel oil is of the l appropriate grade and has not been contaminated with ;

l substances that would have an immediate detrimental impact !

on diesel engine combustion and operation. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for l contaminating the entire volume of fuel oil in the storage ;

tanks. These tests are to be conducted prior to adding the l l

new fuel to the storage tank (s), but in no case is the time '

between the sample (and corresponding results) of new fuel and addition of new fuel oil to the storage tanks to exceed

-31 days. The limits and applicable ASTM Standards for the ;

! tests listed in the Diesel Fuel Oil Testing Program of l Specification 5.5.9 are as follows:

I

! a. Sample the new fuel oil in accordance with ASTM ;

j D270-1975 (Ref. 6);

j (continued) i.

CLINTON B 3.8-45 Revision No. 3-2 1

l Diesel Fuel Oil, Lube Oil, and Starting Air ,

8 3.8.3 j l

BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS l b. Verify in accordance with the tests specified in ASTM D1298-85 (Ref. 6) that the sample has an absolute specific gravity at 60/60*F of 2 0.83 and s 0.87 (or ;

an API gravity at 60*F of a 30' and s 40'), and in 1 accordance with the tests specified in ASTM D975-89 )

(Ref. 6) that the sample has a kinematic viscosity at l 40*C of a 1.9 centistokes and s 4.1 centistokes; and

c. Verify that the new fuel oil has clear and bright !

appearance with proper color when tested in accordance !

with ASTM D4176-82 (Ref. 6), or a water and sediment content s 0.05 v/o when tested in accordance with ASTM-D975-89.

Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO since the' fuel oil is not added to the storage tanks. j l Following the initial new fuel oil sample, the fuel oil is !

analyzed to establish that the other properu;0s specified in Table 1 of ASTM 0975-89 (Ref. 6) are met ior new fuel oil r when tested in accordance with ASTN D975-89 (Ref. 6). These additional analyses 'are required by Specification 5.5.9, Diesel Fuel 011 Testing Program, to be performed within 31 days following sampling and addition. This 31 days is intended to assure: 1) that the sample taken is not more than 31 days old at the time.of 7.dding the fuel oil to the storage tank, and 2) that the results of a new fuol oil sample (sample obtained prior to addition but not more than 31 days prior.to) are obtained within 31 days after addition. The 31 day period is acceptable because the fuel oil properties of interest, even if not within stated limits, would not have an immediate effect on DG operation.

This Surveillance ensures the availability of high quality l

fuel oil for the DGs.

l Fuel oil degradation during long term storage shows up as an

! increase in particulate, mostly due to oxidation. The presence of particulate does nof. mean that the fuel oil will not burn properly in a diesel r.ngine. However, the particulate can cause fouling of filters and fuel oil injection equipment, which can cause engine failure.

L i _,

(continued)

[

CLINTON. 8 3.8-46 Revision No. 3-2

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 1

BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS Particulate concentrations should be determined in accordance with ASTM D22/6-88, Method A (Ref. 6). This 1 method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of l 10 mg/1. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.

The Frequency of this Surveillance takes into consideration fuel oil degradation trends indicating that particulate concentration is unlikely to change between Frequency intervals.

SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design provides for multiple start attempts without recharging when pressurized above the low pressure alarm setpoint. The pressure specified in this SR reflects a value at which multiple starts can be accomplished, but is not so high as to result in failing the limit due to normal cycling of the recharge compressor.

The 31 day Frequency takes into account the capacity, )

capability, redundancy, and diversity of the AC sources and '

other indications available in the control room, including )'

alarms, to alert the operator to below normal air start pressure.

SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water frem the storage tanks once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, contaminated fuel oil, and from breakdown of the fuel oil by bacteria.

(continued)

CLINTON 8 3.8-47 Revision No. 3-2

. . _ _ . . . _ - . . . _ . _ . . _ _ . . . _ .. _ . _ . _ _ _ ~ _ _ _ _ . _ _ _ _ _

4 Diesel Fuel Oil, Lube Oil, and Starting Air l

{ B 3.8.3 BASES

^

SURVEILLANCE SR 3.8.3.5 (continued)

REQUIREMENTS Frequent checking for and removal. of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenant ' The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of the Surveillance.

SR 3.8.3.6 j Drcining of the fuel oil stored in the supply tanks, removal

of accumulated sediment, and tank cleaning are required at l

i 10 year intervals by Regulatory Guide 1.137 (Ref. 2),

. paragraph 7..f. This SR is typically performed in

, conjunction with the ASME Boiler and Pressure Vessel Code,

Section XI (Ref. 7), examinations of the tanks. To preclude j the introduction of surfactants in the fuel oil system, the i cleaning should be accomplished using sodium hypochlorite

! solutions, or their equivalent, rather than soap or detergents. This SR is for preventive maintenance. The presence of sediment does raot necessarily represant a failure of this SR provided that accumulated sediment is removed during performance of the Surveillance.

j- REFERENCES 1. USAR, Section 9.5.4.

2. Regulatory Guide 1.137. l c 3. ANSI N195, Appendix B, 1976.

4. USAR, Chapter 6.

5. USAR, Chapter 15.

6. ASTM Standards: D270-1975; D1298-85; D975-89; l D4176-82; D2276-88.

7. ASME, Boiler and Pressure Vessel Code,Section XI.

CLINTON B 3.8-48 Revision No. 3-2

.- -.- _ .- . - . ~ - - - - - - - _ - . - - - . - - - . - - - . . - - . - .

Battery Cell Parameters B 3.8.6 l

BASES SURVEILLANCE Table 3.8.6-1 (continued) l l REQUIREMENTS i it is not overflowing. These limits ensure that the plates l suffer no physical damage, and 'that adequate electron l l transfer capability is maintained in the event of transient conditions. IEEE-450-(Ref.' 3) recomends that electrolyte

level readings should t,e made only after the battery has l been at float charge for at _least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The Category A limit specified for float voltage is 2 2.13 V per cell. This value is based on the recommendation of IEEE-450 (Ref. 3), which states that prolonged operation of cells below 2.13 V can reduce the life expectancy of cells.

The Category A limit specified for specific gravity for each

! pilot cell is 2 1.195 based on the manufacturer's

' recommendations. This value is characteristic of a charged L cell with adequate capacity. According to IEEE-450 (Ref. 3), the specific gravity readings are based on a i temperature of 77'F (25'C).

I

The specific gravity readings are corrected for actual electrolyte temperature and level. For each 3*F (1.67'C)

- above 77*F (25'C), I point (0.001) is added to the reading; I point is subtracted for each 3*F below 77'F when using a float hydrometer. Temperature correction will be performed

i. in accordance with the hydrometer manufacturer's recommendations when using a digital hydrometer (referenced i to D *l- (23'C)) . The specific gravity of the electrolyte in

! a cell increases with a loss of water due to electrolysis or l evaporatira. Level correction will be in accordance with j manufacturer's recommendations. l

[ Category 8 defines the normal parameter limits for each connected cell. The term " connected cell" excludes ~any battery cell that may be jumpered out. 1 The Category B limits specified for electrolyte level and float voltage are the same as those specified for Category A .

and have been discussed above. The Category B limit l specified for specific gravity for each connected cell is a 1.190 with the average of all connected cells 21.200. l These values are based on manufacturer's recommendations. ]'

The minimum specific gravity value required for each cell ensures that the effects of a highly charged or newly ;

installed cell do not mask overall degradation of the i battery.

l (continued) .

L l

CLINTON B 3.8-66 Revision No. 3-2 .

\

l SVC Protection Systems B 3.8.11 B 3.8 ELECTRICAL POWER SYSTEMS

l. B 3.8.11 Static Var Compensator (SVC) Protection Systems l BASES i

l'

! BACKGROUND As described in the Bases for LCO 3.8.1, "AC Sources- '

( Operating," each Engineered Safety Feature (ESF) electrical :

j bus within the Class IE AC Electrical Power Distribution l system has two separate and independent offsite sources of power. From the plant switchyard, a 345-kV circuit provides AC power to each 4.16-kV ESF bus via the reserve auxiliary ,

transformer (RAT). In addition, an electrically and !

(, physically independent 138-kV offsite power source provides I l AC power to each 4.16-kV ESF bus via the emergency reserve i auxiliary transformer (ERAT). For each of these circuits, a I permanently installed static VAR compensator (SVC) is provided which can be connected to the secondary side of i l the associated auxiliary power transformer (RAT or ERAT) via l two (in-series) circuit breakers. The ERAT SVC and RAT SVC' provide steady state, dynamic and transient voltage support to ensure that the Class IE loads will operate as required during anticipated or postulated events. However, as noted l

in the Bases for LCO 3.8.1, SVC support of the offsite power

. sources may not be required at all times, depending on prevailing grid conditions relative to the requirements of the facility.

The internal control system for each SVC includes control l and protective functions. However, backup protection is L provided by a fully redundant and independent protection system, consisting of.two redundant subsystems for each SVC, for fail safe performance of the overall SVC system. The redundant protection subsystems are powered from independent

. DC supplies. Each subsystem activates separate and l independent relays, which in turn will automatically open l

the two main SVC circuit breakers to automatically disconnect the SVC from the 4.16-kV circuit in response to various SVC failure conditions. The SVC main circuit breakers are redundant for increased protection against breaker failure.

APPLICABLE As noted in the Bases for LCO 3.8.1, "AC Sources-Operating,"

SAFETY ANALYSES the initial conditions of DBA and transient analyses in the USAR assume ESF systems are OPERABLE. The AC electrical power sources, including the offsite electrical power (continued) 4 l

( 'CLINTON B 3.8-93 Revision No. 3-5

SVC Protection Systems B 3.8.11 BASES APPLICABLE sources, are designed to provide sufficient capacity, SAFETY ANALYSES capability, redundancy and reliability to ensure the (continued) ' availability of necessary power to ESF systems so'that the fuel, reactor coolant system, and containment design limits are not exceeded. The RAT and ERAT SVCs provide voltage support, when required, from the associated offsite source circuits to the ESF busses and equipment supplied by those circuits. At the same time, failure and risk analyses performed for the SVCs demonstrate that a protection system for each SVC is necessary to protect ESF equipment from potential SVC failure modes that could damage or de. grade the Class IE equipment. OPERABILITY of the SVC Protection Systems is thus consistent with minimizing the potential for SVC failures to damage or degrade required ESF equipment.

Probabilistic risk assessment has shown the SVC Protection Systems to be important for the protection of required ESF systems and equipment. Therefore, the SVC Protection Systems satisfy Criterion 4 of the NRC Policy Statement.

LC0 Both redundant protection subsystems of a required SVC protection system are required to be OPERABLE to ensure no single failure will preclude protection on a valid signal.

l Total SVC Protection System failure introduces the possibility of ESF equipment failure or degradation of ESF equipment connected or capable of being automatically connected to the busses supported by the SVC(s).

An SVC Protection System is considered OPERABLE when both l SVC protection subsystems are capable of automatically opening its associated SVC main circuit breaker in response to postulated SVC failures that could potentially degrade or damage ESF equipment. OPERABILITY of an SVC protection subsystem exists when it is energized and all essential components are OPERABLE, including the associated relays and sensors (e.g., current transformers and potential transformers).

~

i (continued) l l

l CLINTON B 3.8-94 Revision No. 3-5

i SVC Protection Systems !

B 3.8.11 !

BASES (continued) 1 APPLICABILITY An SVC Protection System must be OPERABLE whenever its associated SVC is in operation, i.e., whenever the SVC's ;

' associated offsite circuit is energized with the SVC l connected. Although the plant ESF busses are normally i aligned together and to either the RAT or ERM , an SVC Protection System must be OPERABLE if its associated SVC is connected to the associated auxiliary transfermer (RAT or ERAT); the transformer is energized by the of fsite network; and the transformer is supplying power to at least one ESF bus, or automatic transfer capability to that transformer exists such that it could supply power to at least one ESF bus.

t The requirements for the offsite electrical power sources are addressed in LCO 3.8.1, "AC Sources-Operating," and LC0 3.8.2, "AC Sources-Shutdown."

ACTIONS- M With one SVC protection subsystem of a required SVC Protection System inoperable, the inoperable subsystem must be restored to OPERABLE status within 30 days. With the SVC Protection System in this condition, the remaining subsystem ,

is adequate to provide the protection function. However, ;

the overall reliability of the SVC Protection System is I

reduced because a failure of the OPERABLE subsystem would result in a loss of the SVC failure protection function.

The 30-day Completion Time is based on the low probability of an SVC failure occurring during this time period, and the fact that the remaining subsystem can provide the required protection function.

M If both SVC protection subsystems of a required SVC Protection System are inoperable, the backup protection

! system designed for the SVC is unavailable to provide its protection function. Though not all failure modes of the SVC would necessarily be unprotected or potentially damaging to ESF equipment with the required protection system unavailable, there is a significant increase in calculated risk based on conservative failure assumptions for the SVCs.

Thus, at least one subsystem must be restored to OPERABLE i

(continued) l CLINTON B 3.8-95 Revision No. 3-5 i

SVC Protection Systems B 3.8.11

~

BASES ACTIONS M (continued) status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable, taking into account the low probabilit~y of an SVC failure occurring in this time period and the realistic potential for an SVC failure to adversely affect plant equipment.

C.1 If the required SVC protection subsystems cannot be restored to OPERABLE status within the required Completion Time, the SVC must be placed in a configuration for which the SVC Protection System LC0 does not apply. This is accomplished by disconnecting the associated SVC from the plant auxiliary power system by opening (at least one of) the SVC main circuit breakers. The Completion Time of one hour allows for an orderly disconnection of the SVC, including evaluation of the resultant impact on required voltage for the onsite ESF busses (i.e., for compliance with LC0 3.8.1, "AC Sources-Operating," or LC0 3.8.2, "AC Sources-Shutdown").

i SURVEILLANCE SR 3.8.11.1 REQUIREMENTS The SVC local control panel is checked to confirm satisfactory operation of the SVC Protection System (s). i This includes verifying that no warning or trouble lights i that could be indicative of SVC Protection System !

degradation are present, and checking the overall condition ,

and/or status of relays to qualitatively confirm satisfactory operation of the SVC and SVC Protection System. I The 24-hour Frequency is based on manufacturer's i recommendations.

SR 3.8.11.2 A system functional test of each SVC Protection System is performed to ensure that each SVC protection subsystem will actuate to automatically open the associated SVC's main l

circuit breakers in response to signals associated with SVC failure modes that could potentially damage or degrade plant (continued)

CLINTON B 3.8-96 Revision No. 3-5

_ . . .. m _ . _ . _ _ _ . _ . _ _ _ _ _ . _ . _ . . _ . . - _ . . _ _ _ . . _ _ . _ _ _ . _ _ _ _. __

SVC Protection Systems l

B 3.8.11 BASES l

SURVEILLANCE SR 3.8.11.2 .(continued) ,

REQUIREMENTS !

equipment. System functional testing should thus l'

' include satisfactory operation of the associated relays and testing of the sensors for which failure modes would be undetected. As a minimum, SVC protection subsystem actuation capability should be verified for response to signals, actual or simulated, corresponding to the following L potential SVC failure modes or conditions:

(1) Overvoltage (2) Undervoltage

, (3) . Phase Unbalance

(4) Harmonics (5) Overcurrent The 18-month Frequency is based on manufacturer's l recommendations.

REFERENCES 1. 10CFR50, Appendix A, GDC 17.

l

2. USAR, Chapter 8.

i I l

l l

l L !

i I

I i

l d

CLINTON B 3.8-97 Revision No. 3-5

.

ML20196A150

Text

Navigation menu

Search