Text

Proposed Tech Specs,Providing Revs to CR-3 Improved TS Bases That Update NRC Copies of Improved TS
	ML20203D161
Person / Time
Site:	Crystal River
Issue date:	02/20/1998
From:	; FLORIDA POWER CORP.
To:	;
Shared Package
ML20203D158	List: 3F0298-24, Forwards Rept of Changes Made to Improved TS Bases,Per Improved TS 5.6.2.17; ML20203D161;
References
	NUDOCS 9802250364
	Download: ML20203D161 (204)
	v • d • e

_ . _ _ , _ _ _ _ . _ _ . . _ _ _ , _ _ _ . _ . _ _ . _ _ _ _ . . . _ _ _ . _ . _ _ - . _ _ _ _ . . _ _ _ _ _ . _ _ _ _ . . . . _ . . _ - _ _ _ _ _ ,

+. .

}

s i

, - U.S. Nuclear Regulatory Commission - Attachment C. !

3F0293 24 - l 5

1 g,

-l

,. y A

t ,

I i

t' J

4 f--

i 11-1 l -

ATTACHMENT C ,

f- REPLACEMENT PAGES -

L TABLE OF CONTENTS AND ha BASES PAGES J

e l

k~

i J

i I 5

4 4

h-._

t r .c

'4 >

M**Ran M*ih2 j P

S

TABLE OF CONTENTS O 3.3 INSTRUMENTATION (continued) 3.2.11 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation . . . . . . . . . . 3.3-26

-3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation ............ 3.3-30 3.3.13 Emergency feedwater Initiation and Control (EFIC) Automatic Actuation Logic ........ 3.3-32

3. 3. l'e Emergency Feedwater Initiation and Con. trol (EFIC)-Emergency feedwater (EFW)-Vector Val ve Log i c . . . . . . . . . . . . . . . . . . . 3.3-34 3.3.15 Reactor Building (RB) Purge Isolation-High Radiation . . . . . . . . . . . . . . . . . . . . 3.3-35 3.3.16 Control Room Isolation-High Radiation . . . . . . . 3.3-36 3.3.17 Post Accident Monitoring (PAM) Instrumantation . . . 3.3-38 3.3.18 Remote Shutdown System . . . . . . . . . . . . . . . 3.3-42 3.4 REACTOR COOLANT SYSTEM (RCS) . . . . . . . . . . . . . . 3.4-1 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits ....... 3.4-1 3.4.2 RCS Minimum Temperature for Criticality ...... 3.4-3 3.4.3 RCS Pressure and Temp,trature (P/T) Limits ..... 3.4-4 3.4.4 RCS Loops-MODE 3 ................. 3.4-6 3.4.5 RCS Loops-MODE 4 ................. 3.4-8 3.4.6 RCS Loops-MODE 5, Loops Filled .......... 3.4 10 A 3.4.7 RCS Loops-MODE 5, Loops Not Filled ........ 3.4-13 V_ 3.4.8 Pressurizer ............. ,,.... 3.4-15 3.4.9 Pressurizer Safety Valves ............. 3.4-17 3.4.10 Pressurizer Power Operated Relief Valve (PORV) . . . 3.4-19 3.4.11 Low Temperature Overpressure Protection (LTOP) System ................... 3.4-21 3.4.12 RCS Operational LEAKAGE ,............. 3.4-22 3.4.13 RCS Pressure Isolation Valve (PIV) Leakage . . . . . 3.4-24 3.4.14 RCS Leakage Detection Instrumentation ....... 3.4-27 3.4.15 RCS Specific Activity ............... 3.4-30 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) ......... 3.5-1 .

3.5.1 Core Flood Tanks (CFis) .............. 3.5-1 3.5.2 ECCS-0)erating .................. 3.5-4 3.5.3 ECCS-S iutdown . . . . . . . . . . . . . . . . . . . 3.5-7 3.5.4 Borated Water Storage Tank (BWST) ......... 3.5-9 3.6 CONTAINMENT SYSTEMS .................. 3.6-1 3.6.1 Containment .................... 3.6-1 3.6.2 Containment Air Locks ............... 3.6-3 3.6.3 Containment Isolation Valves . . . . . . . . . . . . 3.6-8 3.6.4 Containment Pressure . . . . . . . . . . . . . . . . 3.6-15 3.6.5 Containment Air Temperature ............ 3.6-16

.O (coati"#ed)

Crystal River Unit 3 11 Amendment No. 161

TABLE OF CONTENTS in Y

3.6 CONTAINMENT SYSTEMS (continued) 3.6.6 Reactor Building Spray and Containment Cooling Systems . . . . . . . . . . . . . . . . . 3.6-17 3.6.7 Containment Emergency Sump pH Control System (CPCS) . . . . . . . . . . . . . . . . . . 3.6-21 3.7 PLANT SYSTEMS .......... ........... 3.7-1 3.7.1 Main Steam Safety Valves (MSSVs) . . . . . . . . . . 3.7-1 3.7.2 Main Steam Isolation Valves (MSIVs) ........ 3.7-4 3.7.3 Main Feedwater Isolation Valves (MFlys) ...... 3.7-6 3.7.4 Turbine Bypass Valves (TBVs) . . . . . . . . . . . . 3.7-8 3.7.5 Emergency Feedwater (EFW) System . . . . . . . . . . 3.7-9 3.7.6 Emergency Feedwater (EFW) Tank. .......... 3.7-13 3.7.7 Nuclear Services Closed Cycle Cooling Wa t e r ( SW) Sy s t e.a . . . . . . . . . . . . . . . . 3.7-15 3.7.8 Decay Heat Closed Cycle Cooling Water l (DC) System . .................. 3.7-17 3.7.9 Nuclear Services Seawater System . . . . . . . . . . 3.7-19 3.7.10 Decay Heat Seawater System . . . . . . . . . . . . . 3.7-21 3.7.11 Ultimate Heat Sink (VHS) . . . . . . . . . . . . . . 3.7-23 3.7.12 Control Room Emergency Ventilation System (CREVS) ................. 3.7-24 3.7.13 Fuel Storage Pool Water Level ........... 3.7-27 3.7.14 Spent fuel Pool Boron Concentration ........ 3.7-28 O 3.7.15 Spent fuel Assembly Storage ............ 3.7-30 V 3.7.16 Secondary Specific Activity ............ 3.7-34 3.7.17 Steam Generator Level ............... 3.7-35 3.7.18 Control Complex Cooling System . . . . . . . . . . . 3.7-37 l 3.8 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . 3.8-1 3.8.1 AC Sources-0perating ............... 3.8-1 3.8.2 AC Sources-Shutdown . . . . . . . . . . . . . . . . 3.8-11 3.8.3 Diesel fuel Oil, Lube Oil, and Starting Air .... 3.8-14 3.8.4 DC Sources-0perating ............... 3.8-17 3.8.5 DC Sources-Shutdown . . . . . . . . . . . . . . . . 3.8-21 3.8.6 Battery Cell Parameters .............. 3 . 53 - 2 3 3.8.7 Inverters-0perating . . . . . . . . . . . . . . . . 3.8-27 3.8.8 Inverters--Shutdown ................ 3.8-29 3.8.9 Distribution Systems-Operating .......... 3.8-31 3.8.10 Distribution Systems-Shutdown . . . . . . . . . . . 3.S-33 3.9 REFUELING OPERATIONS . . . . . . . . . . . . . . . . . . 3.9-1 3.9.1 Boron Concentration ................ 3.9-1 3.9.2 Nuclear Instrumentation .............. 3.9-2 3.9.3 Containment Penetrations . . . . . . . . . . . . . . 3.9-4 3.9.4 Decay Heat Removal (DHR) and Coolant Circulation-High Water Level . . . . . . . . . . 3.9-6 ij (continued)

Crystal River Unit 3 iii Amendment No. 163

TABLE OF CONTENTS O

v 3.3 INSTRUMENTATION (continued)

B 3.3.12 Emergency feedwater Initiation and Control (EFIC) Manual Initiation ........... B 3.3-100 8 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic ................. B 3.3-105 B 3.3.14 Emergency Feedwater Initiation and Control (EFIC)-Emergency feedwater (EFW)-Vector Valve Logic . . . . . . . . . . . . . . . . . . B 3.3-110 B 3.3.15 Reactor Building (RB) Purge Isolation-High Radiation . . . . . . . . . . . . . . . . . . . B 3.3-114 8 3.3.16 Control Room Isolation-High Radiation . . . . . . B 3.3-119 8 3.3.17 Post Accident Monitoring (PAM) Instrumentation . . B 3.3-124 B 3.3.18 Remote Shutdown System . . . . . . . . . . . . . . B 3.3-145 B 3.4 REACTOR COOLANT SYSTEM (RCS) . . . . . . . . . . . . . . B 3.4-1 B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits . . . . . . . B 3.4-1 B 3.4.2 RCS Minimum Temperature for Criticality . . . . . . B 3.4-6 B 3.4.3 RCS Pressure and Temperature (P/T) Limits , . . . . B 3.4-9 B 3.4.4 RCS Loops-MODE 3 . . . . . . . . . . . . . . . . . B 3.4-17 B 3.4.5 RCS Loops-MODE 4 . . . . . . . . . . . . . . . . . B 3.4-22 B 3.4.6 RCS Loops-MODE 5, Loops Filled . . . . . . . . . . B 3.4-27 8 3.4.7 RCS Loops-MODE 5, Loops Not Filled . . . . . . . . B 3.4-33 fT B 3.4.8 Pressurizer . . . . . . . . . . . . . . . . . . . . B 3.4-37 O B 3.4.9 Pressurizer Safety Valves . . . . . . . . . . . . . B 3.4-43 B 3.4.10 Pressurizer Power Operated Relief Valve (PORV) . . . B 3.4-47 8 3.4.11 Low Temperature Overpressure Protection (LTOP) System . . . . . . . . . . . . . . . . . . . B 3.4-52 B 3.4.12 RCS Operational LEAKAGE . . . . . . . . . . . . . . B 3.4-53 8 3.4.13 RCS Pressure Isolation Valve (PIV) Leakage . . . . . B 3.4-58 8 3.4.14 RCS Leakage Detection Instrumentation . . . . . . . B 3.4-65 8 3.4.15 RCS Specific Activity . . . . . . . . . . . . . . . B 3.4-71 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) . . . . . . . . . B 3.5-1 B 3.5.1 Core Flood Tanks (CFTs) . . . . . . . . . . . . . . B 3.5-1 B 3.5.2 ECCS-Operating . . . . . . . . . . . . . . . . . . B 3.5-9 B 3.5.3 ECCS-Shutdown . . . . . . . . . . . . . . . . . . . B 3. 5-19 8 3.5.4 Borated Water Storage Tank (BWST) . . . . . . . . . B 3.5-23 B 3.6 C0lC INMENT SYETEMS . . . . . . . . . . . . . . . . . . B 3.6-1 B 3.6.1 Containment . . . . . . . . . . . . . . . . . . . . B 3.6-1 B 3.6.2 Containment Air Locks . . . . . . . . . . . . . . . B 3.6-7 B 3.6.3 Containment Isclation Valves . . . . . . . . . . . B 3.6-16 8 3.6.4 Containment Pressure . . . . . . . . . . . . . . . . B 3.6-30 B 3.6.5 Containment Air Temperature . . . . . . . . . . . . B 3.6-33 8 3.6.6 Reactor Building Spray and Containment Cooling Systems . . . . . . . . . . . . . . . . . B 3.6-36 n

U (continued)

Crystal River Unit 3 vi Amendment No. 161

TABLE OF CONTENTS O .B 3.6 CONTAINMENT SYSTEMS (continued)

B 3.6.7 Containment Emergency Sump pH Control (CPCS) . . . . B 3.6-47 B 3.7 PLANT SYSTEMS . . . . . . . . . . . . . . . . . . . . . B 3.7-1 B 3.7.1 Main Steam Safety Valves (MSSVs) . . . . . . . . . . B 3.7-1 B 3.7.2 Main Steam isolation Valves (MSIVs) . . . . . . . . B 3.7-7 B 3.7.3 MainfeedwaterIsolationValves(MFIVs) . . . . . . B 3.7-13 B 3.7.4 Turbine Bypass Valves (TBVs) . . . . . . . . . . . . B 3.7-19 B 3.7.5 Emergency Feedwater (ErW) System . . . . . . . . . . B 3.7 23 1 B 3.7.6 Emergency Feedwater Tank (EFT-2) . . . . . . . . . . B 3.7-32 2

-B 3.7.7 Nuclear Services Closed Cycle Coo'iing Water System (SW) . . . . . . . . . . . . . . . . B 3.7-36 8 3.7.8 Decay Heat Closed Cycle Cooling Water System . . . . B 3.7-41 B 3.7.9 Nuclear Services Seawater System . . . . . . . . . . B 3.7-46 B 3.7.10 Decay Heat Seawater System . . . . . . . . . . . . B 3.7-51 B 3.7.11 Ultimate Heat Sink (VHS) . . . . . . . . . . . . . . B 3.7-56 B 3.7.12 Control Room Emergency Ventilation System (CREVS) . . . . . . . . . . . . . . . . . B 3.7-60 B 3.7.13 Fuel Storage Pool Water Level . . . . . . . . . . . B 3.7-66 B 3.7.14 Spent Fuel Pool Boron Concentration , . . . . . . . B 3.7-69 B 3.7.15 Spent Fuel Assembly Storage . . . . . . . . . . . . B 3.7-72 B 3.7.16 Secondary Specific Activity . . . . . . . . . . . . B 3.7-77

. B 3.7.17 Steam Generator Level . . . . . . . . . . . . . . . B 3.7-81 B 3.7.18 Control- Complex Cooling System . . . . . . . . . . . B 3.7-85 l

.O V

B 3.8 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . B 3.8-1 B 3.8.1 AC Sources-Operating . . . . . . . . . . . . . . . B 3.8-1 AC Sources-Shutdown . . . . . . . . . . . . . . . . B 3.8-24 B 3.8.2 8 3.8.3 Diesel Fuel Oil, Lube 00, and Starting Air . . . . B 3.8 30 B 3.8.4 DC Sources-Operating . . . . . . . . . . . . . . . B 3.8-39 B 3.8.5 DC Sources-Shutdown . . . . . . . . . . . . . . . . B 3.8-49 8 3.8.6 Battery Cell Parameters . . . . . . . . . . . . . . B 3.8 52 B 3.8.7 Inverters-Operating . . . . . . . . . . . , . . . B 3.8-59 B 3.8.8 Inverters-Shutdown . . . . . . . . . . . . . . . . B 3.8-64 B 3.8.9 Distribution Systems-Operating . . . . . . . . . . B 3.8-67 B 3.8.10 Distribution Systems-Shutdown . . . . . . . . . . . B 3.8-77 B 3.9 REFUELING OPERATIONS . . . . . . . . . . . . . . . . B 3.9-1 B 3.9.1 Boron Concentration . . . . . . . . . . . . . . . . B 3.9-1 B 3.9.2 Nuclear Instrumentation . . . . . . . . . . . . . . B 3.9-5

-B 3.9.3 Containment Panetrations . . . . . . . . . . . . . . B 3.9-9 8 3.9.4 Decay Heat Reraval (DHR) and Coolant Circulaticn-High Water Level . . . . . . . . . . B 3.9-14 B 3.9.5 Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level ... . . . . . . B 3.9-18 B 3.9.6 Refueling Canal Water Level . . . . . . . . . . . . B 3.9-23 m

~

b Crystal River Unit- 3 vii Amendment No. 163

SR Applicability B 3.0 B 3.0 SURVEILLANCEREQUIREMENT(SR) APPLICABILITY

' (,.-)

BASES SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LC0 apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:

a. The systems or companents are known to be inoperable, f')

v although still meeting the SRs; c r

b. The requirements of the Surveillance (s) are known not to be met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a PHYSICS TEST Exception LC0 are only applicable when the PHYSICS TEST Exception LC0 is used as an allowable exception to the requirements of a Specification.

Jurveillances, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. SRs have to be met in accordance with SR 3.0.2 prior to returning equipment to OPERABLE status.

Upon s $pletion of maintenance, appropriate post maintenaace testing is required to declare equipment OPERABtE. This includes meeting applicable SRs in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified (g. ,! (continued)

Crystal River Unit 3 B 3.0-16 Amendment No. 149

SR Applicability B 3.0 BASES SR 3.0.1 conditions in the Applicability due to the necess ry unit (continued) parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has beer, satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow o)eration to proceed to a MODE or other specified condition w1ere other necessary post maintenance tests can be completed.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the s_n ecified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic periormance of the Required Action cr. a "once per..."

interval.

SR 3.0.2 permits a 25% extension of the interval r,pecified in the Freq micy. This extension facilitates Surveillance scheduling and considers plant o)erating conditions that may not be suitable for conducting tie Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. ine requirements of regulations take precedence over the TS. Therefore, when a t t interval is specified in the regulations, the test interval cannot be extended by the TS, and the SR include a Note in the Frequency stating, "SR 3.0.2 is not applicable."

An example of an exception when the test interval is not specified in the regit ations is the NOTE in the Containment Leakage Rate Testing Program, "SR 3.0.2 is not applicable."

This exception is provided because the program already includes extension of test interval As stated in SR 3.0.2, the 25% extension also does not a) ply to the initial portion of a periodic Completion Time tlat requires perfonaance on a "once per..." basis. The (continued) h Crystal River Unit 3 B 3.0-17 Amendment No. 156

i CRD Trip Devices )

B 3.3.4 ,

1 O

'q) BASES ACTIONS E.1 and C,1 (continued)

If the Required Actions of Condition A, B, or C are not met within the associated Completion Time while the plant is in MODE 4 or 5, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, all CRD trip breakers must be opened or all power to the CRDCS removed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operathg experience, to open all CRD trip breakers or remove all power to the CRDCS without challenging plant systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS SR 3.3.4.1 is a CHANNEL FUNCTIONAL TEST to the CRD trip devices once every 31 days. This test verifies the OPERABILITY of the trip devices by actuation of the end devices. Also, this test independently verifies the undervoltage and shunt trip mechanisms of the CRD trip breakers. The frequency of 31 days is based on operating O experience, which has demonstrated that failure of more than one trip device in any 31 day interval is unlikely.

REFERENCES 1. FSAR, Chapter 7.

p C

Crystal River Unit 3 B 3.3-43 Amendment No. 149

ESAS Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION h B 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation i

BASES I

BACKGROUND The ESAS initiates Engineered Safeguards (ES) Systems, based on the values of selected plant parameters, to protect core ,

design and reactor coolant pressure boundary limits and to l mitigate accidents. I ESAS actuates the following:

a. High Pressure Injection (HPI);

b. Low Pressure Injection (LPI);

c. Reactor Building (RB) Isolation and Cooling;

d. RB Spray; )

e. Emergency Diesel Generator (EDG) Start; and

f. Control complex normal recirculation. g ESAS also provides two signals to the Emergency Feedwater Initiation and Control (EFIC) System. One signal initiates emergency feedwater (EFW) when an actuation of HPI Channel A and HPI Channel B is present. The other functions to trip the motor driven emergency feedwater pump when an RCS Pressure-Low Low initiation coincident with a loss of offsite power is present.

This trip signal may be manually defeatej in certain small break LOCA scenarios. Assuming the single failure of the turbine driven feedwater pump or associated flow path in such circumstances, defeating this trip signal would maintain steam generatot cooling with the motor N driven emergency feedwater pug . Prior to defeating the trip signal, sufficient capability on the emergency diesel generators to power the required loads would be established as discussed in the BASES for Technical Specification 3.7.5.

(continued) h Crystal River Unit 3 0 3.3-44 Amendment No. 163 NOTE - Valid until Cycle 12 Only

ESAS Instrumentation.

B 3.3.5 (f BASES BACKGROUND The ESAS operates in a distributed manner to initiate the-(continued) appropriate systems. The ESAS does this by monitoring RCS

' pressure actuation parameters in each of three channels and RB pressure actuation in each of six channels (3 per actuationtrain). Once the setpoint for actuation-is reached, the signal is transmitted to automatic actuation logics, which perform the two-out-of-three logic. for actuation of each end device. However, all actomatic ;

actuation logics receive signalt from the same channels for each parametar.

4 Four parameters are used for actuation:

a. Low Reactor Coolant System (RCS) Pressure; o

{-

4 1

1 4

(continued)-

/

Crystal River 011t L3 8 3.3-44A Amendment No. 163

ESAS Instrumentation B 3.3.5 BASES $

THIS PAGE INTENTIONALLY LEFT BLANK (continued) h l

l Crystal River Unit 3 B 3.3-44B Amendment No, 163 I

ESAS Inctrumentation '

I i B 3.3.5

. O 8^sts BACKGROUND Reactor Coolant System Pressure (continued)

The outputs of the three channels trip bistables, associated with the low RCS pressure (1500 psig) actuate bistable trip

auxiliary relays in two sets (actuation trains A and B) of identical and independent trains. The two HPI trains each l

use three logic channels arranged in two out-of three 4 coincidence networks. 1he outputs of the three bistables j associatedwiththelowLowRCSPressure(500psig) actuate bistable trip auxiliary relays in two sets (actuation trains A and B) of identical and independent trains. The two LPI i trains each use three logic channels arranged in two-out-of-three coincidenn networks for LPI Actuation. The outputs of the three Low Low 'tCS Pressure bistables also trip the automatic actuation relays, via a LPI bistable trip auxiliary relay, in the corresponding HPI train as ,

, previously described.

4 Reactor Buildina Pressure ESAS RB pressure signal information is provided by

. (3 12 pressure switches. Six pressure switches are used for U the High RB Pressure Parameter, and six pressure switches

are used for the High High RB Pressure Parameter.

The output contacts of six High RB Pressure switches are used in two sets of identical and independent actuation

, trains. These two trains each use three logic channels.

The outputs of these channels are used in two out-of-three coincidence networks. The output contacts of the six RB pressure switches also trip, via a pressure switch trip

, auxiliary relay, the automatic actuation relays in the corresponding HPl and LPI trains as previously described.

The output contacts of six High High RB Pressure switches are used in two sets of identical and independent actuation trains. The outputs of the High High RB Pressure switches are used in two-out-of-three coincident networks for RB Spray Actuation. The two-out of three logic hssociated with each RB Spray train actuates spray pump operation when the High-High RB signal and the HPI signal are coincident in that train.

D v

(continued)

Crystal River Unit-3 B-3.3-47 Revision No. 11

ESAS lastrumentation B 3.3.5 BASES (continued) g APPLICABLE Accident analyses rely on automatic ESAS actualion for SAFETY ANALYSES protection of the core temperature and containment pressure limits and for limiting off site dose levels following an accident. These include LOCA, SLB, and feedwater line break events that result in RCS inventory reduction or severe loss of RCS cooling.

The following ESAS Functions are assumed to operate to mitigate design basis accidents.

Hiah Pressure in.iection The ESAS actuation of HPI has been assumed for core cooling in the small break LOCA analysis and is credited in the SLB analysis for the purposes of adding boron and negative reactivity. HFI is also credited in the Steam Generator Tube Rupture (SGTR) accident analysis.

Manual actuation of HPI may be relied upon whenever ESAS si nal are bypassed during heatup or cooldown, or when in Ho e 4.

Low Pressure Iniection The ESAS actuation of LPI has been assumed for large break LOCAs. $

Manual actuation of HPI may be relied upon whenever ESAS sicnal are bypassed during heatup or cooldown, or when in Moc e 4.

Reactor 3u

c na Sorav. Reactor Buildino Coolina, and Reactor 3u< c na Isolati2D ESAS actuation of the RB coolers and RB 3 pray is credited in RB analysis for LOCAs, both for RB performance and equipment environmental qualification pressure and temperature envelope definition. Accident dose calculations credit RB Isolation and RB Spray.

Emeraency Diesel Generator Start The ESAS initiated EDG Start has been assumed in the LOCA analysis to ensure that emergency power is available throughout the limiting LOCA scenarios.

The small and large break LOCA analyses assume a conservative 35 second delay time for the actuation of HPI (continued) h Crystal River Unit 3 8 3.3-48 Revision No. 16

ESAS Manual Initiation B 3.3.6 O B32 instauac">^ tion 4 B 3.3.6 Engineered Safeguards Actuation System (ESAS) Manual Initiation 4

t BASES i BACKGROUND The ESAS manual initiation ca) ability allows the operator to actuate ESAS Functions from tie main control room in the

absence of any other initiation condition. Functions capable of being manually actuated include High Pressure Injection, low Pressure injection, and Reactor Building (RB)

Isolation and Cooling.

i This LCO covers only the system level manual initiation of these functions. LCO 3.3.5, " Engineered Safeguards Actuation System (ESAS) Instrumentation," and LCO 3.3.7, "EngineeredSafeguardsActuationSystem(ESAS) Automatic Actuation Logic," provide requirements on the portions of the ESAS that automatically initiate the F9nctions described earlier.

A manual trip push button is provided on the ES panel of the main control board for each function for each actuation A train. Operation of the push button energizes relays whose V contacts perform a logical "0R" function with the matrices l of the automatic actuation logic, except for the matrices

< which are part of the ES buses loading sequence. Manual

, actuation of the ES buses loading sequence is made by l de energizing the block timers and the time delay auxiliary '

relays. The power supply for the manual trip relays is taken from the station batteries. Different batteries are i used for the two trains.

4 The ESAS manual initiation channel is defined as the instrumentation between the console switch and the automatic actuation logic, (not to include the AAL) which actuates the end devices. Other means of manual initiation, such as

, controls for individual ES devices, may be available in the J

control room and other plant locations. These alternative i

means are not required by this LCO, nor are they credited to fulfill the requirements of this LCO.

The most notable example of a manual initiation not addressed by the Technical Specification is Reactor Building Spray. The manual actuation of the Reactor Building Spray was designed to be done in two steps. The first step is the (continued)

Crystal River Unit 3- B 3.3-57 Revision No. 7

}

ESAS Manual Initiation B 3.3.6 BASES $; ;

BACKGROUND manual actuation of the Reacter Building isolation and !

(continued) Coolin to open the valves and the second step is the manual :

actuat on of the Reactor Building Sr+a s. Since Reactor Building Spray pumps have ti,di '

i control switches on the control board, separate ESAS manual actuation switches were not provided. This logic scheme '

relies on the individual Reactor Building Spray pump control switches to meet the requirements of section 4.17 of proposed IEEE 279 dated August 30, 1968 (FSAR section 7.1.1).

APPLICABLE The ESAS manual initiation function is a backup to automatic SAFETY ANALYSES initiation and allows the operator to initiate ES Systems operation whenever plant conditions dictate. The manual initiation function is not assumed or credited in any accident analysis. However, manual actuation of ECCS is assumed for accident mitigation when the FSAS signals are bypassed during heatup or cooldown, or when in Mode 4.

The ESAS manual initiation instrumentation functions are included in Technical Specifications even though they do not strictly satisfy any Criterion of the NRC Policy Statement.

g LCO Two manual initiation channels of each ESAS Function are required to be OPERABLE whenever conditions exist that could require ES protection of the reactor or RB. Two OPERABLE channels ensure that no single failure will prevent system level manual initiation of at least one train of any ESAS function. The ESAS manual initiation Function allows the operator to initiate protective action prior to automatic iritiation or in the event the automatic initiation does not occur.

APPLICABILITY The ESAS manual initiation Functions shall be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the associated Engineered Safeguard equipment is required to be OPERABLE.

The manual initiation channels are required consistent with the requirements for ES Functions to provide protection in these MODES. In MODES 5 and 6, accidents are slow to develop and would be mitigated by manual operation of individual components. Adequate time is available to evaluate plant conditions and to respond by manually operating the ES components, if required.

(continued)

Crystal River Unit 3 8 3.3-58 Revision No. 16

i ESAS Automatic Actuation logic l B 3.3.7 h B 3.3 INSTRUMENTATION B 3.3.7 EngineeredSafguardsActuationSystam(ESAS) Automatic Actuation Logic i

BASES BACKGROUND The automatic actuation logic channels of ESAS include the logic between the bistable or pressure switch trip auxiliary relays and the ES equipment. It does not include the manual actuation auxiliary relay contacts which are addressed separately as part of LC0 3.3.6 "ESAS Manual Initiation."

Each of the components actuated by the ESAS Functions has an associated automatic actuation logic matrix. Certain end devices, prim'arily valves, are actuated by both A and B train actuation signals and have two associated automatic actuation logic matrices, if two out of-three ESAS instrumentation channels indicate an initiation signal, the automatic actuation logic is activated and the associated component is actuated. The purpose of requiring OPERABILITY of the ESAS automatic actuation logic is to ensure that Engineered Safeguards (ES) Functions will automatically initiate in the event of an accident requiring them.

O auto tic ctuatio" or so e ruactio"> is aece==>rs to prevent exceeding the Emergency Core Cooling Systems (ECCS) acceptancecriteriain10CFR50.46(Ref.1). It should be noted that OPERABLE automatic actuation logic channels alone will not ensure that each Function can be performed; the instrumentation channels and actuated equipment associated with each function must also be OPERABLE to ensure that the Functions can be automatically initiated during an accident.

This LCO covers only the automatic actuation logic that initiates the functions listed. LC0 3.3.5, " Engineered SafeguardsActuationSystem(ESAS) Instrumentation,"and LC03.3.6,"EngineeredSafeguardsActuationSystem(ESAS)

Hanual Initiation," address the requirements for the instrumentation and manual initiation channels that input to the automatic actuation logic.

The ESAS, in conjunction with the actuated end device equipment, provides protective functions necessary to mitigate Design Basis Accidents (DBAs). The ESAS relies on the OPERABILITY of the automatic actuation logic for each component to perform the actuation of the required systems, h (continued)

Crystal River Unit'3 8 3.3 61 Amendment No. 149

ESAS Automatic Actuation logic l l

B 3.3.7 BASES (continued) h APPLICABLE Accident analyses rely on automatic ESAS actuation for SAFETY ANALYSES protection of the core and RB and for limiting off-site doses following an accident. The accidents postulated include LOCA, SLB, and feedwater line break events that result in Reactor Coolant System (RCS) inventory reduction or severe loss of RCS cooling.

As the automatic actuation logic is part of the success path th for for assuring ES actuation ES is applicable to t $em,e safetyAanalysis as well. for the need more detailed description of this accident analysis is found in the Bases for LCO 3.3.5 "ESAS Instrumentation" and in Chapter 14 of the FSAR (Ref,. 2).

The ESAS automatic actuation logics satisfy Criterion 3 of the NRC Policy Statement.

LC0 The automatic actuation logic matrix for each com)onent actuated by the ESAS is required to be OPERABLE wienever conditions exist that could require ES protection of the reactor or the RB. This ensures ES Systems will be automatically initiated as required, to mitigate the consequences of accidents. Hatrices not performing a safety function this LCO.(e.g., alarms and interlocks) are not addressed by Manual actuation of ECCS may be relied upon whenever ESAS signals are bypassed during heatup or cooldown, or when in Mode 4.

APPLICABILITY ESAS automatic actuation logic shall be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the associated Engineereo because Safeguard (ES)are ES Functions equipment is required designed to be to provide OPERABLE,hese protection in t MODES. Automatic actuation in MODE 5 or 6 is not required because accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components. Adequate time is available to evaluate plant l conditions and respond by manually operating the ES components, if required.

ACTIONS A Note has been added to the ACTIONS indicating separate Conditicn entry is allowed for each ESAS automatic actuation 1

logic matrix.

{ (continued) h Crystal River Unit 3 B 3.3-62 Revision No. 16

EDG LOPS B 3.3.8 O 8ASES ACTIONS L1 (continued) l Condition C is the default Condition should Required Action A.1 or B.1 not be met within the associated Completion Time.

Required Action C.) ensures that Required Actions for i

affected diesel generator inoperabilities are initiated. ;

Depending on MODE, the Actions specified in LCO 3.8.1, "AC Sources-Operating," or LCO 3.8.2, are required to be entered immedi tely.

SVRVEILLANC SR 3.3.8d REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each required EDG LOPS channel to ensure the entire channel will perform the intended function. This test ensures functionality of each channel to output relays. !

' The Frequency of 31 days is considered reasonable based on the reliability of the components and on operating

] experience.

A temporary extension of the frequency has been made to indicate "31 days or 60 days" as the frequency. This temporary condition applies to a one time performance of the surveillance on each diesel generator and will not be effective after November 23, 1997. The need for this temporary extension of the frequency became evident during replacement of the radiator on the EDGs. This activity had a minimum duration of 42 days, which was in excess of the 31 day frequency. Performance of the surveillance on one EDG with the other EDG inoperable because of the radiator replacement was considered as not the safest and most prudent course of action. A note has been added to the frequency to indicate that the 60 day frequency is not i effective after November 23, 1997.

A Note has been added to allow performance of the SR without taking the ACTIONS for an inoperable instrumentation channel although during this time period the relay instrumentation cannot initiate a diesel start. This allowance is based on the assumation that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to perform c1annel Surveillance. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months testing allowance does not significantly reduce the availability of the EDG.

(continued)

Crystal River Unit 3 B 3.3-71 Amendment No. 157

EDG LOPS E 3.3.8 BASES h SURVEILLANCE SR 3.3.8.2 REQUIREMENTS (continued) A CHANNEL CAllBRATION is a complete check of the instrument channel, including the sensor. The setpoints and the response to a loss of voltage and a degraded voltage test shall include a single point verification that the trip i occurs within the required delay time, as shown in l Reference 2. .

l The 18 month Frequency is based on operating experience and l industry-accepted practice.

A Note has been added indicating the voltage sensing device (bus potential transformer) may be excluded from testing since these transformers are passive, inherently stable devices which cannot be calibrated. In the event of transformer failure, the corresponding degraded voltage or loss of voltage relays would trip on low voltage, actuating the associated channel (i.e., the channels fail in the safe condition). In addition, annunciation of failure of a single transformer or associated circuits would be provided via the channel monitor relay, identifying to the operator a failure within the loss of voltage or degraded voltage channels. g REFERENCES 1. FSAR, Chapter 14.

2. FSAR, Section 8.3.

1 I

O Crystal River Unit 3 8 3.3-72 Amendment No. 157

r EFIC Instrumentation

- B 3.3.11 O BASES APPLICABLE 3, 4. liain Steam Line and MFW isolation (continued)

SAFETY ANALYSES

)'

trip and following EFIC installation considered the isolation functions occurring on OTSG pressure

< 600 psig as backup. Since these isolation functions

. would currently be provided by the safety grade EFIC System, use of the EFIC System in the original safety analysis would have been consistent with the licensing

)osition allowing mitigative functions to be performed

)y safety grade systems in accident analysis. For i

these reasons, the SLB accident analysis remains conservative with the assumed Integrated Control

! System actions.

4 The EFIC System satisfies Criterion 3 of the NRC Policy i Statement.

LCO All instrumentation performing an EFIC System Function listed in Table B 3.3.11-1 shall be OPERABLE. Four channels are required OPERABLE for all Efic instrumentation channels O to ensure that no single failure prevents actuation of a train. Each EFIC instrumentation channel is considered to j include the sensors and measurement channels for each Function, the operational bypass switches, and permissives.

Failures that disable the ca) ability to place a channel in operational bypass, but whic1 do not disable the trip Function, do not render the protection channel inoperable.

The Bases for the LCO requirements of each specific EFIC function are discussed next.

Loss of MFW Pumos Four EFIC channels shall be OPERABLE with MFW pump turbines A and B control oil low pressure actuation setpoints of > 55 psig. The 55 psig setpoint is about half of the normal o)erating control oil 3ressure. The 55 pnig '

setpoint Allowaale Value appears to 1 ave been arbitrarily chosen as a good indication of the loss of MFW Pumps.

Analysis only assumos Loss of MFW Pumps and a specific value of MFW pump control oil pressure is not used in the analysis. Further, since the setpoint is so much less than (continued)

Crystal River Unit 3 B 3.3-91 Revision No. 7

EFIC Instrumentation B 3.3.11 BASES g LCO Loss of HFW Pumoi (continued) operating control oil pressure, instrument error is not a consideration. The Loss of MFW Pumps function includes a bypass enable and removal function utilizing the same bistable and auxiliary relay used in the NI/RPS bypass reactor trip on loss of both MFW pumps. However, the EFIC bypass is a logic requiring neutron flux to be < 20% RTP lad the RPS to be in shutdown bypass. Practically s)eaking, the status of the bypass is strictly a function of tie RPS shutdown bypass (i.e., required to be OPERABLE down into MODE 3).

OT5G Level-Low Four EFIC dedicated low range level transmitters per OTSG shall be OPERABLE with OTSG Level-Low actuation set?oints of 2 0 inches indicated (6 inches above the top of t1e bottom tube sheet), to generate the signals used for detection for low level conditions for EFW Initiation.

There is one transmitter for each of the four channels A, B, C, and D. The signals are also used after EFW is actuated a W

to control at the low level setpoint of 30 inches when one or niore RCPs are in operation. In the determination of the low level setpoint, it is desired to place the setpoint as low as possible, considering instrument errors, to give the maximum operating margin between the ICS low load control setpoint and the EFW initiation setpoint. This minimizes spurious or unwanted initiation of EFW. To meet this criteria, a nominal setpoint of 6 inches indicated was selected, adjusted for >otential instrument error, and shown to be conservative to tie specified Allowable Value. Credit is only taken for low level actuation for those transients which do not involve a degraded environment. Therefore, normal environment errors only are used for determining the OTSG Level-Low Allowable Value.

OTSG Pressure-Low Four OTSG Pressure-Low EFIC channels per OTSG shall be OPERABLE with an allowable value of 2 600 psig. The actual plant setpoint is set higher to account for instrument loop uncertainties and calibration tolerances. The setpoint is chosen to avoid actuation under (continued) $

Crystal River Unit 3 B 3.3-92 Revision No, 16

i Control Room Isolation-High Radiation '

B 3.3.16 O B32 ins'auatatatio" B 3.3.16 Control Room isolation-High Radiation s I

BASES BACKGROUND The principal function of the Control Room Isolation-High Radiation is to provide an enclosed environment from which the plant can be operated following an uncontrolled release of radioactivity. The high radiation isolation function provides assurance that an isolation signal will be generated when conditions dictate. The radiation monitor is located in the control complex return duct. The control room isolation signal is provided by a single channel containing an iodine monitor with a scintillation detector and a gaseous monitor with a Geiger Hueller detector. The iodine channel includes a particulate prefilter with a charcoal cartridge. if a radioactivity concentration above normal background level is detected on the iodine channel or if power is lost, the monitor will initiate a shutdown of l the normal duty supply fans and will place the ventilation dampers in their recirculation mode.

' ch"' "'

O- ^" "'" " ' ',ac'"d'd Specifications the Control ""'" Complex th' 'c a' is also isolated on an Engineered Safeguards Actuation System (ESAS) RB Pressure-High signal as well as elevated toxic gas levels.

APPLICABLE Following a LOCA, the high radiation function is SAFETY ANALYSES credited with performing the initial Control Complex isolation function and beginning the emergency recirculation mode of operation. This isolation is necessary to limit doses to the Control Room operator to within 10 CFR 50, Appendix A, General Design Criteria (GDC) 19 limits, (Ref.

1). The limiting GDC 19 dose criteria is the 30 Rem limit to the thyroid. The high radiation isolation would also limits dose rates to the Control Room Operator in the event of a Fuel Handling Accident.

The Control Room isolation-High Radiation satisfies Criterion 3 of the NRC Policy Statement.

O (continued)

Crystal River Unit 3 B 3.3-119 Revision No. 16

1 l

Control Room Isolation-High Radiation B 3.3.16 1 BASES (continued) $<

LCO Oae channel of Control Room isolation-High Radiation is required to be OPERABLE to ensure 10 CFR 50, Appendix A, GDC 19 operator and 10 CFR 100 offsite dose limits are met for design basis transients and accidents. Only the iodine channel is addressed by this LCO. Operability of the instrumentation includes proper operation of the sample pump.

APPLICABILITY The capability to automatically isolate the Control Room on high radiation shall be OPERABLE whenever an accidental release of radioactivity is postulated. This includes MODES 1, 2, 3, 4, and during movement of irradiated fuel assemblies. If a radioactive release were to occur during any of these conditions, the Control Room would have to remain habitable to ensure reactor shutdown and core cooling is maintained.

ACTIONS Ad Condition A applies to a failure of the Control Room Isolation-Higi Radiation functL.1 in MODE 1, 2, 3, or 4.

With the Control Room Isolation-High Radiation instrumentation inoperable, the Control Room Emergency Ventilation System (CREVS) must be placed in a system configuration that minimizes the impact of the inoperable monitor. To ensure that the ventilation system has been

) laced in a state equivalent to that which occurs after the ligh radiation isolation has occurred, an OPERABLE train of the CREYS is ) laced in the emergency recirculation mode of operation. T1e 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is a sufficient amount of time in which to complete the Required Action.

B.1 and B.2 If the CREVS cannot be ) laced into the emergency recirculation mode or tie monitor restored to OPERABLE status within I hour while in MODE ), 2, 3, or 4, actions must be taken to minimize the plant's vulnerability to an accident that would lead to radiation releases. The plant (continued) h Crystal River Unit 3 8 3.3-120 Amendment No. 149

PAM Instrumentation B 3.3.17 4

h BASES APPLICABLE c. Determine whether systems important to safety are SAFETY ANALYSES performing their intended functions; (continued)

d. Determine the potential for a gross breach of the barriers to radioactivity releaset

e. Determine if a gross breach of a barrier has occurred:

4 and <

f. Initiate action necessary to protect the )ublic and estimate the magnitude of any impending tireat.

PAM instrumentation that is determined to display a Regulatory Guide 1.97 Type A variable, satisfies Criterior. 3 of the NRC Policy Statement. Category 1, non Type A, instrumentation does not meet any of the criterion in the NRC Policy Statement. However, it is retained in Technical Specifications because it is considered important to reducing risk to the public.

1 LCO LC0 3.3.17 requires redundant channels be OPERABLE to ensure no single failure prevents the operators from being presented with the information necessary to determine the 1

status of the unit and to bring the unit to, and maintain it in, a safe condition following that accident. The provision 4 of two channels also allows for relative comparison of the channels (aCHANNELCHECKtypeofqualitativeassessment) '

during the post accident phase to confirm the validity of displayed information.

The exception to the two channel requirement is containment i

isolation valve aosition. In this case, the important information is tie status of the containment penetration.

The LC0 requires one position indicator for each automatic containment isolation valve. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the automatic valve and prior knowledge of the passive valve or via system boundary status. If a normally active containment isolation valve is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.

-h (continued)

Crystal- River Unit 3 B 3.3 125 Revision No. 11

PAM Instrumentation B 3.3.17 BASES g LCO The following list is a discussion of the specified (continued) instrument functions listed in Table 3.3.17-1.

1. Wide Ranae Neutron Fl u Two wide range neutron flux monitors are provided for post accident reactivity monitoring over the entire E

range of expected conditions. indication to 100% logover the range of 10',a rated power covering the source, intermediate, and )ower ranges. Each monitor utilizes a fission chamaer neutron detector to provide redundant main control board indication. A single channel provides recorded information in the control room. The control room indication of neutron flux is considered one of the primary indications used by the operator following an accident, following an event the neutron flux is monitored for reactivity control. The operator ensures that the reactor trips as necessary and that emergency boration is initiated if required. Since the operator relies upon this indication in order to take specified manual action, the variable is included Therefore, the LCO deals specifically e

W in this LCO.

with this portion of the string.

2. Reactor Coolant System (RCS) Hot Lea Temperature Two wide range resistance temperature detectors (RID's), one per loop, provide indication of reactor coolant system of 120' to 920'F.hot Each leg temperature T measuremen(1{,) over the provides an range input to a control room indicator. Channel B is also recorded in the control room. Since the operator relies on the control room indication following an accident, the LC0 deals specifically with this portion of the string.

Tg is a Type A variable on which the operator bases manual actions required for event mitigation for which no automatic controls are provided.

(continued) $

Crystal River Unit 3 B 3.3-126 Amendment No. 162

- - . . . . - - ~ ~ . . - - - - . . - - _ _ - - . . - _ _ - . - . - . - - . . - - .

PAM Instrumentation i

B 3.3.17 O s^sts LCO 2. Reactor Coolant System (RCS) Hot Lea Temoerature (continued) ,

following a steam generator tube rupture, the affected l 2

steam generator is to be isolated only after T g falls below the saturation temperature corresponding to the 1)ressure setpoint of the main steam safety valves.

For event monitoring once the RCP's are tripped. T g is used along with the core exit tem)eratures and RCS cold leg temperature to measure tie temperature rise across the core for verification of core cooling.

3. RCS Pressure (Wide Ranae)

RCS pressure is measured by pressure transmitters with a span of 0 3000 psig. Redundant monitoring capability is provided by two trains of instrumentation. Control room and remote shutdown panel indications are provided. The control room l indications are the primary indications used by the operator during an accident. Therefore, the LCO deals specifically with this portion of the instrument O string.

RCS pressure is a Type A variable because the operator uses this indication to adjust parameters such as steam generator (OTSG) level or pressure in order to monitor and maintain a controlled cooldown of the RCS following a steam generator tube rupture or small break LOCA. In addition, HPl flow is throttled based P

(continued)

Crystal River Unit 3 8 3.3-127 Amendment No. 162

PAM Instrumentation B 3.3.17 BASES h LCO 3. RCS Pressure (Wide Ranat.). (continued) on RCS pressure. Finally HPI flow is required for some small break LOCAs, where LPI may actuate with system pressure stabilizing above the shutoff head of the :.Pl pumps, if this condition exists, the operator is instructed to verify HPl flow and then stop the LPI pumps in order to preclude extended operation against a deadhead pressure.

4. Reactor Coolant Inventory Reactor Vessel Water Level instrumentation is provided for verification and long term surveillance of core cooling. The reactor vessel level monitoring system provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core. Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.

The collapsed level is obtained over the same O

temperature and pressure range as the saturation measurements, thereby encompassing all operating and accident conditions where it must function. Also, it functions during the recovery interval. Therefore, it is designad to survive the high steam temperature that may occur during the preceding core recovery interval.

The level range extends from the top of the vessel down to the top of the fuel alignment plate. The response time is short enough to track the level during small break LOCA events. The resolution is sufficient to show the initial level drop, the key locations near the hot leg elevation, and the lowest levels just above the alignment plate. This arovides the operator with adequate indication to trac ( the progression of the accident and to detect the consequences of its mitigating actions or the functionality of automatic equipment.

(continued)

Crystal River Unit 3 B 3.3-128 Revision No, 11

pAM Instrumentation B 3.3.17 O BA.

LCO 8,9. Containment Pressure (Excetted Post Accident Ranae and Wide Ranael The containment pressure variable is monitored by two ranges of pressure indication. Expected post accident range (10to70psig)andwiderange(0to200psig) pressure indication each provide two channels of pressure indication. Channel A and B wide range containment pressure are recorded in the associated

'A' and 'B' EFIC Rooms. The low range is required in order to ensure instrumentation of the necessary accuracy is available to monitor conditions in the RB during DBAs. The wide range instrument was required by Regulatory Guide 1.97 to be capable of monitoring pressures over the range of atmospheric to three times containment design pressure (approximately 165 psig).

Thus, it was intended to monitor the RB in the event of an accident not bounded by the plant safety analysis (i.e.,aSevereAccident).

These instruments are not assumed to provide l] information required by the operator to take a mitigation action specifi.d in the accident analysis.

As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LCO based upon this consideration.

m O (continued)

Crystal River Unit 3 B 3.3-131 Amendment No. 162

PAM Instrumentation B 3.3.17 BASES $

LCO l

10. Containment isolation Valve Position Containment isolation Valve (CIV) position indication instrumentation is provided in order for the operator to verify that RB penetrations are isolated, as required, following an accident or transient. In this way, the Containment is verified to be functio-ing ts analyzed and as tested (10 CFR 50, Appendix J). The CIV indication consists of open/ closed matrix lights located on the ES Section of the main control board.

CR-3 does not provide position indication for manual CIVsorCIVsutilizingapassivedesign(check valves). In the case of manual valves, these valve types are acceptable alternatives to automatic valves for the purposes of providing ontainment isolation and require no position indication since they are administrative 1y maintained in the isolated position.

Position indication for check valves is specifically excluded by Table 3 of Regu'atory Guide 1.97.

The LCO requires two position indications per penetration rather than tws indications per valve (for those penetrations provided with indication and the applicable valve configuration), in other words, the LC0 requires one position iiidicator for each of two active CIVs with control room indication. Strictly speaking, this is an exception from Category 1 redundancy requirements. However, this is considered acceptable since redundancy is provided on a per-penetration basis. For penetrations having only one CIV having control room indication, only that one indication is required by this LCO.

A Note has been added to indicate that posit un indication is not required for isolation val.es whose associated penetration is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through I the valve secured. This allowance is consistent with the previous discussion on why position indication was l excluded for manual valves.

I (continued) hl Crystal River Unit 3 B 3.3-132 Revision No. 11

PAM In'irumentation B 3.3.17 O 8^sts LCO 17. Emeraehev Feedwater Tank Level (continued)

The dedicated emergency feedwater (EFW) tank provides the assured, safety grade water supply for the Emergency feedwater System. The EFW tank inventory is monitored and displayed by 0 to 38 feet control room level indications. The control room indicators and alarms are considered the primary indication used by the operator. Therefore, the LC0 deals specifically with this portion of the instrument string.

The design basis accidents which require emergency feedwater are those in which the main feedwater supply and/or the electrical supply to the vital feedwater auxiliaries has been lost, e.g., a feedwater line break or a loss of offsite )ower. In the event of such a loss of feedwater, tie EFW tank is the initial sourca af water for the EFW System. As the EfW tank is dapleted, mnusi o)erator action is necessary to replenish the C/W tan ( or to realign the suction to the EfW pumps. Since tank level is required by the operator for manual actions following an event, it has

] been included in this LCO.

18. Core Exit Temocratura (Backuo)

The core exit thermocouples (CETs) provide an indication of the reactor coolant temperature as it exits the active region of the core. The accident monitoring instrumentation providea a display of core exit temperature over a range of 0 to 2500'F. The display consists of 16 separate temperature measurements from 16 CETs, four from each quadrant.

Each of these 16 core exit temperature measurements is continuously recorded in the control room on three separate recorders. Since the control room display is the primary indication used by the operator, this LCO deals specifically with this portion of the instrument string.

The CETs are considered the primary indication of the reactor coolant temperature. Core exit temperature is included in this LCO because the operator uses this indication to monitor the cooldown of the RCS (continued)

Crystal River Unit 3 B 3.3-137 Revision No. 11

PAM Instrumentation B 3.3.17 BASES $

LCO 18. Core Exit Temoerature (Backuol (continued) following a steam generator tube rupture or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting OTSG 1evel or pressure, would be prompted by this indication.

19. Emeroency Feedwater Flow EFW Flow instrumentation is provided to monitor operation of decay heat 'emoval r via the OTSGs. The EFW injection flow to each OTSG (2 channels per OTSG, one associated with each EFW injection line) is determined from a differential pressure measurement calibrated to a span of 0 gpm to 1000 gpm. Each differential pressure transmitter provides an input to a control room indicator and the plant computer.

EFW Flow is used by the operator to determine the need to throttle flow during accident or transient conditions to prevent excessive RCS cooldown rates l when low decay heat levels are present. EFW Flow is also used by the operator to verify that the EFW g

System is delivering the correct flow to each OTSG.

However, the primary indication of this function is provided by OTSG 1evel.

These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the safety analysis.

As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LC0 based upon this consideration.

O (continued)

Crystal River Unit 3 B 3.3-138 Amendment No. 163 l

l

I PAM Instrumentation B 3.3.17 t

O BASES LCO 20. Low Pressure in.iection Flow (continued)

Low pressure injection flow instrumentation is

)rovided to monitor flow to the RCS following a large

areak LOCA. It is also used to monitor LPI flow during piggy back operation following a small break LOCA. The low pressure injection flow to the rector

(2 channels, one associated with each LP! injection

line) is determined from a differential pressure 2 measurement calibrated to a span of 0 gpm to 5000 gpm.

The LPI flow indication is used by the operator to -

throttle the flow to 12000 gpm prior to switching the ,

pump suction from the BWST to the RB sump. This assures adequate net positive suction head (NPSH) is maintained to the pump. The indication is also used .

to verify LPI flow to the reactor as a prerequisite to !

termination of HPI flow.

Since low 3ressure injection flow is a Type A variable on which tie operator bases manual actions required for event mitigation for which no automatic controls are provided, it has been included in this LCO.

Q

21. Deorees of Subcoolina Two channels of subcooling margin with inputs from RCS hot leg temperature (T ), core exit temperature, and RCSpressureareproviUed. Multi)1e core exit temperatures are auctioneered witi only the highest temperature being input to the monitor. A note has been added to indicate that the two channels of subcooling margin are backed up by either of two indications of subcooling margin based on similar inputs through the Safety Parameter Display System (SPDS). At least one SPDS channel must be available to provide this backup. With both SPDS channels IN0PERABLE, Condition C is applicable. This is considered necessary because the core exit thermocouple inputs to the subcooling margin monitors are not environmentally qualified. The Tg inputs to the subcooling margin nionitors and SPDS operate over a range of 120 to 920*F. The core exit temperature inputs operate over a range of '50 to 2000'F and 150 O (continued)

Crystal River Unit 3 8 3.3-13BA ' Amendment No. 162

i PAM Instrumentation j B 3.3.17 BASES g!

i LCO 21. Dearees of Subcoolina (continued) to 2500'F for the subcooling margin monitors and SPDS, respectively. RCS pressure inputs operate over e l range of 200 to 2500 psig. l The subcooling margin monitors are used to verify the existence of, or to take actions to ensure the restoration of subcooling margin. Specifically, a loss of adequate subcooling margin during a LOCA requires the operator to tri) the reactor coolant pumps (RCP's), to ensure higi or low pressure injection, and raise the steam generator levels to the subcooling is a Type A variable on which the operator bases manual actions required for event mitigation for which no automatic control are provided, it has been included in this LCO.

22. [Ineraency Diesel Generator. kW Indicathn The Emergency Diesel Generator (EDG) provides standby (emergency) electrical power in the case of Loss of &

OffsitePower(LOOP). EDG kW indication is provided W in the control room to monitor the operational status of the EDG.

EDG Power (kW) output indication is a type A variable because EDG kW indication provides the control room operator EDG load management capabilities. EDG load management enables the operator to base manual actions of load start and stop for event mitigation.

(continued)

Crystal River Unit 3 8 3.3-138B Amendment No. 162

RCS Loops-HODE 4 B 3.4.5 O 834 atactoacooc^atsvstca(acs) 8 3.4.5 RCS Loops-MODE 4 BASES BACKGROUND In MODE 4 the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the steam generators (OTSGs) or decay heat removal (DHR) heat exchangers. The secondary function of the reactor coolant is to act as a transport medium for soluble neutron poison, boric acid. l In H0DE 4, either reactor coolant pumps (RCPs) or DHR pumps can be used for coolant circulation. The number of ) umps in operation can vary to suit the operational needs. T 1e intent of this LCO is to provide forced flow from at least one RCP or one DHR pump for decay heat removal and j transport. The flow provided by one RCP or one DHR pump is adequate for heat removal. The other intent of this LCO is l to recuire wat two paths (loops) be available to provide i reduntancy for heat removal. l 0 APPLICABLE No safety analyses are performed with initial conditions in !

SAFETY ANALYSES H0DE 4. The flow provided by one reactor coolant or one 1 decay heat removal > ump is adequate to prevent boron stratification in tie vessel core region during a reduction of boron concentration. !

RCS loops-MODE 4 satisfies the requirements of NRC Policy Statement. While none of the three criteria directly apply, this !pecification assures that reactivity control is maintained, thus Criterion 2 is the appropriate criterion, because boron dilution and reactivity control in natural circulation are unanalyzed. Potential reactivity increases would be outside the bounds of the safety analysis. RCS loops-MODE 4 was identified in the NRC Policy Statement as an important contributor to risk reduction.

LC0 The purpose of this LC0 is to require that two loo)s, RCS or DHR, be OPERABLE in MODE 4 and one of these loops se in operation. The LCO allows the two leops that are required to be OPERABLE to consist of any combination of RCS or DHR System loops. Any one loop in operation provides enough (continued)

Crystal River Unit 3 B 3.4 22 Amendment No. 149

RCS Loops-MODE 4 B 3.4.5 BASES h LCO flow to remove the decay heat from the core with forced (continued) circulation. The second loop that is required to be OPERABLE provides a redundant path for heat removal.

An OPERABLE RCS loop consists of at least one ODERABLE RCP and a flow path for circulating reactor coolant around the loop. RCPs are OPrRABLE if they are capable of being powered and are at t to provide flow if required.

Similarly for the DHR System, an OPERABLE DHR loop is comprised of the OPERABLE DHR pump (s) capable of providing forced flow to the DHR heat exchanger (s). DHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.

The Note permits a limited period of operation during which all RCPs may be de energized for s 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months per 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period for the transition to or from the DHR System. This allows the RCPs to be secured prior to reducing RCS pressure selow that needed to place DHR in service. In this pressure range, accelerated RCP seal degradation can potentially occur due to inadequate NPSH. The Note also permits all DHR and RC pumps to be stopped for s I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period for any reason. During this period, natural circulation will provide core decay heat removal. The Note prohibits the reduction of RCS boron concentration when forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained so as to assure subcooling throughout the RCS so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

APPLICABILITY In MODE 4, the heat generated is lower than at power; therefore, one RCS or DHR loop in operation is adequate for transport and heat removal. A second loop, either RCS or DHR, is required to be OPERABLE in order to provide redundant heat removal capability, but does not have to be in operation.

This LC0 allows use of either DHR or RCS loops because it is aossible to remove core decay heat and to provide proper

>oron mixing with either system.

(continued)

Crystal River Unit 3 B 3.4-23 Revision No. 14

RCS Loops-MODE 5. Loops filled B 3.4.6 O sists LCO well within the allowable pressure and subcooling limits:

(continued) or(b)

, operation. Alternate The Noteheat removal prohibits boronpaths through dilution an OTSG is in when DHR forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained so as to assure subcooling throughout the RCS so that no vapor bubble would form and )ossibly cause a natural circulation flow obstruction. In 111s MODE, the OTSG is a backup for decay heat removal and, the RCS must be maintained subcooled to ensure its availability.

Note 2 allows one DHR loop to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on a DHR loop during the optimum plant conditions.

The time periods for each of these allowances is acceptable because natural circulation is adequate for heat removal, the reactor coolant temperature can be maintained subcooled, and boron stratification affecting reactivity control is not expected.

Note 3 provides for an orderly transition from H0DE 5 to MODE 4 dur 'ng a planned heatup by permitting removal of DHR loops F a operation provided at least one RCP is in operation, This Note provides for the transition to MODE 4 recognizing an RCS loop is permitted to be in operation and replaces the heat removal function provided by the DHR loops.

An OPERABLE DHR loop is composed of an OPERABLE DHR pump, OPERABLE DHR heat exchanger, and associated flowpath. DHR pr* s are OPERABLE if they are capable of being powered and are able to provide flow if required. An OTSG can perform as a heat sink when it has an adequate water level and an available f6ed source.

O (continued)

Crystal River Unit 3 8 3.4 29 Revision No. 14

RCS Loops-MODE 5, Loops filled l B 3.4.6 BASES h APPLICABILITY In MODE 5 with loops filled, forced circulation is provided by this LC0 to remove decay heat from the core and to l provide proper boron mixing. One loop of DHR provides sufficient circulation for these purposes. With the loops filled, the second DHR loop or an OTSG is a viable heat removal option.

Forced circulation is required in all MODES and is addressed by the following Specifications:

LCO 3.4.4, "RCS Loops-MODE 3";

LCO 3.4.5, "RCS Loops-MODE 4";

LC0 3.4.7, "RCS Loops-MODE 5, Loops Not filled";

LCO 3.9.4, " Decay Heat Removal (DHR) and Coolant Circulation-High Water Level" (HODE 6);

and LC0 3.9.5, " Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level" (MODE 6).

Forced circulation is implicitly required in MODES I and 2 in order to prevent a Reactor Protection System actuation (Ref. LCO 3.3.1).

O ACTIONS A.1 and A.2 If one DHR loop is inoperable and neither OTSG is OPERABLE, redundant heat removal capability is lost. Action must be initiated to restore a second DHR loop or OTSG to OPERABLE status. Either Recuired Action A.1 or Required Action A.2 will restore reduncant decay heat removal paths. The immediate Com)1etion Time reflects the importance of maintaining tie availability of two heat removal paths.

B.1 and B.2 This Condition is not entered when using the allowance in the Note to the LC0 to de energize all DHR pumps.

If no DHR loop is OPERABLE or in operation, all operations involving the reduction of RCS boron concentration must be suspended and action to restore a DHR loop to OPERABLE status and operation must be initiated immediately. Boron dilution requires forced circulation for proper mixing, and (continued) h Crystal River Unit 3 8 3.4 30 Revision No. 14

Pressurizer Safety Valvos B 3.4.9 i

O 834 atac'oacoo'^"'svs't"(ac5)

B 3.4.9 Pressurizer Safety Valves BASES 1

BACKGROUND The purpose of the two spring loaded pressurizer safety valves is to provide RCS overpressure protection. Operating in conjunction with the Reactor Protection System (RPS), two valvesareusedtoensurethattheSafetyLimit(SL)of 2750 psig is not exceeded for analyzed transients during operation in MODES 1, 2, and 3. For MODE 4, MODE 5, and MODE 6 with the reactor vessel head not completely detensioned, overpressure protection is provided b.y LCO 3.4.11. " Low Temperature Overpressure Protection (LTOP)

- System."

The self actuated pressurizer safety valves are designed in ,

accordance with the requirements set forth in the ASME Boiler and Pressure Vessel Code, Section !!! (Ref.1). The required lift pressure is 2500 psig i 2%. The safety valves discharge steam from the pressurizer to the reactor coolant drain tank (RCDT) located in the containment. The discharge O

V flow is indicated by acoustic monitors downstream of the safety valves and by an increase in RCDT pressure and level.

The upper and lower pressure limits were originally based on the i 1% tolerance requirement for lifting pressures above 1000 psig. However, later versions of the ASME Code allow for tolerances cf up to i3%, and the use of i 2% sas justified in Reference 2. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be estsblished.

The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to less than 110% of design pressure.

(continued)

Crystal Ri'ler Unit 3 B 3.4-43 Amendment No. 161

Pressurizer _ Safety Valves B 3.4.9 BASES (continued) h APPLICABLE All accident analyses in the FSAR that require safety valve SAFETY ANALYSES actuation assume operation of both pressurizer safety valves to limit increasing reactor coolant pressure. The overpressure protection analysis (Ref. 3) is also based on operation of both safety valves and assumes that the valves open at the high range of the setting (2500 psig system designpressureplus2%). These valves e st accommodate pressurizer insurges that could occur during a startup, rod withdrwal, ejected rod, loss of main feedwater, or main feedwater line break accident. The startup accident establishes the limiting design basis safe " valve capacity.

The startup accident is assumed to occur at < 15% power and both values are assumed to lift to relieve RCS pressure.

Single failure of a safety valve is neither assumed in the accident analysis nor required to be addressed by the ASME Code. Compliance with this-Specification is required to ensure that the accident analysis and design basis calculations remain valid.

Pressurizer safety valves satisfy Criterion 3 of the NRC Policy Statement.

=

g LC0 The two pressurizer safety valves are set to open at the RCS design pressure (2500 psig) and within the ASME specified tolerance to avoid exceeding the maximum RCS design pressure SL, to maintain accident analysis assumptions and to comply with ASME Code requirements. The upper and lower pressure tolerance limits are based on a i 2% tolerance. The limit l protected by this Specification is the reactor coolant l pressure SL _of 110% of design pressure. Inoperability of one or both valves could result in exceeding the SL if a transient were to occur.

. The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.

APPLICABILITY In MODES 1, 2, and 3, OPERABILITY of two valves is required because the combined capacity is necessary to maintain (continued)

Crystal River Unit 3 8 3.4-44 Amendment No. 149

Pressurizer Safety Valves B 3.4.9 O 84SES APPLICABILITY reactor coolant pressure less than 110% of its design value

, (continued) during certain accidents.

The LCO is not applicable in MODES 4 and 5 because LCO 3.4.11. " Low Temperature Overpressure Protection (LTOP)

System" provides overpressure protection. Overpressure

)rotection is not required in MODE 6 with the reactor vessel lead completely detensioned. I

. ACTIONS Ad With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS

overpressure protection system. An inoperable safety valve

, coincident with a design basis overpressure event could challenge the integrity of the RCS.

B.1 and B.2 O If the Required Action cannot be met within the associated Completion Time or if both arossurizer safety valves are inoperable, the plant must )e placed in a MODE in which the requirement does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The specified Completion Times are reasonable, based on operating experience, to reach the 4 required MODES from full power conditions in an orderly manner and without challenging plant systems. In MODE 4 and below, overpressure protection is provided by LTOP. Placing the plant in a lower MODE (3 and 4) reduces the RCS energy (thermal and pressure), lowers the potential for large pressurizer insurges, and inereby removes the need for overpressure protection by two pressurizer safety valves.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS The requirement to verify lift setpoint 2 2450 psig and

$2550 psig is implemented in the Inservice Testing Program.

4 -

g d (continued)

Crystal River Unit 3 B 3.4-45 Amendment No. 161

Prcssurizer Safety Valves B 3.4.9 BASES g SVRVEILLANCE SR 3.LL1 (continued)

REQUIREMENTS To meet the Code requirements, CR-3 typically removes the valves and ships them to the vendor to be bench tested.

Alternately, the valves may be tested in-place. If tested in-place, pressurizer safety valves are to be tested one at a time and in accordance with the requirements of Section XI of the ASME Code (Ref. 4), which provides the activities and the Frequency necessary to satisfy the SRs. No additional requirements are specified.

The pressurizer safety valve setpoint is i 2% for OPERABILITY; however, valves removed for testing or maintenance are required to be reset to i 1% as part of the Surveillance to allow for drift.

The Note allows entry into MODE 3 with the lift settings outside the SR limits. This permits testing and examination of the safety valves at pressures and temperatures near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from &

service for testing. The 36 hour4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months exception is based on an W 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each valve. The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from operating experience that hot testing can be performed in this timeframe. As mentioned earlier, this allowance is not utilized at the present time since current practice is to remove the valves and send them to the vendor for testing and lift setting adjustment.

REFERENCES 1. ASME, Boiler and Pressure Vessel Code,Section III.

2. B&W Report 86-1200382-00, November 1990.

3. B&W Topical Report BAW-10043, " Overpressure Protection for B&W's Pressurized Water Reactors."

4. ASME, Boiler and Pressure Vessel Code,Section XI.

O Crystal River Unit 3 B 3.4-46 Amendment No. 149

LTOP System B 3.4.11 O 824 atactoa cootant svstra (acs)

B 3.4.11 Low Temperature Overpressure Protection (LTOP) System i

I BASES

BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of ASME Code Section XI, Division 1, Code Case N-514 (Ref. 1). The reactor vessel is the limiting RCPB component for providing such protection.

The reactor vessel material is less tough at reduced temperatures than at normal operating temperature. Also, as vessel neutron irradiation accumulates, the material becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure must be maintained low when temperature is low and must be increased only as temperature is increased.

The RCS temperatures referenced throughout this LCO and Bases are based on the same criteria as is used for heatup and cooldown monitoring (Refer to LC0 3.4.3). Specifically, O the cold leg temperature should be used with RCPs operating and the decay heat outlet temperature should be used with no

, RCPs operating.

Operational maneuvering during cooldown, heatup, or any anticipated operational occurrence must be controlled to not violate LC0 3.4.3, "RCS Pressure and Temperature (P/T)

Limits." Exceeding these limits could lead to brittle i fracture of the reactor vessel. LC0 3.4.3 presents requirements for administrative control of RCS pressure and

temperature to prevent exceeding the P/T limits.

This LCO provides RCS overpressure protection in the applicable MODES by ensuring an adequate pressure relief capacity and a limited coolant addition capability. The pressure relief capacity requires either the power operated relief valve (PORV) lift setpcint to be reduced and pressurizer coolant level at or below a maximum limit or the RCS depressurized with an RCS vent of sufficient size to handle the limiting transient during LTOP.

(continued)

Crystal River Unit 3 B 3.4-52 Amendment No. 161

LTOP System B 3.4.11 BASES h BACKGR0VND The LTOP approach to )rotecting the vessel by limiting (continued) coolant addition capa)ility allows a maximum of one makeup pump, and requires deactivating HPI, and isolating the core flood tanks (CFTs) when CFT pressures exceed the maximum RCS pressure for the existing RCS temocrature allowed by PTLR.

Should more than one HPI pump inject on an HPI actuation, the pressurizer level and PORY or another RCS vent cannot prevent overpressurizing the RCS.

The pressurizer level limit provides a compressible vapor space or cushion that can accommodate a coolant insurge and prevent a rapid pressure increase, allowing the operator time to ctop the increase. The PORV, with reduced lift setting, or the RCS vent, is the overpressure protection device that acts as backup to the operator in terminating an increasing pressure event.

With HPI deactivated, the ability to )rovide RCS coolant addition is restricted. To balance tie possible need for coolant addition, the LCO does not require the Makeup System to be deactivated. Due to the lower pressures associated with the LTOP MODES and the expected decay heat levels, the Makeup System can provide flow with the OPERABLE makeup pump through the makeup control valve. HPI can be restored by operator action.

PORV Reouirements As designed for the LTOP System, the PORV is signaled to open if the RCS pressure approaches a limit set in the LTOP actuation circuit. The LTOP actuation circuit is the circuit which opens the PORV at the low pressure setpoint.

The LTOP actuation circuit monitors RCS pressure and determines when an overpressure condition is approached.

When the monitored pressure meets or exceeds the setting, the PORV is signaled to open. Maintaining the setpoint within the limits of the LC0 ensures the Reference 1 limits will be met in any event analyzed for LTOP.

When a PORV is opened in an increasing pressure transient,

-the release of coolant causes the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.

(continued) h Crystal River Unit 3 B 3.4-52A Amendment No. 161 l

LTOP System B 3.4.11 O BASES BACKGROUND RCS Vent Reauirementi (continued)

Once the RCS is de)ressurized, a vent exposed to the containment atmospiere will maintain the RCS at ambient containment pressure in an RCS overpressure transient, if the relieving requirements of the maximum credible LTOP transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow of the limiting LTOP transient and maintaining pressure below LTOP limits. The required vent capacity may be provided by one or more vent paths.

For an RCS vent to meet the flow capacity, it requires removing a pressurizer safety valve, or similarly I

establishing a vent by removing an OTSG primary side manway cover or primary side handhole cover, or other vents as determined to be sufficient. The vent path (s) must be above the level of reactor coolant, so as not to drain the RCS when open.

O APPLICABLE SAFETY ANALYSES Analyses (Ref. 3) demonstrate that the reactor vessel can be adequately protected against overpressurization transients during shutdown. At 259'F and below, overpressure prevention is provided by an OPERABLE PORV and a restricted coolant level in the pressurizer or by a depressurized RCS and a sufficient size RCS vent.

The actual temperature at which the pressure in the P/T limit curve can fall below the PORV setpoint increases as vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System will be re-evaluated to ensure that its functional requirements can still be met with the PORV and pressurizer level method or the depressurized and vented RCS condition.

Transients that are capable of overpressurizing the RCS have been identified and evaluated (Ref. 4). These transients relate to either rass input or heat input: actuating the HPI Sptem, discht.rging the CFTs, energizing the pressurizer heaters, failing the makeup control valve open, losing decay heat removal, starting a reactor coolant pump (RCP) with a (continued)

Crystal River Unit 3 B 3.4-52B Amendment No. 161

LTOP- System B 3.4.11 BASES APPLICABLE large temperature mismatch between the primary and secondary SAFETY ANALYSES coolant systems, and adding nitrogen to the pressurizer.

(continued)

HPI actuation and CFT discharge are the transients that result in exceeding P/T limits within < 10 minutes, in which time no operator action is assumed to take place. In the rest, operator action after that time precludes overpressurization. The analyses demonstrate that the time allowed for operator action is adequate, or the evcats are self limiting and do not exceed LTOP limits.

The following are required during the LTOP MODES to ensure that transients do not occur, which either of the LTOP overpressure protection means cannot handle:

a. Deactivating all but one makeup pump;

b. Deactivating HPI; and

c. Immobilizing CFT discharge isolation valves in their closed positions, when CFT pressure is greater than the PTLR limit.

The Reference 3 analyses demonstrate the PORV can maintain RCS pressure below limits when only one makeup pump is g

actuated. Consequently, the LCO allows only one makeup pump to be OPERABLE in the LTOP MODES.

Inadvertent actuation of HPI can cause the RCS pressure to exceed the LTOP limits determined by Reference 3 sooner than the 10 minutes allowed. Consequently, HPI must be deactivated by assuring that an inadvertent HPI actuation can not inject water into the RCS through the HPI valves.

The isolated CFTs must have their discharge valves closed and the valve power breakers in their open positions. The analyses show the effect of CFT discharge is over a narrower RCS temperature range (197'F and below) than that of the LC0 (259'F and below).

Analyses performed per Reference 1 established the temperature of ; TOP A)plicability at 253*F at the vessel quarter-t location. Tie LTOP enable temperature of s 259'F includes correction for instrument uncertainty. The vessel materials were assumed to have a neutron irradiation accumulation equal to 15 effective full power years (EFPYs) of operation and >1 ant o>eration is assumed to be in compliance with tie RCS leatup and cooldown limitations of (continued) h' Crystal River Unit 3 B 3.4-52C Amendment No. 161 l

LTOP System B 3.4.11 4

O BASES !

I l'

APPLICABLE LCO 3.4.3. In addition, Reactor Coolant Pump (RCP)

SAFETY ANALYSES operation is assumed to be restricted to greater than 85'F i (continued) for the first two pumps, and greater than 225'F for pump three. Pump four operation is not considered for LTOP.

During plant heatup, the vessel metal temperature lags the rG.ctor coolant temperature. Stoppins the Reactor Coolant System heatup and holding for a perioc of 90 minutes allows the vessel metal temperature at the quarter-t location to stabilize to the reactor coolant temperature.

This LCO will deactivate the HPI actuation when the RCS temperature is s 259'F. The consequences of a small break LOCA in LTOP MODE 4 are consistent with those discussed in the bases for LC0 3.5.3, "ECCS-Shutdown," by having a maximum of one makeup pump OPERABLE for the required one OPERABLE ECCS train.

Reference 3 contains the acceptance limits that satisfy the LTOP requirements. These limits, in combination with the limitations of LC0 3.4.3, and administrative restrictions on RCP operation, provide the assurance that the reactor vessel is protected from exceeding the requirements of ASME Code Case N-514. Any change to the RCS operation or design must be evaluated against these analyses to determine the impact O of the change on the LTOP acceptance limits.

PORV Performance t

Analyses (Ref. 3) show that the vessel is arotected when the PORY is set to open at s 464 psig. The P0lV setpoint at or below the derived limit ensures Ehe requirements of ASME Code Case N 514 (Reference 1) will be met. The PORV lift setpoint limit of s 457 psig includes correction for instrument uncertainty.

l The PORV setpoint will be re-evaluated for compliance when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are 3eriodically modified as the reactor vessel material touginess decreases due to embrittlement induced by neutron irradiation. Revised P/T limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LC0 3.4.3 discuss these examinations.

The PORV is considered an active component. Therefore, its failure represents the worst case LTOP single active i failure.

t 4

d" - (continued)

Crystal River Unit 3 8 3.4-52D Amendment No. 161

LTOP System B 3.4.11 BASES h APPLICABLE Pressurizer level Performance SAFETY ANALYSES (continued) Analyses of operator response time show that the pressurizer level must be maintained s 160 inches to provide the 10 minute action time for correcting transients. (Ref. 3)

The pressurizer level limit of s 135 inches includes correction for instrument uncertainties.

The pressurizer level limit will also be re-evaluated for compliance each time P/T limit curves are revised based on the results of the vessel material surveillance.

RCS Vent Performance With the RCS depressurized, analyses show a vent of 0.75 square inches is capable of mitigating the transient resulting from full opening of the makeup control valve while the makeup pump is providing RCS makeup. The capacity of a vent this size is greater than the flow resulting from this credible transient.

The RCS vent size will also be re-evaluated for compliance each time P/T limit curves are revised based on the results h

of the vessel material surveillance.

The vent is passive and is not subject to active failure.

O (continued)

Crystal River Unit 3 8 3.4-52E Amendment No. 161

LTOP System B 3.4.11 O BASES (coatinued)

LCO The LCO requires an LTOP System OPERABLE with a limited coolant input capability and a pressure relief capability.

To limit coolant input, the LCO requires only one makeup pump OPERABLE, the HPI deactivated, and the CFT discharge isolation valves closed and immobilized. For pressure relief, it requires either the pressurizer coolant at or below a maximum level and the PORV OPERABLE with a lift setting at or below the LTOP limit or the RCS depressurized and a vent established.

NOTE: The limits and values presented in this LCO for the PORY lift setpoint, enable temperature, and pressurizer level are corrected for instrument uncertainty. The instrumentation to be used by plant operators to assure compliance with these limits and values are specified in approved plant operating procedures.

The pressurizer is available with a coolant level s 135 inches.

The PORV is OPERABLE when its block valve is open, its lift setpoint is set at s 457 psig and testing has proven its

],' $ ability to open at that setpoint, and motive power is available to the PORV and the PORV control circuits.

For the depressurized RCS, an RCS vent is OPERABLE when open with an area of at least 0.75 square inches.

APPLICABILITY This LC0 is applicable in MODE 4 when RCS temperature is s 259'F, in MODE 5, and in MODE 6 when the reactor vessel head is not completely detensioned. The Applicability temperature of 259'F is established by analyses in accordance with Reference 1. With the vessel head completely detensioned, overpressurization is not possible.

The vessel head is completely detensioned when the pre-stress has been relieved from all of the studs, and the nuts are free spinning.

The Applicability is modified by a Note stating that CFT isolation is only required when the CFT pressure is more than or equal to the maximum RCS pressure for the existing RCS temperature, as allowed in LC0 3.4.3. This Note permits the CFT discharge valve surveillance performed only under these pressure and temperature conditions.

O-U (continued)

Crystal River Unit 3 B 3.4-52F Amendment No. 161 J

LTOP System B 3.4.11 BASES (continued) $

ACTIONS Allowable times are specified in the LCO to implement the actions and controls described below. These times range from immediately to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The times are based on operational and industry experience and regulatory recommendations. The times are intended to balance the time necessary to accomplish the actions and the likelihood of experiencing a limiting transient during the action.

A.1 and B.1 With two or more makeup pumps capable of injecting into the RCS or if the HPI is activated, immediate actions are required to render the other pump (s) inoperable or to deactivate HPl. Emphasis is on immediate deactivation because inadvertent injection with one or more HPI pump OPERABLE is the event of greatest significance, since it causes the greatest pressure increase in the shortest time.

Required Action A.1 is modifiet' by a Note that permits two l

pumps capable of RCS injection for s 15 minutes to allow for pump swaps.

The deactivation of HPI is accomplished by assuring that an inadvertent HPI actuation can not inject water into the RCS h

through the HPI valves. This may be accomplished by I combinations of equipment as determined appropriate for the existing plant conditions such as, disabling all HPI valves i or disabling all Makeup pumps. If powered components are l used to accomplish deactivation, power should be removed to

! assure positive lockout.

C.1. D.1, and D.2 l

An unisolated CFT requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months only when

! the CFT pressure is at or greater than the maximum RCS pressure for the existing temperature allowed in LC0 3.4.3.

If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By increasing the RCS temperature to > 191*F, the CFT pressure of 600 psig cannot exceed the LTOP limits if both tanks are fully injected. Depressurizing the CFTs below the LTOP limit of 457 psig also prevents exceeding the LTOP limits in the same event.

(continued) h Crystal River Unit 3 B 3.4-52G Amendment No. 161

LTOP System B 3.4.11 O BASTS ACTIONS E.1. F.1 and F.2 (continued)

With the pressurizer level more than 135 inches, the time for operator action in a pressure increasing event is

~

i reduced. The postulated event most affected in the LTOP MODES is failure of the makeup control valve, which fills the pressurizer relatively rapidly. Restoration is required within I hour.

If restoration within I hour cannot be accomplished, Required Actions F.1 and F.2 must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Actions F.1 and F.2 limit the makeup capability by closing the makeup control valve and its isolation valve, which is not required with a high pressurizer level, and permit cooldown and depressurization to continue. When the makeup is isolated, RCS heatup must be stopped because heat addition decreases the reactor coolant density and increases the pressurizer level. Operations such as starting RC pumps and reducing decay heat removal should not be performed when in this condition.

] G.I. H.l. and H.2 With the PORY inoperable, overpressure relieving capability is lost, and restoration of the PORV within I hour is required. If that cannot be accomplished, the ability of the Makeup System to add water inust be limited within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

If restoration cannot be completed within I hour, Required Action H.1 and Required Action H.2 must be performed to limit RCS water addition capability. Makeup is not required to be deactivated since it may be needed to maintain the RCS coolant level. Required Action H.1 and Required Action H.2 require reducing the makeup tank level to 88 inches and deactivating the low low makeup tank level interlock to the borated water storage tank. This makes the available makeup water volume insufficient to exceed the LTOP limit by a makeup control valve full opening.

I

' b O (continued)

Crystal River Unit 3 8 3.4-52H Amendment No. 161 l

1 LTOP System B 3.4.11 BASES g ACTIONS 1.1 and 1.2 (continued)

With the pressurizer level above 135 inches and the PORY inoperable or the LTOP System ino)erable for any reason other than cited in Condition A tirough H, the system must be restored to OPERABLE status within I hour. When this is not possible, Recuired Action I.2 requires the RCS depressurized and vented within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from the time either Condition started.

One or more RCS vents may be used. A vent size of 2 0.75 square inches is specified. Such a vent keeps the pressure from full flow of one Makeup pump with a wide open makeup control valve within the LC0 limit.

This size RCS vent cannot maintain RCS pressure below LTOP limits if the HPI or CFT systems are inadvertently actuated.

Therefore, verification of the deactivation of two Makeup pumps, HP1 injection, and the CFTs must accompany the depressurizing and venting. Since these systems are recuired deactivated by the LCO, SR 3.4.11.1, SR 3.4.11.2, anc SR 3.4.11.3 require verification of their deactivated status every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , g SURVEILLANCE The following surveillance requirement frequencies are shown REQUIREMENTS by operating experience and industry accepted practice to be sufficient to regularly assess conditions for potential degradation and to verify operation within the requirements.

SR 3.4.11.1. SR ,3.4.11.2. and SR 3.4.11.3 Verifications must be performed that only one makeup pump is capable of injecting into the RCS, the HPI is deactivated, and the CFT discharge isolation valves are closed and immobilized. These Surveillances ensure the minimum coolant input capability will not create an RCS overpressure condition to challenge the LTOP System. The Surveillances are required at 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months intervals.

A Note modifies SR 3.4.11.3 by only requiring this Surveillance when CFT isolation is required.

l (continued) h l

Crystal River Unit 3 B 3.4-521 Amendment No. 161

LTOP System B 3.4.11 O 8^ sos SURVEILLANCE SR 3.4.11.4 REQUIREMENTS (continued) Verification of the pressurizer level at s 135 inches by observing control room or other indications ensures a cushion of sufficient size is available to reduce the rate of pressure increase from potential transients.

The 30 minute Surveillance Frequency during heatup and cooldown must be performed for the LC0 Applicability period when temperature changes can cause pressurizer level variations. This Frequency may be discontinued when the ends of these conditions are satisfied, as defined in plant i procedures. Thereafter, the Surveillance is required at 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months intervals.

A Note modifies the SR by not requiring the Surveillance when complying with LC0 3.4.11.b.

i SR 3.4.11.5 Verification that the PORY block valve is open ensures a flow path to the PORV. This is required at 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

, O. intervals.

A Note modifies the SR by not requiring the Surveillance when complying with LCO 3.4.11.b.

SR 3.4.11.6 When stipulated by LC0 3.4.ll.b, the RCS vent of at least 0.75 square inch must be verified open for relief 4 protection. For an unlocked vent opening, the frequency is every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . For a locked vent opening in the RCS, the required frequency is every 31 days.

A Note modifies the SR by requiring the Surveillance when complying with LC0 3.4.ll.b.

A

, V (continued)

Crystal River Unit 3 .B 3.4-52J Amendment-No. 161

t. e vstem 5: 4.11 BASES $

SURVEILLANCE SR 3.4.11.7 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is required within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months before or after decreasing RCS temperature to s 259'F and every 31 days thereafter to ensure the setpoint is proper for using the PORV for LTOP. PORV actuation is not needed, as it could depressurize the RCS.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months frequency considers the unlikelihood of a low temperature overpressure event during the time.

SR 3.4.11.8 The performance of a CHANNEL CALIBRATION is required every 24 months. The CHANNEL CALIBRATION for the LTOP setpoint ensures that the PORV will be actuated at the appropriate RCS pressure by verifying the accuracy of the instrument string. The calibration can only be performed in shutdown.

The frequency considers the refueling cycle.

SR 3.4.11.9 g Verification that the PORV is selected to the low range setpoint ensures the overpressure protection flow path through the PORV. This is required at 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months intervals.

A Note modifies the SR by not requiring the Surveillance when complying with LCO 3.4.11.b.

(continued)

Crystal River Unit 3 8 3.4-52K Amendment No. 161

LTOP System-B 3.4.11-

. O- BASES < continued) .

REFERENCES. 1. ASME Code Case N 514, " Low Temperature Overpressure Protection Section XI, Division 1". ;

i

2. - Generic Letter 88-ll, "NRC Position on Radiation Embrittlement of Reactor Vessel Materials and its Impact on Plant Operations". ;

]_

l 3. FPC Calculation F97-0003, "CR-315 EFPY LTOP Limits". )

4. - B&W Nuclear Services (FTI) Docu: ..ent 51-1176431-01,

{

" Crystal River 3 Reactor Vessel Low Temperature L Overpresoire Protection (LTOP)".

i i.

iO l

l 4

1 h

[0:

. : Crystal- River ' Unit 3 B 3.4-52L Amendment No. 161 h

c- ,1-,- . = ,ws .rm, , - - - , _ - - . . - , ,. - y

RCS Operational LEAKAGE B 3.4.12 A l t ) B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 RCS Operational LEAKAGE BASES BACKGROUND During the life of the plant, the joint and valve interfaces contained in the RCS can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.

10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems. OPERABILITY of the leakage detection systems is addressed in LC0 3.4.14, "RCS Leakage Detection Instrumentation."

D) The safety significance of RCS LEAKAGE varies widely G depending on its source, rate, and duration. Therefore, detecting, monitoring, and quantifying reactur coolant LEAKAGE is critical. Quickly separating the identified LEAVAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur.

A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight.

Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses SAFETY ANALYSES do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for a LOCA in that the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes 1 gpm primary to secondary LEAKAGE as the initial condition, o

O (continued)

Crystal River Unit 3 8 3.4-53 Revision No. 10

RCS Operational LEAKAGE B 3.4.12 BASES h APPLICABLE The FSAR (Ref. 3) analysis for steam pnerator tube rupture l SAFETY ANALYSES (SGTR) assumes thecontaminated secondary fluid is only (continued) briefly released via safety valves and the majority is steamed to the condenser. The 1 gpm primary to secondary LEAKAGE is relatively inconsequential in terms of offsite dose.

The FSAR steam line brcak (SLB) analysis (Ref. 4) is more limiting for site radiation releases. The safety analysis for the SLB accident assumes 1 gpm primary to secondary LEAKAGE in one generator as an initial condition. The dose consequences resulting from the SLB accident meet the acceptance criteria defined in 10 CFR 100.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being O

indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the reactor coolant pressure boundary l (RCPB). LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment atmosphere and sump level monitoring equipment can detect within a reasonable time period.

Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.

(continued)

Crystal River Unit 3 8 3.4-54 Amendment No. 158

RCS Operational LEAKAGE B 3.4.12 l l

(m) BASES l

LC0 c. Identified LEAKAGE l

Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with the detection of unidentified LEAKAGE and is well within the capability of the RCS makeup system. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).

Violation of this LC0 could result in continued degradation of a component or system.

d. Primary to Secondary LEAKAGE throuah All Steam Generators (OTSGs)

This LEAKAGE limit is established to ensure that tubes initially leaking during normal operation do not contribute excessively to total leakage during postulated accident conditions. The 150 gpd limit is a conservative limit which is consistent with the 3 operational leakage limit specified in NRC Generic (d 'etter 95-05 for plants implementing Alternate Repair J,riteria. CR-3 has elected to voluntarily adopt this conservative limit to ensure plant shutdown in a timely manner in response to detection of primary to secondary LEAKAGE. Primary to secondary LEAKAGE must be included in the tatal allowable liuit for identified LEAKAGE.

Two OTSGs are also required to be OPERABLE. This requirement is met by satisfying the augmented inservice inspection requirements of the Steam Generator Tube Siirveillance Program (Specification 5.6.2.10).

n

(,/ (continued)

Crystal River Unit 3 B 3.4-55 Amendment No. 158

RCS Operational LEAKAGE B 3.4.12 I BASES h APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCF8 LEAKAGE or an event that chr.11enges OTSG (ube integrity is greatest since the RCS is pressurized. In MODES 5 and 6. LEAKAGE limits and OTSG OPERABillTY are not required because the reactor coolant pressure is f ar lower, resulting in icwer stresses and reduced potentials for LEAKAGE or failure.

LC0 3.4.11, 'RCS Pressure Isolation Valve (FIV) Leakags,"

measures leakage through each individual Pli and can impact this LCO. Of the two PlVs in series in ea'.n line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leaktight. If both valves leak and result in a loss of mass from the RCS, the los; must be included in the determi7ation of allowable identified ! EAKAGE.

O O

(continued) !

Crystal River Unit 3 B 3.4-55A Revision No. 10

f ECCS-Operating -

B 3.5.2 83.5 EMERGENCYCORECOOLINGSYSTEMS(ECCS)

B 3.5.2 ECCS-Operating BASES BACKGR0HND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

1. Loss of coolant accident (LOCA);

2. Steam generator tube rupture (SGTR); and j 3. Steam line break (SLB).

There are two modes of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) from the borated water storage tank (BWST). This injection flow is added via the RCS cold legs and core flood nozzles to the reactor vessel. After the BWST has been de)leted to 1 15 feet but > 7 feet, the ECCS recirculation p1ase is entered O as the ECCS suction is manually transferred to the reactor V building emergency sump.

Two redundant, 100% capacity trains are provided. Each train consists of high pressure injection (HPI) and low pressureinjection(LPI) subsystems. In MODES 1, 2, and 3, both trains must be OPERABLE. This ensures that 100% of the

! core cooling requirements can be provided even in the event of a single active failure.

Certain size small break LOCA :cenarios require emergency feedwater to maintain steam generator cooling until core decay heat can be removed solely by ECCS cooling.

Further, with the turbine driven EFW pump or associated M flow path inoperable, SWP-18, train "B" of the Nuclear Services Seawater System, CHHE-18, and CHP-}B, as well as both trains of ECCS, Decay Heat Closed Cycle Cooling Water, Decay Heat Seawater, Emergency Diesel Generators, AC Electrical Power Distribution Subsystem, and AC Vital Bus Subsystems-arerequiredOPERABLE(Ref5).

O (co# tie #ed)

Crystal River Unit 3 B 3.5-9 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

ECCS-Operating B 3.5.2 BASES h BACKGROUND A suction header supplies water f;om the BWST or the reactor (continued) building emergency sump to the ECCS pumps. Separate piping supplies each train. Each HPI subsystem discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. Each LPI subsystem discharges into its associated core flood nozzle on the reactor vessel and discharges into the vessel downcomer area. Control valves are set to balance the HPI flow to the RCS. This flow balance directs sufficient flow to the core to meet the analysis assumptions fcilowing a small break LOCA in one of the RCS cold legs near an HPI nozzle.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer O

(continued)

Crystal River Unit 3 B 3.5-9A Amendment No. 163

. ~ . . _ _ _ . _ _ _ _ _ . . _ _ _ . _ _ _ _ _ _ _ . _ . _ . . _ _ _ _ _ . _ _ . - - _ _ _ _ . _ . . _ _ . _ _ . . _ . _ _ _ _ . . . _ . .

ECCS-Operating 8 3.5.2

. BASES ~

4 i-i.

J 1

1 i

JO i- -

THIS PAGE' INTENTIONALLY LEFT BLANK 4

i'.

2 i

i.

,i -_

t J

1

[d (continued)

Crystal River Unit '3 B 3.5-9B Amendment No. 163

" - veryy- og-,unr r- g-w e-

l l

ECCS-Operating l B 3.5.2 )

BASES h BACKGROUND safety valves. The LPI pumps are capable of discharging to (continued) the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the LPI pumps is manually transferred to the reactor building emergency sump. The HPI pumps cannot take suction directly from the sump. If HPI is still needed, a cross connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as " piggy backing" HPI to LPI, and enables continued HPI to the RCS, if needed, after the BWST is emptied to the switchover point.

In the long term cooling period, flow paths in the LPI System can be established to preclude the possibility of boric acid in the core region reaching an unacceptably high concentration. One flow path is from the hot leg through the decay heat suction line and then in a reverse direction through the reactor building emergency sump suction line into the sump. The other flow path uses the gaps between the hot leg nozzles and the reactor vessel. These gaps provide a flow path between the outlet annulus and the inlet nozzle /downcomer region of the reactor vessel. Either flow path is capable of providing the required flow rates to ensure boron precipitation is not a concern, g HPI also functions to supply barated water to the reactor core following increased heat removal events, such as large SLBs.

During a large break LOCA, RCS pressure will decrease to

< 200 psia in < 20 seconds. The ECCS is actuated upon receipt of an Engineered Safeguards Actuation System (ESAS) signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately (in the programmed sequence). If offsite power is not available, the engineered safety feature (ESF) buses shed normal operating loads and are connected to the diesel generators. Safeguard loads are then actuated in the programmed time sequence.

The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required (continued) h Crystal River Unit 3 B 3.5-10 Amendment No. 161

ECCS-Operating - l B 3.5.2 l h BASES l

LCO Conversely, not all portions of the HPI System satisfy the !

(continued) independence criteria discussed above. Specifically, the )

HPI System downstream of the HPI/ Makeup pumps is not separable into two distinct trains, and is therefore, not independent. This conclusion is based upon analysis which shows, that in the event of a postulated break in the HPI i injection piping, injection flow is required through a minimum of three (3) injection legs, assuming one pump ;

operation, or through a minimum of two (2) injection legs, l assuming two HPI sump operation. When considering the ,

impact of inopera)ilities in this portion of the system, the '

1 same concept of maintaining single active failure protection must be applied. When components become inoperable, an assessment of the HPI systems ability to perform its safety fun: tion must be performed. If the system can continue to perform its safety function, without assuming a single active failure, then the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months loss of redundancy ACTION is appropriate. If the inoperability renders the system, a; is, incapable of performing its safety function, without postulating a single active failure, then the plant is in a condition outside the safety analysis and must enter LCO ,

3.0.3 immediately.

In MODES 1, 2, and 3, an ECCS train consists of an HPI subsystem and an LPI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ESAS signal and manually transferring suction to the reactor building emergency sump.

During an event requiring ECCS actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI and LPI pumps and their respective discharge flow paths to etch of the four cold leg injection nozzles and the reactor vessel. In the long term, this flow i path may be manually transferred to take its supply from the reactor building emergency sump and to supply its flow to the RCS via two paths, as described in the Background section.

The flow path for each train must maintain its designed degree of independence to ensure that no single active failure can disable both ECCS trains.

(

(continued)

Crystal River Unit 3 B 1.5-13 Amendment No. 163

ECCS-Operating B 3.5.2 BASES (continued) $

APPLICABILITY In MODES 1, 2, and 3, the ECCS train OPERABILITY requirements for the limitir,g Design Basis Accident, a large break LOCA, are based on full power operation.

Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The HPI pump performance is based on the small break LOCA, which .

establishes the pump performance curve and is less dependent l on power. MODES 2 and 3 requirements are bounded by the MODE 1 analysis.

l In MODES 5 and 6, plant conditions are such that the l probability of an event requiring ECCS injection is l extremely low. Core cooling requirements in MODE 5 are i addressed by LCO 3.4.6, "RCS Loops-MODE 5, Loops Filled,"

and LCO 3.4.7, "RCS Loops-MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LC0 3.9.4,

" Decay Heat Removal and Coolant Circulation-High Water Level," and LCO 3.9.5, " Decay Heat Removal and Coolant Circulation-Low Water Level."

O (continued)

Crystal River Unit 3 B 3.5-14 Revision No. 6

ECCS-Operating B 3.5.2 BASES (continued)

-ACTIONS M With one or more ECCS trains inoperable and at least 100% of the flow equivalent to a single OPERABLE ECCS train available, prompt action within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is necessary to ensure that the turbine driven emergency feedwater pump and associated flow path are OPERABLE for steam generator cooling. If the turbine driven emergency feedwater pump or associated flow path is not OPERABLE, then the capability to remove sufficient core decay heat can not be assured and Condition B is applicable. Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by non s ensuring the associated surveillance (s) has been satisfactorily completed within the required frequency and the equipment is not otherwise known to be inoperable.

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time 3 to verify the turbine driven emergency feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to confirm core decay heat removal capability.

The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions, u

With one or more ECCS trains inoperable and at least 100% of the flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 3) that are based on a risk evaluation and is a reasonable time for many repairs.

An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS.

The LC0 requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability :d one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of this cond. tion is to maintain a combination of equipment O (coatiauea)

Crystal 111ver Unit 3 8 3.5-15 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

ECCS-Operating B 3.5.2 BASES g ACTIONS L 1 (continued) l NOTE such that the safety injection (SI) flow equivalent to 100%

of a single train remains available. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power aad the failure of an EDG ca:, disable one ECCS train until power is restored. A reliability analysis (Ref. 3) has shown the risk of having one full ECCS train inoperable to be sufficiently low to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

With one or more components inoperable such that the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analyses. Therefore, LC0 3.0.3 must be immediately entered.

O (continued) g Crystal River Unit 3 B 3.5-15A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

ECCS-Operating 8 3.5.2 O

Q BASES O THIS PAGE INTENTIONALLY LEFT BLANK O (continued)

(J Crystal River Unit 3 8 3.5-158 Amendment No. 163

~.

ECCS Operating D 3.5.2 BASES g ACTIONS (continued)

B.1 and 8.2 If the inoserable components cannot be returned to OPERAD'.E status wit 11n the associated Com)1etion Times, the plant must be placed in a MODE in whic1 the LCO does not apply.

To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and at least MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

l SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since ti,ese valves were verified to be in the correct psition prior to locking, sealing, or securing. These valves include valves in the main flow paths and the first normally i.losed valve in a branch line. There are several exceptions for valve position verification due to the low potential for these types of valves to be mispositioned. The valve types which are not verified as part of this SR include vent or drain valves (both inside and outside the RB), relief valves outside the RB, instrumentation valves (both inside and outside the RB), check valves (Mth inside and outside the R6), and sample line valves (inside and outside the RB). A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation; rather, (continued) h Crystal River Unit 3 8 3.5-16 Amendment No. 161

ECCS-Operating B 3.5.2 O 8^sts SURVEILLANCE SR 3.5.2.1 (continued)

REQUIREMENTS it involves verification that those valves ca)able of being mispositioned are in the correct position. T1e 31 day frequency is appropriate because the valves are operated under administrative control, and an inoperable valve

)osition would only affect a single train. This frequency las been shown to be acceptable through operating experience.

In 3.5.2.2 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or otl1er hydraulic component problems is required by Section XI of the American Society of Mechanical Engineers (ASME) Code (Ref. 4). This type of testing may be accomplished by measuring the pump's developed head at only one point of the pump's characteristic curve and this point may be anywhere on the curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance O' assumed in the plant accident analysis. SRs are specified in the Inservice Testing Program, which encom) assesSection XI of the ASME Code.Section XI of tie ASME Code provides the activities and frequencies necessary to satisfy the requirements.

SR 3.5.2.3 and SR 3.5M These SRs demonstrate that each automatic ECCS valve that is not locked, sealed, or otherwise secured in position, actuates to its required position on an actual or simulcted ESAS signal and that each ECCS pump starts on receipt of an actual or simulated ESAS signal. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of the ESAS testing, and equipment performance is monitored as part of the Inservice Testing Program, h (continued)

Crystal River Unit B 3.5 17 Revision No. 6

ECCS-Operating B 3.5.2 BASES SURVEILLANCE 18 3.5.2.5 REQUIREMENTS (continued) This Surveillance ensures that these valves are in the proper position to prevent the HPI pump from exceeding its runout limit. This 24 month Frequency is acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

SR 3.5.2.6 This Surveillance ensures that the flow controllers for the LPI throttle valves will automatically control the LPI train flow rate in the desired range and prevent LPI pump runout as RCS pressure decreases after a LOCA. The 24 month Frequency is acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.

SR 3.5.2.7 Periodic inspections of the reactor building emergency sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 24 month Frequency is based &

W on the need to perform this Surveillance under the conditions that apply during a plant outage and to preserve access to the location. This frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

REFERENCES 1. 10 CFR 50.46.

2. FSAR, Section 6.1,

3. NRC Memorandum to V. Stello, Jr., from R.L. Baer,

" Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

4. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code,Section XI, inservice Inspection, Article IWP-3000,

5. FTI 51-1266138 01, Safety Analysis input to Startup Team Safety Assessment. N O

Crystal River Unit 3 B 3.5-18 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

W - - *K L - _ . - -

ECCS-Shutdown B 3.5.3 O B 3.5 E8EacENCvC0aCCo0tiNcSv5TEss(ECCS)

B 3.5.3 ECCS-Shutdown BASES BACKGROUND The Background section for Bases B 3.5.2 is applicable to these Bases, with the following modification.

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps, such that water from the borated water storage tank (BWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.

APPolCABLE The Applicable Safety Analyses section of Bases 3.5.2 is SAFETY ANAlvSES applicable to these Bases.

Due to the stable conditions associated with operation in MODE 4 and the reduced )robability of occurrence of a Design Basis Accident (DBA), tie ECCS operational requirements are O reduced. Included in these reductions is that certain automatic Engineered Safeguards Actuation System (ESAS) actuation is not available, in this MODE sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one ECCS train is required for MODE 4. This requirement dictates that single failures are not considered during this MODE.

LC0 In MODE 4, one ECCS train is required to ensure sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of an HPI subsystem and an LPI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ESAS signal and manually transferring suction to the reactor building emergency sump.

O V (continued)

Crystal River Unit 3 8 3.5-20 Amendment No. 149

ECCS-Shutdown B 3.5.3 ,

BASES $i LC0 During an event requiring ECCS actuation, a flow path is (continued) required to provide an abundant supply of water from the BWST to the RCS, via the ECCS pumps and their respective discharge flow paths, to each of the four cold leg injection nozzles and the reactor vessel. In the long term, this flow path may be switched to take its supply from the reactor building emergency sump and to supply its flow to the RCS hot and cold legs.

This LCO is modified by a Note which states that HPl may be i deactivated in accordance with LCO 3.4.11, " Low Temperaturo Overpressure Protection (LTOP) System". Operator action is then required to initiate HPl. In the event of a loss of coolant accident (LOCA) requiring HPI actuation, the i time required for operator action has been shown by analysis to be acceptable.

1 APPLICABill1Y In MODES 1, 2, and 3, the OPERABILITY requirements for the ECCS are covered by LCO 3.5.2, "ECCS-Operating."

In MODE 4 with the RCS temperature below 280'F, one &

OPERABLE ECCS train is acceptable without single failure W consideration, on the basis of the stable reactivity condition of the reactor and the limited core cocling requirements.

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LC0 3.4.6, "RCS Loops-MODE 5, Loops Filled,"

and LC0 3.4.7, "RCS Loops-MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LC0 3.9.4,

" Decay Heat Removal and Coolant Circulation-High Water Level," and LC0 3.9.5, " Decay Heat Removal and Coolant Circulation-Low Water Level."

(continued)

Crystal River Unit 3 B 3.5-21 Amendment No. 161

ECCS-Shutdown B 3.5.3 1

O B^stS (coatieved) ;

ACTIONS M If no LPI subsystem is OPERABLE, the unit is not )repared to respond to a LOCA or to continue cooldown using tie DHR/LPI pumps and decay heat heat exchangers. The immediate !

Completion Time ensures that prompt action is initiated to restore the required cooling capacity. Normally, in H0DE 4, reactor decay heat must be removed by a DHR/LPI train operating with suction from the RCS. If no DHR/LPI train is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generator (s) (OTSG). The alternate means of heat removal must continue until the inoperable ECCS LPI subsystem can be restored to operation so that continuation of decay heat removal (DHR) is provided.

M If no ECCS HPI subsystem is OPERABLE, due to the inoperability of the HPl pump or flow path from the Bk'ST, the plant is not prepared to provide high pressure response to Design Basis Events requiring ECCS response. The I hour

(~') Completion Time to restore at least one ECCS HPI subsystem v to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, w1ere an.ECCS train is not required.

This Condition does not apply to HPI subsystem components which are deactivated for the purposes of complying with LC0 3.4.11."LowTemperatureOverpressureProtection(LTOP)

System". With these components deactivated, the HPI subsystem is still considered OPERABLE based upon guidance in NRC Generic letter 91-18. This guidance allows substitution of manual operator action for otherwise automatic functions for the purposes of determining OPERABILITY, The substitutions are limited and must be evaluated against the assumptions in the accident analysis.

In the case of deactivating HPI in MODE 4, the components are availabic for injection following manual operator action to restore the system to OPERABLE status and this action can be accomplished within the time frame required to respond to the transient / accident.

n

() (continued)

Crystal River Unit 3 B 3.5-22 Amendment No. 161

1 1

ECCS-Shutdown B 3.5.3 ,

1 BASES $

ACTIONS L1 (continued)

If the Required Actions and associated Completion Times are not met, the plant must be placed in a MODE in which the Specification does not apply. When the Required Actions of Condition B cannot be completed within the associated Completion Time, a controlled shutdown should be initiated, provided adequate decay heat removal capability exists. The allowed Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable, based on operating experience, to reach MODE 5 from MODE 4 conditions in an orderly manner and without challenging plant systems.

Should adequate decay heat removal capability not exist, or Required Action A.1 not be completed within its associated Completion Time, consideration should be given to pursuing Discretionary Enforcement from the NRC on the requirement to proceed to MODE 5.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply. g This SR is modified by a Note which allows a DHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the DHR mode during MODE 4, if necessary.

REFERENCES The applicable references from Bases 3.5.2 apply.

O Crystal River Unit 3 8 3.5-23 Amendment No. 149 i

i Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES i'

BACKGROUND The containment consists of the concrete reactor building (RB),itssteelliner,andthepenetrationsthroughthis structure. The structure is designed to contain water and steam, as well as radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindrical wall, a flat foundation mat, and a shallow dome '

roof. The cylinder wall is prestressed with a post tensioning system in the vertical and horizontal directions, and the dome roof is arestressed using a three way post i tensioning system. T1e inside surface of the containmert has a carbon steel liner to ensure a high degree of leal tightness during operating and accident conditions.

~

The concrete RB is required for structural integrity of the containment under DBA conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment. Maint ining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment. SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref.1).

The isolation devices for the penetrations in the containment bcundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident

. conditions are either:

1. capable of being closed by an OPERABLE automatic containment isolation system, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LC0 3.6.3, " Containment Isolation Valves";

' O- .ccoatinued)

Crystal River Unit 3 B 3.6-1 Amendment No. 156

Containment l B 3.6.1 l

BASES h BACKGROUND b. Each air lock is OPERABLE, exce)t as provided in (continued) LC0 3.6.2, " Containment Air Loc (s".

APPLICABLE The safety design basis for the containment is that the SAFETY ANALYSES containment must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBAs that result in a challenge to containment from high pressures and temperatures are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (REA)(Ref.2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the analyses of DBAs involving release of fission product radioactivity, it is assumed that the containment is OPERABLE so that the release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.25% of containment air weight per day (Ref.3). This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option B (Ref.1), as L : the maximum allowable leakage rate at the calculated maximum l g peak containment pressure (P.) resulting from the limiting DBA. The allowable leakage rate represented by L. forms the basis for the acceptance criteria imposed on all containment leakage rate testing. L is assumed to be 0.25% of containment air weight p,er day in the safety analysis at P, = 54.2 psig (Ref. 3).

The acceptance criteria applied to accidental releases of radioactive material to tie environment are given in terms of total radiation dose received by a hypothetical member of the general public who is assumed to remain at the exclusion area boundary for two hours following onset of the postulated fission product release. The limits established in 10 CFR 100 (Ref. 5) are a whole body dose of 25 Rem or a 300 Rem dose to the thyroid from iodine exposure.

The containment satisfies Criterion 3 of the NRC Policy Statement.

(continued)

Crystal River Unit 3 B 3.6-2 Amendment No. 156

Containment B 3.6.1 O B^sts (co#ti"#ed)

LCO Containment OPERABILITY is maintained by limiting leakage to less than the acceptance criteria of the Containment Leakage Rate Testing Program. Compliance with this LCO will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.

Individual leakage rates specified for the containment air lock (LC0 3.6.2) and purge valves with resilient seals (LCO 3.6.3) are not specifically part of the acceptance criteria of SR 3.6.1.1. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the total leakage exceeds the acceptance criteria of the Containment Leakage Rate Testing Program. l APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment, in MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be

(]

OPERABLE in MODE 5. The requirements for containment during MODE 6 are addressed in LCO 3.9.3, " Containment Penetrations."

ACTIONS /L1 In the event containment is ino>erable, containment must be restored to OPERABLE status wit 11n I hour. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Com)1etion Time provides a period of time to correct the pro)1em commensurate with the importance of maintaining containment during MODES 1, 2, 3, and 4. This time period also ensures the probability of an accident (requiring containment OPERABillTY) occurring during periods when containment is inoperable is minimal.

B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this n

() (continued)

Crystal River Unit 3 B 3.6-3 Amendment No. 156

Containment B 3.6.1 BASES $

ACTIONS L1 and B.2 (continued) status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compilance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. Failure to meet air lock and purge valve with resilient seal leakage limits for SR 3.6.2.1 and 3.6.3.6 does not constitute a failure of this Surveillance unless the contribution from these penetrations causes overall Type A, B, and C leakage to exceed limits. SR frequencies are as required by the Containment Leakage Rate Testing Program. Thus, SR 3.0.2 (which allows Frequency extensions) A does not apply. These periodic testing requirements ve.ify W that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.

SR 3.6.1.2 This SR ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the Containment Tendon Surveillance Program.

Testing and frequency are consistent with the recommendations of NRC Regulatory Guide 1.35, Revision 3.

The guidance in Regulatory Guide 1.35 should be followed in the event abnormal degradation of the containment tendons is detected. This includes testing additional tendons and submitting a Special Report to the NRC (Refer to Specification 5.7.2.b). The impact of large-scale tendon degradation should also be evaluated with respect to Containment OPERABILITY. In this context, containment structural integrity is analogous to containment OPERABILITY.

(continued)

Crystal River Unit 3 B 3.6-4 Amendment No. 156

._. -_ _ - . - = - . - - _ ._ - . _ -- - - - . _ .

I Containment B 3.6.1 O 8^sts (co#ti#ued)

REFERENCES 1. 10 CFR 50, Appendix J, Option B l

2. FSAR, Sections 14.2.2

3. FSAR, 5.2.1.1 l

4. Regulatory Guide 1.35, Rev.3, 1990. <

5. 10 CFR 100,

6. NEl 94 01, Revision 0, " Industry Guideline for Implementing Performance Based Option of 10 CFR 50, Appendix "

7. ANSI /ANS 56.81994, "American National Standard for Containment System Leikage Testing Requirement" O

CN G

Crystal River Unit 3 B 3.6-5 Amendment No. 156

Containnent Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS g B 3.6.2 Containment Air Locks BASES

=

i BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.

Each air lock is nominally a right circular cylinder,10 ft in diameter, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and is tested to verify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. Therefore, closure of a single door supports containtnent OPERABillTY. Each of the doors contain two gasketed seals and local leakage rate testing ca) ability to ensure )ressure integrity. To effect a leak tigit seal, the a W

air loc ( design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).

Each personnel air lock door is provided with limit switches that provide control room indication of door position.

Additionally, control room indication is p*Jvided to alert the operator whenever an air lock door it.;erlock mechanism is defeated.

The containment air locks form part of the containment pressure boundary. Their integrity and leak tightness is essential for maintaining the contunment leakage rate within limit in the evsat of a N3. Not maintaining air lock integrity or leak tightness inay result in a leakage rate in excess of that assumed in the unit safety analysis.

All leakage rate requirements are in conformance with 10 CFR 50, Appendix J, Option B (Ref. 1). I (continued)

Crystal River Unit 3 B 3.6 6 Amendment No. 156

Containment Air Locks B 3.6.2 O Bases (contiaued)

APPLICABLE The DBAs that result in a release of radioactive material SAFETY ANALYSES within containment are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (Ref. 2), in the analysis of each of these accidents, it is assumed that containment is OPERABLE so that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.25% of containment air weight per day (Ref.3). This leakage rate is defined in 10 CFR 50, Appendix J (Ref. 1), as L : the maximum allowable containment leakage rate it the calculated maximum seak containment pressure (P ) followin a DBA. This al' owable leakagerateformsthebasisforteacceptancecriteria imposed on the SRs associated with the air lock. L is 0.25% of containment air weight per day and P, is 54.2 psig, l resulting from the limiting design basis LOCA.

The acceptance criteria a> plied to DBA releases of radioactive material to t1e environment are given in terms of total radiation dose received by a member of the general sublic who remains at the exclusion area boundary for two 1ours following onset of the )ostulated fission product h release. The limits establis1ed in 10 CFR 100 (Ref. 4 are a whole body dose of 25 Rem or a 300 Rem dose to the t yroid from iodine exposure.

The containment air locks satisfy Criterion 3 of the NRC Policy Statement.

LC0 Each containment air lock forms part of the containment pressure boundary. As a part of containment, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

O (continued)

Crystal River Unit 3 B 3.6-7 Revision No. 1

Containment Air Locks B 3.6.2 BASES $

LCO Each air lock is required to be OPERABLE. For the air lock (continued) to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock (Ref. 5)doesThisl door of anensures provision air lockthat to be opened a gross at one breach of time containment not exist when containment is required to be OPERABLE.

Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events.

Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from containment.

APPLICABILITY In MODES 1, 2, 3, aiid 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The recuirements for the containment air locks a during MODE 6 are adcressed in LC0 3.9.3, " Containment W Penetrations."

ACTIONS The ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock com)onent or for emergencies involving personnel safety. If t1e outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one th+ is inoperable, however, then a short time exists when t containment boundary is not intact (during access thi agh the outer door). In this context, repairs include follow-up actions to an initial failure of the air lock door seal SR in order to determine which air lock door (s) is faulty. There are circumstances where an at-power containment entry would be required during the period of time that one air lock was inoperable. in this case, entry would be made through the OPERABLE air lock if ALARA conditions permit. However, the (continued)

Crystal River Unit 3 B 3.6-8 Amendment No. 156

i Containment Air Locks l B 3.6.2 j O BASES ACTIONS C.l. C.2. and C.3 (continued) criteria, is acceptable when considering the historical intent of the overall/ individual door seal, air lock leakage rate tests. The overall test has historically been the true measure of an air lock's ability to perform its DBA -

function. Periodic containment airlock test should be performed at not lest than P, at a frequency of at least once per 30 months. Containment airlock test methods should be performed in accordance with the Containment Leakage Rate Testing Program. Containment airlock door seals should be tested within 7 days of opening. For periods of multiple i containment entries where the airlock doors are routinely [

used for access more frequently than once every 7 days (e.g.,shiftordailyinspectiontoursofthecontainment),

door seals may be tested once per 30 days during this time period. Door seals are not required to be tested when containment integrity is not required, however they must be tested )rior to reestablishing containment integrity. Door seals siall be tested at a pressure stated in the plant Technical Specifications.

D.1 and 0.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within -

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the recuired plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of 10 CFR 50, Appendix J. Option B (Ref. 1), as modified by l approved exemptions. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakagetests). The acceptance criteria were established during initial air lock and containment testing. The (continued)

Crystal River Unit 3- B 3.6-13 Amendment No. 156

Containment Air Locks B 3.6.2 BASES (continued)

O SURVEILI.N4CE SR 3.6.2.1 (continued)

REQUIREMENTS periodic testing requirement 3 verify that the ait lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The frequency is required by the Containment Leakage Rate Testing Program. Thus, SR 3.0.2 l (which allows frequency extensions) does not apply.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable, since either air lock door is capable of aroviding a fission product barrier in the event of a DBA. lote 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria of SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the overall containment leakage rate.

SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since the inner and outer doors of an air lock are both designed to g

withstand the maximum ex>ected post accident containment pressure, closure of eitler door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABillTY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock w!11 function as designed and that simultaneous opening of the inner and outer doors will not iaadvertently occur. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is only challenged when containment is entered, this test is only required to be performed upon entering containment but is not required more frequently than every 184 days. The 184 day Frequency is based on engineering judgment and is considered adequate in view of other indications of door and interlock mechanism status available to operations personnel.

(continued)

Crystal River Unit 3 B 3.6 14 Amendment No. 156

Containment Air Locks B 3.6.2 BASES REFERENCES 1. 10 CFR 50, Appendix J, Option B l

2. FSAR, Sections 14.2.2

3. FSAR, 5.2.3.1 1

4. 10 CFR 100

5. FSAR Section 5.2.5.2.3.1

6. ANSI /ANS 56.8 1994 l O

o Crystal River Unit 3 B-3.6-14A AmendmentNo.156l-

gm m aaw.a x. A a .-s Aa mmw + *-m mmaaw-wom. mum- -.< -wanw- - -- --a--.m mm w O

l I

I i

t i

i e!

l i

i r

J O

Containment isolation Valves B 3.6.3 O B 3.6 CoatAiaaEaT Sv51Ea5 :

B 3.6.3 Containment isolation Valves i

BASES BACKGROUND The general design basis governing isolation valve i requirements is leakage through fluid penetrations not serving accident-consequence limiting systems is minimized :

by a double barrier so that no single, credible failure or malfunction of an active com)onent can result in loss of

~

isolation or intolerable lea (age. The installed double barriers take the form of closed piping systems, both inside and outside the reactor building, and various types of isolation valves (Ref.1).

Containment isolation occurs upon receipt of a high containment pressure or diverse containment isolation signal. The containment isolation signal closes automatic containment isolation valves in fluid penetrations not required for operation of engineered safeguard systems to

)revent leakage of radioactive material. Upon actuation of ligh pressure injection, automatic containment valves also C isolats systems not required for containment or Reactor Coolant System (RCS) beat removal. Other penetrations are isolated by the use of valves in the closed position or blind flanges. As a result, the containment isolation valves (and blind atmosphere flanges)d will be isolate in the event of a release ofhelp ensure that th radioactive material to containment atmosphere from the RCS following a Design Basis Accident (DBA).

OPERABIL11Y of the containment isolation valves (and blind flanges) supports containment OPERABILITY during accident conditions.

! The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analysis. ..ierefore, the OPERABILITY requirements provide assurance that containment leakage ra+.es assumed in the safety analysis will not be exceeded.

The Reactor Building Purge System is part of the Reactor Building Ventilation System. The Purge System was designed for intermittent operation, providing a means of removing (continued)

Crystal River Unit 3 B 3.6-15 Revision No. 11

Containment Isolation Valves B 3.6.3 BASES h, l

BACKGROUND airborne radioactivity caused by minor leakage from the RCS (continued) prior to personnel entry into containment. The Containment Purge System consists of one 48 inch line for exhaust and one 48 inch line for supply, with supply and exhaust fans capable of purging the fontainment atmos:hore at a rate of approximately 50,000 f t / min. The conta'nment purge tupply ,

and exhaust lines each contain two isolation valves that :

receive an isolation signal on a uM t vent high radiation condition. Each of the purge lines is provided with two 48 inch diameter butterfly valves, one inside and one outside of containment. The valves inside containment are electric motor operated, designed to close within five seconds, while the autsoard isolation valves are pneumatically opened-spring closed, designed to close within two seconds of demand (Ref. 5). Each of these valves was intended to be capable of closing against a differential pressure of 55 psig would(be assured in the event a loss of coolant accidentthe containment d (LOCA) occurred while containment purging was in progress.

Failure of the purge valves to close following a design basis event would cause a significant incruase in the radioactive release because of the large containment leakage path introduced by these 48 inch purge lines. failure of g

the purge valves to close would result in leakage considerably in excess of the containment design leakage rate of 0.25% of containment air weight )er day (L.)

(Ref. 2). Because of their large size, t1e 48 inch purge valves are not qualified for automatic closure from their open position under DBA conditions. Therefore, the 48 inch purge valves are maintained sealed closed (SR 3.6.3.1) in MODES 1, 2, 3, and 4.

The 6 inch post accident hydrogen purge valves operate to: l

a. Reduce the concentration of noble gases within containment prior to and during personnel access; and

b. Equalize internal and external pressures.

Since the post accident hydrogen purge valves are designed I to meet the requirements for automatic containment isolation valves, these valves may be opened as needed in MODES 1, 2, 3, and 4.

O (continued)

Crystal River Unit 3 B 3.6-16 Revision No. 156

Containment Isolation Valves B 3.6.3 O

Q BASES (continued)

APPLICABLE The containment isolation valve LCO was derived from the SAFETY ANALYSES requirements related to the control of leakage from containment during major accidents. This LCO is intended to ensure the containment leakage rates do not exceed the values assumed in the safety analysis. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment.

Therefore, the safety analysis of any event requiring containment isolation is applicable to this LCO.

The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA), a main steam line break, and a rod ejection accident (Ref. 3),

in the analysis for each of these ac:idents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential leakage paths to the environment through containment isolation valves (including containment purge valves) are minimized.

The acceptance criteria a) plied to accidental releases of radioactive material to tio environment are given in terms O' of total radiation dose received by a member of the general

)ubile who remains at the exclusion area boundary for two 1ours following the onset of the postulated fission product release. The limits established in 10 CFR 100 (Ref. 8) are a whole body dose of 25 Rem or a 300 Rem dose to the thyroid from iodine exposure.

The DBA analysis assumes that, within 60 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, L.,

The containment isolation total response time of 60 seconds includes signal 61ay, diesel generator startup (for loss of offsite power), and containment isolation valve stroke times. SR 3.3.5.4 addresses the response time testing requirements.

The single failure criterion recuired in the safety analyses was considered in the original cesign of the containment purge valves. Two valves in a series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. The n

V (continued)

Crystal River Unit 3 B 3.6 17 Revision No. 11

Containment Isolation Valves B 3.6.3 BASES APPLICABLE inboard and outboard isolation valves on each line are SAFETY ANALYSES provided with diverse power sources, motor operated and (continued) pneumatically operated spring closed, respectively. This arrangement was designed to preclude common mode failures from disabling both valves on a purge line.

The containment purge valves may be unable to close in the environment following a LOCA. Therefore, each of the 48 inch purge valves is required to remain sealed closed during MODES 1, 2, 3, and 4. In this case, the single failure criterion remains applicable to the containment purge valves because of failure in the control circuit associated with each valve. Again, the 48 inch purge system valve design prevents a single failure from compromising containment OPERABILITY as long as the system is operated in accordance with the subject LCO.

The containment isolation valves satisfy Criterion 3 of the NRC Policy Statement.

LCO Containment isolation valves form a part of the containment a W

boundary. The containment isolation valve safety function is related to control of containment leakage rates during a DBA.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The 48 inch purge valves must be maintained sealed closed in MODES 1, 2, 3 and 4. The valves covered by this LC0 are listed along with their associated stroke times in the FSAR (Ref. 4).

The normally closed isolation valves are considered OPERABLE when manual valves are closed, check valves have flow through the valve secured, blind flanges are in place, and closed systems are intact.

Purge valves with resilient seals must meet additional leakage rate requirements addressed as part of this Specification. All other containment isolation valve leakage rate testing is addressed by LCO 3.6.1,

" Containment," as part of Type C testing.

(continued) h Crystal River Unit 3 8 3.6-18 Amendr.ent No. 156

. . ---- .____- - - - _=_ _-__ _- - _ -.-- ---

Containment Isolation Valves :

B 3.6.3 O 8^5c5 ACTIONS A.1 and A.2 (continuea) l verification is necessary to ensure that containment '

penetrations required to be isolated followihg an accident and no longer capable of being automatically isolated will '

be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as " prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other

administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Condition A has been modified by a Note indicating this O Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides appropriate actions.

Required Action A.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows the devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is l typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

B.1 and B J With all containment isolation valves in one or more penetration flow paths inoperable (except for 48 inch purge l valve leakage not within limit), the affected penetration flow path must be isolated within I hour. The method of isolation must include the use of at least one isolation 1

(continued) ,

Crystal River Unit 3 -B 3.6 21 Amendment No. 156

Containment Isolation Valves B 3.6.3 BASES g

ACTIONS B.1 and B,2 (continued) barrier that cannot be adversely affected by a single activ9 failure. Isolation barriers that meet this criterion are a closed and de activatr,d automatic valve, a closed manual valve, and a blind flange. The I hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action 8.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action D.2 This periodic verification is necessary to assure leak ti htness of containment and that penetrations requiring isnia ion following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves or those with one containment isolation valve and no closed system. Condition A of this Specification addresses the condition of one containment &

isolation valve inoperable in a penetration flow path with W two containment isolation valves.

Required Action B.2 is modified by a Note that applies to valves and blind flanges lectted in high radiation areas and allows the devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

C.1 and C.2 i With one or more penetration ficw paths with one containment isolation valve inoperable or the closed system breached, the inoperable valve must be restored to OPE' TABLE status or the affected penetration flow path must be i;olated. The method of isolation must include the use of at least one (continued) l Crystal River Unit 3 B 3.6-22 Revision No, 11 l

l

Containment Isolation Valves I B 3.6.3 I

O a^scs ;

ACTIONS C.1 and C.2 (continued) isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this -

criterion are a closed and de activated automatic valve, a ,

closed manual valve, and a blind flange. A check valve may l not be used to isolate the affected penetration. Required l Action C.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion !

Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and '

the relative importance of supporting containment '

OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action C.1, the affected penetration flow path must be ,

verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring

, isolation following an accident are isolated. The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low.

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation vah e and a closed system. This Note is necessary since this Condition is i written to specifically address those penetration flow paths utilizing a closed system.

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and ,

allows these devices to be verified by use of administrative j means. Allowing verification by administrative means is ,

considered acceptable since access to these areas is i typically restricted. Therefore, the probability of misalignment of these devices, once verified to be in the proper position, is small, t l

i p (continued)

G Crystal River Unit ? B 3.6 23 Revision No. 11

Containment Isolation Valves B 3.6.3 ,

BASES i

ACTIONS [L1 1 (continued)

Intheeventoneormorecohtainment48inchpurgevalvesinl one or more penetration flow paths are no' ;$1n the purge valve leakage limits, purge valve leakage h,ust be rostored to within limits within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The specified time is a !

reasonable peiiod for restoring the n1ve leakage to within l limits, provided n '1 containment leakage rate remains within limits. Witn ne purge valve seal degraded such that leakage exceeds the limits, there is an increased potential for the same mechan;sm that caused the initial degradation to cause further degradation, if lef t unchecked, this could result in a loss of containment OPERABILITY. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is necessary to limit the length of time the plant can operate in this condition.

E.1 and E.2 If the Required Actions and associated Completion Times are not met, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least M10E 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the recuired plant conditions from full power conditions in an orcerly manner and without challenging plant systems.

SVRVEILLANCE 5R 3.6.3.1 REQUIREMENTS Each '8 inch containment purge valve is required to be verified sealed closed at 31 day intervals. This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertent or spurious o>ening of a containment purge valve. Detailed analysis of tie purge valves failed to conclusively demonstrate their ability to close during a LOCA in time to maintain offsite doses to within licensing basis limits. Therefore, these valves are required to be in the sealed closed position during MODES 1. 2, 3, and 4. A containment aurge valve that is scaled closed must have motive power to tie valve operator removed. This can be accomplished by de-energizing (continued) g Crystal River Unit 3 8 3.6-24 Amendment No. 156

Containment Isolation Valves B 3.6.3

) BASES SURVEILLANCE SR 3.6.3 d (continued)

REQUIREMENTS the source of electric power or by removing the ali supply to the valve operator. In this ap)11 cation, the term

" sealed" has no connotation of lea ( tightness. The frequency is a result of an NRC initiative, Generic Issue B-24 (Ref. 6), related to centainment purge valve use during unit operations. In the vent purge valve leakage requires entry into Condition D, Je Surveillance permits opening one purge valve in a penetration flow path to perform repairs.

SR 3.6.3.2 This SR ensures that the 6 inch post accident hydrogen purge I valves are closed as required or, if open, open for an allowable reason. The SR is not required to be met whs' the post accident hydrogen purge valves are open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be D open. The post accident hydrogen purge valves are capable l (d of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency for verifying valve position is consistent with other containment isolation valve requirements discussed in SR 3.6.3.3.

SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and required to be closed during accident conditions is closed. The SR helps to ensure that post acc. dent leakage of radioactive fluids or gases outside the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that these valves outside containment and capable of being mispositioned are in the correct position. Since verification of valve position for valves outside containment is relatively easy, a 31 day Frequency, based on engineering judgment was chosen to provide added assurance (continue..)

(JN Crystal River Unit 3 B 3.6-25 Amendment No. 156

Containment Isolation Valves B 3.6.3 BASES h SURVEILLANCE SR 3.6.3.3 (continued)

REQUIREMENTS of the correct positions. The SR specifies that valves open under administrative controls are not required to meet the SR during the time the val w s are open.

A Note modifies this SR and gplies to valves and blind flanges located in higc *a tiation creas allowing these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, ?, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these valves, once they have been verified to ee in the proper position, is low.

SR 3.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange that is located inside containment and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. For valves inside containment, the Frequency of " prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate, since these valves and flanges are typically iraccessible during reactor operation, are operated under administrative controls and the probability of their misalignment is low. The SR specifies that valves open under administrative controls are not required to meet the F3 during the time they are open.

The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these valves, once they have been verified to be in their prcper position, is smali.

(continued) g Crystal River Unit 3 B 3.6-26 Revision No. 11

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.5 REQUIREMENTS (continued) Verifying that the isolation time of each power operated and automatic containment isolation valve that is not locked, e sealed, or otherwin secured in the isolation position is within limits is rouired to demonstrate OPERABILITY. The isolation time test ' ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and frequency of this SR are in accordance with the Inservice Testing Program..

SR 3,.M 6 for 48 inch containment purge valves, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, is required to ensure OPERABILITY. Operating ex0erience has demonstrated that this type of valve seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment),

additional purge valve testing was established as part of

_O the NRC resolution of Generic Issuc B-20, " Containment

Leakage Due to Seal Deterioration" (Ref. 7).

The specified Frequencies are based on plant-specific as-found/as-left leakage rate data for these valves. The data indicates the CR-3 purge valve resilient seals do not degrade during the operating cycle with the valves in the sealed closed position. The 92 day Frequency after opening the valves recognizes the seals are prone to excessive leakage following use and is consistent with the NRC resolution of B-20.

A Note to this SR requires the results to be evaluated against the Containment Leakage Rate Testing Program. This I ensures that excessive containment purge valve leakage is properly accounted for in determining the overall containment leakage rate to verify containment OPERABILITY.

(continued)

Crystal- River Unit 3 8 3.6-27 Amendment No. 256

Containment isolation Valves B 3.6.3 l BASES

SURVEILLANCE SR 3.6.3.7 REQUIREMENTS (continued) Automatic containment isolation valves close on a containment isolation signal to prevent leakage 'of radioactive material from containment following a DBA. This SR ensures each automatic containment isolation valve that is not locked, sealed, or otherwise secured in the isolation position, will actuate to its isolation sosition on an actual or simulated actuation signal. T1e 24 month Frequency is based on the need to perform this Surveillanc.e under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance when performed at the 24 month Frequency.

Therefore, the frequency was concluded to be acceptable from a reliability standpoint.

The SR is modified by a note indicating the SR is not applicable in the identified MODE. This is necessary in order to make the requirements for automatic system response consistent with those for the actuation instrumentation.

O REFERENCES 1. FSAR, Section 5.3.1.

2. FSAR, Section 5.2.1.1 l

3. FSAR, Sections 14.2.2.

4. FSAR, Table 5-9.

5. FSAR, Section 5.3.3.1 l

6. Generic Issue B-24.

7. Generic Issue B-20.

8. 10 CFR 100.

o Crystal River Unit 3 8 3.6-28 Amendment No. 156

Reactor Building Spray and Containment Cooling Systens B 3.6.6 3 BASES (V

BACKGROUND Containment Coolina System (continued)

Upon receipt of a high reactor building pressure ES signal (4 psig), the two operating cooling fans running at high speed will automatically stop. The two cooling unit fans connected to the ES buses will automatically restart and run at low speed, provided normal or emergency power is available. In post accident operation following an actuation signal, the Containment Cooling System fans are designed to start automatically in slow speed if they are not already running. The fans are operated at the lower speed during accident conditions to prevent motor overload from the higher density atmosphere. The automatic changeover valves operate to provide Nuclear Service Closed Cycle Cooling (SW) System flow to the operating units and isolate the CI System flow.

APPLICABLE The RB Spray System and Containment Cooling System limit the SAFETY ANALYSES temperature and pressure that could be experienced following a DBA. The limiting DBAs considered are the loss of coolant

/ accident (LOCA) and the steam line break. The postulated

\ DBAs are analyzed, with regard to containment ES systems, assuming the loss of one ES bus. This is the worst-case single active failure, resulting in one train of the RB Spray System and one train of the Containment Cooling System being inoperable.

The analysis and evaluation show that, under the worst-case scenario, the highest peak containment pressure is 54.2 psig (exaerienced during a LOCA). The analysis shows that the pea ( containment temperature is 278.4'F (experienced during a LOCA). Both results are less than the design values.

(See the Bases for LCO 3.6.4, " Containment Pressure," and LC0 3.6.5, " Containment Air Temperature," for a detailed discussion.) The analyses and evaluations assume a power level of 2568 MWt, one RB spray train and one RB cooling train operating, and initial (pre-accident) conditions of 130'F and 17.7 psia. The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses, n

() (continued)

Crystal River Unit 3 8 3.6-37 Revision No. 2

Reactor Building S; ray and Containment Cooling Systems B 3.6.6 BASES g APPLICABLE The effect of an inadvertent RB spray actuation has also SAFETY ANALYSIS been ar.alyzed. An inadvertent spray actuation results in a (continued) 2.5 pssg containment pressure drop and is associated with the sudden cooling effect in the interior of the leak tight containment. Additional discussion is provided in the Bases for LCO 3.6.4.

The modeled RB Spray System actuation from the containment analyses is based on a res)onse time associated with exceeding the RB pressure.iigh High setpoint coincident with a high pressure injection start permit actuation signal to achieve full flow through the containment spray nozzles.

The Containment Spray System total response time of 90 startup seconds includes (for loss of offsite emergency) power , blockdiesel generator loading of equ (EDG)ipment, spray pump startup, and spray line filling (Ref. 2).

Containment cooling train performance for post accident conditions is given in Reference 3. The result of the analysis is that one train of RB cooling will contribute sufficient peak cooling capacity during the post accident condition in conlunction with one RB spray train to successfully lim t peak containment pressure and temperature to less than design values. The train post accident cooling capacity under varying containment ambient conditions, required to &

Reference 4. perform the accident analyses, is also shown in W The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the containment pressure high setpoint to achieve full Containment Cooling System air and safety grade cooling water flow. The Containment Cooling System total response time of 25 seconds includes signal delay, EDG startup (for loss of offsite power), and service water pump startup times (Ref 3).

The Reactor Building Spray System and the Containment Cooling System satisfy Criterion 3 of the NRC Policy Statament.

LC0 During a DBA, a minimum of one containment cooling train and one RB spray train are required to maintain the containment peak pressure and temperature below the design limits.

Additionally, one RB spray train is required to remove (continued) g Crystal River Unit 3 8 3.6-38 Revision No. 16

l l

l EFW System B 3.7.5 B 3.7 PLANT SYSTEMS l)

B 3.7.5 Emergency Feedwater (EFW) System BASES BACKGROUND The Emergency Feedwater (EFW) System is designed to provide adequate flow to one or both steam generators (OTSGs) for decay heat removal with the generators at the maximum operating pressure of 1050 psig plus suitable margin for post-accident pressure increase (Ref. 1, 2). The principal function of the EFW system is to remove decay heat from the Reactor Coolant System upon the unavailability of normal feedwater supply. This is accomplished by supplying water from the emergency feedwater tank (EFT-2) to the OTSG secondary side via the high nozzles. Steam produced in the OTSGs is condensed in the main condenser via the turbine bypass valves or, if the atmospheric dump valves (ADVs) or main steam safety valves (MSSVs) have actuated, discharged directly to the atmosphere.

The EFW System consists of one motor driven EFW pump and one steam turbine driven EFW pump, each having a nominal 100%

3 capacity (Ref. 3). The motor driven EFW pump is powered (V from the 4160 volt ES bus 3A. The turbine driven EFW pump receives steam from one main steam line per OTSG via connections upstream of the associated main steam isolation valve. An alternative source of steam is available from the fossil units, Crystal River Unit 1 and 2 (Ref.1), but cannot be relied upon to consider the EFW train OPERABLE.

The diverse motive power of the two trains enhances both system availability and reliability. The preferred water source for both EFW pump trains is the Seismic Class I, missile protected dedicated EFW tank. Backup supplies of emergency feedwater are provided by the condensate storage tank and the main condenser hotwell. The pumps tie into common discharge headers providing the capability to feed either or both of the OTSGs.

The pumps and OTSGs are protected from excessively high flow induced problems by cavitating venturis (EF-62-F0 and EF F0) in the pump discharge lines, designed to limit EFW flow to the steam generators regardless of steam generator pressure (Ref. 7).

/~T V (continued)

Crystal River Unit 3 B 3.7-23 Amendment No. 163

EFW System B 3.7.5 BASES $

BACKGROUND DC powered block and control valves are actuated to feed the (continued) appropriate steam generator by the Emergency Feedwater Initiation and Control (EFIC) System. The capacity of either EFW pump is sufficient to remove decay heat and cool the plant until the Reactor Coolant System (RCS) pressure and temperature are low enough to place the Decay Heat Removal (DHR) System in service or until core decay heat

, can be removed solely by ECCS.

NOTE For certain small break LOCA scenarios also involving a loss of offsite power, securing the motor driven EFW pump would provide capability on the emergency diesel generator to load the "A" train low pressure injection pump and other required loads (Ref 6).

O l

l l

(continued) h Crystal River Unit 3 B 3.7-23A Amendment No. 163 l NOTE - Valid Until Cycle 12 Only

EFW Systen i B 3.7.5 l 1

BASES i

i s

]

4 >

t E

J J

4 d

9 THIS PAGE INTENTIONALLY LEFT BLANK-1 t

(continued)

- Crystal River Unit 3 B 3.7-23B Amendment No. 163

EFW System B 3.7.5 BASES g BACKGROUND Automatic actuation of the EFW System occurs on the (continued) following:

1. Trip of both main feedwater pumps with reactor power greater than 20% or the NI/RPS not in shutdown bypass;

2. Low level in either OTSG;

3. Low pressure in either OTSG;

4. Trip of all four reactor coolant pumps;

5. High pressure injection (HPI) actuation on both Channel A and B Engineered Safeguards Actuation System (ESAS) channels; and

6. AMSAC actuation.

The EFIC is a " smart" system which will feed either or both OTSGs with indications of low levels, but will isolate EFW to a faulted steam generator having a significantly lower steam pressure than the other.

The EFW System is designed to ANSI B 31.1 ES Seismic Class I and in accordance with General Design Criteria 2, 4, 5,19, 44,45,and46(Ref.3,4).

APPLICABLE The EFW System is sized to provide sufficient decay heat SAFETY ANALYSIS removal capability to cooldown the RCS to the temperature and pressure at which the DHR System can be placed in service or at which core decay heat can be removed solely ,og by ECCS for any of the following events:

. loss of main feedwater (LMFW);

- LMFW with loss of offsite power; a main feedwater line break;

. main steam line break; and

. small break loss of coolant accident (LOCA),

(continued) $

Crystal River Unit 3 B 3.7-24 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

EFW System B 3.7.5 BASES APPLICABLE- The EFW System is designed to remain functional following SAFETY ANALYSES the maximum hypothetical earthquake. It will also remain (continued) functional following a single failure in addition to any of the above events with the exception of the loss of all AC power (Ref. 3) No single failure prevents EFW from being supplied to the intact OTSG nor allows EFW to be supplied to the faulted OTSG. Note that in most cases of a main feedwater break or a steam line break, the depressurization of the affected 0TSG would cause the automatic initiation of EFW. However, there will be some small break sizes for which automatic detection will not be possible. For these small breaks, the operator will have sufficient time in which to take appropriate action to terminate the event (Ref.1).

The EFW System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two independent emergency feedwater pumps and their associated flow paths are required to be OPERA ~. The O OPERABILITY of the EFW pumps requires that each be capable of developing its required discharge pressure and flow.

The OPERABILITY OF ASV-5 is addressed by Condition B. The UPERABILITY of ASV-204 is a portion of EFP-2 OPERABILITY "

and is addressed as by Condition D.

The motive power for the turbine driven pump is steam supplied from either OTSG from a main steam header upstream of the main steam isolation valves so that their closure does not isolate the steam sup)1y to the turbine. Both steam supply flow paths througi MSV-55 and MSV-56 (Condition A) to the turbine driven pump are required to be OPERABLE.

The OPERABILITY of the associated EFW flow paths requires all valves be in their correct positions or be capable of actuating to their correct positions on a valid actuation signal.

1

~

(continued)

Crystal River Unit 3 -B 3.7-25 Amendment No. 163 NOTE - Valid until Cycle 12 Only

EFW System B 3.7.5 BASES LCO In certain small break LOCA scenarios, as;uming the single (continued) failure as the loss of "B" train Class lE direct current power, manual operator action would be taken to maintainsteam generator cooling by feeding the steam generators using the turbine driven EFW pum). In this circumstance; manual operator action would se taken to NM close the "B train EFW isolation valves, and open the crosstie valve EFV-12 (Condition C and feed the steam generators via,the "A" train flow pa)lh.

Inoperability of the EFW System may result in inadequate decay heat removal follewing a transient or accident during which main feedwater is not available. The resulting RCS heatup and pressure increase can potentially result in significant loss of coolant through the pressurizer code safety valves or the PORV.

APPLICABILITY In MODES 1, 2 and 3 the EFW System is required to be OPERABLE and to func{ ion in the event that main feedwater is lost. In addition, the EFW System is required to supply enough makeup water to replace the secondary side inventory lost as the plant cools to MODE 4 conditions.

In MODES 4 5, and 6 the OTSG need not be used to cooldown the RCS. therefore,theEFWSystemisnotrequiredtobe OPERABLEintheseMdDES.

ACTIONS ad With one of the two steam supplies to the turbine driven EFW action must be taken to restore the steam pump inoperable supply to OPERA $lE status within 7 days. Allowing 7 days in this Condition is reasonable, based on the redundant OPERABLE steam supply to the pump and the low probability of an event occurring that would require the inoperable steam supply to the turbine driven EFW pumps.

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be entered during any continuous failure to meet this LCO. The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which other Conditions are entered concurrently. The !""

'A bo_N]' connectorTimes between 7 days and 10 daysand dictates that t1 Completion apply simultaneously, the more restrictive must be met.

(continued) h Crystal River Unit 3 B 3.7-26 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

EFW System B 3.7.5-BASES ACTIONS B.d (continued)

If ASV-5 is inoperable, prompt action must be taken to restore ASV-5 to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the EFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

The second Completion Time for Required Action B.1 established a limit on the maximum time allowed for any combination of Conditions to be entered during any

. cor+iruous failure to meet this LCO. The 10 day Completion Ti provides a limitation time allowed in this specified

r. .cion after discovery of failure to meet the LCO.

. limit is considered reasonable for situations in which other Conditions are entered concurrently. The

'MQ' connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that moit both Completion Times apply simultaneously, and the more restrictive must be met.

' b If ASV-204, EFV-12, or EFV-13 is inoperable, prompt action must be taken within I hour to ensure the following ara OPERABLE:

- Train "B" Emergency Diesel Generators (TS 3.8.1)

Train "B": AC Electrical Power Distribution Subsystem (TS3.8.9),and

- Train "B" AC Vital Bus Subsystem (TS 3.8.9)

Consistent with the Bases for Surveillance 3.0.1, j' OPERABILITY is verified by ensuring the associated surveillance (s) has been satisfactorily completed within the required frequency and the equipment is not otherwise known to be inoperable.

If the above Train "B" equipment is not OPERABLE with ASV-204, EFV-12, or EFV-13 inoperable, the capability to remove sufficient core decay heat cannot be assured and Condition F is applicable.

(continued)

Crystal River Unit 3 B 3.7-27 Amendment No. 163 NOTE - Valid Until Cycle 12 Only -

EFW System B 3.7.5 BASES $

ACTIONS Gd (continued)

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time to verify the above Train "B" equipment as OPERABLE ensures that prompt action will be taken to confirm ce*e decay heat removal capability. The Completion Time mini 'zes the time the plant is potentially exposed to a LOCA in these conditions.

L.2 If ASV-204, EFV-12, or EFV-13 is inoperable, prompt action must be taken to restore the valves to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the EFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

NOTE The second Completion Time for Required Action C.2 established a limit on the maximum time allowed for any combination of Conditions to be entered during any continuous failure to meet this LCO. The 10 day Completion g

Tic.o prcvides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which other Conditions are entered concurrently. The 'MQ' connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

DJ If the turbine driven EFW pump or associated flow path is inoperable, prompt action must be taken within I hour to ensure the following "B" train systems are OPERABLE:

- SWP-1B (TS 3.7.7),

Train "B" of the Nuclear Services Seawater System (TS 3.7.9),

CHHE-1B and CHP-1B (TS 3.7.18)

(continued) h Crystal River Unit 3 B 3.7-27A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

EFW System

B 3.7.5 O 8^SES ACTIONS M (continued)

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s has been satisfactorily completed within the required freque)ncy and the equipment is not otherwise known to be inoperable.

If the above listed "B" train components are not OPERABLE with the turbine driven EFW pum) or associated flow path inoperable, the capability for EDG load management to improve small break LOCA mitigation can not be assured and Condition F is applicable.

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time to verify the cbove listed "B" train components as OPERABLE ensures that prompt action will be taken to confirm EDG load management. The Completion Time minimizes the time the plant is potentially exposed to a "

LOCA in these conditions.

O "

If the turbine driven EFW pump or associated flow path is 4 inoperable, prompt action must be taken within I hour to ensure both trains of the following are OPERABLE:

- ECCS (TS 3.5.2 ,

- Decay Heat Clos)ed Cycle Coolin Water (TS3.7.8),

- Decay Heat Seawater (TS 3.7.10 ,

- Emergency Diesel Generators (T 3.8.1),

- AC Electrical Power Distribution Subsystems (TS 3.8.9),

and AC Vital Bus Subsystems (TS 3.8.9)

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance s 4 -

required freq(ue)ncy and the equipment is not otherwise knownhas b to be inoperable.

If both trains of the above equipient are not OPERABLE with

~

the turbine driven EFW pur.ip or associated flow path inoperable, the capability to remove. sufficient core decay heat can not be assured and Condition F is applicable.

g

( (continued)

Crystal River Unit 3 B 3.7-278 Amendment No. 163 NOTE -Valid Until Cycle 12 Only

EFW Systea B 3.7.5 BASES g ;

ACTIONS U (continued) l 1

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time to verify both trains of the above equipment as OPERABLE ensures that prompt action will be taken to confirm core decay heat removal capability. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.

M If the turbine driven EFW pump or associated flow path is inoperable, action must be taken to restore the required equipment to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the motor driven EFW pump, time needed for repairs, and the low probability of a DBA occurring during this time period. N The second Completion Time for Required Action D.3 establishes a limit on the maximum time allowed for any &

W combination of Conditions to be entered during any continuous failure to meet this LCO. The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which other Conditions are entered concurrently. The 'NLQ' connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

(continued) h Crystal River Unit 3 B 3.7-27C Amendment No. 163 NOTE - Valid Until Cycle 12 Only

I EFW System l B 3.7.5 j l

O bases l ACTIONS L1 (continued)

If the motor driven EFW ) ump or associated flow path is NOTE inoperable, action must se taken to restore the required equipment to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the EFW pump, time needed for repairs, and the low probability of a DBA occurring during this time period. 1 NOTE The second Completion Time for Required Action E.1 1 NoiE establishes a limit on the maximum time allowed for any combination of Conditions to be entered during any continuous failure to meet this LCO. The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which other Conditions are entered concurrently. The 'eMl' l NOTE connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

F.1 and F.2 O)

C NOTE If Required Actions A.1, B.1, C.1, C.2, D.1, D.2, D.3, or E.1 cannot be completed within the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not appl.s. To achieve this status, the plant must be placed in at le c' MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , b ellowed Completion Times are reasonable, based on operating experience, to reach the recuired plant conditions from full power conditions in an orcerly manner and without challenging plant systems.

El l NOTE With both EFW trains inoperable, the plant is in a seriously degraded condition with no safety related means for conducting a cooldown. In such a condition, plant operation should not be perturbed by a forced action, including a power change, that might result in a trip. For this reason, the Technical Specifications do not mandate a plant shutdown. Rather the ACTIONS allow the plant to dictate the most prudent course of action (including plant shutdown) for the situation. The seriousness of this condition requires tnat action be initiated immediately to restore at least one EFW train to OPERABLE status.

/m d

(continued)

Crystal Giver Unit 3 8 3.7-27D Amendment No. 163 NOTE - Valid Until Cycle 12 Only

i EFW System B 3.7.5 BASES $

SURVEILLANCE SR 3.7.S.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in ine EfW water and steam supply flow paths provides usurance that the proper flow paths exist for EFW operation. The valves verified by this SR include valves in the main flow paths and the first normally closed valve in a branch line. This SR does not apply to valres that are locked, sealed, or otherwise secured in posit.on, since those valves are verified to be in the correct position prior to locking, sealing, or securing. There are several other exceptions for valve position verification due to the low potential for these ty)es of valves to be mispositioned. The valve types witch are not verified as part of this SR include vent or drain valves outside the RB, relief valves outside the RB, and instrumentation valves (bothinsideandoutsidetheRB). This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves.

This Surveillance does not require any testing or valve manipulation, rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. The 45 day frequency is based on g

engineering judgment and is consistent with the Frequency established for SR 3.7.5.2. SR 3.7.5.2 requires extensive EFW valve manipulation in order to perform the pump flow rate verification, such that a flow path verification is necessary following each performance.

SR 3.7.5.2 This SR verifies that the EFW pumps develop sufficient discharge pressure to deliver the required flow at the full open pressure of the MSSVs. Because it is undesirable to (continued) h Crystal River Unit 3 8 3.7-28 Amendment No. 163

l EFW System

-B 3.7.5 O Basts !

SURVEILLANCE SR 3.7.5.5 (continued) i i

REQUIREMENTS '

of EFW flow paths must be demonstrated before sufficient core heat is generated that would require the operation of :

the EFW System during a subsequent shutdown. The frequency is reasonable, based on engineering judgment, in view of other administrative controls to ensure that the flow paths are OPERABLE. To further ensure EFW System alignment, flow path OPERABILITY is verified, following extended outages to determine no misalignment of valves has occurred. This SR

ensures that the flow path from the EFW tank to the uiSGs is properly aligned. This requirement is based upon the recommendation of NUREG 0737. The Frequency was modified slightly during ITS development (prior to entering MODE 2) to provide an SR 3.0.4 type exception. As written, the SR allows the plant to achieve and maintain MODE 3 conditions '

in order to perform the verification.

REFERENCES 1. Enhanced Design Basis Document for the Emergency Feedwater and Emergency Feedwater Initiation and Control O System, Revision 1, dated September 27, 1991 with O

Temporary Changes 156, 230, 247, and 249.

2. BAW-10043, " Overpressure Protection for B&W Reactors",

dated May 1972.

3. FSAR, Section 10.5.

4. 10 CFR 50, Appendix A.

5. ASME, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Subsection IWP.

6. FTI 51-1266138-01, Safety Analysis Input to Startup NOTE Team Safety Assessment.

7. FPC calculation 187-0008, Rev. 5. I O

V Crystal River Unit 3 B 3.7-31 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

Emergency Feedwater Tank B 3.7.6 B 3.7 PLANT SYSTEMS g B 3.7.6 EmergencyFeedwaterTank(EFT-2)

BASES BACKGROUND The function of the emergency feedwater (EFW) tank is to provide a safety grade sourc: of water for the removal of decay and sensible heat from the Reactor Coolant System (RCS) and reactor core following an event requiring EFW System operation. The EFW tank provides a gravity feed to the EFW ) umps, which su) ply the driving head necessary to inject tie water into tie steam generators Within the OTSGs, heat from the RCS is transferred (OTSGs).

to the secondary coolant, which boils and is subsequently discharged to the atmosphere via the main steam safety valves (MSSVs) or atmospheric dump valves. If the main steam isolation valves (MSIVs) are open, the preferred, non-safety grade means of decay heat removal is to discharge the generated steam to the main condenser via the turbine bypass valves. This has the advantage of conserving condensate while minimizing radioactivity releases to the environment.

The EFW tank provides the secondary coolant necessary for the Emergency Feedwater System to function to remove heat from the RCS during accident conditions. It is tornado hardened, Seismic category I and, therefore, designed to

. Additionally, the tank is withstand enclosed by earthquakes (Ref. 1)d, seismically qualified a missile protecte concrete structure which provides not only tornado missile protection, but also protection from environmental effects such as wind and wave loads (Ref. 2). The EFW tank has an overall capacity of 184,000 gallons, and a minimum dedicated volume of 150,000 ge'lons of condensate quality water. Two other sources of condensate quality water are available to effect the removal of decay heat and sensible heat: the condenser hotwells (150,000 gallon combined surveillance capacity) and the condensate storage tank (120,000 gallon surveillance capacity . Fire Service Water Storage Tanks have a 600,000 gallon) surveillance water capacity available for natural circulation cooldown after using condensate quality water.

APPLICABLE The EFW System provides water to the OTSGs to remove decay SAFETY ANALYSIS heat and establish RCS natural circulation conditions following certain design basis events. Although the capacity of the EFW tank (continued) h Crystal River Unit 3 8 3.7-32 Revision No. 16

.. .. =. - - - . - . - _ _ -_ .. . - -

Emergency Feedwater Tank B 3.7.6 O 8^sts APPLICABLE was not used as an input to these safety analyses, SAFETY ANALYSES OPERABILITY of the EFW System, and therefore the (continued) EFW tank, is essential to the mitigation of the following events (Ref. 3):

Loss of main feedwater (LMFW)

. LMFW with a loss of offsite power

. Main feedwater line break

. Main steam line break Small break loss of coolant accident (LOCA)

The required minimum volume of usable condensate in the EFW tank is 150,000 gallons. This amount-is sufficient to remove decay heat for a period of approximately 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months at l MODE 3 conditions (Ref. 4). This time period is considered adequate to allow plant conditions to be stabilized and another source of water to be made available for natural circulation cooldown until MODE 4 is achieved. In MODE 4, the RCS pressure will be decreased to the soint that allows the alignment of the Decay Heat Removal (DiR) System to the RCS.

Although the single failure criteria is applicable to the Q EFW System in the evaluation of the previously mentioned v events, the EFW tank performs its safety function in a passive manner and is thereby excluded from application of the single failure criterion.

The EFW tank satisfies Criterion 3 of the NRC Policy Statement.

LC0 In the event of a loss of offsite power, or other condition resulting in a complete loss of main feedwater, a means of removing heat from the RCS must be immediately available.

The EFW tank minimum usable water volume limit of 150,000 gallons is necessary to provide assurance that the EFW System can su) ply the volume of secondary coolant needed to remove decay leat in MODE 3 conditions for approximately 18 l hours (Ref. 4) while other sources of water are made available for subsequent cooldown to below 280 degrees, if

- required.

Compliance with the LC0 is verified by maintaining tank level at or above the minimum required level.

O (continued)

Crystal River Unit 3 8 3.7-33 Revision No. 16

Emergency Feedwater Tank B 3.7.6 BASES (continued) $

APPLICABILITY In h0 DES 1, 2, and 3 the OTSGs are the operating heat sink for RCS heat removal. The EFW system, and thus, the EFW tank must be OPERABLE during these MODES, to assure the availability of a safety grade means of RCS heat removal following any event which results in a loss of main feedwater. In MODES 4, 5, and 6, the EFW Tank water volume is not required to be within limits consistent with the requirements for EFW System OPERABILITY.

ACTIONS A.1 and A.2 As an alternative to restoring the EFW Tank volume to within limit, the OPERABILITY of the backup water supply can be verified within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter.

The OPERABILITY of the backup feedwater sup)1y must include verification, by administrative means, of tie OPERABILITY of flow paths from the backup supply to the EFW pumps and availability of the required volume of water in the backep supply. Typically, the condensate storage tank is the preferred back-up since the volume in this tank is available without the time delay essociated with having to ' break' condenser vacuum in the hotwells. g The EFW Tank volume must be restored to within limit within 7 days because the backup supply is not designed to the same criteria as the EFW tank and may be fulfilling the requirements of this Specification in addition to its normal operational functions. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on o)erating experience, to verify the OPEPABILITY of the baccup water supply. The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period, requiring the use of the water from the EFW Tank.

B.1 and B.2 If the EFW Tank volume cannot be restored to within limit in the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be ) laced in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , ar.d in MODE 4 wit 11n 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

O (continued)

Crystal River Unit 3 B 3.7-34 Amendment No. 149

SW System B 3.7.7 BASES.

BACKGROUND for certain small break LOCAs with a concurrent loss of (continued) .offsite power, securing SWP 1A and RWP 2A to provide-capability on the emergency diesel generator to load the "A" train low pressure injection pump and:other required loads. These pumps would be manually secured and locked note out to preclude automatic reinitiation. In these situations, SWP-1B and RWP-2B are relied upon to provide-continued flow for the SW and Nuclear Services Seawater systems.

O 1

3 1

e t

1 (continued)

Crystal River l Unit 3 B 3.7-36A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

-_ _ . __ _ __ ...___ _ _ ,__ ___ __ ~. _ . _ - . .. .

SW System B 3.7.7 BASES g 1

THIS PAGE INTENTIONALLY LEFT BLANK 1

i, J

(continued) h i

- Crystal kiver Unit 3 8 3.7-368 Amendment No. 163 i

4 d

= , - - , , , . , , . _ , r_ , , , , , , _ . . _

SW System B 3.7.7 O BASES (continued)

APPLICABLE The SW System provides cooling for components essential for SAFETY ANALYSIS the mitigation of design basis accidents. An ESAS signal will start both emergency SW pumps (each pump is actually two pump assemblies driven by a single motor), transfer cooling of the containment fan assembly cooling coils and fan motors from the Cl System to the SW System, and isolate various non-essential loads. The two emergency pumps (100 percent capacity each), in conjunction with the three heat exchangers required to be OPERABLE by this LCO, provide the necessary capability for cooling the motor-driven EFW pump, containment fan assembly cooling coils and fan motors, spent fuel pool, SW and Nuclear Services Seawater System pump motors, and other equipment which must function following an accident.

By supplying the containment fan assembly cooling coils and fan motors following a LOCA, the SW System and the Reactor Building Spray System act in conjunction to ensure the pressure and temperature in containment are maintained less than the design limits. The OPERABILITY of the Reactor Building Spray System is ad&essed by LC0 3.6.6.

The Nuclear Services Closed L8 :e Cooling Water System (nj satisfies Criterion 3 of the NkC Policy Statement.

LCOs The requirement for OPERABILITY of both emergency SW pumps and thres of four SW heat exchangers in MODES 1 through 4 provides sufficient capacity to ensure adequate post-accident heat removal, considering a worst case single active failure. Each emergency SW aump is powered from a separate 4160 V ES bus. Each of tie two sets of emergency SW pumps is capable of supplying 100 percent of the recuired system flow. Each heat exchanger is rated at one-thirc the total required system flow, thus 3 are required to be OPERABLE for this LC0 (Ref. 2).

APPLICABILITY In MODES 1, 2, 3, and 4, the SW system is a normally operating system that must be capable of performing its post-accident safety functions, which include providing cooling water to components required for Reactor Coolant System (RCS) and containment heat removal, equipment essential to safely shutdown the plant, and equipment required for adequate spent fuel pool cooling, p

V (continued)

Crystai River Unit 3 B '.7-37 Amendment No. 149

SW System B 3.7.7 BASES g APPLICABILITY Three of the four heat exchangers must be OPERABLE to (continued) accommodate the design system heat load requirements.

In MODES 5 and 6, the SW System is not required to be OPERABLE due to the limitations on RCS temperature and pressure in these MODES. Additionally, there are no other Technical Specification LCOs supported by SW which are applicable during these plant conditions.

ACTIONS A.1 and A.2 With SWP 1B inoperable, prompt action must be taken within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to ensure that sufficient capability is available on "A" train emergency diesel generator for SWP-1A in certain small break LOCA scenarios. In such circumstances, the motor driven emergency feedwater pump would be secured and the turbine driven emergency feedwater pump and associated flow path would be required OPRABLE to provide steam generator cooling. If the tur.)ine driven emergency feedwater pump is not OPERABLE to aermit securing motor a driven emergency feedwater pump, tie ca) ability for EDG load management to improve small break .0CA mitigation &

cannot be assured and Condition C is applicable. The W operability of the turbine driven emergency feedwater pump is not required in MODE 4.

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s) has been satisfactorily completed within the required frequency and the equipment is not otherwise known to be inoperable.

Due to the severity of the consequences should a small bruk LOCA occur in these conditions, the I hour Completion Time to verify the turbine driven emergency feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to confirm EDG load management capability for small break LOCA mitigation improvement. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time for restoring SWP-1B OPERABILITY is consistent with other ECCS Specifications for a loss of redundancy Condition and, has been shown to maintain a suitable limit on risk. As such, this Completion Time is based on engineering judgment and is consistent with industry-accepted practice.

(continued) h Crystal l'iver Unit 3 B 3.7-38 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

SW System B 3.7.7 O 8^sts ACTIONS B.d

-(continued) ett WithSWP-1Aand/oroneoftherequiredheatexchangers inoperable, the heat removal capacity of the SW System is degraded. In thi., Condition,-adequate cooling of the containment and ES equipment served by SW cannot be assured following an accident coincident with a worst-case single active failure. Therefore, action must be taken to restore the affected component (s) to OPERABLE status. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time for restoring full SW System OPERABillTY is consistent with other ECCS Specifications for a loss of redundancy Condition and, has been shown to maintain a suitable limit on risk. As such, this Completion Time is based on engineering judgment and is consistent with industry-t.ccepted practice.

C.1 and C.2 l NOTE If the innperable SW com)onent(s) cannot be restored to OPERABLE status within tie associated Com)letion Time, the plant must be placed in a MODE in which tie LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36

-] hours. The Completion Times are reasonable, based on operating experience, to reach the required plant conditions-from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the SW finw to individual components may render those components inoperable, but does not affect the OPERABILITY of the SW System.

(continued)

Crystal River Unit 3 B 3.7-38A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

SW System B 3.7.7 BASES h L

l

\

r THIS PAGE INTENTIONALLY LEFT BLANK (continued)

Crystal River Unit 3 B 3.7-38B Amendment No. 163

DC Systea B 3.7.8 O B 3.7 etun Sv5 = S B 3.7.8 Decay Heat Closed Cycle Cooling Water System BASES BACKGROUND The Decay Heat Closed Cycle Cooling Water (DC) System facilitates the removal of decay heat from the reactor core.

The system also removes process and operating heat from safety related components associated with decay heat removal during normal plant cooldown and following a transient or accident. During plant cooldown below ap3roximately 250'F the DC system provides core heat removal )y transferring heat Seawater Heat from the Decay System,HeatlheRemoval (DHR)ivided system is d into twoSystem to the Dec independent and redundant trains, each capable of supplying 100 percent of the required normal and post accident cooling. Each train contains a pump, a surge tank pressurized with nitrogen for volume and pressure control, and a heat exchanger which removes heat from the DHR system and rejects it to the Decay Heat Seawater System.

The design and operation of the DC system, along with a list of the components served, can be found in FSAR Section

]' 9.5.2.2 (Ref. 1). For normal operation the DC ) umps are started manually. However, in an emergency bot) DC pumps start automatically upon receipt of an Engin*ered Safeguards

) ActuationSystem(ESAS). The DC system supports long-term reactor decay heat removal following a loss of coolant accident (LOCA) when the Emergency Core Coo'.ing Systew (ECCS) is recirculating water from the RB sump to the reacter core through the DH heat exchanger. The DC System also support

sost accident containment cooling by supplying cooling watei to the reactor building spray aump motor coolers and bearings. Other inads supplied )y this system are the DHR (LPI) pumps and motors, DC and decay heat seawater pump motors and two of the three make up and purification (HPI)pumpmotors. The DC System supplies cooling to these pump motor heat exchangers, lube oil coolers, gear lube oil coolers, bearings, or air handling units to prevent overheating of the associated components (Ref 3).

Certain small break LOCA scenarios require emergency feedwater to maintain steam generator cooling until core a decay heat can be removed solely by ECCS cooling.

Further, with the turbine driven EfW pump or associated flow pach 3

(V (continued)

Crystal River Unit 3 0 3.7-41 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

I DC System B 3.7.8 BASES h, BACKGROUND inoperable, SWP-1B, train "B" of the Nuclear jervices (continued) as well as both 5zawater System, trains of ECCS, CHHE-18, Decay and Cyc Heat Closed CHP-1B,le Cooling Water, Decay Heat Seawater, Emergency Diesel Generators, AC W Electrical Power Distribution Subsystems, and AC Vital Bus Subsystems are required OPERABLE.

As a closed system, the DC System also serves as ar intermediate barrier to radioactivity releases to the environment from potential leaks in interfacing systems.

APPLICABLE The DC system provides coolir for components essential to SAFETY ANALYSIS the mitigation of plant transa nts and accidents. An ESAS initiation signal will start both DC pumps. This ensures that the required ccoling capacity is provided to the essential equipment following a steam line break, steam generator tube rupture, makeup system letdown line failure, or LOCA. The running pumps (100 percent capacity each) conjunctionwithanassociatedDCheatexchanger,rejec{in heat to the Decay Heat Seawater System to ensure the necessary cooling flow to components required for reactor decay heat removal. By cooling the RB spray pumps and pump motors following a LOCA or SLB, the DC system supports the RB Spray System by ensuring the pressure and temperature in g

containment are maintained within acceptable limits. The OPERABILITY of the RB Spray System is addressed in LC0 3.6.6, " Reactor Building Spray and Containment Cooling Systems, Durina normal and post-accident cooldown operations, when RCS umperature and pressure are reduced to allow the alignment of the DHR System to the RCS, DC System operation facilitates core heat removal by transferring heat from the DHR System to the Decay Heat Seawater System.

The Decay Heat Closed Cycle Cooling Water Syst m satisfies Cf;terion 3 of the NRC Policy Statement.

LCO The requirement for two DC trains to be OPERABLE assures adequate normal and post-accident heat removal from the reactor core and essential components, considering a worst case single active failure. One of the OPERABILITY considerations regarding these independent and redundant trains is that each valve in the flow path be in the correct post-accident position. Additionally, each DC pump must be capable of being powered from its emergoney power supply and be capable of automatically starting on an ESAS actuation.

O (continued)

Crystal River Unit 3 B 3.7-42 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

DC Systen B 3.7.8 ,

h BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, the DC System is not a normally operating system, but must be capable of performing its post accident safety functions, which include providing ;

cooling water to components required for RCS and containment i

heat removal. Two independent 100 percent capacity DC trains must be OPERABLE to accommodate the design system heat load requirements and satisfy reliability considerations assuming a single failure. ,

4 In MODE 4, although RCS temperature and r n sra are i reduced, there remains sufficient stored mergy that the occurrence of an accident would necessitate the post-accident cooling functions of the DC System. When temperature and pressure have been reduced sufficiently to allow alignment of the DHR System to the RCS, the DC System is no longer required for post accident component cooling, but must continue to provide cooling to the DHR heat exchangers. Therefore, two trains of the DC System must remain OPERABLE throughout MODE 4 to ensure emergency preparedness and/or decay heat removal, assuming a single active failure.

in H0 DES 5 and 6, the DC System is in operation performing dec- deca > heat re 'a-O it aor '

various means r tx of '#actiaa 6 are addressed in LCO 3.4.6, "RCS Loops removing ar acs reactor MODE 5, Loops ovai-y heat in M

Filled"; LCO 3.4.7, "RCS Loops MODE 5, Loops Not filled";

LCO 3.9.4, "DHR and Coolant Circulation High Water level";

- and LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level". In olhar words, the OPERABILITY requirements for the DC System are determined by the systems it supports.

Therefore, this LCO is not applicable in MODES 5 and 6.

ACTIONS A.1 and A.2 With one DC train inoperable, prompt action within I hour is necessary to ensure that the turbine driven emergency feedwater pump and associated flow path are available for steam generator cooling. If the turbine driven emergency a feedwater pump and associated flow path are not available, i the capability for core decay heat removal has not been assured and Condition B is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4.

(continued)

Crystal River Unit 3 8 3.7-43 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

__ _ _ _ . ~ ._ _ _ . . _ ~ _ _ _ _ . _ _ . . , _ _ _ _ . . - .. _.

DC Systea B 3.7.8 BASES $

ACTIONS A.1 and A.2 (continued)

Consistent with the Bases for Surveillar:ce 3.0.1, OPERABILITY is verified by ensuring the associated surveillance s) has been satisfactorily completed within the required (frequency and the equipment is not otherwise known to be inoperable.

Due to the severity of the consequences should a small mott break LOCA occur in these conditions, the I hour Completion Time to verify the turbine driven emergency feedwater pump and associated flow path are OPERA 3LE ensures that prompt action will be taken to confirm core decay heat capability. The Completion Time minimins the time the plant is potentially exposed to a LOCA in these conditions.

Required Action A.2 is modified by a Note indicating that I natt the applicable Conditions and Required Actions of LCO 3.4.5, "RCS Loops H0DE 4," be entered if an inoperable DC train results in an inoperable required DHR loop. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for an inoperability of a required DlR loop.

With one DC train inoperable, action must be taken to restore the train to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In g

this Condition, the remaining OPERABLE DC train is adequate to perform the heat removal function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time for restoring full DC System OPERABILITY is the same as that for the ECCS Syster.s, whose safety functions are supported by the DC System. This Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train and the low probability of a DBA occurring during this period.

B.1 and 0.2 If the ino)erable DC train cannot be restored to OPERABLE status wit 11n the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be ) laced in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 witiin 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued) h Crystal River Unit 3 8 3.7-44 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

DC Systen B 3.7.8 .

T

'^5 "

O SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This_SR is modified by a Note indicating that the isolation of the DC flow to individual components may render those components inoperable, but does not affect the OPERABILITY of the DC System.

V9rifying the correct alignment for manual and power o;mrated valves in the SW flow path provides assurance that t1e proper flow paths exist for DC operation. This SR does ,

not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the sealing, or securing.

correct position The valves prior verified byto locking,lude this SR inc valves in the main flow paths and the first normally closed valve in a branch line. There are several other exceptions for valve position verification due to the low potential for these types of valves to be mispositioned. The valve types which are not verified as ) art of this SR include vent or drain valves outside the AB, relief valves outside the RB, and O

t O <continoed)

Crystal River Unit 3 8 3.7 44A Amendment No. 163

OC Systea B 3.7.8 dASES $

TH15 PAGE INTENTIONALLY LEFT BLANK (continued) h Crystal River Unit 3 B 3.7-44B Amendment No. 163

Nuclear Services Seaweter Systen i B 3.7.9 O 8^5c5

DACKGROUND The Nuclear Services Seawater System is designed to seismic (continued) category I requirements, except for the standpipe drain line. The design and operation of the Nuclear Services Seawater System along with a list of components served by SW during normal and emergency conditions, can be found in FSAR Section9.5(Ref.2). Following an Engineered Safeguards Actuation realigned to System provi (de a reliable source of cooling toESAS) actuatio essential safeguards equipment which may be' supplied by non-safety cooling water systems during normal operations. To ensure these additional heat loads can be accommodated, both emergency pumps are started simultaneously by an ESAS signal to provide adequate cooling in the event of a single active failure which disables one emergency pump.

For certain small break LOCAs with a concurrent loss of offsite power, securing SWP-1A and RWP-2A would provide capability on the emergency diesel generator to load the "A" train low pressure injection pump and other required loads. These pumps would be manually secured and locked out to preclude automatic reinitiation. In these "

situations, SWP-1B and RWP 2B are relied upon to provide continued flow to the SW and Nuclear Services Seawater

' systems.

APPLICABLE The Nuclear Services Seawater System supports the SW System SAFETY ANALYSES in providing cooling for components essential to the mitigation of plant transients and accidents. The system has two separate 100 percent capacity underground intake conduits, independent emergency pumps, and underground discharge conduits to allow for a single failure while still providing the required flow. An ESAS signal will start both

emergency pumps. This ensures the required cooling capacity 1: provided to the SW System following a steam line break, steam generator tube rupture, makeup system letdown line failure, or loss of coolant accident.

The Nuclear Services Seawater System satisfies Criterion 3 of the NRC Policy Statement.

l 0 .

(continued)

Crystal River Unit 3 B 3.7-47 Amendment No. 163 NOTE - Valid Until Cycle 12 Only ,

Nuclear Services Seawater System B 3.7.9 BASES (continued) $

LC0 The requirement for the OPERABILITY of the Nuclear Services Seawater System including two emergency nuclear services seawater pumps provides redundancy necessary to ensure the system will provide adequate post-accident heat removal in the event of a coincident single failure.

Emergency nuclear services seawater pump OPERABILITY requires that each be capable of being powered from separate OPERABLE emergency buses. OPERABILITY of the associated flow paths requires that each valve in the flow path must be aligned to permit sea water flow from the intake canal to the SW heat exchangers, and subsequently to the discharge canal. The OPERABILITY of the SW heat exchangers, recuired to ensure proper heat removal capability, is addressec in LC0 3.7.7, " Nuclear Services Closed Cycle Cooling Water System".

APPLICABILITY In MODES 1 through 4 the SW and Nuclear Services Seawater Systems are normally operating systems which must be prepared to provide post accident cooling for components required for RCS and containment heat removal, equipment essential in providing the capability to safely shutdown the g

plant, and equipment required for adequate spent fuel pool cooling. The Nuclear Services Seawater System must be capable of providing its )ost-accident cooling assuming a singlo active failure. Tierefore, both emergency pumps are required to be OPERABLE during these MODES.

In MODES 5 and 6, the Nuclear Services Seawater System is not required to be OPERABLE due to the limitations on RCS temperature and pressure in these MODES. Additionally, there are no other Technical Specification LCOs supported by the system which are applicable during these plant conditions.

ACTIONS A.1 and A.2 With train "B" of the Nuclear Services Seawater System "

inoperable, prompt action must be taken within I hour to ensure that sufficient capability is available on "A" train (continued) h Crystal River Unit 3 B 3.7-48 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

1 1

Nuclear Services Seawater Systea !

B 3.7.9 !

O Basts ACTIONS L1 and A.2 (continued) of emergency diesel generator for RWP-2A in certain small break LOCA scenarios. In such circumstances, the motor driven emergency feedwater pump would be secured and the turbine driven emergency feedwater pump would be required OPERABLE to provide steam generator cooling. If the turbine driven emergency feedwater pump is not OPERABLE to permit secur.ng motor driven emergency feedwater pump, the capability for EDG load management to improve small break LOCA mitigation can not be assured and Condition C is applicable. The operability of the turbine driven emergency feedwater pump is not required in Mode 4.

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated a surveillance (s)hasbeensatisfactorilycompletedwithin the required frequency and the equipment is not otherwise known to be inoperable.

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time O to verify the turbine driven emergency feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to confirm EDG load management capability.

The Completion Time minimizes the time the plant is

>otentially exposed to a LOCA in these conditions. The 72 1our Completion Time for restoring full Nuclear Services Seawater System OPERABILITY is consistent with that for ECCS Systems, whose safety functions are supported by the system.

This Completion Time is based on engineering judgment and is consistent with accepted industry-accepted practice.

L.1 With train "B" of the Nuclear Services Seawater System inoperable, action must be taken to restore the pump to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time for restoring full Nuclear Services Seawater System OPERABILITY is consistent with that for ECCS Systems, whose safety functions are supported by the system. This Completion Time is based on engineering judgement and is consistent with accepted industry-accepted practice, b (continued)

Crystal River Unit 3 B 3.7-48A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

tiuclear Services Seawater System B 3.7.9 BASES THIS PAGE INTENTIONALLY LEFT BLANK (continued) h Crystal River Unit 3 8 3.7-48B Amendment No. 163

Nuclear Services Seawater Systea B 3.7.9 O BASTS !<

l C.1 and C.2 l mt ACTIONS (coatinued) i If the inoperable emergency nuclear services seawater pump '

cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which i the LCO does not apply. To achieve this status, the plant i

must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The Completion Times are reasonable, .

based on operating experience, to reach the recuired plant !

conditions from full power conditions in an orcerly manner t and without challenging plant systems, SURVEILLANCE SR 3.7.9.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the seawater flow to individual components may render those components inoperable, but does not affect the OPERABILITY of the Nuclear Services Seawater System.

Verifying the correct alignment for manual valves in the i nuclear services seawater flow path provides assurance that O the proper flow paths exist to support SW operation. This SR does not apply to valves that are locked, sealed, or i

otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. The valves verified by this SR include valves in the main flow paths and the first normally closed valve in a branch line. There are several other exceptions for valve position verification due to the low potential for these types of valves to be mispositioned. The valve types which are not verified as part of this SR include vent or drata valves, relief valves, instrumentation valves, and sample '

line valves. This SR also does not apply to valves which cannot be inadvertently misaligned, such as check valves.

This Surveillance does not require any testing or valve manipulation rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.

The 31 day frequency is based on engineering judgment, is consistent with the procedural controls governing valve '

operation, and ensures correct valve positions.

O continued)

Crystal River Unit 3 B 3.7 49 Amendment No. 163 ,

NOTE - Valid Until Cycle 12 Only

Nuclear Services Seawater System B 3.7.9 BASES $

SURVEILLANCE SR 3.7.9.2 REQUIREMENTS (continued) This SR verifies proper automatic operation of the emergency nuclear services seawater pumps on an actual or simulated actuation signal. The RW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The 24 month frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these componei.ts usually pass the Surveillance when performed at the 24 month frequency.

Therefore, the frequency is acceptable from a reliability standpoint.

The SR is modified by a note indicating the SR is not applicable in the identified MODE. This is necessary in order to make the requirements for automatic system response consistent with those for the actuation instrumentation.

REFERENCES 1. Enhanced Design Basis Document for Nuclear Services and Decay Heat Seawater System, Revision 2, November 21, 1991 including temporary Change 193 dated April 8, 1992.

2. FSAR, Section 9.5.

3. FSAR, Section 14.2.2.

4. Enhanced Design Basis Document for Wuclear Services Closed Cycle Cooling Water System, Revision 2, July 29, 1992.

O Crystal River Unit 3 B 3.7-50 Amendment No. 163

4 Decay Heat Seawater System B 3.7.10 827 e'^"' svs't"5 iO B 3.7.10 Decay Heat Seawater System BASES

= . . . _

4 BACKGROUND The Decay Heat Seawater System serves as the heat sink for the Decay Heat Closed Cycle Cooling Water (DC) System, which facilitates the removal of decay heat from the reactor core >

and the removal of process and operating heat from safety related components associated with decay heat removal following a transient or accident. During plant cooldown below ap)roximately 250'F, the Decay Heat Seawater System removes 1 eat which has been rejected to the DC System by the Decay Heat Removal (DHR) System. The OPERABillTY of the DC System is governed by LC0 3.7.8, " Decay Heat Closed Cycle Cooling Water System."

All structures and components in the decay heat seawater pump suction path are shared by the Nuclear Services and DecayHeatSeawaterSystems(RW). The two decay heat seawater pumps are located inside two separate compartments I of the nuclear services seawater sump pit. One compartment contains the A train decay heat seawater pum) and an

,A emergency nuclear services seawater pum). Tie other U compartment contains the B train decay an emergency nuclear services seawater Teat ) ump,seawater pump,l and the norma duty auclear services seawater pump. Tie OPERABILITY sf the nuclear services seawater pumps is addressed in LCO 3.7.9,

" Nuclear Services Seawater System." A separate underground intake conduit for each compartment connects the associated pump suctions to the intake canal (Ref. 1). The system provides cooling water to the tube side of two heat exchangers removing heat from the DC System and subsequently rejecting it to the ultimate heat sink (the Gulf of Mexico) 1

~

by way of the discharge canal. The two decay heat seawater pumps sufficient areflow nominally 100 percent for the maximum capacity,d heat loa expected foreach providi normal cooldown or following an emergency. Each of the pumps is powered from a separate 4160 volt engineered safeguards (ES) bus.

The design and operation of the Decay Heat Seawater System along with a list of the components served by DC can be found in FSAR Section 9.5.2.2 (Ref. 2). Both decay heat seawater pumps are started simultaneously on an Engineered Safeguards Actuation System (ESAS) signal to provide adequate cooling in the event of a single failure which disables a decay heat seawater pump or train.

(continued)

Crystal River Unit 3 B 3.7-51 Amendment No. 149

Decay Heat Seawater Systea B 3.7.10 BASES $

BACKGROUND Certain small break LOCA scenarios require emergency (continued) feedwater to maintain steam generator cooling until core decay heat can be removed solely by ECCS cooling. .

Further, with the turbine driven EfW pump and associated flow path inoperable, SWP 1B, train "B" of the Nuclear Services Seawater System, CHHE-10 and CHP 1B, as well as nm both trains of ECCS, Decay Heat Closed Cycle Cooling Water, Decay Heat Seawater, Emergency Diesel Generators, AC Electrical Power Distribution Subsystems, and AC Vital Bus Subsystems are required OPERABLE.

APPLICABLE The Decay Heat Seawater System supports the DC System in SAFETY ANALYSIS providing cooling for components essential to the mitigation of plant transients and accidents. The system has two separate 100 percent capacity underground intake conduits, independent pumps, and underground discharge conduits to provide for a single failuro while still providing required flow. An ESAS initiation signal will start both decay heat seawater pumps u)on low Reactor Coolant System (RCS) pressure and/or ligh containment pressure. This ensures that the required cooling capacity is provided to the DC &

System for cooling of components required for reactor heat W removal following a steam line break, steam generator tube rupture, makeup system letdown line failure, or loss of coolant accident.

During normal and post accident cooldown operations, when RCS temperature and pressure are reduced to allow the alignment of the DHR System to the RCS, the Decay Heat Seawater System is placed in service to support decay heat removal.

The Decay Heat Seawater System satisfies Criterion 3 of the NRC Policy Statement.

LCOs The requirement for OPERABILITY of both decay heat seawater trains provides redundancy necessary to ensure the system will provide adegoate post-accident heat removal in the event of a coincident single failure.

(continued) h Crystal River Unit 3 8 3.7 52 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

Decay Heat Seawater System

B 3.7.10 i

O BASES LCOs The OPERABILITY of the decay heat seawater pumps requires (continued) that they each be capable of being powered from an OPERABLE

. emergency bus. Each valve in the flow path must ha in its correct position for permitting sea water flow from the intake canal to the DC heat exchangers, and subsequently to the discharge canal. The OPERABILITY of the DC System, recuired to ensure proper heat removal capability, is adcressed in LC0 3.7.8, " Decay Heat Closed Cycle Cooling Water System."

i APPLICABILITY In MODES 1, 2, and 3 the DC and Decay Heat Seawater Systems may not be operating, but must be prepared to perform post-accident safety functions, which include providing cooling water to componentJ required for RCS and containment heat removal. The Decay Heat Seawater System must be capable of providing its post accident cooling assuming a single failure. Therefore, both pumps are required to be OPERABLE during these MODES.

In MODE 4, although RCS temperature and pressure are reduced, there remains sufficient stored ener y that the Q occurrence of an accident would necessitate t e post-accident cooling functions of the DC and Decay Heat Seawater Systems. When temperature and pressure have been reduced sufficiently to allow alignment of the DHR System to the RCS, the Decay Heat Seawater System is no longer needed for post accident component cooling, but must provide cooling to the DC heat excliangers for cooldown and holding operations.

Therefore, two trains of the Decay Heat Seawater System must remain OPERABLE throughout MODE 4 to ensure emergency preparedness and/or decay heat removal, assuming a single failure, in MODES 5 and 6 the DHR, DC, and Decay Heat Seawater Systems are in operation performing their normal safety function of RCS decay heat removal. The various maans of removing reactor decay heat in MODES 5 and 6 are addressed in LCO 3.4.6, "RCS Loops - MODE 5, Loops filled"; LCO 3.4.7, "RCS Loops - MODE 5, Loops Not filled"; LCO 3.9.4, "DHR and Coolant Circulation - High Water Level"; and LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level". In other words, the OPERABILITY requirements for the DC System are determined by the systems it supports. Therefore, this particular LCO is not applicable in MODES 5 and 6.

(continued)

Crystal River Unit 3 8 3.7-53 Amendment No. 163

Decay Heat Seawater System B 3.7.10 BASES (continued) $

ACTIONS A.1 and A.1 W)th one Decay Heat Seawater train inoperable, prompt action is necessary to ensure that the turbine driven emergency feedwater pump and associated flow path are OPERABLE for if the turbine driven emergency steam feedwatergenerator pump andcooling,iated assoc flow path are not OPERABLE, the capability to remove core decay heat can not be assured and Condition B is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4. nort Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s) has been satisfactorily completed within the required frequency and the equipment is not otherwise known to be inoperable.

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time to verify the turbine driven emergency feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to confirm core decay heat removal capability.

The Completion Time minimizes the time the plant is g

potentially exposed to a LOCA in these conditions.

Required Action A.2 is modified by a Note indicating that Inort the applicable Conditions and Required Actions of LCO 3.4.5, "RCS Loops - H0DE 4," should be entered if an increrable decay heat seawater train results in an inoperable required DHR loop. This is an exception to LC0 3.0.6 and ensures the proper actions are taKen for an inoperability of a required DHR loop.

If one of the decay heat seawater trains is inoperable, action must be taken to restore the train to OPERABLE status wiHi in 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE train is adequate to perform the heat removal function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time for restoring full Decay Heat Seawater System OPERABILITY is the same as that for the ECCS Systems, whose safety functions are supported by the Decay Heat Seawater System. This Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train and the low probability of a DBA occurring during this period.

(continued) h Crystal River Unit 3 B 3.7-54 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

i a

Decay Heat Seawater Systea B 3.7.10 a :

O a^5c5 ACTIONS B.1 and B.2 >

(continued)

If the inoperable d$ cay heat seawater train cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LC0 i

does not apply. To achieve this status, the plant must be '

placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The Completion Times are reasonable, based on operating experience, to reach the required plant !

conditions from full power conditions in an orderly manner and without challenging plant systems. ;

j SURVEILLANCE SR 3.7.10.1 REQUIREMENTS

Verifylag the correct alignment for manual valves in the j Decay Feat Seawater System flow path provides assurance that the proper flow paths exist for DC operation. This SR does not apply to valves that are locked, sealed, or otherwise

! secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.

The valves verified by this SR include valves in the main a

O flow paths and the first normally closed valve in a branch line. There are several other exceptions for valve position

! verification due to the low potential for these types of valves to be mispositioned. The valve types which are not verified as part of this SR include vent or drain valves, relief valves, instrumentation valves, and sample line

valves. This SR also does not apply to valves which cannot O (continued)

Crystal River Unit 3 .B 3.7-54A Amendment No. 163

i i

Decay lleat Seewater Systea l B 3.7.10 !

1 BASES Tills PAGE INTENTIONALLY LEFT BLANK (continued)

Crystal River Unit 3 8 3.7-548 Amendment No. 163

CREVS B 3.7.12 l

O sasts l BACKGROUND The control com>1ex normal duty ventilation system is (continued) operated from t1e control room and runs continuously, i During normal operation, the outside air intake damper is ;

open,thedischargetooutsideairdamperisclosed,andthel l system return damper is throttled. This configuration '

allows a controlled amount of outside air to be admitted to

. the control complex. The design temperature maintained by the system is 75'F at a relative humidity of 50%. 1 Three signals will cause the system to automatically switch to the recirculation modes of operation.

4

1. EngineeredSafeguardsActuationSystem(ESAS) signal (highreactorbuildingpressure).

2. High radiation signal from the return duct radiation monitor RM AS.

3. Toxic gas signal (chlorine or sulfur dioxide)

The recirculation modes isolate the control room from outside air to ensure a habitable environment for the safe shutdown of the plant. In these modes of operation, the controlled access area is isolated from the control room and O the remaining areas of the control complex.

Upon detection of ESAS or toxic gas signals, the system switches to the normal recirculation mode. in this mode, the outside air intake and atmospheric relief discharge dampers will automatically close, isolating the control room envelope from outside air paths, and the system return damper will open thus allowing air in the control complex to be recirculated. Additionally, the mechanical equipment room exhaust fan, CA fume hood exhaust fan, CA fume hood auxiliary supply fan \ng isolation dampers close.and and their correspond CA exhaust fan a The return fan, normal filters, normal fan, and the cooling (or heating) coils remain in operation in a recirculating mode.

Upon detection of high radiation by RM A5 the system switches to the emergency recirculation mode. In this mode, >

the dampers that form the control room envelope will automatically close. The mechanical equipment room exhaust fan, CA fume hood exhaust fan, CA fume hood auxiliary supply fan, CA exhaust fan, normal supply fan, and return fan are tripped and their corresponding isolation dampers close.

Manual action is required to restart the return fan and The place coolingthe emergency)

(orheating coilsfans and in remain filters in operation.

operation.

(continued)

Crystal River Unit 3 B 3.7 61 Revision No. 16

l CREVS B 3.7.12 l BASES (continued) h APPLICABLE During emergency operations the design basis of the CREVS is SAFETY ANALYSIS to provide radiation protection to the control room operators. The limiting accident which may threaten the habitability of the control room (i.e., accidents resulting in release of airborne radioactivity) is the postulated maximum hypothetical accident (MHA), which is assumed to occur while in MODE 1. The consequences of this event in MODE 1 envelope the results for MODES 2, 3, and 4, and results in the limiting radiological source term for the control room habitability evaluation (Ref. 2). A fuel handling control roomaccident habita (bility, and may occur in any MODE. FHA) may a However, due to the severity of the MHA and the MODES in which the postulated MHA can occur, the FHA is the limiting accident in MODES 5 and 6 only. The CREVS ensures that the control room will remain habitable follow"g all postulated design basis events, maintaining exposures to control room operators within the limits of GDC 19 of 10 CFR 50 Appendix A(Ref.3).

The CREVS is not in t' primary success path for any accident analysis. However, the Control Room Emergency Ventilation System meets Criterion 3 of the NRC Policy Statement since long term control room habitability is essential to mitigation of accidents resulting in atmospheric fission product release.

LCO Two trains of the control room emergency ventilation system are required to be OPERABLE to ensure that at least one is available assuming a single failure disabling the other train, failure to meet the LC0 could result in the control room becoming uninhabitable in the unlikely event of an accident.

The recuired CREVS trains must be independent to the extent allowec by the design which provides redundant components for the major equipment as discussed in the BACKGROUND section of this bases. OPERABILITY of the CREVS requires the following as a minimum:

a. The emergency duty fan is OPERABLE;

b. HEPA filter and charcoal absorber are not excessively restricting flow, and are capable of performing their filtration functions; and (continued) h Crystal River Unit 3 B 3.7-62 Amendment No. 149

)

CREVS B 3.7.12 C BASES LCO c. ductwork, valves, and dampers are OPERABLE, and air (continued) circulation can be maintained.

The ability to maintain temperature in the Control Complex is addressed in Technical Specification 3.7.18. I l

APPLICABillTY In MODES 1, 2, 3, and 4, the CREVS must be OPERABLE to ensure that the control complex will remain habitable during and following a postulated DBA. During movement of irradiated fuel assemblies, the CREVS must be OPERABLE to ,

cope with a release due to a fuel handling accident.

ACTIONS Ad With one CREVS train inoperable, action must be taken to restore the train to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREVS train is adequate to perform the control room radiation protection function.

lowever, the overall reliability is reduced because a O raiiure la the oeta^Btt catv5 traia could reiuit ia loss or CREVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

B.1 and 8.2 In MODE 1, 2, 3, or 4, if the inoperable CREVS train cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in wh%h the LC0 does not apply. To achieve this status, the plan.

must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the recuired plant conditions from full power conditions in an orcerly manner and without challenging plant systems.

( (continued)

Crystal River Unit 3 B 3.7-63 Amendment No. 163

CREVS '

B 3.7.12 BASES h ACTIONS G.1 and C.2 (continued)

During movement of irradiated fuel assemblies, if the ino)erable CREVS train cannot be restored to OPERABLE status witiin the associated Completion Time, the OPERABLE CREVS train must immediately be placed in the emergency recirculation mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure will be readily detected. Required Action C.1 is modified by a Note indicating to place the system in the emergency mode if automatic transfer to emergency mode is inoperable.

An alternative to Required Action C.1 is to immediately suspend activities that could release radioactivity and require isolation of the control rooin. This places the plant in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

DJ If both CREVS trains are inoperable in MODE 1, 2, 3, or 4, the CREVS may not be capable of performing the intended a function and the plant is in a condition outside the W accident analysis. Therefore, LCO 3.0.3 must be entered immediately.

Ed During movement of irradiated fuel assemblies, when two CREVS trains are inoperable, action must be taken immediately to suspend activities that could release radioactivity that could enter the control room. This places the plant in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

SURVEILLANCE SR 3.7.12.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. Since the environment and normal operating conditions on thir system are not severe, testing each train once avery m ath adequately checks proper function of this system. Systems such " 't e CR-3 design (continued) h Crystal River Unit 3 8 3.7-64 Amendment No. 149

l I

Cont"ol Complex Cooling System i B 3.7.18 l 1

O B 2.7 PLAxT Sv5 tea 5 8 3.7.18 Control Complex Cooling System I BASES l

BACKGROUND The Control Complex Cooling System )rovides temperature :

control for the control room and ot1er portions of the Control Complex containing safety related equipment.

The Control Complex Cooling System consists of two redumnt chillers and associated chilled water pumps that provid.

cooling of recirculated control complex air. Redundant chillers and chilled water sumps are provided for suitable temperature conditions in t1e control complex for operating personnel and safety related control equipment. The Control Complex Cooling System maintains the nominal temperature between 70'F and 80'F.

A single chiller and associated chilled water pump will provide the required temperature control for either heat exchanger. The Control Cornplex Cooling System operation to maintain control complex temperature is discussed in the FSAR, Section 9.7 (Ref.1).

Q For certain small break LOCAs with a concurrent loss of offsite power, it is necessary to provide capability on ,

the emergency diesel generator to load the "A" train low pressure injection pump and other required loads. In um these situations, CHHE-1B and CHP 1B would be relied upon to provide required cooling.

APPLICABLE The Control Complex Cooling System consists of redundant, SAFETY ANALYSIS safety related components, with some common piping. The Control Complex Cooling System maintains the temperature between 70'F ond 80'F. A single active failure of a Control Complex Cooling System component does not impair the ability of the system to perform as designed. The Control Complex Cooling System is designed in accordance with Seismic Category I requirements. The Control Complex Cooling System is capable of removing heat loads from the control room and other portions of the Control Complex containing safety related equipment, including consideration of equipment heat loads and (continued)

Crystal River Unit 3 B 3.7-B5 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

Control Complex Cooling Systea B 3.7.18 BASES gl APPLICABLE personnel occupancy requirements, to ensure equipment SAFETY ANALYSIS OPERABILITY.

(continued)

The Control Complex Cooling System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two redundant heat exchangers and two redundant chillers and associated pumps of the Control Complex Cooling System are required to be OPERABLE to ensure that at least one of each is available, assuming a single failure disables one redundant component. Total system failure could result in the equipment operating temperature exceeding limits.

The Cor, trol Complex Cooling System is considered OPERABLE when the individual redundant components that are necessary to maintain control complex tempereture are OPERABLE. These components include the cooling coils, water cooled condensing units, and associated temperature control instrumentation. In addition, the Control Complex Cooling System must be OPERABLE to the extent that air circulation can be maintained (See Specification 3.7.12). g APPLICABILITY In MODES 1, 2, 3, and 4, the Control Complex Cooling System must be OPERABLE to ensure that the control complex temperature will not exceed equipment OPERABILITY requirements. During movement of irradiated fuel assemblies the Control Complex Cocling System must be OPERABLE to cope with a release due to a fuel handling accident.

ACTIONS A.1 and A.2 With the CHHE 1B or CHP-1B inoperable, prompt action must be taken within I hour to verify the turbine driven emergency feedwater pump and associated flow path is

OPERABLE to (continued) $

Crystal River Unit 3 0 3.7-86 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

1 Control Complex Cooling Systea (

B 3.7.18 BASES ACTIONS A.1 and A.2 (continued) provide steam generator cooling, if the turbine driven emergency feedwater pump and associated flow path are not OPERABLE, the capability to provide EDG load management for small break LOCA mitigation improvement :annot be assured and Condition D is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4.

Due to the severity of the consequences should a sina11 break LOCA occur in these conditions, the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to' verify the turbine driven emergency feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to provide the capability for EDG load management for small break LOCA mitigation mmt improvement. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s) has been satisfactorily completed within the O- required frequency and the equipment is not otherwise known to be inoperable.

With CHHE 1B or CHP 1B inoperable, action must be taken to restore its OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE Control Complex Cooling System redundant components are adequate to maintain the control complex temperature within limits. However, the overall reliability is reduced because a failure in the OPERABLE Control Complex Cooling System components could result in a loss of Control Com)1ex Cooling System function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sased on the low probability of an event occurring requiring the Control Complex Cooling System and the consideration that the remaining redundant components can provide the required capabilities.

O ccontinued)

Crystal River Unit 3 8 3.7 87 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

Control Complex Cooling System

( B 3.7.18 BASES h ACTIONS ILL (continued)

With CHHE 1A, CHP-1A or one Control Complex Cooling heat exchanger inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE Control Complex Cooling System equipment is adequate to maintain the control complex temperature within limits. However, the overall reliability is reduced because a failure in the OPERABLE Control Complex Cooling System redundant components could result in a loss of W Control Complex Cooling System function. The 7 day Completion Time is based on the low probability of an event occurring requiring the Control Complex Cooling System and the consideration that the remaining components can provide the required capabilities.

C.1 and C 2 During movement of irradiated fuel, if the required Action and Completion Times of Condition A or Condition B can not be met, the Control Complex Cooling System must be placed in operation immediately. This action ensures that the remaining Control Complex Cooling System components are g

OPERABLE, and that any active failure will be readily detected.

An alternative to Required Action C.1 is to immediately susaend activities that could release radioactivity that mig 1t require the isolation of the control room. This places the plant in a condition that minimizes accident risk. This does not preclude the movement of fuel to a saf.

position.

O (continued)

Crystal River Unit 3 8 3.7-88 Amendment No. 163 '

NOTE - Valid Until Cycle 12 Only

Control Complex Cooling Systea B 3.7.18 O s^SES ACTIONS D.1 and 0.2 (continued)

In MODE 1, 2, 3, or 4, if the inoperable Control Complex Cooling System component cannot be restored to OPERABLE status within the required Com)letion Time, the unit must be placed in a MODE in which the 00 does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner without challenging unit systems.

Ll If any combination of components that would render the Control Complex Cooling System not capable of performing the intended function, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

O Ll During movement of irradiated fuel assemblies, with any combination of components inoperable that would render the Control Complex Cooling System not capable of performing the intended function, action must be taken to immediately sus)end activities that could release radioactivity that migit require isolation of the control room. This-) laces the unit in a condition that minimizes accident ris(. This does not preclude the movement of fuel to a safe position.

O (continued)

Crystal River Unit 3 8 3.7-89 Amendment No. 163

I Control Complex Cooling Systeo B 3.7.18 BASES (continued) $!

SURVEILLANCE SR 3.7.18.1 REQUIREMENTS Verifying that each Control Complex Cooling chiller's developed head at the flow test soint is greater than or equal to the required developed lead ensures that chiller's performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performancerequiredbySectionXIoftheASMECode(Ref.

3). This test confirms one point on the pump design curve and is indicative of overall performan:e. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of the SR is in accordance with the Inservice Testing Program.

SR 3.7.18.2 This SR verifies that the heat removal capability of the syr. tem is sufficient to meet design requirements. This SR consists of a combination of testing and calculations. A 24 month frequency is appropriate, as significant degradation of the system is slow and is not expected over this time period.

REFERENCES 1. FSAR, Section 9.7.

2. FTl 51-1266138 01, Safety Analysis input to Startup m Team Safety Assessment.

3. ASME, Boiler and Pressure Vessel Code,Section XI. I O

Crystal River Unit 3 8 3.7-90 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

< j i

A0 Sources-Operating

. B 3.8.1

<] BASES BACKGROUND Certain small break LOCA scenarios require emergency

, (continued) feedwater to maintain steam generator cooling until core decay heat can be removed solely by ECCS cooling. Further, with the turbine driven EFW pump or associated flow path inoperable, SWP 1B, train "B" of the Nuclear Services Seawater System, CHHE-1B and CHP-1B, as well as both trains of ECCS, Decay Heat Closed Cycle Cooling _ Water, Decay Heat Seawater, Emergency Diesel Generators, AC "

Electrical Power Distribution Subsystems, and AC Vital Bus Subsystems are required OPERABLE. With ASV-204, EFV-12, or EFV-13 inoperable, Train "B" Emorgency Diesel

> Generators, Train "B" AC Electrical Power Distri*o ution Subsystems, and Train "B" AC Vital Bus Subsystems are

required OPERABLE.

4 O

i i

1 (continued)

Crystal River Unit 3 8 3.8-2A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

AC Sources-Operating

' B 3.8.1 BASES g THIS PAGE INTENTIONAL.LY LEFT BLANK (continued) h I Crystal River Unit 3 B 3.8-2B Amendment No. 163

l AC Sources-Operating B 3.8.1 O BASES C/

BACKGROUND Provided an ES signal is present, certain required ES loads (continued) are returned to service in a predetermined sequence in order to prevent overloading the EDG in the process. Within 35 seconds after the initiating signal is received, all loads needed to recover the plant or maintain it in a safe condition are returned to service.

The service ratings of the EDG are:

. O to 2850 kw a a continuous basis

. 2851 to 3200 kw on a cumulative 2000 hour0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months basis I

. 3201 to 3400 kw on a cumulative 200 hour0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months basis l

. 3401 to 3500 kw on a cumulative 30 minute basis. I Loads powered from the 4160 V ES buses are listed in Reference 2.

Steady state load does not include loads imposed by the starting of motors such as during block loading, and short duration loads such as motor operated valves, battery p)

( charger surges, and short duration pump surge flows. Loads imposed by the starting of motors are not included in the service ratings and are less than the EDG manufacturer limits of 3910 kW for such loading.

APPLICABLE The initial conditions of DBA and transient analyses SAFETY ANALYSES in the FSAR, Chapter 6 (Ref, 4) and Chapter 14 (Ref. 5),

assume ES systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ES systems so that the fuel, RCS, and containment design limits are not exceeded.

These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

(continued)

Crystal River Unit 3 B 3.8-3 Amendment No. 163

AC Sources-Operating B 3.8.1 BASES h APPLICABLE The OPERABILITY of the AC electrical power sources is SAFETY ANALYSIS consistent with the initial assumptions of the accident (continued) analyses and the design basis of the plant. This results in maintaining at least one train of the onsite or offsite AC sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power; and O

(continued)

Crystal River Unit 3 8 3.8-3A Ar,..r.dment No. 163

~ _ .

r

. AC Sources-Operating e

B 3.8.1 1

3 i

S'$

HO i e

?

!- s 4 ;

i i l

l l

t t

i e

t ,

i >

4

l. -

LO Tsis exce inten110aatty ter1 8taux s

3-p i

i 4

I, i-1 l--

i 1

j.

I'.

p-

. - i (continued)

.g- _

[- Crystal River Unit 3 B 3.8-3B-- Amendment No. 163-F

--.-.-....._:_.,.-.-...._,...-.._._,u...

-- - - ._.,_--.u.._.~,.._-

AC Sources-Operating B 3.8.1 BASES h APPLICABLE b. A worst-case single failure.

SAFETY ANALYSES (continued) The AC Sources satisfy Criterion 3 of the NRC Policy Statement.

LC0 Two qualified circuits between the offsite transmission network and the onsite Class lE electrical power distribution system and separate arid independent EDGs far each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an .nticipated operational occurrence (A00) or a postulated DBA.

Qualified offsite circuits are those that are described in the FSAR. Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ES buses.

The qualified circuits, two of which are required to be OPERABLE to satisfy this LCO, consist of: g

a. The offsite power transformer, cabling through breakers 3211, and 3212, connecting to ES bus 3A and 3B respectively.

b. The BEST transformer, nonsegregated-phase bus through breakers 3205, and 3206, connecting to ES bus 3A and 3B respectively,

c. When the CR-3 generator is not producing power, back feed from the 500 kV substation through the Unit 3 step up transformers and the Unit 3 auxiliary transformer, nonsegregated-phase bus through breakers 3207 and 3208, connecting to ES bus 3A and 3B respectively. In order to make use of this power source the step up transformer must first be manually disconnected from the CR-3 main generator by disengaging the disconnect links, and the backfeed ground fault protection scheme enabled.

(continued) h Crystal River Unit 3 8 3.8-4 Amendment No. 149

AC Sources-Operating B 3.8.1 O B^StS LCO The 230 kV and 500 kV substations, while part of the (continued) offsite network, are not considered part of the circuit required by this LCO. The OPERABILITY of the circuit is supported by the substation provided the substation is capable of supplying the required post accident loads. Each EDG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ES bus on.

detection of bus undervoltage. This must be accomplished within 10 seconds. Each EDG must also be capable of accepting required loads within the assumed loading sequence intervals, ard continue to operate until offsite power can be restored to the ES buses. These capabilities are required to be met from a variety of initial conditions, such as the EDG in standby with the engine hot and the EDG in standby with the engine at ambient conditions. Proper sequencing of loads, including shedding of non-essential loads, is a required function for EDG 0F2RABILITY.

EDG OPERABILITY requires pro er ventilation using EDG Air Handling System cooling fan ) for each EDG in order to maintain the tem)erature of ( he EDG enoint ros::: and EDG control room wit 1in manufacturer's limits. Based on analysis,

11e fan or dual fan operation is acceptable q dependent > .n fan supply air temperature.

The AC sources in one train must be separate and independent (to the extent possible) of the AC sources in the other train. For the EDGs, separation and independence are complete. For the offsite AC sources, separation and independence exist to the extent )ractical. A circuit may be connected to more than one ES aus and not violate separation criteria. A circuit that is not connected to an ES bus is required to have the capability for the operator to transfer power to the ES buses in order to be considered OPERABLE.

APPLICABILITY Two onsite and two offsite AC sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of anticipated operational occurrences (A00s) or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

O (cont 4nued)

Crystal River Unit 3 8 3.8-5 Amendment No. 160

AC Sources-Operating 8 3.8.1 BASES g APPLICABILITY AC power requirements for MODES 5 and 6 are (continued) addressed in LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS M To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis.

Since the Required Action only specifies " perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met (Condition F). However, if the remaining required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

M Required Action A.2, which only applies if the train cannot a W

be powered from an offsite source, is intended to provide assurance that an event coincident with a single failure of the associated EDG will not result in a complete loss of safety function of redundant required features. These features are powered from the redundant AC electrical power train. Single train systems (from an electrical perspective), such as the turbine driven emergency feedwater pump, are not included.

The Completion Time for Requi~ed Action A.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed outage time " clock." In this Required Action, the Completion Time only begins on discovery that both:

a. The train has no offsite power supplying it loads; and

b. A required feature on the other train is inoperable.

(continued) $

Crystal River Unit 3 B 3.8-6 Amendment No. 149

AC Sources-Operating B 3.8.1 BASES ACTIONS M (continued)

If at any time during the existence of Condition A (one offsite circuit inoperable) both 'a' and 'b' above become met, this Completion Time begins to be tracked.

The remaining OPERABLE offsite circuit and EDGs are adequate to supply electrical power to Train A and Train B of the onsite Class IE distribution system. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature.

Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for resairs, and the low probability of a DBA occurring during t11s period.

M r

According to the recommendations of Regulatory Guide 1.93 (Ref. 6,', operation with one required offsite circuit inoperable should be limited to a pericd of time not to j.]'

exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, the relialility of the offsito system is degraded, and the potential for a loss oi offsite power is increased. with attendant potential for a challenge to the unit safety systems. However, the j remaining OPERABLE offsite circuit and EDGs are adequate to supply electrical power to the onsite Class 1E distribution system.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action A.3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failure to meet the LCO. If Condition A is entered while, for instance, an EDG is inoperable and that EDG is subsequently returned to OPERABLE status, LCO 3.8.1 may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore the offsite circuit. At this time, an EDG could again become inoperable, the circuit restored to OPERABLE status, and an O

,d (continued)

Crystal River Unit 3 E 3.8-7 Amendment No. 149

AC Sources-Operating <

B 3.8.1 i

BASES

ACTIONS U -(continued) additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for-a total of 9 days) allowed prior to complete restoration of_the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

As k Required Action A.2, the Completion Time allows for an exception to the normal " time zero" for beginning the allowed outage time " clock." This will result in establishing the " time zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.

M To ensure a highly reliable power source in the event one EDG is inoperable, it is necessary to verify the availability of the OPERABLE offsite :ircuits on a more frequent basis. Since the Required Action only specifies a W

" perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met (Condition F).

However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

M With Train "A" EDG inoperable, promat action within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is necessary to ensure that the tur)ine driven emergency feedwater pump and associated flow path are available-for ,

steam generator cooling. If the turbine driven emergency feedwater pump and associated flow path are not available, the capability for core decay heat removal has not been assured and Condition H is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4..

(continued)

Crystal River Unit 3 8 3.8-8 Amendment No. 163 NOTE 'ialid until Cycle -12 Only

- . . . _ _ _ _ _ . - - - . - - . - - _ , - - - - ~ - . -

/,C Sources-Operating B 3.8.1 BASES ACTIONS JL2 (continued)

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated _

surveillar.ce(s) has been satirfactorily completed within the '

required frequency and the eqtipment is not otherwise known to be inoperable.

Due to the severity of the consequences should a small break LOCA occur in these conditions, the I hour Completion Time to verify the turbine driven emergency feedwater pump and associated flow path are OPEFABLE ensures that prompt noit action will be taken to confirm core decay heat capability.

The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.

Ibl Required Action B.3 is intended to provide assurance that a loss of offsite power, during the_ period that a EDG is inoperable, does not result in a complete loss of safety function of critical- redundant required features, These Os features are designed with redundant safety rrelated trains.

Redundant required feature failures consist ot' inoperaWe features associated with a train, redundant to the train that has an inoperable EDG. Single train systems (from an electrical perspective), such as the turbine driven emergency feedwater pump, are not included.

The Completion Time for Required A tion B.3 is intended to I NOTE allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed outage time "c. lock. In this Required Action, the Completion Time only begins on discovery that both:

a. An EDG is inoperable; and

. b. A required feature on the other train is inoperable.

. If at any time during the existence of this Condition (one EDG inoperable) a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

(continued)

Crystal River Unit 3 8 3.8-9 Amendment No. 163 NOTE - Valid Until Cycle 12 Onl.y

AC Sources-0perating B 3.8.1 BASES h ACTIONS SJ (continued) l ut Declaring the required features inoperable within four hours from the discover; of items 'a' and 'b' existing concurrently 1, acceptable because it minimizes risk while allowing time for restoration before subjecting the plant to transients associated with shutdown.

In this condition, the remaining OPERABLE EDG and offsite circuits are adequate to supply electrical power to the onsite Class lE distribution system. Thus, on a component basis, single-failur<t protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.4.1 and B.4.2 NOTE Required Action B.4.1 provides an option to testing the OPERABLE EDG in order to avoid unnecessary testing. If it can be determined that the cause of the i.. operable EDG does not exist on the OPERABLE EDG, SR 3.8.'. 2 does not have to be performed. If the cause of inopeiability exists on the other EDG, the other EDG would be declared inoperable upon discovery and Condition E of LC0 3.8.1 would be entered.

If the common cause failure evaluation is indeterminate (the cause of the initial inor.erable EDG cannot be confirmed not to exist on the remaining EDG), performance of SR 3.8.1.2 is adequate to provide assurance of continued OPERABILITY of that EDG.

The Con.pletion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable to confirm that the OPERABLE EDG is not affected by the same problem as the inope.able EDG and is based on the recommendations of Generic Letter 84-15 (Ref. 7).

(contint:d)

Crystal River Unit 3 B 3.8-10 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

AC Sources-Operatin? l B 3.8.1 l l

l Q BASES ACTIONS Li l Mit (continued)

According to the recommendations of Regulatory Guide 1.93

~(Ref.

imited 6)to a period not to exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ., operation with one EDG .

I

, in Condition B, the remaining OPERABLE EDG and offsite ;

circuits are adequate to supply electrical power tc, the ,

onsite Class 1E distribution system. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Com letion Time takes into account the capacity and capability o the a reasonable time for repairs, and remaining the low probability o a DBA occurring during this period.

AC sources,f The second Completion Time for Required Action B.5 establishes a limit on the maximum time allcw 1 for any MTE combination of required AC power sources to be inoperable during any single contiguous occurrence of failure to meet the LCO. Refer to the Bases for Re uired Action A.3 for additional information on this Comp etion Time.

C.I. C.2. C.3. C.4. and C.5 Refer to the Bases for Actions B.1, B.3, 8.4 and B.5 for thediscussionforthecorrespondingBasesofRequired Action C.

For Action C.2 with Train "B" EDG inoperable prompt action within1hourIsnecessarytoensurethatthe,turbinedriven emergency feedwater pump, associated flow path, ASV-204, EFV-12, and EFV-13 are available for steam generator coolin . If the required e pment is not available, the capabi ity for core decay h removal has not been assured MTE and Condition H is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4.

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance required freq(s)uenchas been satisfactorily completed within the to be inoperable.y and the equipment is not otherwise known Due to the severity of the consequences should a small break LOCA occur in these conditions, the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to verify the turbine driven emergency feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to confirm core decay heat capability. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.

(continued)

Crystal River Unit 3 B 3.8-10A Amendment No. 163 NOTE - Valid Until Cycle 12 Only

AC Sources-Operating B 3.8.1 BASES g THIS PAGE INTENTIONALLY LEFT BLANK (continued) h Crystal River Unit 3 B 3.8-10B Amendment No. 163

AC Sources-Operating 8 3.8.1 BASES ACTIONS D.1 and 0.2 lmit (continued)

< Required Action 0.1, which a> plies when both required I mit offsite circuits are inoperaale, is intended to provide assurance that a DBA, coincident with a worst-case single failure, will not result.in a complete loss of redundant required safety functions. The Completion Time for declaring the redundant required features inoperable is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; reduced from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is no longer valid, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are powered from redundant AC safety trains. Single train features (from an electrical perspective), such as the turbine driven emergency feedwater pump, are not included.

The Completion Time for Required Action D.1 is intended to l "IE p allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal " time zero" for beginning the allowed outage time " clock." In this Required Action, the Completion Time only begins 3n discovery that both:

a. All required offsite circuits are inoperable; and

b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits inoperable) a required feature becomes inoperable, this ' ompletion Time begins to be tracked.

p (continued) g Crystal River Unit 3 B 3.8-11 Amendment No. 163 NOTE - Valii Until Cycle 12 Only

AC Sources-0perating B 3.8.1 BASES g ACTIONS 0.1 and 0.2 (continued) lnoit According to the recommendations of Regulatory Guide 1.93

, operation with two required offsite circuits (Ref.

inoperab6)le should be limited to a period not to exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . In this condition, the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Becau:e of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more EDGs inoperable. However, two factors tend to decrease the severity of this level of degradation:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, the simultaneous loss of offsite AC sources coincident with a LOCA, and a worst-case single failure were postulated as a part of the original licensing basis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

(continued)

Crystal River Unit 3 B 3.8-12 Amendment No. 163 NOTE '!alid Until Cycle 12 Only

AC Sources-Operating l B 3.8.1

BASES- ;

ACTIONS D.1 and D.2 (continued) Inoit It one required offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months power operation may continue in accordance with the required Actions of Condition A. l g 1 With Train "A" EDG inoperable, prom)t action within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1 is necessary to ensure that the tur)ine driven emergency feedwater pump and associated flow path are available for steam generator cooling. If the turbine driven emergency feedwater pump and associated flow path are not available, the capability for core decay heat removal has not been assured and Condition H is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4 Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s)hasbeensatisfactorilycompletedwithin nort the required frequency and the equipment is not otherwise known to be inoperable.

P Due to the severity of the consequences should a small break LOCA occur in these conditions, the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to verify the turbine driven emergency feedwater pump and i

associate eration in accordance with this Specification still means tie EDG is OPERABLE.

g (continued)

V Crystal River Unit 3 B 3.8-32 Amendment No. 163 NOTE - Valid Until Cycle 12 Only

Diesel fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES g ACTIONS M (continued)

With usable fuel oil volume in one or more storage tanks

< 22,917 gallons, p om)t action must be taken within I hour to verif H,834 gallons.y However, that the com)ined fuel oil the Condition supply >d to fuel oil is restricte level reductions that maintain at least a combined 7 day supply. In this Condition a period of I hour is allowed to ensure that sufficient fuel oil supply for 7 days of EDG operation at its up)er 200 hour0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months rating is available. In order to maintain tie ability to treat the EDG as independent entities for the ACTIONS (from a fuel oil an artificial lower limit on stored fuel oil

)ers)ective),blished las seen esta .

The minimum usable volume specified for each tank is equivalent to 3 days operation and was set to ensure a minimum combined 6 day supply.

The limit on combined supply recognizes that while one tank may contain less than 3.5 day supply, the usabir, volume in the other tank could be such that 7 day capacity still exists.

Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s) has been satisfactorily completed within the required frequency and the equipment is not otherwise known g

to be inoperable.

M With usable fuel oil volume in one or more storage tanks

< 22,917 gallons and combined fuel oil supply < 45,834 gallons, sufficient fuel oil supply for 7 days of EDG operation at its upper 200 hour0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months rating is not available.

However, the Condition is restricted to fuel oil level that maintain at least a combined 6 day supply, reductions,dition, in this Con a period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed prior to declaring the associated EDG inoperable, in order to maintain the ability to treat the EDG as independent entities for the ACTIONS (from a fuel oil )ers)ective), an artifici 1 lower limit on stored fuel oil las )een establisied. The minimum usable volume specified for each tank is equivalent to 3 days operation and was set to ensure a minimum combined 6 day supply.

(continued) $

Crystal River Unit 3 8 3.8-33 Amendment No. 163

I Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 ,

BASES ACTIONS Ad (continued) l The limit on o mbined supply recognizes that while one tank may contain 'ess than 3.5 day supply, the usablo volume in l .

the other tank could be such that 7 day capacity still !

exists.

The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of fuel oil to the tank. This period is acceptable based on the remain.ng capacity (> 6 days), the fact that action will be initiated to obtain riplenishment, and the low probability of an event occurring during this brief period.

C.d With lube oil inventory < 280 gallons, there is not ^

sufficient lube oil to support 7 days continuous operation of one EDG at the upper limit of its 200 hour0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months rating.

However, the Condition is restricted to lube oil volume reductions that maintain at least a 6 day supply. In this Condition, a period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered adequate to Q restore the required volume prior to declaring the 1

f (continued)

Crystal River Unit 3 B 3.8-33A Amendment No. 163

I Diesel fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES g l

l l

I i

l THIS PAGE INTENTIONALLY LEFT BLANK h (continued) $

Crystal River linit 3 B 3.8-33B Amendment No. 163

1 Diesel fuel Oil, Lube Oil, and Starting Air B 3.8.3 Q BASES ACTIDNE L1 (continued)

EDGs inoperable. The volume specified includes the lube oil

. contained in the sump as well as the lube oil stored onsite (offensine. If the required stored volume cannot be restorec, b th EDGs must be declared inoperable since this volume is common to both EDGs.

The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Com letion Time is acce table based on the remainin ca ac ty f> 6 da 1 the ow rate of usa the fact t'la ac ions will be h lated to obtain rep 1 shment, I

and the low probability of an event occurring during this brief period D.d This Condition is entered as a result of a failure to meet the acceptance criterion for EDG fuel oil particulates.

Normally, trendin of particulate levels allows sufficient !

time to correct h articulate levels prior to reaching '
the limit of accep b lity. However poor sample procedures (bottomsampling,contaminatedsamplingequpment,and errors in labora ory analysis can produce fa lures that do not follow a trend. Since the )resence of particulates does not mean the fuel oil will not surn proper y and given that !
-O roper engine erformance has been recenti demonstrated it is prudent to allow a brief period of within 31 day ime prior to ec),laring the associated EDG inoperable. The 7 da Com samp ing,pletion Time ~~ofows and re analysts the for further EDG evaluation, re-fuel oil.
~
LJ l With the new fuel oil operties defined in the Bases for SR 3.8.3.3 not within e required limits, a period of i 30 days is allowed for restoring the stored fuel oil properties prior to declaring the associated EDG inoperable.
This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil remains acce t ble, or to restorethestoredfueloil may involve feed and bleed, This restorationp a properties.
filtering, or combinations of these procedures. Even if an EDG start and load was required during this time and the fuel oil properties were outside limits, there is a hi h likel hood that the EDG would still be capable of per.orming its intended function.
(continued)
Crystal River Unit 3 B 3.8-34 Amendment No. 163
Oicsel fuel Oil, Lube Oil, and Starting Air B 3.8.3 l
BASES g ACTIONS L1 l (continued)
With starting airsuccessive receiver pressure < 225 sufficient psig,does not capacity for six EDG start attempts exist. However, as long as the receiver pressure is
> 150 psig, there is adequate capacity for at least ene start attempt, and the EDG can be considerec' OPERABLE while the air receiver pressure is restored to the required limit.
A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the associated EDG inoperable. This period is acce) table based on the remaining air start capacity, the fact tlat most EDG starts are accomplished on the first attem)t, and the icw probability of an event occurring during t11s brief period.
ful With a Required Action and associated Completion Time not met, or one or more EDGs with fuel oil, lube oil, or startins air subsystems not within limits for reasons other than adcressed by Conditions A through F, the associated EDG l must be immediately declared inoperable, in this case, the ACTIONS of Specification 3.8.1 or 3.8.2, as ap)licable, are entered. in the case of stored EDG lube oil, )oth EDGs must &
be declared ino>erable since the stored lube oil volume is W common to both EDGs.
SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate usable inventory of fuel oil in each storage tank to support operation of one EDG for 3.5 days at the upper limit of its 200 hour0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months rating (assuming no offsite power). The SR also verifies combined capacity of the two tanks to be > 7 days fuel su) ply. The 3.5 day )eriod (7 day capacity provided by the com)ined inventory of is sufficient time to place the plant in a safe shutdown )oth tanks) condition, cross connect if necessary, and to brin fuel storage tanks,from replenishment fuel an offsite location, g in lhe 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and the likelihood any large uses of fuel oil during this period would be detected.
(continued) $
Crystal River Unit 3 B 3.8 35 Amendment No. 163
Diesel fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES l SURVEILLANCE $R 3.8.3.2 REQUIREMENTS (continued) This Surveillance 6nsures that sufficient lube oil inventory is available to support at least 7 days of operation of a single EDG at the upper limit of its 200-hour rating. The l 280 gallon requirement is based on the EDG manufacturer !
, consumption values for the run time of the EDG, The !
specified volume includes the lube oil contained in the sump !
as well as the onsite stored stock. As such, implicit in
, this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the EDG.
When determining compliance with this requirement, both EDGs may take credit for the same volume of onsite stored lube oil.
A 31 day Frequency is adequate to ensure that a sufficient lube oil supply is onsite, since EDG starts and run time are closely monitored by the plant staff.
SR 3.8.3.3 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminatedwithsubstancesthatwouldhaveanimmediate{s impact on diesel engine combustion. If resul
< O detrimental from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank (s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:
a. Sample the new fuel oil in accordance with ASTM 04057-88 (Ref 6);
b. Verify in accordance with the tests specified in ASTM D975-74, (Ref 6) that the sample has a maximum of 0.05% by volume water and sediment (using ASTM D2709-82)}
40. SUS, and a flash point of it 125'F;a Saybolt viscosity at 100
c. Verify in accordance with the test specified in ASTM D287-82 that new fuel has an API specific gravity of 28(min);and (continued)
Crystal River Unit 3 B 3.8 36 Amendment No. 163
Diesel fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES $
SURVEILLANCE SR 3.8.3.3 (continued)
REQUIREMENTS
d. Vcrify that the new fuel oil has a clear and bright appearance with pro with ASTM D4176 91,per (Ref. 6).color when tested in accordance Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.
Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-74, (Ref. 7) are met for new fuel oil when tested in accordance with ASTM D975 74, (Ref. 7), except that a calculated Cetane Index per ASTM D976 or 04737, is determined to estimate the actuaiCetaneNumber. If the Cetane Index is not met then asampleoffuelintestedinaccordancewithASTMD6l3to determine Cetane Number. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on EDG operation. This Surveillance ensures the availability of high quality fuel oil for the EDGs. g fuel oil degradation during long term storage is typically detected as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine.
However the particulate can cause fouling of filters and fueloilinjectionequipmentwhichcancauseenginefailure.
Particulate concentrations should be determined in accordance with ASTM D2276-91, Method A This methodinvolvesagravimetricdeterminat(Ref.6). ion of total particulate concentration in the fuel oil. It is acceptable to obtain a field sampic for subsequent laboratory testing in lieu of field testing. Because the total stored fuel oil volume is contained in two isolated tanks, each tank must be considered and tested separately.
The frequency of this SR takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between tests.
(continued)
Crystal River Unit 3 8 3.8-37 Amendment No. 149
i Distribution Systems-Operating B 3.8.9
] B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.9 Distribution Systems-Operating BASES BACKGROUND The onsite Class lE AC, DC, and AC vital bus electrical power distribution systems are divided into two redundant and independent AC, DC, and AC vital bus electrical power distributionsubsystems(trains).
The AC electrical power distribution subsystem for each train consists of a primary Engineered Safeguard (ES) 4160 V bus and secondary 480 and 120 i buses, distribution panels, motor control centers (MCCs) and load centers. Each 4160 V ES bus is fed from an offsite circuit as well as a dedicated onsite emergency diesel generator (EDG). During normal operation, each 4160 V ES bus is connected to a preferred offsite source. If all offsite sources are unavailable or not connected to a power supply, the EDG supplies power to the 4160 V ES bus. Control power for the 4160 V breakers is supplied from the Class IE batteries. Additional description of these systems may be found in the Bases for LCO 3.8.1, "AC Sources-Operating,"" and the Bases for LC0 3.8.4, "DC Sources-Operating.
The secondary AC electrical power distribution system for each train includes the safety related load centers, MCCs, and distribution panels shown in Table B 3.8.9-1.
The 120 VAC vital buses are arranged in two load grou)s per train and are normally powered from the inverters. 11e alternate power supply for the vital buses are Class IE constant voltage transformers (CVTs) powered from +.he same train as the associated inverter. Each constant veltage transformer is powered from a Class lE AC bus. Opet'ation of the inverters and CVTs is governed by LCO 3.8.7,
" Inverters-Operating."
There are two independent 250/125 VDC electrical power distribution subsystems (one for each train).
The list of all required DC distribution buses is also presented in Table B 3.8.9-1.
(continued)
Crystal River Unit 3 - B 3.8 67 Amendment No. 149
I Distribution Systems-Operating B 3.8.9 ,
BASES g BACKGROUND Certain small break LOCA scenarios require emergency (continued) feedwater to maintain steam generator cooling until v re decay heat can be removed solely by ECCS cocling.
Further with tho turbine driven EFW ) ump or associated flow pafh inoperable, SWP 18, train "3" of the Nuclear .
Services Seawater System, CHHE-1B and CHP-1B, as well as " l both trains of ECCS, Decay Heat Closed Cycle Cooling i Water Decay Heat Seawater, Emergency Diesel Generators AC Electrical Power Distribution Subsystems, and AC Vital Bus Subsystems are re With ASV-204, EFV 12, or EFV-13 ino)erable, quired OPERABLETrain "B" Emergency Diesel Train "B" AC Electrical Power Distribution Subsystems [E.and Train "B" AC Vital Bus Suosystems are required OPERAB O
l l
s (continued)
O Crystal River Unit 3 B 3.8 67A Amendment No. 163 NOTE - Valid Until Cycle 12 Only
1 Olstribution Systens-Operating B 3.8.9
] P'StS O iniS exct initutionatty ttri 8taux 0 (continued)
Crystal River Unit 3 8 3.8 67B Amendment No. 163
Distribution Systems-Operating B 3.8.9 BASES (continued) g APPLICABLE The initial conditions of Desi n Basis Accident DBA)and SAFETY ANALYSES transientanalysesinChapterh(Ref.1)andChater14 The 1Ref.
C, DC,2)andofACthe F'iAR vital assume bus electrical twodistribution power ES trains are OP:RA systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ES systems so that the fuel, Reactor Coolant System and containment design limits are not exceeded. TheselimItsarediscussedinmoredetail in the Bases for Section 3.2 Power Distribution Limits; Section3.4,ReactorCoolantSystem(RCS);andSection3.6, Containment Systems.
The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and the design basis of the plant. This includes maintaining electrical power distribution systems OPERABLE during accident conditions in the event of:
a. An assumed loss of all offsite power or all onsite AC electrical power; and
b. A worst case single failure.
g The distribution systems satisfy Criterion 3 of the NRC Policy Statement.
LC0 The required power distribution subsystems listed in Table B 3.8.91 ensure the availability of AC, DC, and AC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (A00) or a postulated DBA.
Two trains of AC, DC, and AC vital tus electrical lower distribution subsystems are required to be OPERABLE in order to ensure that the redundancy incorporated into the ES systems design is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.
(continued) h Crystal River Unit 3 8 3.8-68 Amendment No. 149
Distribution Systems-Operating B 3.8.9 BASES LCO AC, DC and AC vital bus electrical >ower distribution (continued) subsyslemsareconsideredOPERABLEw1entheassociated buses load centers, MCCs, and distribution panels are energlzedtotheirpropervoltages, in addition, tie breakers between 480 V ES bus 3A and 3B must be open. This prevents an electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem. If this were to occur it could cause the failure of a redundant subsystem and a loss of essential safety function (s). If any tie breakers are closed the i affectedredundantelectricalpowerdistributionsubsystems '
are no longer redundant and one train must be considered inoperable. This applies to the onsite, safety related redundant electrical power distribution subsystems, it does not, however, preclude redundant Class IE 4160 V buses from being powered from the same offsite circuit.
APPLICACILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result
] b.
of A00s or abnorr,a1 transients; and Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
Electrical power distribution subsystem requirements for MODES 5 and 6 n addressed in the Bases for LC0 3.8.10
" Distribution Jystems-Shutdown."
ACTIONS A.1. A.2. B.1. and 8.2 With Train "A" AC electrical power distribution subsystem ino)erable prompt action is necessary to ensure that the tur)ine drlven emergency feedwater pump and associated flow gathareOPERABLEforsteamgeneratorcooling. With Train B" AC electrical power distribution subsystem inoperable, um prompt action is necessary to ensure that the turbine driven emergency feedwater pum) and associated flow path as and E V-13 are OPERABLE for steam wellasASV-204,EFV-12{herequiredequipmentisnot aenerator cooling. If OPERABLE, the capability to remove core decay heat cannot be assured and Condition F is applicable. The operability of the turbine driven emergency feedwater pump is not required in MODE 4.
n
() (continued)
Crystal River Unit 3 B 3.8 69 Amendment No. 163 NOTE - Valid Until Cycle 12 Only
Distribution Systems-Operating B 3.8.9 BASES $
ACTIONS A.I. A.2. 8.1. and B.J (continued)
Due to the severity of the consequences should a small break LOCA occur in these conditions, the I heur Completion Time to verify the turbine driven emergency eg feedwater pump and associated flow path are OPERABLE ensures that prompt action will be taken to confirm core decay heat removal capability. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.
With one AC electrical power distribution subsystem inoperable, the remaining AC electrical power distribution subsystem in the other train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. However, the overall reliability is reduced because a single failure in the remaining power distribution subsystems could result in the minimum required ES functions not being met. Therefore, the required AC buses, load centers, MCCs, and distribution panels must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .
The most severe scenario addressed by Conditions A and B is l MTL an entire train without AC power (i.e., no offsite )ower to the train and the associated EDG inoperable). In t11s condition, the plant has an increased vulnerability to a complete loss of AC power. It is, therefore, imperative that the operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the plant, and on restoring power to the affected train. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit for restoration, prior to requiring a plant shutdown in this Condition is acceptable because of:
a. The potential for decreased safety if the operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train to the actions associated with shuttir,q down the plant within this time limit; and
b. The low probability of an event occurring coincident with a single failure of a redundant component in the train with AC power.
(continued) h Crystal River Unit 3 B 3.8-70 Amendment No. 163 NOTE - Valid until Cycle 12 Only
Distribution Systers-Operating B 3.8.9 BASES (vQ ACTIONS A.1. A.2. B.l. and B.2 (continued) lnort The second Completion Time for Required Actions A.2 and B.2 l nott establithes a lin.it on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failure to meet the LCO. If Condition A or 8 is entared I "Dil a DC bus is inoperable and while, for instance,d subsequently restoreto OPERABLE status, LCO 3.8.9 may already have been not met for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . This could lead toto restore a total of since initial failure of the the10AC hours,ibution distr system. At this time, a LCO,ircuit DC c could again become inoperable, and AC distribution restored to OPERABLE status. This could continue indefinitely.
The Completion Time allows for an exception to the normal
" time zero" for beginning the allowed outage time " clock."
This will result in establishing the " time zero" at the time instead of the time the LC0 was Condition initially A was not met,16 entered. The hour Completion Time is in acceptable limitation on this potential to fail to meet the LCO indefinitely.
C.l. C.2. D.l. and D.2 (3
U With Train "A" necessary AC vital to ensure busthe that inoperable,iven turbine dr emergencyprompt action noit is feedwater pump and associated flow path are OPERABLE for steam generator cooling. With Train "B" AC vital bus inoperable prompt action is necessary to ensure that the turbine dr\ven emergency feedwater pum) and associated flow path as well as ASV-204, EFV-12, and E V 13 are OPERABLE for steam generator cooling. If the required equi) ment is not OPERABLE, the capability to remove core decay 1 eat cannot be assured and Condition f is applicable. The operability of the turbine driven emergency feedwater pump is not required in H0DE 4.
Consistent with the Bases for Surveillance 3.0.1, OPERABILITY is verified by ensuring the associated surveillance (s) has been satisfactorily completed within the required frequency and the equipment is not otherwise known to be inoperable.
Due to the severity of the consequences should a small break LOCA occur in these conditions, the i hour Completion Time to verify the turbine driven emergency feedwater pump and associated flow path aro OPERABLE ensures that prompt action will be taken to confirm core decay heat removal capability.
The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.
(continued)
Crystal River Unit 3 8 3.8-71 Amendment No. 163 NOTE - Valid Until Cycle 12 Only
Distribution Systems-Operating B 3.8.9 BASES $
ACTIONS C.I. C.2. D.l. and 0.2 (continued) I am With one AC vital bus inoperable, the remaining OPERABLE AC vital buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum required ES functions not being supported. Therefore, the AC vital bus must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .
Condition B represents a condition in which potentially both the DC source and the associated AC source are nonfunctional. In this situation the plant is significantly more vulnerable to a complete loss of all non-interruptible power, it is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining vital buses and restoring power to the affected vital bus.
The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months limit is more conservative thaa Completion Times allowed for the vast majority of components that would be without adequate AC vital power. However, there are certain affected features Completion Times of shorter duration. The g
intent of the improved Technical Specifications is to remain within this Specification only and not take the ACTIONS for inoperable supported systems. Taking this ex eption to LCO 3.0.2 for com)onents without adequate vital AC power, that would have tie Required Action Completion Times shorter than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months if declared inoperable, is acceptable because of:
a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue; (continued) h Crystal River Unit 3 B 3.8-71A Amendment No. 163 NOTE - Valid Until Cycle 12 Only
Distribution Systens-Operating 8 3.8.9 0 8^5ts d
,3 J THIS PAGE INTENTIONALLY LEFT BLANK O <<entinuea>
Crystal River Unit 3 8 3.8-718 Amendment No. 163
Distribution Systems-Operating B 3.8.9 BASES g ACTIONS C.I. C.2. D.1. and 0.2 (continued) l noit
b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without adequate vital AC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and
c. The low pro'. ability of an event occurring coincident with a single failure of a redundant component.
The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Com)1etion Time takes into account the importance of restoring tie AC vital bus to OPERABLE status, the redundant ca) ability afforded by the other OPERABLE vital buses, and tie low probability of a DBA occurring during this period.
The third Completion Time for Required Actions C.2 and D.2 lNOTE establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failure. Refer to the Bases for Required Actions A.? and I natr a B.2 for further discussion of this completion Time. I W LJ lnatt With DC bus (es) in DC electrical power distribution train inoperable, the remaining train is capable of sup)orting the minimum safety functions necessary to shut down tie reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution train could result in the minimum required ES function: not being met. Therefore, the DC i es must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .
(continued) h Crystal River Unit 3 8 3.8-72 Amendment No. 163 NOTE - Valid Until Cycle 12 Only
Distribution Systens-Operating i B 3.8.9 BASES ACTIONS L1 (continued) j uit Condition E represents a condition in which one train is I mit without adequate DC power; potentially both with the battery significantly degraded and the associated charger inocerable. In this situation, the plant is significantly more vulnerable to a complete loss of all DC power. It is, therefore, im)erative that the operator's attention focus on stabilizing tie plant, minimizing the potential for loss of j power to the remaining trains and restoring power to the affected train.
The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast mejority of components that weuld be without adequate AC vital power. However, there are certain <
affected features with Completion Times of shorter duration.
The intent of the Improved Technical Specifications is to remain within this Specification only and not take the ACTIONS for inoperable supported systems. Taking this exception to LC0 3.0.2 for components without adequate vital AC power, that would have the Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if declared inoperable, is acceptable because of:
a. The potential for decreased safety by requiring a change in plant conditions (i.e., requiring a shutdown) while allowing stable operations to
' continue;
b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not l providing sufficient time for the operators to perform the necessary evaluations and actions to restore power to the affected train; and
c. The low probability of an event occurring coincident with c single failure of a redundant component.
The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with the recommendations of Regulatory Guide 1.93 (Ref. 3),
h (continued)
Crystal River Unit 3 8 3.d 73 Amendment No. 163 NOTE - Valid Until Cycle 12 Only
Distribution Systems-Operating B 3.8.9 BASES h ACTIONS L 1 (continued) I noit The second Completion Time for Required Action E.1 I noit establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of ;
failure to meet the LCO. Refer to the Bases for Required i Actions A.2 and B.2 for further discussion of this l Noi[ j Completion Time. i i
l
" 'E F.1 and F.2 i If the inoperable distribution subsystem cannot be restored to OPERABLE status within the associated Corpletion Time, the plant must be placed in a MODE in which the LCO do' not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging plant systems.
O y lNoit Condition G corresponds to a level of degradation in which i Nott redundant safety related trains have lost power to one or more busses. At this severely degraded level, the plant's ability to respond to an event may be significantly reduced.
Therefore, if it is determined that redundant trains of a necessary function are concurrently inoperable, no additional time is justified for continued operation. The plant is required to immediately enter LC0 3.0.3 and begin preparations for a controlled shutdown.
O (continued)
Crystal River Unit 3 B 3.8-74 Amendment No. 163 NOTE - Valid Until Cycle 12 Only
-

ML20203D161

Text

Navigation menu

Search