Text

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative
	ML22090A287
Person / Time
Site:	Browns Ferry
Issue date:	03/31/2022
From:	Polickoski J; Tennessee Valley Authority
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	CNL-21-009
	Download: ML22090A287 (449)
	v • d • e

1101 Market Street, Chattanooga, Tennessee 37402 CNL-21-009 March , 2022 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Dockets 50-259, 50-260, and 50-296

Subject:

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (BFN TS-524)

Reference:

1. Letter from the Technical Specification Task Force (TSTF) to the Nuclear Regulatory Commission (NRC), TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk-Informed Extended Completion Times and Submittal of TSTF-505, Revision 2, July 2, 2018 (ML18183A493)

2. Letter from NRC to the TSTF, Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated November 21, 2018 (ML18253A085)

In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit, Tennessee Valley Authority (TVA) is submitting a request for an amendment to the Technical Specifications (TS) for the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3.

The proposed amendment would modify the BFN TS requirements to permit the use of Risk-Informed Completion Times in accordance with Technical Specification Task Force (TSTF)-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (Reference 1). A model safety evaluation was provided by the NRC to the TSTF on November 21, 2018 (Reference 2). As part of this application, TVA proposes the adoption of TSTF-439-A, Eliminate Second Completion Times Limiting Time From Discovery of Failure To Meet an LCO. Adopting TSTF-439-A is a prerequisite to applying a risk-informed completion time to certain TS Required Actions.

U.S. Nuclear Regulatory Commission CNL-21-009 Page 2 March , 2022 x Attachment 1 provides a description and assessment of the proposed change, the requested confirmation of applicability, and plant-specific variations.

x Attachments 2.1, 2.2, and 2.3 provide the existing TS pages marked up to show the proposed changes for BFN Units 1, 2, and 3, respectively.

x Attachments 3.1, 3.2, and 3.3 provide revised (retyped) TS pages.

x Attachment 4 provides existing TS Bases pages for BFN Unit 1 marked up to show the proposed changes and is provided for information only (the Unit 2 and 3 Bases are nearly identical in terms of what is being affected by adoption of TSTF-505-A and TSTF-439-A).

x Attachment 5 provides a cross-reference between the TS included in TSTF-505-A, Revision 2, and the BFN plant-specific TS.

x Attachment 6 provides a cross-reference between the TS included in TSTF-439-A, Revision 2, and the BFN plant-specific TS.

x Enclosures 1 through 12 are included in accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A (ML12286A322).

TVA requests approval of the proposed license amendment within one year from the date of this submittal with implementation within 180 days following NRC approval.

TVA has determined that there is no significant hazards consideration associated with the proposed change and that the TS change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9). In accordance with 10 CFR 50.91, Notice for Public Comment; State Consultation, a copy of this application with attachments and enclosures is being provided to the Alabama State Department of Public Health.

There are no new regulatory commitments contained in this submittal. Please address any questions regarding this submittal to Stuart L. Rymer, Senior Manager, Fleet Licensing, at slrymer@tva.gov.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this

VW day of March 2022.

Respectfully, Digitally signed by Carla Edmondson Date: 2022.03.31 22:26:29 -04'00' James T. Polickoski Director, Nuclear Regulatory Affairs Attachments cc: See page 3

U.S. Nuclear Regulatory Commission CNL-21-009 Page 3 March , 2022 Attachments:

1. Description and Assessment 2.1 Proposed Technical Specification Changes (Unit 1 Markup) 2.2 Proposed Technical Specification Changes (Unit 2 Markup) 2.3 Proposed Technical Specification Changes (Unit 3 Markup) 3.1 Revised Technical Specification Pages (Unit 1 Final Retyped) 3.2 Revised Technical Specification Pages (Unit 2 Final Retyped) 3.3 Revised Technical Specification Pages (Unit 3 Final Retyped)

4. Proposed Technical Specification Bases Changes (Unit 1 For Information Only)

5. TSTF-505-A (NUREG-1433) Versus BFN TS Cross-Reference

6. TSTF-439-A (NUREG-1433) Versus BFN TS Cross-Reference Enclosures (12) cc (w/Attachments and Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant State Health Officer, Alabama State Department of Public Health

Attachment 1 Description and Assessment

Subject:

License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (BFN-TS-524)

CONTENTS 1.0

SUMMARY

DESCRIPTION .......................................................................................2 2.0 TSTF-505-A ASSESSMENT ......................................................................................2 2.1 Applicability of Published Safety Evaluation Regarding TSTF-505 ........................... 2 2.2 Verifications and Regulatory Commitments Regarding TSTF-505-A ........................ 2 2.3 Optional Changes and Variations from TSTF-505-A ................................................. 3 2.3.1 Administrative Variations ........................................................................................... 4 2.3.2 Technical Variations .................................................................................................. 5 3.0 ADOPTION OF TSTF-439-A ....................................................................................10 3.1 Description of Proposed Change ............................................................................ 10 3.2 Description of Variations ......................................................................................... 10 3.3 Technical Evaluation ............................................................................................... 10 3.3.1 Maintenance Rule ................................................................................................... 11 3.3.2 Reactor Oversight Process ..................................................................................... 11 3.3.3 Administrative Controls ........................................................................................... 12 3.4 Conclusion............................................................................................................... 12 4.0 OTHER CHANGES ..................................................................................................12 4.1 Deletion of Unit 2 One-Time Historical Change ...................................................... 12 4.2 Added Continuation Header .................................................................................... 12

5.0 REGULATORY ANALYSIS

......................................................................................13 5.1 Applicable Regulatory Requirements ...................................................................... 13 5.2 No Significant Hazards Consideration ..................................................................... 13

6.0 ENVIRONMENTAL CONSIDERATION

S .................................................................15 Attachments 1.0 Description and Assessment 2.1 Proposed Technical Specification Changes (Unit 1 Markup) 2.2 Proposed Technical Specification Changes (Unit 2 Markup) 2.3 Proposed Technical Specification Changes (Unit 3 Markup) 3.1 Revised Technical Specification Pages (Unit 1 Final Retyped) 3.2 Revised Technical Specification Pages (Unit 2 Final Retyped) 3.3 Revised Technical Specification Pages (Unit 3 Final Retyped)

4. Proposed Technical Specification Bases Changes (Unit 1 For Information Only)

5. TSTF-505-A (NUREG-1433) Versus BFN TS Cross-Reference

6. TSTF-439-A (NUREG-1433) Versus BFN TS Cross-Reference CNL-21-009 A1-1 of 15

Attachment 1 Description and Assessment 1.0

SUMMARY

DESCRIPTION The proposed amendment would modify the Technical Specification (TS) requirements related to Completion Times (CT) for Required Actions (RA) to provide the option to calculate a longer, risk-informed CT (RICT). A new program, the Risk Informed Completion Time Program, is added to TS Section 5, Administrative Controls.

The methodology for using the RICT Program is described in Nuclear Energy Institute (NEI) 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, which was approved by the Nuclear Regulatory Commission (NRC) on May 17, 2007. Adherence to NEI 06-09-A is required by the RICT Program.

The proposed amendment is consistent with Technical Specification Task Force (TSTF)-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b.

However, only those RAs described in Attachment 5 and Enclosure 1 of this submittal, as reflected in the proposed TS markups provided in Attachments 2.1, 2.2, and 2.3, are proposed to be changed, because some of the modified RAs in TSTF-505-A are not applicable to the Browns Ferry Nuclear Plant (BFN), and there are some plant-specific RAs not included in TSTF-505-A that are included in this proposed amendment.

As part of this application, Tennessee Valley Authority (TVA) proposes the adoption of TSTF-439-A, Eliminate Second Completion Times Limiting Time From Discovery of Failure To Meet an LCO. Adopting TSTF-439-A is a prerequisite to applying a risk-informed completion time to certain TS Required Actions.

2.0 TSTF-505-A ASSESSMENT 2.1 Applicability of Published Safety Evaluation Regarding TSTF-505 Tennessee Valley Authority has reviewed TSTF-505, Revision 2, and the model safety evaluation dated November 21, 2018 (ML18253A085). This review included the supporting information provided to support TSTF-505 and the safety evaluation for NEI 06-09-A. As described in the subsequent paragraphs, TVA has concluded that the technical basis is applicable to BFN Units 1, 2 and 3, and support incorporation of this amendment in the BFN TS.

2.2 Verifications and Regulatory Commitments Regarding TSTF-505-A In accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A, the following is provided below.

1. Enclosure 1 identifies each of the TS RAs to which the RICT Program will apply, with a comparison of the TS functions to the functions modeled in the Probabilistic Risk Assessment (PRA) of the structures, systems, and components (SSCs) subject to those actions.

2. Enclosure 2 provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, as required by Regulatory Guide (RG) 1.200, Section 4.2.

CNL-21-009 A1-2 of 15

Attachment 1

3. Enclosure 3 is not applicable because each PRA model used for the RICT Program is addressed using a standard endorsed by the NRC.

4. Enclosure 4 provides appropriate justification for excluding sources of risk not addressed by the PRA models.

5. Enclosure 5 provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.

6. Enclosure 6 is not applicable because the RICT Program is not being applied to shutdown modes.

7. Enclosure 7 provides a discussion of the programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.

8. Enclosure 8 provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified to assess real-time configuration risk, and describes the scope of, and quality controls applied to, the real-time risk model.

9. Enclosure 9 provides a discussion of how the key assumptions and key sources of uncertainty in the PRA models were identified, and how their impact on the RICT Program was assessed and dispositioned.

10. Enclosure 10 provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program implementation, including risk management action (RMA) implementation.

11. Enclosure 11 provides a description of the implementation and monitoring program, as described in NEI 06-09-A, Section 2.3.2, Step 7.

12. Enclosure 12 provides a description of the process to identify and provide RMAs.

2.3 Optional Changes and Variations from TSTF-505-A In this section, TVA is proposing variations from the TS changes described in TSTF-505-A, Revision 2, or the applicable parts of the NRC staffs model safety evaluation dated November 21, 2018. These options were recognized as acceptable variations in TSTF-505-A and the NRC model safety evaluation, or are otherwise justified.

A cross-reference of the TSTF-505-A standard technical specification (STS) changes versus the BFN changes is provided in Attachment 5 of this submittal. Attachment 5 provides individual dispositions of each STS and BFN change. Where the changes are identical, a disposition of No variation is provided. Where a variation is taken, the disposition provides a cross-reference to the paragraph in this Attachment that provides justification.

CNL-21-009 A1-3 of 15

Attachment 1 2.3.1 Administrative Variations The following variations taken from the TSTF-505-A template for NUREG-1433 are considered to be administrative in nature.

2.3.1.1 BFN RAs with alpha-numeric designations that differ from the corresponding General Electric Standard Technical Specifications (NUREG-1433) RAs (as applicable), have wording that is slightly different, and have differing existing Completion Times with a similar intent are administrative variations from TSTF-505-A with no effect on the NRC staff's model safety evaluation.

2.3.1.2 For NUREG-1433 RAs that are not contained in the BFN TS, the corresponding NUREG-1433 markups included in TSTF-505-A for these RAs and Completion Times are not applicable to BFN. These are administrative variations from TSTF-505-A with no effect on the NRC staff's model safety evaluation.

2.3.1.3 Various TSTF-505-A Section 3.3 instrumentation Conditions are invoked by instrumentation Functions contained in tables. The analogous BFN instrumentation Functions may have different Conditions referenced or have slightly different wording.

This includes differences in lettering in the tables. These are administrative variations from TSTF-505-A that meet the criteria for administering a RICT and have no effect on the NRC staff's model safety evaluation.

2.3.1.4 TSTF-505-A applies RICT to certain RAs that require additional plant-specific justification. For several of these RAs, the BFN design has not been able to meet the necessary justification, so a RICT has not been applied. For example, as the proposed BFN RICT Program is applicable in Modes 1 and 2, TVA will not adopt changes in TSTF-505-A for RAs that are only applicable in Mode 3 and below.

2.3.1.5 TSTF-505-A applies a RICT to STS TS 3.3.2.2 Condition A, One feedwater and main turbine high water level trip channel inoperable. The trip logic in the STS reference plant is that there is no loss of function in this condition. The analogous BFN requirement is TS 3.3.2.2 Condition A, One of more feedwater and main turbine high water level trip channels inoperable, in one trip system. Similarly, there is no loss of function in this configuration. This is an administrative variation with no effect on the NRC staffs model safety evaluation.

2.3.1.6 Certain BFN TS did not include a RICT because it could not be verified that there would not be a loss of function, or that the function was adequately modeled in the PRA.

2.3.1.7 The wording in TSTF-505-A for TS Section 5.5.15, Risk Informed Completion Time Program, Paragraph e. states, in part:

Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, The correlating wording in the TSTF-505 model safety evaluation states:

Methods to assess the risk from extending the Completion Times must be PRA methods approved for use with this program, CNL-21-009 A1-4 of 15

Attachment 1 The language in the model safety evaluation provides more clarity for BFN TS Section 5.5.16 Paragraph e., so that language has been proposed. This is an administrative variation that promotes conformity with the model safety evaluation.

2.3.1.8 STS 3.8.4 Condition C, One DC electrical power subsystem inoperable for reason other than Condition A [or B]. best correlates with:

BFN Unit 1 and 2 TS 3.8.4 Condition A, One Unit DC electrical power subsystem inoperable OR One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable.

and BFN Unit 3 TS 3.8.4 Condition A, One Unit DC electrical power subsystem inoperable OR 3EB Shutdown Board DC electrical power subsystem inoperable.

Although the wording of the BFN Conditions is more detailed than the STS Condition, they are similarly bounded by the loss of a single DC electrical power subsystem that does not result in a loss of function. This is therefore an administrative variation with no effect on the NRC staffs model safety evaluation.

2.3.2 Technical Variations The following variations from the TSTF-505-A template for NUREG-1433 are considered to be technical in nature.

2.3.2.1 BFN TS 3.3.8.1, Loss of Power (LOP) Instrumentation, Condition A states:

A. One degraded voltage relay channel inoperable on one or more shutdown board(s).

AND The loss of voltage relay channels on the affected shutdown board(s) are Operable.

This Condition does not directly correlate to STS TS 3.3.8.1 Condition A. A RICT is proposed for RA A.2, Place the degraded voltage relay in trip. The Degraded Voltage Function is monitored by three undervoltage relay channels for each shutdown board, whose outputs are arranged in a two-out-of-three logic configuration. The channels compare measured input signals with pre-established setpoints. When the setpoint is exceeded for two of the three degraded voltage channels, the logic energizes timers which provides a loss of power (LOP) trip signal to the shutdown board logic. This two-out-of-three permissive logic scheme provided for these relays ensures there is no loss of function with one degraded voltage relay channel inoperable. This Function is therefore assessed as passing the exclusion criteria of TSTF-505-A with one degraded voltage relay channel inoperable, and that delaying the placing of the relay in trip does not entail a loss of function. Accordingly, it is acceptable to allow the option of a RICT to this RA.

2.3.2.2 STS limiting condition for operation (LCO) 3.6.2.3, RHR Suppression Pool Cooling, requires two residual heat removal (RHR) suppression pool cooling subsystems be CNL-21-009 A1-5 of 15

Attachment 1 Operable. As described in the NUREG-1433 Bases, the STS reference plant has two RHR suppression pool cooling subsystems; and so, in the event of an accident, at least one subsystem will be Operable assuming the worst case single active failure.

STS TS 3.6.2.3 Conditions A and B are:

A. One RHR suppression pool cooling subsystem inoperable.

B. Two RHR suppression pool cooling subsystems inoperable.

A RICT can be applied to STS RA A.1 (Restore RHR suppression pool cooling subsystem to Operable status), because there is no loss of function. A RICT cannot be applied to STS B.1 (Restore one RHR suppression pool cooling subsystem to OPERABLE status), because this Condition results in a loss of function.

In contrast, the BFN LCO 3.6.2.3 requires four RHR suppression pool cooling subsystems be Operable. As described in the BFN Bases, the RHR System has two loops with each loop consisting of two RHR suppression pool cooling subsystems.

With this configuration, a single active failure will ensure that there are at least two subsystems performing the required primary containment cooling function. BFN Conditions A and B are below.

A. One RHR suppression pool cooling subsystem inoperable.

B. Two RHR suppression pool cooling subsystems inoperable.

A RICT cannot be applied to BFN RA A.1 (Restore the RHR suppression pool cooling subsystem to Operable status), because the Completion Time is already 30 days, and is therefore ineligible. A RICT can be applied to BFN RA B.1 (Restore one RHR suppression pool cooling subsystem to Operable status) because the remaining two RHR suppression pool cooling subsystems are adequate to perform the primary containment cooling function.

This justification is also applicable to STS TS 3.6.2.4 (RHR Suppression Pool Spray) compared to BFN TS 3.6.2.4. Similar to TS 3.6.2.3, a RICT is not applied to BFN TS 3.6.2.4 RA A.1 but is applied to RA B.1.

This justification is also applied to BFN TS 3.6.2.5 (RHR Drywell Spray). This TS is not contained in STS. Similar to BFN TS 3.6.2.3, a RICT is not applied to RA A.1 but is applied to RA B.1.

2.3.2.3 STS LCO 3.7.1, Residual Heat Removal Service Water (RHRSW) System, requires two RHRSW subsystems be Operable. As described in the NUREG-1433 Bases, the STS reference plant has two RHRSW subsystems; and so, in the event of an accident, at least one subsystem will be OPERABLE assuming the worst case single active failure. STS TS 3.7.1 Conditions B and C are:

B. One RHRSW pump in each subsystem inoperable.

C. One RHRSW subsystem inoperable for reasons other than Condition A.

A RICT can be applied to STS RA B.1 (Restore one RHRSW pump to OPERABLE status), because there is no loss of function. A RICT can also applied to STS C.1 (Restore RHRSW subsystem to OPERABLE status), because there is no loss of function.

CNL-21-009 A1-6 of 15

Attachment 1 In contrast, as a shared system between the three BFN units, the BFN LCO 3.7.1 requires four RHRSW subsystems be Operable with the following pump Operability requirements:

1 unit fueled - four operable RHRSW pumps 2 units fueled - six operable RHRSW pumps 3 units fueled - eight operable RHRSW pumps As described in the BFN Bases, the RHRSW system has four subsystems, with two pumps in each subsystem. With this configuration, a single active failure will ensure that there are at least two subsystems, with one pump operating in each subsystem, performing the required cooling function. BFN Conditions C and D are:

C. Two required RHRSW pumps inoperable.

D. Two RHRSW subsystems inoperable.

A RICT can be applied to BFN RA C.1 (Restore one inoperable RHRSW pump to Operable status), because the remaining RHRSW pumps are adequate to perform the RHRSW heat removal function. A RICT can be applied to BFN RA D.1 (Restore one RHR suppression pool cooling subsystem to Operable status) because the remaining Operable RHRSW subsystems are adequate to perform the RHRSW heat removal function.

2.3.2.4 STS TS 3.8.9 is written based on a reference plant that has no shared electrical distribution systems with other units. BFN TS 3.8.7, Distribution Systems -

Operating, is written with respect to certain shared electrical distribution systems for Units 1, 2, and 3.

Units 1 and 2 The onsite Class 1E AC and DC electrical power distribution system is divided into redundant and independent AC and DC electrical power distribution subsystems.

The primary AC distribution system consists of four Unit 1 and 2 4.16 kV shutdown boards each having an offsite source of power as well as a dedicated onsite diesel generator (DG) source. Each 4.16 kV shutdown board is normally connected to a unit station service transformer (USST) (1B or 2B) via a 4.16 kV unit board and a shutdown bus (1 or 2). If no offsite source is available, the onsite emergency DGs supply power to the 4.16 kV shutdown boards.

The secondary plant distribution system includes 480 VAC shutdown boards and associated load centers, and transformers.

BFN Unit 1 and 2 TS 3.8.7 Condition A (One Unit 1 and 2 4.16kV Shutdown Board inoperable) is roughly comparable to STS TS 3.8.9 Condition A (one or more AC electrical power distribution subsystems inoperable). With one Unit 1 and 2 4.16 kV shutdown board inoperable, the remaining Unit 1 and 2 4.16 kV shutdown boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. Accordingly, a RICT may be applied to RA A.1 because there is no resulting loss of function.

CNL-21-009 A1-7 of 15

Attachment 1 BFN Unit 1(2) TS 3.8.7 Condition B (One Unit 1(2) 480 V Shutdown board inoperable OR 480 V RMOV Board 1A(2A) OR 480 V RMOV Board 1B(2B) inoperable) is roughly comparable to STS TS 3.8.9 Condition B (One or more AC vital buses inoperable). With one Unit 1(2) 480 V shutdown board inoperable, the remaining 480 V shutdown board is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. This condition also bounds the inoperability of 480 V RMOV boards 1(2)A or 1(2)B. Accordingly, a RICT may be applied to RA B.1 because there is no resulting loss of function.

BFN TS 3.8.7 Condition C (Unit 1) and Condition D (Unit 2) pertain to one Unit 1 and 2 DG Auxiliary Board inoperable. With one Units 1 and 2 480 V diesel auxiliary board inoperable, the remaining 480 V diesel auxiliary board is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. Accordingly, a RICT may be applied to RA C.1 (Unit 1) and D.1 (Unit 2) because there is no resulting loss of function.

BFN TS 3.8.7 Condition D (Unit 1) and Condition E (Unit 2) pertain to the inoperability of various DC boards (Unit DC board, Unit 1 and 2 Shutdown Board DC Distribution Panel, 250 V DC RMOV Board 1(2)A/1(2)B/1(2)C). With one Unit DC board or one Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable, the remaining boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. This condition also bounds the inoperability of 250 V RMOV boards 1(2)A, 1(2)B, or 1(2)C. Accordingly, a RICT may be applied to RA D.1 (Unit 1) and E.1 (Unit 2) because there is no resulting loss of function.

BFN TS 3.8.7 Condition E (Unit 1) and Condition F (Unit 2) pertain to Unit 1 and 2, 4.16 kV Shutdown Board A and B inoperable OR Unit 1 and 2, 4.16 kV Shutdown Board C and D inoperable. With one division of 4.16 kV shutdown boards inoperable, the remaining division of shutdown boards is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. Accordingly, a RICT may be applied to RA E.1 (Unit 1) and F.1 (Unit 2) because there is no resulting loss of function.

Unit 3 The onsite Class 1E AC and DC electrical power distribution system is divided into redundant and independent AC and DC electrical power distribution subsystems.

The primary AC distribution system consists of four Unit 3 4.16 kV shutdown boards each having an offsite source of power as well as a dedicated onsite DG source. Each 4.16 kV shutdown board is normally connected to the 3B USST via a 4.16 kV unit board. If no offsite source is available, the onsite emergency DGs supply power to the 4.16 kV shutdown boards.

The secondary plant distribution system includes 480 VAC shutdown boards and associated load centers, and transformers.

BFN Unit 3 TS 3.8.7 Condition A (One Unit 3 4.16kV Shutdown Board inoperable) is roughly comparable to STS TS 3.8.9 Condition A (One or more AC electrical power CNL-21-009 A1-8 of 15

Attachment 1 distribution subsystems inoperable). With one Unit 3 4.16 kV shutdown board inoperable, the remaining Unit 3 4.16 kV shutdown boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. Accordingly, a RICT may be applied to RA A.1 because there is no resulting loss of function.

BFN Unit 3 TS 3.8.7 Condition B (One Unit 3 480 V Shutdown board inoperable OR 480 V RMOV Board 3A OR 480 V RMOV Board 3B inoperable) is roughly comparable to STS TS 3.8.9 Condition B (One or more AC vital buses inoperable).

With one Unit 3 480 V shutdown board inoperable, the remaining 480 V shutdown board is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. This condition also bounds the inoperability of 480 V RMOV boards 3A or 3B. Accordingly, a RICT may be applied to RA B.1 because there is no resulting loss of function.

BFN TS 3.8.7 Condition D pertains to one Unit 3 DG Auxiliary Board inoperable.

With one Unit 3 480 V diesel auxiliary board inoperable, the remaining 480 V diesel auxiliary board is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. Accordingly, a RICT may be applied to RA D.1 because there is no resulting loss of function.

BFN TS 3.8.7 Condition E pertains to the inoperability of various DC boards (Unit DC board, Shutdown Board DC Distribution Panel 3EB, 250 V DC RMOV Board 3A/3B/3C). With one Unit DC board or Shutdown Board DC Distribution Panel 3EB inoperable, the remaining boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. This condition also bounds the inoperability of 250 V RMOV boards 3A, 3B, or 3C.

BFN TS 3.8.7 Condition F pertains to Unit 3 4.16 kV Shutdown Board 3EA and 3EB inoperable OR Unit 3 4.16 kV Shutdown Board 3EC and 3ED inoperable. With one division of 4.16 kV shutdown boards inoperable, the remaining division of shutdown boards is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure.

Accordingly, a RICT may be applied to RA F.1 because there is no resulting loss of function.

2.4 Bases Changes Revised TS Bases are provided in Attachment 4 for NRC information only. Only the BFN Unit 1 TS Bases markups are provided, as the BFN Unit 2 and 3 Bases changes are nearly identical in terms of the TSTF-505-driven changes being made. These Bases revisions will be incorporated as an implementing action pursuant to TS 5.5.10, Technical Specifications (TS) Bases Control Program, following issuance of the amendment.

CNL-21-009 A1-9 of 15

Attachment 1 3.0 ADOPTION OF TSTF-439-A 3.1 Description of Proposed Change The guidance of NUREG-1433, Revision 1, "Standard Technical Specifications General Electric Plants, BWR/4," was used to convert BFN standard TS to the improved TS (ITS),

which was issued as Amendments 234, 253, and 212 for BFN Units 1, 2, and 3, respectively, on July 14, 1998 (ML9808030269). The ITS conversion introduced a second Completion Time for certain TS Required Actions that establish a limit on the maximum allowed for any combination of Conditions that result in a single continuous failure to meet the LCO. These Completion Times, henceforth referred to as "second Completion Times," are joined by an "AND" logical connector to the Condition-specific Completion Time and state "X days from discovery of failure to meet the LCO," where "X" varies by specification. The intent of the second Completion Time was to preclude entry into and out of the Actions for an indefinite period without meeting the LCO by providing a limit on the amount of time that the LCO could not be met for various combinations of Conditions.

Consistent with TSTF-439-A1, the proposed change, (1) deletes all second Completion Times contained in the BFN TS and, (2) revises Completion Times Example 1.3-3 to eliminate the second Completion Times contained within and revises the discussion in the Example to state that alternating between Conditions in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO is inconsistent with the basis of the Completion Times and is inappropriate.

Marked up and retyped TS pages are provided in Attachments 2.1, 2.2, and 2.3, and Attachments 3.1, 3.2, and 3.3, along with the TSTF-505-A changes. Associated TS Bases changes are provided in Attachment 4 for Unit 1 (for information only). The TSTF-439-A markups are distinguished from the TSTF-505-A markups by different colors.

3.2 Description of Variations provides a comparison of the TSTF-439-A changes to NUREG-1433 versus the changes made to the BFN TS. TVA has concluded that these variations are administrative in nature, and consistent with the intent of the NRC-approved traveler.

3.3 Technical Evaluation As discussed in TSTF-439-A, Revision 2, the adoption of a second Completion Time was based on an NRC concern that a plant could continue to operate indefinitely with an LCO governing safety significant systems never being met by alternately meeting the requirements of different Conditions in the same specification. In 1991, there was no regulatory requirement or program which could prevent this misuse of the TS. However, that is no longer the case.

With the promulgation of the Maintenance Rule, implementation of the Reactor Oversight Process, and the inclusion of administrative controls as discussed herein, there would exist strong disincentive to continue operation with concurrent multiple inoperabilities of the type the second Completion Times were designed to prevent.

1 TSTF-439 was approved for use by the NRC in a letter dated January 11, 2006 (ML060120272).

CNL-21-009 A1-10 of 15

Attachment 1 3.3.1 Maintenance Rule 10 CFR 50.65 (a)(1), "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants" (the Maintenance Rule), requires each licensee to monitor the performance or condition of SSCs against licensee-established goals to assure that the SSCs are capable of fulfilling their intended functions. If the performance or condition of an SSC does not meet established goals, appropriate corrective action is required to be taken. The NRC Resident Inspectors monitor the licensee's Corrective Action Program (CAP) and could take action if the licensee's maintenance program allowed the systems required by a single LCO to become concurrently inoperable multiple times. The performance and condition monitoring activities required by 10 CFR 50.65 (a)(1) and (a)(2) would identify if poor maintenance practices resulted in multiple entries into the Actions of the TS and unacceptable unavailability of these SSCs. The effectiveness of these performance monitoring activities, and associated corrective actions, is evaluated at least every refueling cycle, not to exceed 24 months per 10 CFR 50.65 (a)(3).

Under the TS, the Completion Time for one system is not affected by other inoperable equipment. The second Completion Times were an attempt to influence the Completion Time for one system based on the condition of another system, if the two systems were required by the same LCO. However, 10 CFR 50.65(a)(4) is a much better mechanism to apply this influence as the Maintenance Rule considers all inoperable risk-significant equipment, not just the one or two systems governed by the same LCO.

Under 10 CFR 50.65(a)(4), the risk impact of all inoperable risk-significant equipment is assessed and managed when performing preventative or corrective maintenance. The risk assessments are conducted using the procedures and guidance endorsed by RG 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." RG 1.160 endorses the Revision 4A of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to:

x plan and conduct other activities in a manner that controls overall risk, x increased risk awareness by shift and management personnel, x reduce the duration of the condition, x minimize the magnitude of risk increases through the establishment of backup success paths or compensatory measures, and x determination that the proposed maintenance is acceptable.

This comprehensive program provides much greater assurance of safe plant operation than the second Completion Times in the TS.

3.3.2 Reactor Oversight Process Nuclear Energy Institute (NEI) 99-02, "Regulatory Assessment Performance Indicator Guideline," describes the tracking and reporting of performance indicators to support the NRC's Reactor Oversight Process (ROP). The NEI document is endorsed by Regulatory Issue Summary (RIS) 2001-11, "Voluntary Submission of Performance Indicator Data." NEI 99-02, Section 2.2, describes the Mitigating Systems Cornerstone. NEI 99-02 specifically addresses Emergency AC Sources, which encompasses the BFN AC Sources and Distribution System LCOs which have second Completion Times. Extended unavailability of these systems due to CNL-21-009 A1-11 of 15

Attachment 1 multiple entries into the Actions would affect the NRCs evaluation of the licensee's performance under the ROP.

3.3.3 Administrative Controls In addition to these programs, a requirement is added to Section 1.3 of the TS to require licensees to have administrative controls to limit the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls should consider plant risk and shall limit the maximum contiguous time of failing to meet the LCO. This TS requirement, when considered with the regulatory processes discussed above, provides an equivalent or superior level of plant safety without the unnecessary complication of the TS by second Completion Times on some Specifications. Furthermore, TVA will revise Procedure OPDP-8, Operability Determination Process and Limiting Conditions for Operation Tracking, to implement the guidance contained in TSTF-439-A, Revision 2. Specifically:

It is possible to alternate between Technical Specification Conditions in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO.

However, doing so would be inconsistent with the basis of the Completion Times.

Therefore, the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO shall be limited. The Completion Times for those Conditions shall not be inappropriately extended.

OPDP-8 provides guidance for documenting the entrance into TS Actions when an applicable LCO is not met, LCO re-assignment, and LCO cancellation. This change will be part of the implementation process for this TS change.

3.4 Conclusion In conclusion, the proposed changes, although with variances, fall within the scope of this TSTF traveler and the justification is also applicable.

4.0 OTHER CHANGES 4.1 Deletion of Unit 2 One-Time Historical Change and Extraneous Footer Markings With License Amendment 294, TVA implemented a one-time change to Unit 2 TS 3.5.1 to extend the Completion Time for Required Action A.1 from 7 days to 14 days. This one-time approval expired on June 1, 2005 and is deleted from the Unit 2 technical specifications to avoid unnecessary confusion. Additionally, extraneous pen-and-ink markings to the footers of Page 3.3-1 for BFN UnitV 2 and 3 were removed. These markings do not show in the as-issued pages for License Amendment 258/221.

4.2 Improved Technical Specification Writers Guide Modifications On BFN Unit 1, a continuation header for Section 5.15 is added to Page 5.0.21c, consistent with the Improved Technical Specifications (ITS) Writers Guide. This is an administrative change.

On BFN Unit 2, section-ending double underlines are added to Page 5.0.21c, consistent with the ITS Writers Guide. This is an administrative change.

CNL-21-009 A1-12 of 15

Attachment 1

5.0 REGULATORY ANALYSIS

5.1 Applicable Regulatory Requirements The following NRC requirements are applicable to the proposed change.

Title 10 Code of Federal Regulations 50.36(c)(2)

The regulations of Title 10 of the Code of Federal Regulations (10 CFR), "Technical Specifications," establish the requirements related to the content of the TS. Section 50.36(c)(2) states, in part:

When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

Title 10 Code of Federal Regulations 50.65 The regulations of 10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," establish a performance-based rule to ensure that nuclear power plant structures, systems, and components (SSCs) will be maintained so that they will perform their intended function when required.

The proposed changes continue to meet the requirements of these regulations.

5.2 No Significant Hazards Consideration TVA has evaluated the proposed change to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.

TVA requests for BFN Units 1, 2, and 3, adoption of an approved change to the STS and plant-specific TS, to modify the TS requirements related to Completion Times for Required Actions to provide the option to calculate a longer, risk-informed Completion Time. The allowance is described in a new program in Chapter 5, Administrative Controls, entitled the Risk Informed Completion Time Program. Additionally, TVA proposes the adoption of TSTF-439-A, Eliminate Second Completion Times Limiting Time From Discovery of Failure To Meet An LCO. Adopting TSTF-439-A is a prerequisite to applying a risk-informed completion time to certain Limiting Conditions for Operation.

As required by 10 CFR 50.91(a), an analysis of the issue of no significant hazards consideration is presented below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change permits the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program, and the deletion of second Completion Times. The proposed change does not involve a significant increase in the probability of an accident previously evaluated because the change involves no change to the CNL-21-009 A1-13 of 15

Attachment 1 plant or its modes of operation. The proposed change does not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the extended Completion Time (and deleted second Completion Times) are no different from those during the existing Completion Time.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change does not change the design, configuration, or method of operation of the plant. The proposed change does not involve a physical alteration of the plant (no new or different kind of equipment will be installed).

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change permits the extension of Completion Times provided risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change implements a risk-informed configuration management program to assure that adequate margins of safety are maintained. Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS. Deleting the second Completion Time does not alter the manner in which safety limits, limiting safety system settings, limited safety system settings, or limiting conditions for operation are determined. The safety analysis acceptance criteria are not affected by this change.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, TVA concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

5.3 Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with NRC regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

CNL-21-009 A1-14 of 15

Attachment 1

6.0 ENVIRONMENTAL CONSIDERATION

S TVA has reviewed the environmental evaluation included in the model safety evaluation published on November 21, 2018. TVA has concluded that the NRC staff findings presented in that evaluation are applicable to BFN Units 1, 2, and 3.

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

CNL-21-009 A1-15 of 15

Attachment 2.1 Proposed Technical Specification Changes (Unit 1 Markup)

(43 total pages)

Note - The blue markups pertain to TSTF-439-A.

The red markups pertain to TSTF-505-A and all other changes.

CNL-21-009

,16(57(;$03/(

(;$03/(

$&7,216

&21',7,21 5(48,5('$&7,21 &203/(7,21

7,0(

$ 2QH $ 5HVWRUHVXEV\VWHP GD\V

VXEV\VWHP WR23(5$%/(

LQRSHUDEOH VWDWXV 25

,QDFFRUGDQFH

ZLWKWKH5LVN

,QIRUPHG

&RPSOHWLRQ

7LPH3URJUDP

% 5HTXLUHG % %HLQ02'( KRXUV

$FWLRQDQG DVVRFLDWHG $1'

&RPSOHWLRQ 7LPHQRWPHW % %HLQ02'( KRXUV

KHQDVXEV\VWHPLVGHFODUHGLQRSHUDEOH&RQGLWLRQ$LVHQWHUHG

7KHGD\&RPSOHWLRQ7LPHPD\EHDSSOLHGDVGLVFXVVHGLQ

([DPSOH+RZHYHUWKHOLFHQVHHPD\HOHFWWRDSSO\WKH5LVN

,QIRUPHG&RPSOHWLRQ7LPH3URJUDPZKLFKSHUPLWVFDOFXODWLRQRID

5LVN,QIRUPHG&RPSOHWLRQ7LPH 5,&7 WKDWPD\EHXVHGWR

FRPSOHWHWKH5HTXLUHG$FWLRQEH\RQGWKHGD\&RPSOHWLRQ7LPH

7KH5,&7FDQQRWH[FHHGGD\V$IWHUWKHGD\&RPSOHWLRQ7LPH

KDVH[SLUHGWKHVXEV\VWHPPXVWEHUHVWRUHGWR23(5$%/(VWDWXV

ZLWKLQWKH5,&7RU&RQGLWLRQ%PXVWDOVREHHQWHUHG

7KH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPUHTXLUHV

UHFDOFXODWLRQRIWKH5,&7WRUHIOHFWFKDQJLQJSODQWFRQGLWLRQV)RU

SODQQHGFKDQJHVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGSULRUWR

LPSOHPHQWDWLRQRIWKHFKDQJHLQFRQILJXUDWLRQ)RUHPHUJHQW

FRQGLWLRQVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGZLWKLQWKHWLPH

OLPLWVRIWKH5HTXLUHG$FWLRQ&RPSOHWLRQ7LPH LHQRWWKH5,&7

RUKRXUVDIWHUWKHSODQWFRQILJXUDWLRQFKDQJHZKLFKHYHULVOHVV

,IWKHGD\&RPSOHWLRQ7LPHFORFNRI&RQGLWLRQ$KDVH[SLUHGDQG

VXEVHTXHQWFKDQJHVLQSODQWFRQGLWLRQUHVXOWLQH[LWLQJWKH

DSSOLFDELOLW\RIWKH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPZLWKRXW

UHVWRULQJWKHLQRSHUDEOHVXEV\VWHPWR23(5$%/(VWDWXV

&RQGLWLRQ%LVDOVRHQWHUHGDQGWKH&RPSOHWLRQ7LPHFORFNVIRU

5HTXLUHG$FWLRQV%DQG%VWDUW

,IWKH5,&7H[SLUHVRULVUHFDOFXODWHGWREHOHVVWKDQWKHHODSVHG

WLPHVLQFHWKH&RQGLWLRQZDVHQWHUHGDQGWKHLQRSHUDEOH

VXEV\VWHPKDVQRWEHHQUHVWRUHGWR23(5$%/(VWDWXV&RQGLWLRQ

%LVDOVRHQWHUHGDQGWKH&RPSOHWLRQ7LPHFORFNVIRU5HTXLUHG

$FWLRQV%DQG%VWDUW,IWKHLQRSHUDEOHVXEV\VWHPVDUH

UHVWRUHGWR23(5$%/(VWDWXVDIWHU&RQGLWLRQ%LVHQWHUHG

&RQGLWLRQ$LVH[LWHGDQGWKHUHIRUHWKH5HTXLUHG$FWLRQVRI

&RQGLWLRQ%PD\EHWHUPLQDWHG

,16(575,&7

25

,QDFFRUGDQFH

ZLWKWKH5LVN

,QIRUPHG

&RPSOHWLRQ7LPH

3URJUDP

,16(575,&73URJUDP

5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDP

7KLVSURJUDPSURYLGHVFRQWUROVWRFDOFXODWHD5LVN,QIRUPHG&RPSOHWLRQ

7LPH 5,&7 DQGPXVWEHLPSOHPHQWHGLQDFFRUGDQFHZLWK1(,$

5HYLVLRQ5LVN0DQDJHG7HFKQLFDO6SHFLILFDWLRQV 5076

XLGHOLQHV7KHSURJUDPVKDOOLQFOXGHWKHIROORZLQJ

D 7KH5,&7PD\QRWH[FHHGGD\V

E $5,&7PD\RQO\EHXWLOL]HGLQ02'(6DQG

F :KHQD5,&7LVEHLQJXVHGDQ\FKDQJHWRWKHSODQWFRQILJXUDWLRQDV GHILQHGLQ1(,$$SSHQGL[$PXVWEHFRQVLGHUHGIRUWKHHIIHFW RQWKH5,&7

)RUSODQQHGFKDQJHVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGSULRU WRLPSOHPHQWDWLRQRIWKHFKDQJHLQFRQILJXUDWLRQ

)RUHPHUJHQWFRQGLWLRQVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHG ZLWKLQWKHWLPHOLPLWVRIWKH5HTXLUHG$FWLRQ&RPSOHWLRQ7LPH LH

QRWWKH5,&7 RUKRXUVDIWHUWKHSODQWFRQILJXUDWLRQFKDQJH

ZKLFKHYHULVOHVV

5HYLVLQJWKH5,&7LVQRWUHTXLUHGLIWKHSODQWFRQILJXUDWLRQFKDQJH ZRXOGORZHUSODQWULVNDQGZRXOGUHVXOWLQDORQJHU5,&7

G )RUHPHUJHQWFRQGLWLRQVLIWKHH[WHQWRIFRQGLWLRQHYDOXDWLRQIRU LQRSHUDEOHVWUXFWXUHVV\VWHPVRUFRPSRQHQWV 66&V LVQRWFRPSOHWH SULRUWRH[FHHGLQJWKH&RPSOHWLRQ7LPHWKH5,&7VKDOODFFRXQWIRUWKH LQFUHDVHGSRVVLELOLW\RIFRPPRQFDXVHIDLOXUH &&) E\HLWKHU

1XPHULFDOO\DFFRXQWLQJIRUWKHLQFUHDVHGSRVVLELOLW\RI&&)LQWKH 5,&7FDOFXODWLRQRU

5LVN0DQDJHPHQW$FWLRQV 50$V QRWDOUHDG\FUHGLWHGLQWKH 5,&7FDOFXODWLRQVKDOOEHLPSOHPHQWHGWKDWVXSSRUWUHGXQGDQWRU GLYHUVH66&VWKDWSHUIRUPWKHIXQFWLRQ V RIWKHLQRSHUDEOH66&V

DQGLISUDFWLFDEOHUHGXFHWKHIUHTXHQF\RILQLWLDWLQJHYHQWVWKDW FKDOOHQJHWKHIXQFWLRQ V SHUIRUPHGE\WKHLQRSHUDEOH66&V

H 7KHULVNDVVHVVPHQWDSSURDFKHVDQGPHWKRGVVKDOOEHDFFHSWDEOHWRWKH 15&7KHSODQW35$VKDOOEHEDVHGRQWKHDVEXLOWDVRSHUDWHGDQG PDLQWDLQHGSODQWDQGUHIOHFWWKHRSHUDWLQJH[SHULHQFHDWWKHSODQWDV VSHFLILHGLQ5HJXODWRU\*XLGH5HYLVLRQ0HWKRGVWRDVVHVV WKHULVNIURPH[WHQGLQJWKH&RPSOHWLRQ7LPHVPXVWEH35$PHWKRGV DSSURYHGIRUXVHZLWKWKLVSURJUDPRURWKHUPHWKRGVDSSURYHGE\WKH 15&IRUJHQHULFXVHDQGDQ\FKDQJHLQWKH35$PHWKRGVWRDVVHVV ULVNWKDWDUHRXWVLGHWKHVHDSSURYDOERXQGDULHVUHTXLUHSULRU15&

DSSURYDO

Completion Times 1.3 1.3 Completion Times

\._)

DESCRIPTION The above Completion Time extension does not apply to a

( continued) Completion Time with a modified "time zero." This modified "time zero" may be expressed as a *repetitive time (i.e., "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Required Action versus the time of Condition entry) or as a time modified by the phrase from discovery ..." E* ffiple 1.a a ilh:1stFates eRe 1:1s e ef this ty13e ef GeffipletieA Tiffie. The 1O eay GefflpletieR Tiffie speeifiea for GeReitiOR A Re B iR EM ffiple 1.3 3 FflBY Rat ee e*1eRaea:

The following examples illustrate the use of Completion Times

~ith different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. Required 8.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

\,_/' Action and associated AND Completion Time not met.

8.2 Be in MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Condi~ion B has two Required Actions. Each Required Action has its own separate Completion Time. Each Completion Time is referenced to the time that Condition B is entered.

(continued)

BFN-UNIT 1 1.3-3 Amendment No. 234

Completion Times 1.3

1.3 Completion Times EXAMPLES EXAMPLE 1.3-3

( continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore 7 days Function X Function X subsystem subsystem to AWO inoperable. OPERABLE status . . ~g says u:em diseorviery of f-eiluFe to meet the l::GG .

B. One B.'1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function Y Function Y subsystem subsystem to ANO inoperable. OPERABLE status. 10 days u:em diseo*,ery of f-eiluFe to meet the bGQ (continued)

BFN-UNIT 1 1.3-6 Amendment No. 234

It is possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO. However, doing so would be inconsistent with the basis of the Completion Times.

Therefore, there shall be administrative controls to limit the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls shall ensure that the Completion Times for those Conditions are not inappropriately extended.

INSERT Example 1.3-8

INSERT RICT

RPS Instrumentation 3.3.1 .1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1.

ACTIONS

NOTE--------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR A. 2 -------------NOTE-------------

INSERT Not applicable for RICT Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

Place associated trip system in trip.

. B. -------------NOTE------------ 8.1 Place *channel in one trip Not applicable for system in trip.

Functions 2.a, 2.b, 2.c, 2.d, or 2.f. OR One or more Functions B.2 Place one trip system in with one or more required trip.

channels inoperable in both trip systems .

(continued)

BFN-UNIT 1 3.3-1 Amendment No. 234, 262, z66

Feedwater and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3 .2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Two channels of feedwater and main turbine high water level trip instrumentation per trip system shall be OPERABLE.

APPLICABILITY: THERMAL POWER~ 23% RTP.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION INSERT TIME

~RICT I A. One or more feedwater and main turbine high water level trip channels A.1 Place channel(s) in trip.

17 inoperable, in one trip system.

B. One or more feedwater B.1 Restore feedwater and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and main turbine high main turbine high water water level trip channels level trip capability.

inoperable in each trip system.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to < 23% RTP.

Time not met. I BFN-UNIT 1 3.3-21 Amendment No. 2-34,~

ATWS-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION U 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation LCO 3.3.4.2 Two channels per trip system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low, Level 2; and

b. Reactor Steam Dome Pressure - High.

APPLICABIUTY: MODE 1.

ACTIONS

NOTE-------------

.Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A.. One or rriore channels A. 1 Restore channel to 14 day.s inoperable. OPERABLE status.

OR A2 ----NOTE---

Not applicable if inoperable channel is the INSERT RICT result of an inoperable breaker.

Place channel in trip.

{continued)

BFN-UNIT 1 Amendment No. ~

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required B.1 ---NOTE---

Action A.1 and referenced Only applicable for in Table 3.3.5.1-1. Functions 1.a, 1.b, 2.a, and 2.b.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND B.2 ---NOTE---

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Coolant Injection (HPCI) discovery of loss System inoperable. of HPCI initiation capability INSERT AND RICT B.3 Place channel in trip.

(continued)

BFN-UNIT 1 3.3-36 Amendment No. ~ . 3-44

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required C.1 NOTE Action A.1 and referenced Only applicable for in Table 3.3.5.1-1. Functions 1.c, 1.e, 2.c, 2.d, and 2.f.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s} inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT RICT OPERABLE status. /

~

D. As required by Required D.1 -----------NOTE Action A.1 and referenced Only applicable if HPCI in Table 3.3.5.1-1 . pump suction is not aligned to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable.

(continued}

BFN-UNIT 1 3.3-37 Amendment No. 2M, 344

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required E.1 ,---NOTE_,_ __

Action A.1 and referenced Only applicable for in Table 3.3.5.1-1. Function 1.d.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. subsystems in both divisions AND INSERT E.2 Restore channel to 7 days RICT OPERABLE status.

(continued)

BFN-UNIT 1 3.3-38 Amendment No.~. ~

ECCS Instrumentation 3.3.5.1

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hourfrom Action A.1 and referenced Depressurization System discovery of loss in Table 3.3.5.1-1. (ADS) valves inoperable. of ADS initiation capability in both trip systems F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable

~

INSERT RICT Bd .

(continued)

BFN-UNIT 1 3.3-39 Amendment No. 234

ECCS Instrumentation 3.3.5.1 A CTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required G.1 Declare ADS valves 1 hourfrom Action A.1 and referenced inoperable. discovery of loss in Table 3.3.5.1-1. of ADS initiation capability in both trip systems AND G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable

~

INSERT RICT Bda H. Required Action and H.1 Declare associated Immediately associated Completion supported ECCS Time of Condition 8, C, feature(s) inoperable.

D, E, F, or G not met.

BFN-UNIT 1 3.3-40 Amendment No. -234

RCIC System Instrumentation 3.3.5.3 3.3 INSTRUMENTATION 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5.3 The RCIC System instrumentation for each Function in Table 3.3.5.3-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE-----------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A. 1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.3-1 for the channel.

B. As required by Required B.1 Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced inoperable. discovery of loss in Table 3.3.5.3-1. of RCIC initiation capability ANO INSERT B.2 Place channel in trip. 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months RICT

~

(continued)

BFN-UNIT 1 3.3-48 Amendment No. 234, 34-1

Primary Containment Isolation Instrumentation 3.3.6.1 ACTIONS

NOTE-------------

Separate C~ndition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 NOTE channels inoperable. Only applicable for Function 1.d if two or more channels are inoperable.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c AND INSERT RICT 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for V Functions oth than Function .a, 2.b, 5. , 6.b, and 6.c AND A.2 NOTE Only applicable for Function 1.d when 15 of 16 channels are OPERABLE.

Place channel in trip. 30 days (continued)

BFN-UNIT 1 3.3-53 Amendment No. ~

u

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION 3.3.B.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Table 3.3.8.1-1 Function on 4 kV shutdown boards A, 8, C, and D shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, When the associated diesel generator is required to be _

OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME

\__,,;* A. One degraded voltage A.1 Verify by administrative Immediately relay channel inoperable means that *the other two on one or more shutdown degraded voltage relay board(s). channels and associated timers on the affected AND shutdown board(s) are OPERABLE.

The loss of voltage relay channels on the affected AND shutdown board(s) are A.2 Place the degraded 15 days OPERABLE.

voltage relay channel in trip.

~ 7 INSERT RICT (continued}

BFN-UNIT 1 3.3-70 Amendment No. ~

ECCS - Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.1 ECCS - Operating LCO 3.5.1 Each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS) function of six safety/relief valves shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3, except high pressure coolant injection (HPCI) and ADS valves are not required to be OPERABLE with reactor steam dome pressure ~ 150 psig.

ACTIONS

NOTE------------

LCO 3.0.4.b is not applicable to HPCI.

CONDITION REQUIRED ACTION COMPLETION TIME A. One low pressure ECCS A.1 Restore low pressure INSERT injection/spray subsystem ECCS injection/spray RICT inoperable. subsystem(s) to OPERABLE status.

OR One low pressure coolant injection (LPCI) pump in both LPCI subsystems inoperable.

(continued)

BFN-UNIT 1 3.5-1 Amendment No. 2d-4, ~ . 249, a-1--1

Relocate to next page and delete this page

Relocated from previous page INSERT RICT Relocate to next new page

RCIC System 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.3 RCIC System LCO 3.5.3 The RCIC System shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE-------------

LCO 3.0.4.b is not applicable to RCIC.

CONDITION REQUIRED ACTION COMPLETION TIME A. RCIC System inoperable. A.1 Verify by administrative Immediately means High Pressure Coolant Injection System is OPERABLE.

AND A.2 Restore RCIC System to 14 days INSERT RICT OPERABLE status. /

--=:::--

B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND B.2 Reduce reactor steam 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months dome pressure to

$ 150 psig.

BFN-UNIT 1 3.5-12 Amendment No. 234, ~ . 3+-1

Primary Containment Air Lock 3.6.1.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME

8. ( continued) 8.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed.

AND 8.3 NOTE Air lock doors in high radiation areas or areas with limited access due to inerting may be verified locked closed by administrative means.

Verify an OPERABLE Once per 31 days door is locked closed.

C. Primary containment air C.1 Initiate action to evaluate Immediately lock inoperable for primary containment reasons other than overall leakage rate per Condition A or B. LCO 3.6.1.1, using current air lock test results.

AND C.2 Verify a door is closed. . 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status. < iINSERT RICT (continued}

BFN-UNIT 1 3.6-6 Amendment No. -234

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME A. - - - N O T E - - - A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by main steam line penetration flow paths use of at least one closed with two PCIVs. and de-activated automatic valve, closed manual valve, blind INSERT One or more penetration flange, or check valve RICT flow paths with one PCIV with flow through the inoperable except due to valve secured.

MSIV leakage not within limits.

continued BFN-UNIT 1 3.6-10 Amendment No. 2-34, 341

[following isolation]

RHR Suppression Pool Cooling 3.6.2.3

\._) 3.6 CONTAINMENT SYSTEMS 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling LCO 3.6.2.3 Four RHR suppression pool cooling subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool cooling subsystem suppression pool cooling inoperable. subsystem to OPERABLE status.

u B. Two RHR suppression pool cooling subsystems 8.1 Restore one RHR suppression pool cooling 7days

~ INSERT inoperable. subsystem to OPERABLE RICT status.

C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool cooling suppression pool cooling subsystems inoperable. subsystems to OPERABLE status.

(continued) u BFN-UNIT 1 3.6-31 Amendment No.~. 244 JYN---&- a- 1001

RHR Suppression Pool Spray 3.6.2.4 3.6 CONTAINMENT SYSTEMS 3.6.2.4 Residual Heat Removal {RHR) Suppression Pool Spray LCO 3.6.2.4 Four RHR suppression pool spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool spray subsystem suppression pool spray inoperable. subsystem to OPERABLE status.

8. Two RHR suppression 8.1 Restore one RHR 7days pool spray subsystems

\_,)

inoperable.

suppression pool spray subsystem to OPERABLE

~

I INSERT RICT status.

C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool spray suppression pool spray subsystems inoperable. subsystems to OPERABLE status.

D, Required Action and D.:1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion .

Time not met. AND D.2 Be in MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months

BFN-UNIT 1 _3.6-34 Amendment No. 234

RHR Drywell Spray 3.6.2.5 3.6 CONTAINMENT SYSTEMS 3.6.2.5 Residual Heat Removal (RHR) Drywell Spray LCO 3.6.2.5 Four RHR drywell spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A One RHR drywall spray A.1 Rest~re the RHR drywell 30 days subsystem inoperable. spray subsystem to OPERABLE status.

8. Two RHR drywell spray 8.1 Restore one RHR drywell 7 days INSERT subsystems inoperable. spray subsystem to < 1RICT OPERABLE status.

C. Three or more RHR. C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months drywell spray subsystems drywell spray subsystems inoperable. to OPERABLE status.

D. Required Action and 0.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND 0.2 Be in MOOE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 1 3.6-36 Amendment No. 2a4

RHRSW System 3.7.1 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION TIME B. One RHRSW subsystem 8.1 NOTE inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "R_esidual Heat Removal (RHR) Shutdown Cooling

- Hot Shutdown," for RHR shutdown cooling made inoperable by the RHRSW system.

Restore RHRSW 30 days subsystem to OPERABLE status.

C. Two required RHRSW C.1 Restore one inoperable 7 days pumps inoperable. RHRSW pump to

\___,I OPERABLE status.

D. Two RHRSW subsystems D:1 NOTE inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, for INSERT RHR shutdown cooling RICT made inoperable by the RHRSW System.

Restore one RHRSW subsystem to OPERABLE status.

(continued)

BFN-UNIT 1 3.7-3 Amendment No. 2-34

EECW System and UHS 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Equipment Cooling Water (EECW) System and Ultimate Heat Sink (UHS)

LCO 3.7.2 The EECW System with three pumps and UHS shall be OPERABLE. .

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required EECW A.1 Restore the required 7 days

pump inoperable. EECWpumpto OPERABLE status. iINSERT RICT B. Required Action and 8.1 Bein MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

8.2 Bein MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Two or more required EECW pumps inoperable.

OR UHS inoperable.

BFN-UNIT 1 3.7-6 Amendment No. ~

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no offsite discovery of no power available offsite power to inoperable when the one shutdown redundant required board concurrent feature(s) are inoperable. with inoperability of redundant required feature(s)

AND A.3 Restore required offsite 7 days circuit to OPERABLE ~

status. ANQ [

INSERT RICT 2~ days fFem disoo*, ery of faih.1re te meet bGG B. One required Unit 1 and 2 B.1 Verify power availability 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months DG inoperable. from the offsite transmission network. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

BFN-UNIT 1 3.8-2 Amendment No. ~

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.5 Restore Unit 1 and 2 DG 7 days from to OPERABLE status. discovery of unavailability of TDG(s)

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry

~ 6 days concurrent with unavailability of TDG(s)

AND 14 days INSERT

~

,<---_]~ . .- -

RICT 21 days from discovery of failure to meet bGQ (continued)

BFN-UNIT 1 3.8-3a Amendment No. 2-8-0

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One division of 480 V C.1 . Restore required division 7 days load shed logic of 480 V load shed logic inoperable. to OPERABLE status .

D. One division of common 0.1 Restore required division 7 days accident signal logic of common accident inoperable. signal logic to OPERABLE status.

E. Two required offsite E.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when the redundant Condition E required feature(s) are concurrent with inoperable. inoperability of redundant required feature(s) INSERT AND IRICT E.2 Restore on~ required 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status.

(continued)

BFN-UNIT1 3.8-4 Amendment No. 23'4

INSERT RICT

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The following DC electrical power systems shall be OPERABLE:

a. Unit DC subsystems 1, 2, and 3;

b. Shutdown Board DC subsystems A, 8, C, and D;

c. Unit 1 and 2 Diesel Generator (DG) DC subsystems;_

d. Unit 3 DG DC subsystem(s) supporting DG(s) required to be OPERABLE by LCO 3.8.1, "AC Sources - Operating"; and

e. Unit 3 Shutdown Board DC subsystem 3EB needed to support equipment required to be OPERABLE by LCO 3.7._ 3, "Control Room Emergency Ventilation (CREV) System."

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME

A. One Unit DC electrical A.1 Restore DC electrical 7 days power subsystem power *subsystem to ~<---1 INSERT RICT

____.I .

inoperable. OPERABLE status.

OR

One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable.

(continued)

BFN-UNIT 1 3.8-22 Amendment No. 234

Distribution Systems - Operating 3.8.7 ACTIONS CONDITION . REQUIRED ACTION COMPLETION TIME A. One Unit 1 and 2 4.16 kV --------------NOTE--------------

-Shutdown Board Enter applicable Conditions ahd inoperable. Required Actions of Condition B, C, and F when *condition A results in no power source to a required 480 volt board.

A.1 Restore the Unit 1 and 2 5 days 4.16 kV Shutdown Board to OPERABLE status.

12 days freni INSERT disoevery of RICT failure to meet bG9 A.2 Declare associated diesel Immediately generator inoperable.

(continued)

.... . . , . .. - .. *, -.. r_

BFN-UNIT 1 Amendment No."232F25~

Distribution Systems - Operating 3.8.7 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION TIME 8 . One Unit 1 480 V 8.1 Restore Board to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board OPERABLE status . .

inoperable.

OR 480 V RMOV Board 1A inoperable.

OR 480 V RMOV Board 18 inoperable. INSERT RICT C. One Unit 1 and 2 DG C.1 Restore Unit 1 and 2 DG Auxiliary Board Auxiliary Board to inoperable. OPERABLE status. AN9 12 days f FOFA :

discovery of failuFe to meet tee-(continued)

BFN-UNIT 1 3.8-35 Amendment N~3'1=254l

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One Unit DC Board 0.1 est(?re required Board or 7 days R_

inoperable. -Shutdown Board DC Distribution Panel to -A-NE>

INSERT OR OPERABLE status. RICT 12 days from One Unit 1 and 2 discovery of Shutdown Board DC failure to 111eet Distribution Panel tee inoperable.

OR 250 V DC RMOV Board 1A inoperable.

OR .

250 V DC RMOV Board 1B inoperable.

OR 250 V DC RMOV Board 1C inoperable.

(continued)

BFN-UNIT 1 3.8-30 Amendment N~~

Distribution Systems - Operating 3.8.7 ACTIONS (continued) .

CONDITION REQUIRED ACTION COMPLETION TIME E. Unit 1 and 2 *4.16 kV -----------------NOTE----------------

Shutdown Board A and B Enter applicable conditions and inoperable. required actions of Condition B, C, and F when Condition E OR resul~s in *no power source to a required 480.volt board.

Unit 1and24.16 kV Shutdown Board C and D inoperable. E.1 Restore one 4.16 kV 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board to OPERABLE status.

12 days fFom INSERT diseo1,ef)' of. RICT failure to meet bGG F. One or more required F.1

Declare the affected SGT Immediately Unit 2 or 3 AC or DC or GREV subsystem

. Boards inoperable. inoperable.

G. Required Action and G.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, C, AND D, or E not met.

G.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months H. Two or more electrical H.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of

. Junct{on. . .:* * .£.1' ' .

A** ..,._ . . *~ : "J ~~ *,.._.,*, ;;...* ; ~

S-Ff'f-ONIT 1 3]F37

3URJUDPVDQG0DQXDOV

5.5.15 Surveillance Frequency Control Program (continued)

3URJUDPVDQG0DQXDOV

D 7KH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPVKDOOFRQWDLQDOLVWRI

)UHTXHQFLHVRIWKRVH6XUYHLOODQFH5HTXLUHPHQWVIRUZKLFKWKH

)UHTXHQF\LVFRQWUROOHGE\WKHSURJUDP

INSERT RICT PROGRAM E &KDQJHVWRWKH)UHTXHQFLHVOLVWHGLQWKH6XUYHLOODQFH)UHTXHQF\

&RQWURO3URJUDPVKDOOEHPDGHLQDFFRUGDQFHZLWK1(,

³5LVN,QIRUPHG0HWKRGIRU&RQWURORI6XUYHLOODQFH)UHTXHQFLHV'

5HYLVLRQ

F 7KHSURYLVLRQVRI6XUYHLOODQFH5HTXLUHPHQWVDQGDUH DSSOLFDEOHWRWKH)UHTXHQFLHVHVWDEOLVKHGLQWKH6XUYHLOODQFH

)UHTXHQF\&RQWURO3URJUDP

%)181,7 F $PHQGPHQW1R

Attachment 2.2 Proposed Technical Specification Changes (Unit 2 Markup)

(44 total pages)

Note - The blue markups pertain to TSTF-439-A.

The red markups pertain to TSTF-505-A and all other changes.

CNL-21-009

,16(57(;$03/(

(;$03/(

$&7,216

&21',7,21 5(48,5('$&7,21 &203/(7,21

7,0(

$ 2QH $ 5HVWRUHVXEV\VWHP GD\V

VXEV\VWHP WR23(5$%/(

LQRSHUDEOH VWDWXV 25

,QDFFRUGDQFH

ZLWKWKH5LVN

,QIRUPHG

&RPSOHWLRQ

7LPH3URJUDP

% 5HTXLUHG % %HLQ02'( KRXUV

$FWLRQDQG DVVRFLDWHG $1'

&RPSOHWLRQ 7LPHQRWPHW % %HLQ02'( KRXUV

KHQDVXEV\VWHPLVGHFODUHGLQRSHUDEOH&RQGLWLRQ$LVHQWHUHG

7KHGD\&RPSOHWLRQ7LPHPD\EHDSSOLHGDVGLVFXVVHGLQ

([DPSOH+RZHYHUWKHOLFHQVHHPD\HOHFWWRDSSO\WKH5LVN

,QIRUPHG&RPSOHWLRQ7LPH3URJUDPZKLFKSHUPLWVFDOFXODWLRQRID

5LVN,QIRUPHG&RPSOHWLRQ7LPH 5,&7 WKDWPD\EHXVHGWR

FRPSOHWHWKH5HTXLUHG$FWLRQEH\RQGWKHGD\&RPSOHWLRQ7LPH

7KH5,&7FDQQRWH[FHHGGD\V$IWHUWKHGD\&RPSOHWLRQ7LPH

KDVH[SLUHGWKHVXEV\VWHPPXVWEHUHVWRUHGWR23(5$%/(VWDWXV

ZLWKLQWKH5,&7RU&RQGLWLRQ%PXVWDOVREHHQWHUHG

7KH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPUHTXLUHV

UHFDOFXODWLRQRIWKH5,&7WRUHIOHFWFKDQJLQJSODQWFRQGLWLRQV)RU

SODQQHGFKDQJHVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGSULRUWR

LPSOHPHQWDWLRQRIWKHFKDQJHLQFRQILJXUDWLRQ)RUHPHUJHQW

FRQGLWLRQVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGZLWKLQWKHWLPH

OLPLWVRIWKH5HTXLUHG$FWLRQ&RPSOHWLRQ7LPH LHQRWWKH5,&7

RUKRXUVDIWHUWKHSODQWFRQILJXUDWLRQFKDQJHZKLFKHYHULVOHVV

,IWKHGD\&RPSOHWLRQ7LPHFORFNRI&RQGLWLRQ$KDVH[SLUHGDQG

VXEVHTXHQWFKDQJHVLQSODQWFRQGLWLRQUHVXOWLQH[LWLQJWKH

DSSOLFDELOLW\RIWKH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPZLWKRXW

UHVWRULQJWKHLQRSHUDEOHVXEV\VWHPWR23(5$%/(VWDWXV

&RQGLWLRQ%LVDOVRHQWHUHGDQGWKH&RPSOHWLRQ7LPHFORFNVIRU

5HTXLUHG$FWLRQV%DQG%VWDUW

,IWKH5,&7H[SLUHVRULVUHFDOFXODWHGWREHOHVVWKDQWKHHODSVHG

WLPHVLQFHWKH&RQGLWLRQZDVHQWHUHGDQGWKHLQRSHUDEOH

VXEV\VWHPKDVQRWEHHQUHVWRUHGWR23(5$%/(VWDWXV&RQGLWLRQ

%LVDOVRHQWHUHGDQGWKH&RPSOHWLRQ7LPHFORFNVIRU5HTXLUHG

$FWLRQV%DQG%VWDUW,IWKHLQRSHUDEOHVXEV\VWHPVDUH

UHVWRUHGWR23(5$%/(VWDWXVDIWHU&RQGLWLRQ%LVHQWHUHG

&RQGLWLRQ$LVH[LWHGDQGWKHUHIRUHWKH5HTXLUHG$FWLRQVRI

&RQGLWLRQ%PD\EHWHUPLQDWHG

,16(575,&7

25

,QDFFRUGDQFH

ZLWKWKH5LVN

,QIRUPHG

&RPSOHWLRQ7LPH

3URJUDP

,16(575,&73URJUDP

5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDP

7KLVSURJUDPSURYLGHVFRQWUROVWRFDOFXODWHD5LVN,QIRUPHG&RPSOHWLRQ

7LPH 5,&7 DQGPXVWEHLPSOHPHQWHGLQDFFRUGDQFHZLWK1(,$

5HYLVLRQ5LVN0DQDJHG7HFKQLFDO6SHFLILFDWLRQV 5076

XLGHOLQHV7KHSURJUDPVKDOOLQFOXGHWKHIROORZLQJ

D 7KH5,&7PD\QRWH[FHHGGD\V

E $5,&7PD\RQO\EHXWLOL]HGLQ02'(6DQG

F :KHQD5,&7LVEHLQJXVHGDQ\FKDQJHWRWKHSODQWFRQILJXUDWLRQDV

GHILQHGLQ1(,$$SSHQGL[$PXVWEHFRQVLGHUHGIRUWKHHIIHFW

RQWKH5,&7

)RUSODQQHGFKDQJHVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGSULRU

WRLPSOHPHQWDWLRQRIWKHFKDQJHLQFRQILJXUDWLRQ

)RUHPHUJHQWFRQGLWLRQVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHG

ZLWKLQWKHWLPHOLPLWVRIWKH5HTXLUHG$FWLRQ&RPSOHWLRQ7LPH LH

QRWWKH5,&7 RUKRXUVDIWHUWKHSODQWFRQILJXUDWLRQFKDQJH

ZKLFKHYHULVOHVV

5HYLVLQJWKH5,&7LVQRWUHTXLUHGLIWKHSODQWFRQILJXUDWLRQFKDQJH

ZRXOGORZHUSODQWULVNDQGZRXOGUHVXOWLQDORQJHU5,&7

G )RUHPHUJHQWFRQGLWLRQVLIWKHH[WHQWRIFRQGLWLRQHYDOXDWLRQIRU

LQRSHUDEOHVWUXFWXUHVV\VWHPVRUFRPSRQHQWV 66&V LVQRWFRPSOHWH

SULRUWRH[FHHGLQJWKH&RPSOHWLRQ7LPHWKH5,&7VKDOODFFRXQWIRUWKH

LQFUHDVHGSRVVLELOLW\RIFRPPRQFDXVHIDLOXUH &&) E\HLWKHU

1XPHULFDOO\DFFRXQWLQJIRUWKHLQFUHDVHGSRVVLELOLW\RI&&)LQWKH

5,&7FDOFXODWLRQRU

5LVN0DQDJHPHQW$FWLRQV 50$V QRWDOUHDG\FUHGLWHGLQWKH

5,&7FDOFXODWLRQVKDOOEHLPSOHPHQWHGWKDWVXSSRUWUHGXQGDQWRU

GLYHUVH66&VWKDWSHUIRUPWKHIXQFWLRQ V RIWKHLQRSHUDEOH66&V

DQGLISUDFWLFDEOHUHGXFHWKHIUHTXHQF\RILQLWLDWLQJHYHQWVWKDW

FKDOOHQJHWKHIXQFWLRQ V SHUIRUPHGE\WKHLQRSHUDEOH66&V

H 7KHULVNDVVHVVPHQWDSSURDFKHVDQGPHWKRGVVKDOOEHDFFHSWDEOHWRWKH 15&7KHSODQW35$VKDOOEHEDVHGRQWKHDVEXLOWDVRSHUDWHGDQG

PDLQWDLQHGSODQWDQGUHIOHFWWKHRSHUDWLQJH[SHULHQFHDWWKHSODQWDV

VSHFLILHGLQ5HJXODWRU\*XLGH5HYLVLRQ0HWKRGVWRDVVHVV

WKHULVNIURPH[WHQGLQJWKH&RPSOHWLRQ7LPHVPXVWEH35$PHWKRGV

DSSURYHGIRUXVHZLWKWKLVSURJUDPRURWKHUPHWKRGVDSSURYHGE\WKH

15&IRUJHQHULFXVHDQGDQ\FKDQJHLQWKH35$PHWKRGVWRDVVHVV

ULVNWKDWDUHRXWVLGHWKHVHDSSURYDOERXQGDULHVUHTXLUHSULRU15&

DSSURYDO

Completion Times 1.3 1.3 Completion Times DESCRIPTION The above Completion Time extension does not apply to a (continued) Completion Time with a modified "time zero." This modified "time zero" may be expressed as a repetitive time (i.e., "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Required Action versus the time of Condition entry) or as a time modified by the phrase "from a

discovery ..." ExFRJ3le 1.3 ilh:1stFates eAe 1:1se ef U~is tyJ3e ef GempletieA TiFRe. The 1Oaey GemJ3letieA TiFRe sf)eeifieeJ #er GeAaitieA A AeJ 8 iA EM FRple 1.3 3 may A8t ee eMleAeteet.

The following examples illustrate the use of Completion Times with different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION. REQUIRED ACTION COMPLETION TIME

8. Required 8.1 Bein MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

\__) Action and associated AND Completion Time not met. 8.2 Be in MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Condition 8 has two Required Actions. Each Required Action

.has its own separate Completion Time. Each Completion Time is referenced to the time that Condition 8 is entered.

(continued}

BFN-UNIT2 1.3-3 Amendment No. ~

Completion Times 1.3 1.3 Completion Times EXAMPLES .EXAMPLE 1.3-3 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A: One A.1 Restore 7 days Function X Function X subsystem subsystem to AW[)

inoperable. OPERABLE status. 10 days#rom

. discovery of failuFe to meet tRe hGG

8. One 8.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function Y Function Y subsystem subsystem to AblO inoperable. OPERABLE status. 1g days fi:om eiseo 1.te,y of failure to meet tRe l::G9 (continued)

BFN-UNIT 2 1.3-6 Amendment No. ~

It is possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO. However, doing so would be inconsistent with the basis of the Completion Times.

Therefore, there shall be administrative controls to limit the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls shall ensure that the Completion Times for those Conditions are not inappropriately extended.

INSERT Example 1.3-8

SLC System 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETIO~ INSERT TIME RICT I A. One SLC subsystem A.1 Restore SLC subsystem 7da inoperable. to OPERABLE status.

B. Two SLC subsystems 8.1 Restore one SLC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months u inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Bein MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met.

AND C.2 Bein MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 2 3.1-23 Amendment No. ~ . 290

INSERT RICT

RPS Instrumentation 3.3.1.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION .

TIME B. -------------NOTE------------- B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Not applicable for system in trip.

Functions 2.a, 2.b, 2.c, 2.d, or 2.f. OR INSERT

RICT B.2 Place one trip system in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months One or more Functions trip.

with one or more required channels inoperable in both trip systems.

C. One or more Functions C.1 Restore RPS trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with RPS trip capability capability.

not maintained.

D. Required Action and 0.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A, B, or Table 3.3.1.1-1 for the C not met. channel.

E. As required by Required E.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Action 0.1 and POWER to < 26% RTP.

referenced in Table 3.3.1.1-1.

F. As required by Required F.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action 0.1 and referenced in Table 3.3.1 .1-1.

(continued)

BFN-UNIT 2 3.3-2 Amendment No. ia8,3z3

Feedwater and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Two channels of feedwater and main turbine high water level trip instrumentation per trip system shall be OPERABLE.

APPLICABILITY: THERMAL POWER~ 23% RTP.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more feedwater A.1 Place channel(s) in trip. 7 days and main turbine high ~ l...._____.

INSERT RICT water level trip channels inoperable, in one trip system.

B. One or more feedwater 8.1 Restore feedwater and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and main turbine high main turbine high water water level trip channels level trip capability.

inoperable in each trip system.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to< 23% RTP.

Time not met.

BFN-UNIT 2 3.3-22 Amendment No. ~.m

ATWS-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION

~ 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation LCO 3.3.4.2 Two channels per trip system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low, Level 2; and

b. Reactor Steam Dome Pressure - High.

APPLICABILITY: MODE 1.

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 14 days

inoperable. OPERABLE status.

OR A.2 ---NOTE-*- -

Not applicable if INSERT inoperable channel is the RICT result of an inoperable breaker.

Place channel in trip.

(continued}

BFN-UNIT2 3.3-33 Amendment No. r5a

EGGS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required B.1 ---NOTE---

Action A.1 and Only applicable for referenced in Functions 1.a, 1.b, 2.a, Table 3.3.5.1-1.

and 2.b.

Declare supported EGGS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature EGGS initiation capability for capability is inoperable. features in both divisions AND B.2 ---NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Coolant Injection (HPCI) discovery of loss System inoperable. of HPCI initiation capability AND B.3 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

~

--1...______.

INSERT RICT (continued)

BFN-UNIT 2 3.3-37 Amendment No . 2&d, ~

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required C.1 ---NOTE-----------

Action A.1 and Only applicable for referenced in Functions 1.c, 1.e, 2.c, 2.d, Table 3.3.5.1-1.

and 2.f.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions I

AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABl,..E status.

- *1..._____,

INSERT RICT k-D. As required by Required 0.1 --------------NOTE Action A.1 and Only applicable if HPCI referenced in pump suction is not Table 3.3.5.1-1. aligned to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable.

(continued)

BFN-UNIT 2 3.3-38 Amendment No.~. 3a4

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required E.1 ------NOTE---

Action A.1 and Only applicable for referenced in Function 1.d.

Table 3.3.5.1-1.

Declare supported ECCS 1 hourfrom feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. subsystems in both divisions AND E.2 Restore channel to OPERABLE status.

~ day'-=s: . . - - - - --1. . __. . .

INSERT RICT (continued)

BFN-UNIT 2 3.3-39 Amendment No.~. ~

ECCS Instrumentation 3.3.5.1 ACTIONS continued

.- CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hourfrom Action A.1 and referenced Depressurization System discovery of loss in Table 3.3.5.1-1. (ADS) valves inoperable. of ADS initiation capability in both trip systems AND F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable INSERT RICT (continued)

BFN-UNIT2 3.3-40 Amendment No. ~

u

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

. CONDITION REQUIRED ACTION COMPLETION TIME G. _As required by Required G.1 Declare ADS valves 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced inoperable. discovery of loss in Table 3.3.5.1-1. of ADS initiation capability in both trip systems AND G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable

~

INSERT RICT u

H. Required Action and H.1 Declare associated Immediately associated Completion supported ECCS Time of Condition B, C, feature(s} inoperable.

D, E, F, or G not met.

BFN-UNIT2 3.3-41 Amendment No. "25--S u

RCIC System Instrumentation 3.3.5.3 1 3.3 INSTRUMENTATION 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5.3 The RCIC System instrumentation for each Function in Table 3.3.5.3-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE-------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.3-1 for the channel.

B. As required by Required B.1 Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and inoperable. discovery of loss referenced in of RCIC initiation Table 3.3.5.3-1. capability AND B.2 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT

~ 1,_________.

RICT (continued)

BFN-UNIT 2 3.3-49 Amendment No. ~ . 3-34

Primary Containment Isolation Instrumentation 3.3.6.1 ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 NOTE channels inoperable. Only applicable for

Function 1.d if two or more channels are inoperable.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c.

AND INSERT RICT

\._,)' 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions ct r than Functio 2.a, 2.b, , 6.b, and 6.

AND A.2 NOTE Only applicable for Function 1.d when 15 of 16 channels are OPERABLE.

Place channel in trip. 30days (continued)

BFN-UNIT2 3.3-54 Amendment No. 26.a

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION

-\ .._) 3.3.8.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Table 3.3.8.1-1 Function on 4 kV shutdown boards A, B, C, and D shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, _

When the associated diesel generator is required to be

OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME

\_J' A. One degraded voltage A.1 . Verify ~Y administrative Immediately relay channel inoperable means that the other two on one or more shutdown degraded voltage relay

_board(s). channels and associated timers on the affected AND shutdown board(s) are OPERABLE.

The loss of voltage relay channels on the affected AND shutdown board( s) are OPERABLE. -A.2 Place the degraded 15 days voltage relay channel in trip.

~ 7 INSERT RICT (continued)

BFN-UNIT2 3.3-71 Amendment No. ~

INSERT RICT Relocated from next page

Relocate to previous ECCS - Operating page and delete this 3.5.1 page ACTIONS continued CONDITION COMPLETION TIME

8. Required Action and 8.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

8.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months u BFN-UNIT 2 3.5-1a Amendment No. 286

INSERT RICT Relocate to next new page

RCICSystem 3.5.3 3.5 EMERGENCY CORE COOLING.SYSTEMS (ECCS), RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.3 RCIC System LCO 3.5.3 The RCIC System shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE----- . ----------

LCO 3.0.4.b is not applicable to RCIC .

CONDITION REQUIRED ACTION COMPLETION TIME A. RCIC System inoperable. A.1 Verify by administrative Immediately means High Pressure Coolant Injection System is OPERABLE.

AND A.2 Restore RCIC System to 14 days OPERABLE status. ~ l.______,

INSERT RICT B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND 8.2 Reduce reactor steam 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months dome pressure to s 150 psig.

BFN-UNIT 2 3.5-12 Amendment No.~.~. 364

Primary Containment Air Lock 3.6.1.2 ACTIONS CONDITION 'REQUIRED ACTION COMPLETION TIME

8. (continued) 8.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed.

AND 8.3 NOTE Air lock doors in high radiation areas or areas with limited access due to inerting may be verified locked closed by

administrative means.

Verify an OPERABLE Once per 31 days door is locked closed.

C. Primary containment air C.1 Initiate action to evaluate Immediately lock inoperable for primary containment reasons other than overall leakage rate per Condition A or 8. LCD 3.6.1.1, using current air lock test results.

AND C.2 Verify a door is closed.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status. ~ INSERT (continued}

I RICT BFN-UNIT 2 3.6-6 Amendment No. 253

PCIVs 3.6.1.3 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION TIME A. ----------NOTE--- A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by . main steam line penetration flow paths use of at least one closed with two PCIVs. and de-activated INSERT RICT automatic valve, closed manual valve, blind One or more penetration flange, or check valve flow paths with one PCIV with flow through the inoperable except due to valve secured.

MSIV leakage not within limits.

AND continued BFN-UNIT 2 3.6-10 Amendment No.~. 334

[following isolation]

RHR Suppression Pool Cooling 3.6.2.3

\._) 3.6 CONTAINMENT SYSTEMS 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling L.:CO 3.6.2.3 ** -:Four RHR suppression pool cooUng subsystems shall be OPERABLE.

APPLICABILllY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool cooling subsystem suppression pool cooling inoperable. subsystem to OPERABLE status.

8. Two RHR suppression 8.1 Restore one RHR 7days pool cooling subsystems suppression pool cooling ~ INSERT inoperable. subsystem to OPERABLE RICT status.

C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool cooling suppression pool cooling subsystems inoperable. subsystems to OPERABLE status.

(continued)

BFN-UNIT2 3.6-31 Amendment No.~. 2-12 JUN 0 3 200f

RHR Suppression Pool Spray 3.6.2.4 3.6 CONTAINMENT SYSTEMS 3.6.2.4 Residual Heat Removal {RHR) Suppression Pool Spray LCO 3.6.2.4 Four RHR suppression pool spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1. 2. and 3. .

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool spray subsystem suppression pool spray inoperable. . subsystem to OPERABLE status.

B. Two RHR suppression 8.1 Restore one RHR 7days pool spray subsystems inoperable.

suppression pool spray subsystem to OPERABLE

< I INSERT RICT status.

C. Three or more RHR C.1 *Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool spray suppression pool spray subsystems inoperable. subsystems to OPERABLE status.

D. Required Action and 0.1* Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND.

D.2 Be in MODE .4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 2 3.6-34 Amendment No. -263

RHR Drywell Spray 3.6.2.5 3.6 CONTAINMENT SYSTEMS 3.6.2.5 Residual Heat Removal (RHR} Drywell Spray LCO 3.6.2.5 Four RHR drywell spray subsystems shall be OPERABLE.

APPLICABiLITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME .

A One RHR drywell spray A1 Restore the RHR drywell 30 days subsystem inoperable. spray subsystem to OPERABLE status.

e: Two RHR drywell spray 8.1 Restore one RHR drywell 7 days subsystems inoperable. spray subsystem to < INSERT I

RICT OPERABLE status.

C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

drywell spray subsystems drywell spray subsystems inoperable. to OPERABLE status.

D. Required Action and . 0.1 Befo MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

associated Completion Time not met. AND 0.2 Be in MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 2 3.6-36 Amendment No. 253

\.__J

RHRSW System 3.7.1 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION TIME

8. One RHRSW subsystem 8.1 -----------NO TE-- --- --- ----

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling - Hot Shutdown,"

for RHR shutdown cooling made inoperable by the RHRSW system.

Restore RHRSW 30 days subsystem to OPERABLE status.

C. Two required RHRSW C.1 Restore one inoperable 7 days pumps inoperable. RHRSW pump to OPERABLE status.

D. Two RHRSW subsystems D.1 NO TE------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, for RHR shutdown cooling made inoperable by the INSERT RHRSW System. RICT Restore one RHRSW subsystem to OPERABLE status.

(continued)

BFN-UNIT 2 3.7-3 Amendment No.~.~

EECW System and UHS 3.7.2 3.7 PLANT SYSTEMS

\__)

3.7.2 Emergency Equipment Cooling Water (EECW) System and Ultimate Heat Sink (UHS)

LCO 3.7.2 The EECW Systero with three pumps and UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required EECW A.1 Restore the required 7 days pump inoperable. EECWpumpto OPERABLE status.

~ INSERT RICT I u B. Required Action and associated Completion 8.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Time of Condition A not AND met.

B.2 Be in MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Two or more required EECW pumps inoperable.

OR UHS inoperable.

BFN-UNIT 2 3.7-7 Amendment No. 264 SEP 9 H998

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no offsite discovery of no power available offsite power to inoperable when the one shutdown redundant required board concurrent feature(s) are inoperable. with inoperability of redundant required feature(s)

AND A.3 Restore required offsite 7 days circuit to OPERABLE status. ANQ 21 days from diseot;ei:y ef INSERT RICT failure to meet b-GG B. One required Unit 1 and 2 B.1 Verify power availability 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months DG inoperable. from the offsite transmission network. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

BFN-UNIT2 3.8-2 Amendment No. ~

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.5 Restore Unit 1 and 2 DG 7 days from to OPERABLE status. discovery of unavailability of TDG(s) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry

~ 6 days concurrent with unavailability of TDG(s) 14 days INSERT

.~ D RICT

~,...______.

21 days from disco*.iery of failure to meet bGe (continued)

BFN-UNIT 2 3.8-3a Amendment No. aw

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One division of 480 V C.1 Restore required division 7 days load shed logic of 480 V load shed logic

-inoperable. to OPERABLE status .

D. One division of common 0.1 Restore required division 7 days accident signal logic of common accident inoperable. signal logic to ..

OPERABLE status.

E. Two required offsite E.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when the redundant Condition E.

required feature(s) are concurrent with inoperable. inoperability of redundant required feature(s)

AND INSERT RICT E.2 Restore one required 24 hou offsite circuit to OPERABLE status.

(continued)

BFN-UNIT2 3.8-4 Amendment No. ~

AC Sources - Operating 3.8.1 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION

~

TIME NOTE NOTE Only applicable when more Enter applicable Conditions and than one 4.16 kV shutdown Required Actions of LCO 3.8.7,

board is *affected. "Distribution Systems -

Operating," when Condition Fis entered with no AC power source F. One required offsite to any 4.16 kV shutdown board.

circuit inoperable.

AND F.1 Restore required offsite 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months circuit to OPERABLE One Unit 1 and 2 DG status.

inoperable.

INSERT RICT OR F.2 Restore Unit 1 and 2 DG to OPERABLE status.

\_,;*

NOTE Applicable when only ~me 4:16 kV shutdown board is affected.

G .. One required _offsite G.1 Declare the affected Immediately

. circuit inoperable. 4.16 kV shutdown board inoperable.

AND One Unit 1 and 2 DG inoperable.

(continued)

BFN-UNIT2 3.8-5 Amendment No. 2-Sa

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The following DC electrical power systems shall be OPERABLE:

a. Unit DC subsystems 1, 2, and 3;

b. Shutdown Board DC subsystems A, B, C, and D;

c. Unit 1 and 2 Diesel Generator (DG} DC subsystems;

d. Unit 3 DG DC subsystem(s} supporting DG(s} required to be OPERABLE by LCO 3.8.1, "AC Sources - Operating"; and

e. Unit 3 Shutdown Board DC subsystem 3EB needed to support equipment required to be OPERABLE by LCO 3.7.3, "Control Room Emergency Ventilation (CREV) System."

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit DC electrical A.1 Restore DC electrical 7 days power subsystem power subsystem to

.inoperable. OPERABLE status . INSERT RICT OR One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable.

(continued)

BFN-UNIT2 . 3.8-22 Amendment No. 25a

Distribution Systems - Operating 3.8.7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit 1and24.16 kV NOTE Shutdown Board Enter applicable Conditions and inoperable. Required Actions of Condition 8, C, D, and G when Condition A results in.no power source to a required 480 volt board.

A.1 Restore the Unit 1 and 2 Sdays 4.16 kV Shutdown .Board ~

to OPERABLE status. ANO INSERT

~2 says fFam I

RICT eisee\teiy ef failure ta meet

!:GG AND A.2 Declare associated diesel Immediately generator inoperable.

(continued)

BFN-UNIT2 3.8-34 Amendment No. 253

Distribution Systems - Operating 3.8.7 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION TIME B. One Unit 2 480 V -----NOTE----

Shutdown Board Enter Condition C when inoperable. Condition B results in no power source to 480 volt RMOV board OR 20 or 2E.

480 V RMOV Board 2A 8.1 Restore Board to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable.

OPERABLE status.

OR 480 V RMOV Board 28 inoperable.

C. Unit 2 480 V RMOV C.1 Declare the affected RHR Immediately Board 20 inope~able. subsystem inoperable.

INSERT RICT OR Unit 2 480 V RMOV Board 2E inoperable.

0. One Unit 1 and 2 DG 0.1 Restore Unit 1 and 2 OG Auxiliary Board Auxiliary Board to inoperable. OPERABLE status. ~

12 days from diseo*,ery of failure to meet bGQ (continued)

BFN-UNIT2 3.8-35 Amendment No. -253

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One Unit DC Board E.1 Restore required Board or 7 days inoperable. Shutdown Board DC ~

INSERT Distribution Panel to AN9 RICT OR OPERABLE status.

12 days fFORl One Unit 1 and 2 discovery of Shutdown Board DC failure to r-neet Distribution Panel kGG inoperable.

OR 250 V DC RMOV Board 2A inoperable.

OR 250 V DC RMOV Board 2B inoperable.

\__J OR .

250 V DC RMOV Board 2C inoperable.

(continued)

BFN-UNIT2 3.8-36 Amendment No. ~

Distribution Systems - Operating 3.8.7 A CTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION

\_J TIME F. Unit 1 and 2 4.16 kV NOTE Shutdown Board A and 8 Enter applicable conditions and inoperable. required actions of Condition 8, C, D, and G when Condition F OR results in no power source to a required 480 volt board.

Unit 1 and 2 4.16 kV Shutdown Board C and D inoperable. F.1 Restore one 4.16 kV 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board to OPERABLE status. AN-9 INSERT RICT

~ 2 88)15 fF8FR aisee\tefY ef failuFC ta FReet b6Q G. One or more required G.1 Declare the affected SGT Immediately Unit 1 or 3 AC or DC or CREV subsystem Boards inoperable. inoperable.

H. Required Action and H.1 Be in MODE 3. 12*hours associated Completion Time of Cohdition A, B, D, AND E, or F not met.

H.2 Be in MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months I. *. Two or more electrical 1.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of function.

BFN-UNIT2 3.8-37 Amendment No . .2§3

\ .

'--.../

3URJUDPVDQG0DQXDOV

6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDP

7KLVSURJUDPSURYLGHVFRQWUROVIRU6XUYHLOODQFH)UHTXHQFLHV7KH

SURJUDPVKDOOHQVXUHWKDW6XUYHLOODQFH5HTXLUHPHQWVVSHFLILHGLQWKH

7HFKQLFDO6SHFLILFDWLRQVDUHSHUIRUPHGDWLQWHUYDOVVXIILFLHQWWRDVVXUHWKH

DVVRFLDWHG/LPLWLQJ&RQGLWLRQVIRU2SHUDWLRQDUHPHW

D 7KH6XUYHLOODQFH)UHTXHQF\&RQWURO3URJUDPVKDOOFRQWDLQD OLVWRI)UHTXHQFLHVRIWKRVH6XUYHLOODQFH5HTXLUHPHQWVIRU ZKLFKWKH)UHTXHQF\LVFRQWUROOHGE\WKHSURJUDP

E &KDQJHVWRWKH)UHTXHQFLHVOLVWHGLQWKH6XUYHLOODQFH)UHTXHQF\

&RQWURO3URJUDPVKDOOEHPDGHLQDFFRUGDQFHZLWK1(,

5LVN,QIRUPHG0HWKRGIRU&RQWURORI6XUYHLOODQFH)UHTXHQFLHV

5HYLVLRQ

INSERT RICT PROGRAM F 7KHSURYLVLRQVRI6XUYHLOODQFH5HTXLUHPHQWVDQGDUH DSSOLFDEOHWRWKH)UHTXHQFLHVHVWDEOLVKHGLQWKH6XUYHLOODQFH

)UHTXHQF\&RQWURO3URJUDP

Insert double underlines FRQWLQXHG

%)181,7 F $PHQGPHQW1R

Attachment 2.3 Proposed Technical Specification Changes (Unit 3 Markup)

(44 total pages)

Note - The blue markups pertain to TSTF-439-A.

The red markups pertain to TSTF-505-A and all other changes.

CNL-21-009

,16(57(;$03/(

(;$03/(

$&7,216

&21',7,21 5(48,5('$&7,21 &203/(7,21

7,0(

$ 2QH $ 5HVWRUHVXEV\VWHP GD\V

VXEV\VWHP WR23(5$%/(

LQRSHUDEOH VWDWXV 25

,QDFFRUGDQFH

ZLWKWKH5LVN

,QIRUPHG

&RPSOHWLRQ

7LPH3URJUDP

% 5HTXLUHG % %HLQ02'( KRXUV

$FWLRQDQG DVVRFLDWHG $1'

&RPSOHWLRQ 7LPHQRWPHW % %HLQ02'( KRXUV

KHQDVXEV\VWHPLVGHFODUHGLQRSHUDEOH&RQGLWLRQ$LVHQWHUHG

7KHGD\&RPSOHWLRQ7LPHPD\EHDSSOLHGDVGLVFXVVHGLQ

([DPSOH+RZHYHUWKHOLFHQVHHPD\HOHFWWRDSSO\WKH5LVN

,QIRUPHG&RPSOHWLRQ7LPH3URJUDPZKLFKSHUPLWVFDOFXODWLRQRID

5LVN,QIRUPHG&RPSOHWLRQ7LPH 5,&7 WKDWPD\EHXVHGWR

FRPSOHWHWKH5HTXLUHG$FWLRQEH\RQGWKHGD\&RPSOHWLRQ7LPH

7KH5,&7FDQQRWH[FHHGGD\V$IWHUWKHGD\&RPSOHWLRQ7LPH

KDVH[SLUHGWKHVXEV\VWHPPXVWEHUHVWRUHGWR23(5$%/(VWDWXV

ZLWKLQWKH5,&7RU&RQGLWLRQ%PXVWDOVREHHQWHUHG

7KH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPUHTXLUHV

UHFDOFXODWLRQRIWKH5,&7WRUHIOHFWFKDQJLQJSODQWFRQGLWLRQV)RU

SODQQHGFKDQJHVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGSULRUWR

LPSOHPHQWDWLRQRIWKHFKDQJHLQFRQILJXUDWLRQ)RUHPHUJHQW

FRQGLWLRQVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGZLWKLQWKHWLPH

OLPLWVRIWKH5HTXLUHG$FWLRQ&RPSOHWLRQ7LPH LHQRWWKH5,&7

RUKRXUVDIWHUWKHSODQWFRQILJXUDWLRQFKDQJHZKLFKHYHULVOHVV

,IWKHGD\&RPSOHWLRQ7LPHFORFNRI&RQGLWLRQ$KDVH[SLUHGDQG

VXEVHTXHQWFKDQJHVLQSODQWFRQGLWLRQUHVXOWLQH[LWLQJWKH

DSSOLFDELOLW\RIWKH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPZLWKRXW

UHVWRULQJWKHLQRSHUDEOHVXEV\VWHPWR23(5$%/(VWDWXV

&RQGLWLRQ%LVDOVRHQWHUHGDQGWKH&RPSOHWLRQ7LPHFORFNVIRU

5HTXLUHG$FWLRQV%DQG%VWDUW

,IWKH5,&7H[SLUHVRULVUHFDOFXODWHGWREHOHVVWKDQWKHHODSVHG

WLPHVLQFHWKH&RQGLWLRQZDVHQWHUHGDQGWKHLQRSHUDEOH

VXEV\VWHPKDVQRWEHHQUHVWRUHGWR23(5$%/(VWDWXV&RQGLWLRQ

%LVDOVRHQWHUHGDQGWKH&RPSOHWLRQ7LPHFORFNVIRU5HTXLUHG

$FWLRQV%DQG%VWDUW,IWKHLQRSHUDEOHVXEV\VWHPVDUH

UHVWRUHGWR23(5$%/(VWDWXVDIWHU&RQGLWLRQ%LVHQWHUHG

&RQGLWLRQ$LVH[LWHGDQGWKHUHIRUHWKH5HTXLUHG$FWLRQVRI

&RQGLWLRQ%PD\EHWHUPLQDWHG

,16(575,&7

25

,QDFFRUGDQFH

ZLWKWKH5LVN

,QIRUPHG

&RPSOHWLRQ7LPH

3URJUDP

,16(575,&73URJUDP

5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDP

7KLVSURJUDPSURYLGHVFRQWUROVWRFDOFXODWHD5LVN,QIRUPHG&RPSOHWLRQ

7LPH 5,&7 DQGPXVWEHLPSOHPHQWHGLQDFFRUGDQFHZLWK1(,$

5HYLVLRQ5LVN0DQDJHG7HFKQLFDO6SHFLILFDWLRQV 5076

XLGHOLQHV7KHSURJUDPVKDOOLQFOXGHWKHIROORZLQJ

D 7KH5,&7PD\QRWH[FHHGGD\V

E $5,&7PD\RQO\EHXWLOL]HGLQ02'(6DQG

F :KHQD5,&7LVEHLQJXVHGDQ\FKDQJHWRWKHSODQWFRQILJXUDWLRQDV

GHILQHGLQ1(,$$SSHQGL[$PXVWEHFRQVLGHUHGIRUWKHHIIHFW

RQWKH5,&7

)RUSODQQHGFKDQJHVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHGSULRU

WRLPSOHPHQWDWLRQRIWKHFKDQJHLQFRQILJXUDWLRQ

)RUHPHUJHQWFRQGLWLRQVWKHUHYLVHG5,&7PXVWEHGHWHUPLQHG

ZLWKLQWKHWLPHOLPLWVRIWKH5HTXLUHG$FWLRQ&RPSOHWLRQ7LPH LH

QRWWKH5,&7 RUKRXUVDIWHUWKHSODQWFRQILJXUDWLRQFKDQJH

ZKLFKHYHULVOHVV

5HYLVLQJWKH5,&7LVQRWUHTXLUHGLIWKHSODQWFRQILJXUDWLRQFKDQJH

ZRXOGORZHUSODQWULVNDQGZRXOGUHVXOWLQDORQJHU5,&7

G )RUHPHUJHQWFRQGLWLRQVLIWKHH[WHQWRIFRQGLWLRQHYDOXDWLRQIRU

LQRSHUDEOHVWUXFWXUHVV\VWHPVRUFRPSRQHQWV 66&V LVQRWFRPSOHWH

SULRUWRH[FHHGLQJWKH&RPSOHWLRQ7LPHWKH5,&7VKDOODFFRXQWIRUWKH

LQFUHDVHGSRVVLELOLW\RIFRPPRQFDXVHIDLOXUH &&) E\HLWKHU

1XPHULFDOO\DFFRXQWLQJIRUWKHLQFUHDVHGSRVVLELOLW\RI&&)LQWKH

5,&7FDOFXODWLRQRU

5LVN0DQDJHPHQW$FWLRQV 50$V QRWDOUHDG\FUHGLWHGLQWKH

5,&7FDOFXODWLRQVKDOOEHLPSOHPHQWHGWKDWVXSSRUWUHGXQGDQWRU

GLYHUVH66&VWKDWSHUIRUPWKHIXQFWLRQ V RIWKHLQRSHUDEOH66&V

DQGLISUDFWLFDEOHUHGXFHWKHIUHTXHQF\RILQLWLDWLQJHYHQWVWKDW

FKDOOHQJHWKHIXQFWLRQ V SHUIRUPHGE\WKHLQRSHUDEOH66&V

H 7KHULVNDVVHVVPHQWDSSURDFKHVDQGPHWKRGVVKDOOEHDFFHSWDEOHWRWKH 15&7KHSODQW35$VKDOOEHEDVHGRQWKHDVEXLOWDVRSHUDWHGDQG PDLQWDLQHGSODQWDQGUHIOHFWWKHRSHUDWLQJH[SHULHQFHDWWKHSODQWDV VSHFLILHGLQ5HJXODWRU\*XLGH5HYLVLRQ0HWKRGVWRDVVHVV WKHULVNIURPH[WHQGLQJWKH&RPSOHWLRQ7LPHVPXVWEH35$PHWKRGV DSSURYHGIRUXVHZLWKWKLVSURJUDPRURWKHUPHWKRGVDSSURYHGE\WKH 15&IRUJHQHULFXVHDQGDQ\FKDQJHLQWKH35$PHWKRGVWRDVVHVV ULVNWKDWDUHRXWVLGHWKHVHDSSURYDOERXQGDULHVUHTXLUHSULRU15&

DSSURYDO

Completion Times

1.3 1.3 Completion Times DESCRIPTION The above Completion Time extension does not apply to a

( continued) Completion Time with a modified time zero." This modified "time zero" may be expressed as a repetitive time (i.e., "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Required Action versus the time of Condition entry) or as a time modified by the phrase from discovery ... " E>Eemf)le 1.a a i111:1stFOtes eRe 1:1se ef this type ef Gempletien Time. The 1e day Gempletien Time speeifiea fer Genaitien A ena B in E>Eemple 1.a a may Rat be e.>ffeRaea.

The following examples illustrate the use of Completion Times with different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME

-.__,/

B. Required 8.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Action and associated AND Completion Time not met. B.2 Be in MODE 4. 36hours Condition B has two Required Actions. Each Required Action has its own separate Completion Time. Each Completion Time is referenced to the time that Condition B is entered.

(continued)

BFN-UNIT3 1.3-3 Amendment No. ~12

Completion Times

' 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A One A.1 Restore 7days FunctionX FunctionX subsystem subsystem to AND inoperable. OPERABLE status.

10 Etaysffem EJiseevery ef failure to meet the bG9 B. One B.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function Y Function Y subsystem subsystem to ANO inoperable. OPERABLE status. 1O Eteys ffem

- 1*eA Etisee* -~,* ef failure to meet the bG9 (continued)

BFN-UNIT3 1.3-6 Amendment No. ~

It is possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO. However, doing so would be inconsistent with the basis of the Completion Times.

Therefore, there shall be administrative controls to limit the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls shall ensure that the Completion Times for those Conditions are not inappropriately extended.

INSERT Example 1.3-8

SLC System 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME INSERT RICT A. One SLC subsystem A.1 Restore SLC subsystem 7days inoperable. to OPERABLE status.

B. Two SLC subsystems B.1 Restore one SLC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met.

AND

. C.2 Bein MODE4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 3 3.1-23 Amendment No. m, m

RPS Instrumentation 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1 .

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A One or more required A1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR A.2 ---NOTE--- INSERT Not applicable for RICT Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

Place associated trip system in trip.

(continued)

BFN-UNIT 3 3.3-1 Amendment No. 212,213, ~

S-EP 2 7 1S9S

- s 1<,t1+/-: Pt.~tmtl o+/- ~ uvJ.-, o0,~ e>>p.u 9 co~

RPS Instrumentation 3.3.1 .1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. -------------NOTE------------- 8.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

/

Not applicable for system in trip.

' INSERT Functions 2.a, 2.b, 2.c, RICT 2.d, or 2.f. OR 8.2 Place one trip system in 6h One or more Functions trip.

with one or more required channels inoperable in both trip systems.

C. One or more Functions C.1 Restore RPS trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with RPS trip capability capability.

not maintained.

D. Required Action and 0.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A, B, or Table3.3.1 .1-1 forthe C not met. channel.

E. As required by Required E.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Action 0.1 and POWER to < 26% RTP.

referenced in Table 3.3.1.1-1.

F. As required by Required F.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action D.1 and referenced in Table 3.3.1.1-1.

(continued)

BFN-UNIT 3 3.3-2 Amendment No. 212,213, 221,~

Feedwater and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Two channels of feedwater and main turbine high water level trip instrumentation per trip system shall be OPERABLE.

APPLICABILITY: THERMAL POWER~ 23% RTP.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A One or more feedwater A.1 Place channel(s) in trip. 7 days and main turbine high < INSERT RICT water level trip channels inoperable, in one trip system.

B. One or more feedwater B.1 Restore feedwater and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and main turbine high main turbine high water water level trip channels level trip capability.

inoperable in each trip system.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to< 23% RTP.

Time not met.

BFN-UNIT 3 3.3-22 Amendment No. ~ . 2-83

ATWS-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip {ATWS-RPT)

Instrumentation LCO 3.3.4.2 Two channels per trjp system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low, Level 2; and

b. Reactor Steam Dome Pressure - High.

APPLICABILITY: MODE 1.

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A One or more channels A.1 Restore channel to 14 days inoperable. OPERABLE status.

OR A.2 ----NOTE---

INSERT Not applicable if RICT inoperable channel is the result of an inoperable breaker.

Place channel in trip.

(continued)

BFN-UNIT3 3.3-33 Amendment No. z-1-a

~ fl? o a 199a

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME

8. As required by Required 8.1 --------------NOTE---

Action A.1 and Only applicable for referenced in Functions 1.a, 1.b, 2.a, Table 3.3.5.1-1.

and 2.b.

Declare supported ECCS 1 hourfrom feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND 8.2 --NOTE-----------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hourfrom Coolant Injection (HPCI) discovery of loss System inoperable. of HPCI initiation capability AND INSERT 8.3 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months RICT k

(continued)

BFN-UNIT 3 3.3-37 Amendment No.~. 294

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required C.1 - NOTE Action A.1 and Only applicable for referenced in Functions 1.c, 1.e, 2.c, Table 3.3.5.1-1.

2.d, and 2.f.

Declare supported ECCS 1 hourfrom feature( s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status. ~

- l._______.

INSERT RICT D. As required by Required 0.1 ---NOTE Action A.1 and Only applicable if HPCI referenced in pump suction is not Table 3.3.5.1-1. aligned to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable.

(continued)

BFN-UNIT 3 3.3-38 Amendment No.~. 294

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required E.1 -----------NOTE------------

Action A.1 and Only applicable for referenced in Function 1.d.

Table 3.3.5.1-1.

Declare supported ECCS 1 hourfrom feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. subsystems in both divisions AND E.2 Restore channel to 7 days OPERABLE status. ~ iINSERT RICT (continued)

BFN-UNIT 3 3.3-39 Amendment No. ~ . 294

ECCS Instrumentation 3.3.5.1 ACTIONS continued CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A. 1 and referenced **Depressurization System discovery of loss in Table 3.3.5.1-1. (ADS) valves inoperable. of ADS initiation capability in both trip systems AND F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable INSERT RICT (continued)

BFN-UNIT 3 3.3-40 Amendment No. 2-1-3

-&EP 8 8 1998

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

\ .._ /

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required G. 1 Declare ADS valves 1 hourfrom Action A.1 and referenced **inoperable. discovery of loss in Table 3.3.5.1-1. of ADS initiation capability in both trip systems AND G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable

./

~

INSERT RICT I a

H. Required Action and H.1 Declare associated Immediately associated Completion supported ECCS Time of Condition B, C, feature(s) inoperable.

D, E, F, or G not met.

BFN-UNIT 3 3.3-41 Amendment No. 24-a

~

RCIC System Instrumentation 3.3.5.3 3.3 INSTRUMENTATION 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5.3 The RCIC System instrumentation for each Function in Table 3.3.5.3-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE----------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.3-1 for the channel.

8. As required by Required 8.1 Declare RCIC System 1 hourfrom Action A.1 and inoperable. discovery of loss referenced in of RCIC initiation Table 3.3.5.3-1. capability AND 8.2 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT

~ i...______.

RICT (continued)

BFN-UNIT 3 3.3-49 Amendment No. 24-J, 294

Primary Containment Isolation Instrumentation 3.3.6.1 ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 ----NOTE---

channels inoperable. Only applicable for Function 1.d if two or more channels are inoperable.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months f INSERT Functions RICT than Functi 2.b d AND A.2 ----NOTE---

Only applicable for Function 1.d when 15 of 16 channels are OPERABLE.

Place channel in trip. 30 days (continued)

BFN-UNIT3 3.3-54 Amendment No. 243

-SEP B 8 1SS8

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION 3.3.8.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Table 3.3.8.1-1 Function on 4 kV shutdown boards 3EA, 3EB, 3EC, and 3ED shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, When the associated diesel generator is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION

. TIME A. One degraded voltage A.1 Verify by administrative Immediately relay channel inoperable means that the other two on one or more shutdown degraded voltage relay board(s). channels and associated timers on the affected AND shutdown board( s) are OPERABLE.

The loss of voltage relay channels on the affected AND shutdown board( s) are OPERABLE. A.2 Place the degraded 15 days INSERT voltage relay channel in < RICT trip.

(continued)

BFN-UNIT 3 3.3-71 Amendment No. -243 SEP Q g 1998

INSERT RICT Relocated from next page

Relocate to previous page and delete this page

INSERT RICT Relocate to next new page

INSERT RICT

[following isolation]

INSERT RICT

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.15 Surveillance Frequency Control Program (continued)

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency INSERT Control Program shall be made in the accordance with NEI 04-10, RICT Risk-Informed Method for Control of Surveillance Frequencies, PROGRAM Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

BFN-UNIT 3 5.0-21c Amendment No.

000

Attachment 3.1 Proposed Technical Specification Pages (Unit 1 Final Retyped)

(42 total pages)

CNL-21-009

Completion Times 1.3 1.3 Completion Times DESCRIPTION The above Completion Time extension does not apply to a (continued) Completion Time with a modified "time zero." This modified "time zero" may be expressed as a repetitive time (i.e., "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Required Action versus the time of Condition entry) or as a time modified by the phrase "from discovery . . ."

The following examples illustrate the use of Completion Times with different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and associated Completion Time AND not met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Condition B has two Required Actions. Each Required Action has its own separate Completion Time. Each Completion Time is referenced to the time that Condition B is entered.

(continued)

BFN-UNIT 1 1.3-3 Amendment No. 234, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Function X A.1 Restore 7 days subsystem Function X inoperable. subsystem to OPERABLE status.

B. One Function Y B.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months subsystem Function Y inoperable. subsystem to OPERABLE status.

(continued)

BFN-UNIT 1 1.3-6 Amendment No. 234, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

If Required Action C.2 is completed within the specified Completion Time, Conditions B and C are exited. If the Completion Time for Required Action A.1 has not expired, operation may continue in accordance with Condition A. The remaining Completion Time in Condition A is measured from the time the affected subsystem was declared inoperable (i.e., initial entry into Condition A).

It is possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO. However, doing so would be inconsistent with the basis of the Completion Times. Therefore, there shall be administrative controls to limits the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls shall ensure that the Completion Times for those Conditions are not inappropriately extended.

(continued)

BFN-UNIT 1 1.3-8 Amendment No. 234, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or any subsequent 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (plus the extension allowed by SR 3.0.2),

Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore 7 days inoperable. subsystem to OPERABLE status..

OR In accordance with the Risk Informed Completion Time Program B. Required Action B.1 Be in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated MODE 3.

Completion Time not met. AND B.2 Be in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months MODE .

BFN-UNIT 1 1.3-15 Amendment No. 234, ___

Completion Times 1.3 1.3 Completion Times (continued)

EXAMPLE 1.3-8 (continued)

When a subsystem is declared inoperable, Condition A is entered.

The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time (RICT) Program which permits calculation of a RICT that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered.

The RICT Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the RICT Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION Required Action should be pursued without delay and in a TIME controlled manner.

BFN-UNIT 1 1.3-15a Amendment No. 234, ___

SLC System 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SLC subsystem A.1 Restore SLC subsystem 7 days inoperable. to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Two SLC subsystems B.1 Restore one SLC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met.

AND C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 1 3.1-23 Amendment No. 234, 251, ___

RPS Instrumentation 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR In accordance with the Risk Informed Completion Time Program OR A.2 -------------NOTE------------

Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

(continued)

BFN-UNIT 1 3.3-1 Amendment No. 234, 262, 266, ___

RPS Instrumentation 3.3.1.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME A.2 (continued)

Place associated trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months system in trip.

OR In accordance with the Risk Informed Completion Time Program B. -------------NOTE------------ B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Not applicable for system in trip.

Functions 2.a, 2.b, 2.c, 2.d, or 2.f. OR OR One or more Functions In accordance with one or more required with the Risk channels inoperable in Informed both trip systems. Completion Time Program B.2 Place one trip system in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months trip.

OR In accordance with the Risk Informed Completion Time Program BFN-UNIT 1 3.3-1a Amendment No. 234, 262, 266, ___

Feedwater and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Two channels of feedwater and main turbine high water level trip instrumentation per trip system shall be OPERABLE.

APPLICABILITY: THERMAL POWER t 23% RTP.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more feedwater A.1 Place channel(s) in trip. 7 days and main turbine high water level trip channels OR inoperable, in one trip system. In accordance with the Risk Informed Completion Time Program B. One or more feedwater B.1 Restore feedwater and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and main turbine high main turbine high water water level trip channels level trip capability.

inoperable in each trip system.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to < 23% RTP.

Time not met.

BFN-UNIT 1 3.3-21 Amendment No. 234, 299, ___

ATWS-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation LCO 3.3.4.2 Two channels per trip system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low, Level 2; and

b. Reactor Steam Dome Pressure - High.

APPLICABILITY: MODE 1.

ACTIONS

NOTE----------------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 14 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program OR A.2 -------------NOTE------------

Not applicable if inoperable channel is the result of an inoperable breaker.

Place channel in trip. 14 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.3-32 Amendment No. 234, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required %1 ------------NOTE-----------

Action A.1 and referenced 2QO\DSSOLFDEOHIRU

in Table 3.3.5.1-1. )XQFWLRQVDED

DQGE

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable when discovery of loss its redundant feature ECCS of initiation initiation capability is capability for inoperable. features in both divisions AND B.2 -------------NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Coolant Injection (HPCI) discovery of loss System inoperable. of HPCI initiation capability AND B.3 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.3-36 Amendment No. 234 234, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required &1 ------------NOTE-----------

Action A.1 and referenced 2QO\DSSOLFDEOHIRU

in Table 3.3.5.1-1. )XQFWLRQVFHF

GDQGI

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable when discovery of loss its redundant feature of initiation ECCS initiation capability capability for is inoperable. features in both divisions AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. As required by Required D.1 -------------NOTE------------

Action A.1 and referenced Only applicable if HPCI in Table 3.3.5.1-1. pump suction is not aligned to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable.

(continued)

BFN-UNIT 1 3.3-37 Amendment No. 234 234, ___

(&&6,QVWUXPHQWDWLRQ

$&7,216 FRQWLQXHG

&21',7,21 5(48,5('$&7,21 &203/(7,21 7,0(

( $VUHTXLUHGE\5HTXLUHG ( 127(

$FWLRQ$DQGUHIHUHQFHG 2QO\DSSOLFDEOHIRU

LQ7DEOH )XQFWLRQG

'HFODUHVXSSRUWHG(&&6 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from IHDWXUH V LQRSHUDEOH discovery of loss ZKHQLWVUHGXQGDQW of initiation IHDWXUH(&&6LQLWLDWLRQ capability for FDSDELOLW\LVLQRSHUDEOH subsystems in both divisions

$1'

( 5HVWRUHFKDQQHOWR 7 days 23(5$%/(VWDWXV

OR In accordance with the Risk Informed Completion Time Program FRQWLQXHG

%)181,7 $PHQGPHQW1RBBB

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced Depressurization System discovery of loss in Table 3.3.5.1-1. (ADS) valves inoperable. of ADS initiation capability in both trip systems AND F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable OR In accordance with the Risk Informed Completion Time Program AND 8 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.3-39 Amendment No. 234, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required G.1 Declare ADS valves 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced inoperable. discovery of loss in Table 3.3.5.1-1. of ADS initiation capability in both trip systems AND G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable OR In accordance with the Risk Informed Completion Time Program AND 8 days OR In accordance with the Risk Informed Completion Time Program H. Required Action and H.1 Declare associated Immediately associated Completion supported ECCS feature(s)

Time of Condition B, C, D, inoperable.

E, F, or G not met.

BFN-UNIT 1 3.3-40 Amendment No. 234, ___

RCIC System Instrumentation 3.3.5.

3.3 INSTRUMENTATION 3.3.5. Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5. The RCIC System instrumentation for each Function in Table 3.3.5.-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.-1 for the channel.

B. As required by Required B.1 Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and referenced inoperable. discovery of loss in Table 3.3.5.-1. of RCIC initiation capability AND B.2 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.3-48 Amendment No. 234, ___

Primary Containment Isolation Instrumentation 3.3.6.1 ACTIONS

NOTE------------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 -------------NOTE------------

channels inoperable. Only applicable for Function 1.d if two or more channels are inoperable.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c OR In accordance with the Risk Informed Completion Time Program AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.b, 5.h, 6.b, and 6.c OR In accordance with the Risk Informed Completion Time Program AND A.2 -------------NOTE------------

Only applicable for Function 1.d when 15 of 16 channels are OPERABLE.

Place channel in trip. 30 days (continued)

BFN-UNIT 1 3.3-53 Amendment No. 234, ___

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION 3.3.8.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Table 3.3.8.1-1 Function on 4 kV shutdown boards A, B, C, and D shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, When the associated diesel generator is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One degraded voltage A.1 Verify by administrative Immediately relay channel inoperable means that the other two on one or more shutdown degraded voltage relay board(s). channels and associated timers on the affected AND shutdown board(s) are OPERABLE.

The loss of voltage relay channels on the affected AND shutdown board(s) are OPERABLE. A.2 Place the degraded 15 days voltage relay channel in trip. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.3-70 Amendment No. 234, ___

ECCS - Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.1 ECCS - Operating LCO 3.5.1 Each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS) function of six safety/relief valves shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3, except high pressure coolant injection (HPCI) and ADS valves are not required to be OPERABLE with reactor steam dome pressure d 150 psig.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to HPCI.

CONDITION REQUIRED ACTION COMPLETION TIME A. One low pressure ECCS A.1 Restore low pressure 7 days injection/spray subsystem ECCS injection/spray inoperable. subsystem(s) to OR OPERABLE status.

OR In accordance with the Risk One low pressure coolant Informed injection (LPCI) pump in Completion Time both LPCI subsystems Program inoperable.

(continued)

BFN-UNIT 1 3.5-1 Amendment No. 234, 240, 249, 311, ___

311

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C. HPCI System inoperable. C.1 Verify by administrative Immediately means RCIC System is OPERABLE.

AND C.2 Restore HPCI System to 14 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. HPCI System inoperable. D.1 Restore HPCI System to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

AND OR Condition A entered. In accordance with the Risk Informed Completion Time Program OR D.2 Restore low pressure 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ECCS injection/spray OR subsystem to OPERABLE status. In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.5-2 Amendment No. 249, ___

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One ADS valve E.1 Restore ADS valve to 14 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program F. One ADS valve F.1 Restore ADS valve to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

OR AND In accordance Condition A entered. with the Risk Informed OR Completion Time Program F.2 Restore low pressure 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ECCS injection/spray subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.5-2a Amendment No. 234, 240, ___

RCIC System 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)539:$7(5,19(1725<

&21752/$1'5($&725&25(ISOLATION COOLING (RCIC) SYSTEM 3.5.3 RCIC System LCO 3.5.3 The RCIC System shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to RCIC.

CONDITION REQUIRED ACTION COMPLETION TIME A. RCIC System inoperable. A.1 Verify by administrative Immediately means High Pressure Coolant Injection System is OPERABLE.

AND A.2 Restore RCIC System to 14 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND B.2 Reduce reactor steam 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months dome pressure to d 150 psig.

BFN-UNIT 1 3.5-12 Amendment No. 234, 249, ___

Primary Containment Air Lock 3.6.1.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed.

AND B.3 --------------NOTE------------

Air lock doors in high radiation areas or areas with limited access due to inerting may be verified locked closed by administrative means.

Verify an OPERABLE Once per 31 days door is locked closed.

C. Primary containment air C.1 Initiate action to evaluate Immediately lock inoperable for primary containment reasons other than overall leakage rate per Condition A or B. LCO 3.6.1.1, using current air lock test results.

AND C.2 Verify a door is closed. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.6-6 Amendment No. 234, ___

PCIVs 3.6.1.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------ A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by main steam line penetration flow paths use of at least one closed with two PCIVs. and de-activated OR

automatic valve, closed manual valve, blind In accordance One or more penetration flange, or check valve with the Risk flow paths with one PCIV with flow through the Informed inoperable except due to valve secured. Completion Time MSIV leakage not within Program limits.

AND 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam line OR In accordance with the Risk Informed Completion Time Program AND (continued)

BFN-UNIT 1 3.6-10 Amendment No. 234, 311, ___

PCIVs 3.6.1.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------------NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 penetration flow path is days >following isolated. isolation@ for isolation devices outside primary containment AND Prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days, for isolation devices inside primary containment (continued)

BFN-UNIT 1 3.6-11 Amendment No. 234, ___

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------------NOTE------------ B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Only applicable to penetration flow path by penetration flow paths use of at least one closed with two PCIVs. and de-activated

automatic valve, closed manual valve, or blind One or more penetration flange.

flow paths with two PCIVs inoperable except due to MSIV leakage not within limits.

C. --------------NOTE------------ C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by excess flow check penetration flow paths use of at least one closed valves (EFCVs) with only one PCIV. and de-activated

automatic valve, closed AND manual valve, or blind One or more penetration flange. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for flow paths with one PCIV EFCVs inoperable. AND C.2 --------------NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is >following isolation@

isolated.

(continued)

BFN-UNIT 1 3.6-12 Amendment No. 234, ___

RHR Suppression Pool Cooling 3.6.2.3 3.6 CONTAINMENT SYSTEMS 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling LCO 3.6.2.3 Four RHR suppression pool cooling subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool cooling subsystem suppression pool cooling inoperable. subsystem to OPERABLE status.

B. Two RHR suppression B.1 Restore one RHR 7 days pool cooling subsystems suppression pool cooling inoperable. subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool cooling suppression pool cooling subsystems inoperable. subsystems to OPERABLE status.

(continued)

BFN-UNIT 1 3.6-31 Amendment No. 234, 241, ___

RHR Suppression Pool Spray 3.6.2.4 3.6 CONTAINMENT SYSTEMS 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray LCO 3.6.2.4 Four RHR suppression pool spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool spray subsystem suppression pool spray inoperable. subsystem to OPERABLE status.

B. Two RHR suppression B.1 Restore one RHR 7 days pool spray subsystems suppression pool spray inoperable. subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool spray suppression pool spray subsystems inoperable. subsystems to OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 1 3.6-34 Amendment No. 234, ___

RHR Drywell Spray 3.6.2.5 3.6 CONTAINMENT SYSTEMS 3.6.2.5 Residual Heat Removal (RHR) Drywell Spray LCO 3.6.2.5 Four RHR drywell spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR drywell spray A.1 Restore the RHR drywell 30 days subsystem inoperable. spray subsystem to OPERABLE status.

B. Two RHR drywell spray B.1 Restore one RHR drywell 7 days subsystems inoperable. spray subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months drywell spray subsystems drywell spray subsystems inoperable. to OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 1 3.6-36 Amendment No. 234, ___

RHRSW System 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One RHRSW subsystem B.1 -------------NOTE-------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling - Hot Shutdown," for RHR shutdown cooling made inoperable by the RHRSW system.

Restore RHRSW subsystem 30 days to OPERABLE status.

C. Two required RHRSW C.1 Restore one inoperable 7 days pumps inoperable. RHRSW pump to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Two RHRSW subsystems D.1 -------------NOTE-------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, for RHR shutdown cooling made inoperable by the RHRSW System.

Restore one RHRSW 7 days subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.7-3 Amendment No. 234 234BBB

EECW System and UHS 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Equipment Cooling Water (EECW) System and Ultimate Heat Sink (UHS)

LCO 3.7.2 The EECW System with three pumps and UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required EECW A.1 Restore the required 7 days pump inoperable. EECW pump to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Two or more required EECW pumps inoperable.

OR UHS inoperable.

BFN-UNIT 1 3.7-6 Amendment No. 234, ___

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no offsite discovery of no power available offsite power to inoperable when the one shutdown redundant required board concurrent feature(s) are inoperable. with inoperability of redundant required feature(s)

AND A.3 Restore required offsite 7 days circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One required Unit 1 and 2 B.1 Verify power availability 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months DG inoperable. from the offsite transmission network. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

BFN-UNIT 1 3.8-2 Amendment No. 280, ___

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.5 Restore Unit 1 and 2 DG to 7 days from OPERABLE status. discovery of unavailability of TDG(s)

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry

GD\V

FRQFXUUHQWZLWK

XQDYDLODELOLW\RI

7'* V AND 14 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.8-3a Amendment No. 280, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One division of 480 V C.1 Restore required division 7 days load shed logic of 480 V load shed logic inoperable. to OPERABLE status.

D. One division of common D.1 Restore required division 7 days accident signal logic of common accident inoperable. signal logic to OPERABLE status.

E. Two required offsite E.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when the redundant Condition E required feature(s) are concurrent with inoperable. inoperability of redundant AND required feature(s)

E.2 Restore one required KRXUV offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program FRQWLQXHG BFN-UNIT 1 3.8-4 Amendment No. 234, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE------------- -------------------NOTE----------------

Only applicable when more than Enter applicable Conditions and one 4.16 kV shutdown board is Required Actions of LCO 3.8.7, affected. "Distribution Systems - Operating,"

when Condition F is entered with no AC power source to any 4.16 kV F. One required offsite circuit shutdown board.

inoperable. --------------------------------------------

AND F.1 Restore required offsite 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months circuit to OPERABLE status.

One Unit 1 and 2 DG OR inoperable.

In accordance with the Risk Informed Completion Time Program OR F.2 Restore Unit 1 and 2 DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program

NOTE-------------

Applicable when only one 4.16 kV shutdown board is affected.

G. One required offsite circuit G.1 Declare the affected 4.16 kV Immediately inoperable. shutdown board inoperable.

AND One Unit 1 and 2 DG inoperable.

(continued)

BFN-UNIT 1 3.8-5 Amendment No. 234, ___

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The following DC electrical power systems shall be OPERABLE:

a. Unit DC subsystems 1, 2, and 3;

b. Shutdown Board DC subsystems A, B, C, and D;

c. Unit 1 and 2 Diesel Generator (DG) DC subsystems;

d. Unit 3 DG DC subsystem(s) supporting DG(s) required to be OPERABLE by LCO 3.8.1, "AC Sources - Operating"; and

e. Unit 3 Shutdown Board DC subsystem 3EB needed to support equipment required to be OPERABLE by LCO 3.7.3, "Control Room Emergency Ventilation (CREV) System."

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit DC electrical A.1 Restore DC electrical 7 days power subsystem power subsystem to inoperable. OPERABLE status. OR OR In accordance with the Risk One Unit 1 and 2 Informed Shutdown Board DC Completion Time electrical power Program subsystem inoperable.

(continued)

BFN-UNIT 1 3.8-22 Amendment No. 234, ___

Distribution Systems - Operating 3.8.7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit 1 and 2 4.16 kV -------------------NOTE----------------

Shutdown Board Enter applicable Conditions and inoperable. Required Actions of Condition B, C, and F when Condition A results in no power source to a required 480 volt board.

A.1 Restore the Unit 1 and 2 5 days 4.16 kV Shutdown Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program AND A.2 Declare associated diesel Immediately generator inoperable.

(continued)

BFN-UNIT 1 3.8-34 Amendment No. 234, 254, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One Unit 1 480 V B.1 Restore Board to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board OPERABLE status.

inoperable. OR OR In accordance with the Risk 480 V RMOV Board 1A Informed inoperable. Completion Time Program OR 480 V RMOV Board 1B inoperable.

C. One Unit 1 and 2 DG C.1 Restore Unit 1 and 2 DG 5 days Auxiliary Board Auxiliary Board to inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 3.8-35 Amendment No. 234, 254, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One Unit DC Board D.1 Restore required Board or 7 days inoperable. Shutdown Board DC Distribution Panel to OR OR OPERABLE status.

In accordance One Unit 1 and 2 with the Risk Shutdown Board DC Informed Distribution Panel Completion Time inoperable. Program OR 250 V DC RMOV Board 1A inoperable.

OR 250 V DC RMOV Board 1B inoperable.

OR 250 V DC RMOV Board 1C inoperable.

(continued)

BFN-UNIT 1 3.8-36 Amendment No. 234, 254, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Unit 1 and 2 4.16 kV -------------------NOTE----------------

Shutdown Board A and B Enter applicable conditions and inoperable. required actions of Condition B, C, and F when Condition E OR results in no power source to a required 480 volt board.

Unit 1 and 2 4.16 kV --------------------------------------------

Shutdown Board C and D inoperable. E.1 Restore one 4.16 kV 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program F. One or more required F.1 Declare the affected SGT Immediately Unit 2 or 3 AC or DC or CREV subsystem Boards inoperable. inoperable.

G. Required Action and G.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, AND C, D, or E not met.

G.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months H. Two or more electrical H.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of function.

BFN-UNIT 1 3.8-37 Amendment No. 234, 254, ___

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.15 Surveillance Frequency Control Program (continued)

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, Risk-Informed Method for Control of Surveillance Frequencies, Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

5.5.16 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines."

The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1, 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI-06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

BFN-UNIT 1 5.0-21c Amendment No. 315, ___

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.16 Risk Informed Completion Time Program (continued)

3. Revising the RICT is not required Lf the plant configuration change would lower plant risk and would result in a longer RICT.

G For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

Numerically accounting for the increased possibility of CCF in the RICT calculation; or

Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

H 7KHULVNDVVHVVPHQWDSSURDFKHVDQGPHWKRGVVKDOOEHDFFHSWDEOHWRWKH

15&7KHSODQW35$VKDOOEHEDVHGRQWKHDVEXLOWDVRSHUDWHGDQG

PDLQWDLQHGSODQWDQGUHIOHFWWKHRSHUDWLQJH[SHULHQFHDWWKHSODQWDV

VSHFLILHGLQ5HJXODWRU\*XLGH5HYLVLRQ0HWKRGVWRDVVHVVWKH

ULVNIURPH[WHQGLQJWKH&RPSOHWLRQ7LPHVPXVWEH35$PHWKRGV

DSSURYHGIRUXVHZLWKWKLVSURJUDPRURWKHUPHWKRGVDSSURYHGE\WKH

15&IRUJHQHULFXVHDQGDQ\FKDQJHLQWKH35$PHWKRGVWRDVVHVVULVN

WKDWDUHRXWVLGHWKHVHDSSURYDOERXQGDULHVUHTXLUHSULRU15&DSSURYDO

BFN-UNIT 1 5.0-21d Amendment No. 315, ___

Attachment 3.2 Proposed Technical Specification Pages (Unit 2 Final Retyped)

(42 total pages)

CNL-21-009

Completion Times 1.3 1.3 Completion Times DESCRIPTION The above Completion Time extension does not apply to a (continued) Completion Time with a modified "time zero." This modified "time zero" may be expressed as a repetitive time (i.e., "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Required Action versus the time of Condition entry) or as a time modified by the phrase "from discovery . . ."

The following examples illustrate the use of Completion Times with different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and associated Completion Time AND not met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Condition B has two Required Actions. Each Required Action has its own separate Completion Time. Each Completion Time is referenced to the time that Condition B is entered.

(continued)

BFN-UNIT 2 1.3-3 Amendment No. 253, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Function X A.1 Restore 7 days subsystem Function X inoperable. subsystem to OPERABLE status.

B. One Function Y B.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months subsystem Function Y inoperable. subsystem to OPERABLE status.

(continued)

BFN-UNIT 2 1.3-6 Amendment No. 253, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

If Required Action C.2 is completed within the specified Completion Time, Conditions B and C are exited. If the Completion Time for Required Action A.1 has not expired, operation may continue in accordance with Condition A. The remaining Completion Time in Condition A is measured from the time the affected subsystem was declared inoperable (i.e., initial entry into Condition A).

It is possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO. However, doing so would be inconsistent with the basis of the Completion Times. Therefore, there shall be administrative controls to limit the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls shall ensure that the Completion Times for those Conditions are not inappropriately extended.

(continued)

BFN-UNIT 2 1.3-8 Amendment No. 253, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or any subsequent 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (plus the extension allowed by SR 3.0.2),

Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore 7 days inoperable. subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program B. Required Action B.1 Be in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated MODE 3.

Completion Time not met. AND B.2 Be in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months MODE 4.

BFN-UNIT 2 1.3-15 Amendment No. 253, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

When a subsystem is declared inoperable, Condition A is entered.

The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time.

The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition % must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revise RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Times (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION Required Action should be pursued without delay and in a TIME controlled manner.

BFN-UNIT 2 1.3-15a Amendment No. 253, ___

SLC System 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SLC subsystem A.1 Restore SLC subsystem 7 days inoperable. to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Two SLC subsystems B.1 Restore one SLC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 2 3.1-23 Amendment No. 253, 290, ___

RPS Instrumentation 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1.

ACTIONS

NOTE-----------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR In accordance with the Risk Informed Completion Time Program OR A.2 -------------NOTE-------------

Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

Place associated trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months system in trip.

OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.3-1 Amendment No. 258, ___

RPS Instrumentation 3.3.1.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. -------------NOTE------------- B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Not applicable for Functions system in trip.

2.a, 2.b, 2.c, 2.d, or 2.f. OR In accordance with One or more Functions with the Risk Informed one or more required Completion Time channels inoperable in both Program trip systems.

OR B.2 Place one trip system in trip. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR In accordance with the Risk Informed Completion Time Program C. One or more Functions with C.1 Restore RPS trip capability. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RPS trip capability not maintained.

D. Required Action and D.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A, B, or C Table 3.3.1.1-1 for the not met. channel.

E. As required by Required E.1 Reduce THERMAL POWER 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Action D.1 and referenced to < 26% RTP.

in Table 3.3.1.1-1.

F. As required by Required F.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action D.1 and referenced in Table 3.3.1.1-1.

(continued)

BFN-UNIT 2 3.3-2 Amendment No. 258, 323, ___

Feedwater and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Two channels of feedwater and main turbine high water level trip instrumentation per trip system shall be OPERABLE.

APPLICABILITY: THERMAL POWER t 23% RTP.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more feedwater A.1 Place channel(s) in trip. 7 days and main turbine high water level trip channels OR inoperable, in one trip system. In accordance with the Risk Informed Completion Time Program B. One or more feedwater B.1 Restore feedwater and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and main turbine high main turbine high water water level trip channels level trip capability.

inoperable in each trip system.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to < 23% RTP.

Time not met.

BFN-UNIT 2 3.3-22 Amendment No. 253, 323, ___

ATWS-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation LCO 3.3.4.2 Two channels per trip system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low, Level 2; and

b. Reactor Steam Dome Pressure - High.

APPLICABILITY: MODE 1.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 14 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program OR A.2 --------------NOTE------------ 14 days Not applicable if inoperable channel is the result of an OR inoperable breaker.

In accordance with the Risk Informed Place channel in trip. Completion Time Program (continued)

BFN-UNIT 2 3.3-33 Amendment No. 253, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required %1 -------------NOTE-----------

Action A.1 and Only applicable for referenced in Functionsa, 1.b,a, and Table 3.3.5.1-1. 2.b.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND B.2 --------------NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Coolant Injection (HPCI) discovery of loss System inoperable. of HPCI initiation capability AND B.3 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.3-37 Amendment No. 253, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required &1 -------------NOTE-----------

Action A.1 and Only applicable for referenced in Functions 1.c, 1.e, c, 2.d, Table 3.3.5.1-1. and 2.f.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. As required by Required D.1 --------------NOTE------------

Action A.1 and Only applicable if HPCI referenced in pump suction is not Table 3.3.5.1-1. aligned to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable.

(continued)

BFN-UNIT 2 3.3-38 Amendment No. 253 253BBB

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required (1 -------------NOTE-----------

Action A.1 and 2QO\DSSOLFDEOHIRU

referenced in )XQFWLRQG

Table 3.3.5.1-1.

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. subsystems in both divisions AND E.2 Restore channel to 7 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.3-39 Amendment No. 253,

253 ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and Depressurization System discovery of loss referenced in (ADS) valves inoperable. of ADS initiation Table 3.3.5.1-1. capability in both trip systems AND F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable OR In accordance with the Risk Informed Completion Time Program AND 8 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.3-40 Amendment No. 253, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required G.1 Declare ADS valves 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and inoperable. discovery of loss referenced in of ADS initiation Table 3.3.5.1-1. capability in both trip systems AND G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable OR In accordance with the Risk Informed Completion Time Program AND 8 days OR In accordance with the Risk Informed Completion Time Program H. Required Action and H.1 Declare associated Immediately associated Completion supported ECCS Time of Condition B, C, feature(s) inoperable.

D, E, F, or G not met.

BFN-UNIT 2 3.3-41 Amendment No. 253, ___

RCIC System Instrumentation 3.3.5.

3.3 INSTRUMENTATION 3.3.5. Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5. The RCIC System instrumentation for each Function in Table 3.3.5.-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.-1 for the channel.

B. As required by Required B.1 Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and inoperable. discovery of loss referenced in of RCIC initiation Table 3.3.5.-1. capability AND B.2 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.3-49 Amendment No. 253 253, ___

Primary Containment Isolation Instrumentation 3.3.6.1 ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 --------------NOTE------------

channels inoperable. Only applicable for Function 1.d if two or more channels are inoperable.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c OR In accordance with the Risk Informed Completion Time Program AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.b, 5.h, 6.b, and 6.c OR In accordance with the Risk Informed Completion Time Program AND A.2 --------------NOTE------------

Only applicable for Function 1.d when 15 of 16 channels are OPERABLE.

Place channel in trip. 30 days (continued)

BFN-UNIT 2 3.3-54 Amendment No. 253, ___

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION 3.3.8.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Table 3.3.8.1-1 Function on 4 kV shutdown boards A, B, C, and D shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, When the associated diesel generator is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One degraded voltage A.1 Verify by administrative Immediately relay channel inoperable means that the other two on one or more shutdown degraded voltage relay board(s). channels and associated timers on the affected AND shutdown board(s) are OPERABLE.

The loss of voltage relay channels on the affected AND shutdown board(s) are OPERABLE. A.2 Place the degraded 15 days voltage relay channel in trip. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.3-71 Amendment No. 253, ___

ECCS - Operating 3.5.1 3.5 EMERGENCY CORE SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.1 ECCS - Operating LCO 3.5.1 Each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS) function of six safety/relief valves shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3, except high pressure coolant injection (HPCI) and ADS valves are not required to be OPERABLE with reactor steam dome pressure d 150 psig.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to HPCI.

CONDITION REQUIRED ACTION COMPLETION TIME A. One low pressure ECCS A.1 Restore low pressure 7 days injection/spray subsystem ECCS injection/spray inoperable. subsystem(s) to OR OPERABLE status.

OR In accordance with the Risk One low pressure coolant Informed injection (LPCI) pump in Completion Time both LPCI subsystems Program inoperable.

B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (continued)

BFN-UNIT 2 3.5-1 Amendment No. 253, 269, 286, 294, ___

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. HPCI System inoperable. C.1 Verify by administrative Immediately means RCIC System is OPERABLE.

AND C.2 Restore HPCI System to 14 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. HPCI System inoperable. D.1 Restore HPCI System to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

AND OR Condition A entered. In accordance with the Risk Informed Completion Time Program OR D.2 Restore low pressure ECCS 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months injection/spray subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.5-2 Amendment No. 253, 269, ___

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One ADS valve E.1 Restore ADS valve to 14 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program F. One ADS valve F.1 Restore ADS valve to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

OR AND In accordance Condition A entered. with the Risk Informed Completion Time Program OR F.2 Restore low pressure 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ECCS injection/spray OR subsystem to OPERABLE status. In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.5-2a Amendment No. 253, 269, ___

RCIC System 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.3 RCIC System LCO 3.5.3 The RCIC System shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to RCIC.

CONDITION REQUIRED ACTION COMPLETION TIME A. RCIC System inoperable. A.1 Verify by administrative Immediately means High Pressure Coolant Injection System is OPERABLE.

AND A.2 Restore RCIC System to 14 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND B.2 Reduce reactor steam 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months dome pressure to d 150 psig.

BFN-UNIT 2 3.5-12 Amendment No. 253, 286, ___

Primary Containment Air Lock 3.6.1.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed.

AND B.3 --------------NOTE------------

Air lock doors in high radiation areas or areas with limited access due to inerting may be verified locked closed by administrative means.

Verify an OPERABLE door Once per 31 days is locked closed.

C. Primary containment air C.1 Initiate action to evaluate Immediately lock inoperable for reasons primary containment other than Condition A or overall leakage rate per B. LCO 3.6.1.1, using current air lock test results.

AND C.2 Verify a door is closed. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.6-6 Amendment No. 253, ___

PCIVs 3.6.1.3 ACTIONS FRQWLQXHG CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------ A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by main steam line penetration flow paths use of at least one closed and de-activated OR with two PCIVs.

automatic valve, closed In accordance manual valve, blind with the Risk One or more penetration flange, or check valve Informed flow paths with one PCIV with flow through the Completion Time inoperable except due to valve secured. Program MSIV leakage not within limits. AND 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam line OR In accordance with the Risk Informed Completion Time Program AND (continued)

BFN-UNIT 2 3.6-10 Amendment No. 253 253, ___

PCIVs 3.6.1.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------------NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 penetration flow path is days >following isolated. isolation@ for isolation devices outside primary containment AND Prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days, for isolation devices inside primary containment (continued)

BFN-UNIT 2 3.6-11 Amendment No. 253, ___

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------------NOTE------------ B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Only applicable to penetration flow path by penetration flow paths use of at least one closed with two PCIVs. and de-activated

automatic valve, closed manual valve, or blind One or more penetration flange.

flow paths with two PCIVs inoperable except due to MSIV leakage not within limits.

C. --------------NOTE------------ C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by excess flow check penetration flow paths use of at least one closed valves (EFCVs) with only one PCIV. and de-activated

automatic valve, closed AND manual valve, or blind One or more penetration flange. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for flow paths with one PCIV EFCVs inoperable. AND C.2 --------------NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is >following isolation@

isolated.

(continued)

BFN-UNIT 2 3.6-12 Amendment No. 253, ___

RHR Suppression Pool Cooling 3.6.2.3 3.6 CONTAINMENT SYSTEMS 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling LCO 3.6.2.3 Four RHR suppression pool cooling subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool cooling subsystem suppression pool cooling inoperable. subsystem to OPERABLE status.

B. Two RHR suppression B.1 Restore one RHR 7 days pool cooling subsystems suppression pool cooling inoperable. subsystem to OPERABLE OR status. In accordance with the Risk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool cooling suppression pool cooling subsystems inoperable. subsystems to OPERABLE status.

(continued)

BFN-UNIT 2 3.6-31 Amendment No. 253, 272, ___

RHR Suppression Pool Spray 3.6.2.4 3.6 CONTAINMENT SYSTEMS 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray LCO 3.6.2.4 Four RHR suppression pool spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool spray subsystem suppression pool spray inoperable. subsystem to OPERABLE status.

B. Two RHR suppression B.1 Restore one RHR 7 days pool spray subsystems suppression pool spray inoperable. subsystem to OPERABLE OR status. In accordance with the Risk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool spray suppression pool spray subsystems inoperable. subsystems to OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 2 3.6-34 Amendment No. 253, ___

RHR Drywell Spray 3.6.2.5 3.6 CONTAINMENT SYSTEMS 3.6.2.5 Residual Heat Removal (RHR) Drywell Spray LCO 3.6.2.5 Four RHR drywell spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR drywell spray A.1 Restore the RHR drywell 30 days subsystem inoperable. spray subsystem to OPERABLE status.

B. Two RHR drywell spray B.1 Restore one RHR drywell 7 days subsystems inoperable. spray subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months drywell spray subsystems drywell spray subsystems inoperable. to OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 2 3.6-36 Amendment No. 253, ___

RHRSW System 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One RHRSW subsystem B.1 -------------NOTE-------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling - Hot Shutdown," for RHR shutdown cooling made inoperable by the RHRSW system.

Restore RHRSW subsystem 30 days to OPERABLE status.

C. Two required RHRSW C.1 Restore one inoperable 7 days pumps inoperable. RHRSW pump to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Two RHRSW subsystems D.1 -------------NOTE-------------

inoperable.. Enter applicable Conditions and Required Actions of LCO 3.4.7, for RHR shutdown cooling made inoperable by the RHRSW System.

Restore one RHRSW 7 days subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.7-3 Amendment No. 254, 323, ___

EECW System and UHS 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Equipment Cooling Water (EECW) System and Ultimate Heat Sink (UHS)

LCO 3.7.2 The EECW System with three pumps and UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required EECW A.1 Restore the required 7 days pump inoperable. EECW pump to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Two or more required EECW pumps inoperable.

OR UHS inoperable.

BFN-UNIT 2 3.7-7 Amendment No. 254 254, ___

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no offsite discovery of no power available offsite power to inoperable when the one shutdown redundant required board concurrent feature(s) are inoperable. with inoperability of redundant required feature(s)

AND A.3 Restore required offsite 7 days circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One required Unit 1 and 2 B.1 Verify power availability 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months DG inoperable. from the offsite transmission network. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

BFN-UNIT 2 3.8-2 Amendment No. 307, ___

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.5 Restore Unit 1 and 2 DG 7 days from to OPERABLE status. discovery of unavailability of TDG(s)

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry

GD\V

FRQFXUUHQWZLWK

XQDYDLODELOLW\RI

7'* V AND 14 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.8-3a Amendment No. 307, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One division of 480 V C.1 Restore required division 7 days load shed logic of 480 V load shed logic inoperable. to OPERABLE status.

D. One division of common D.1 Restore required division 7 days accident signal logic of common accident inoperable. signal logic to OPERABLE status.

E. Two required offsite E.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when the redundant Condition E required feature(s) are concurrent with inoperable. inoperability of redundant AND required feature(s)

E.2 Restore one required KRXUV offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program FRQWLQXHG BFN-UNIT 3.8-4 Amendment No. 2, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE------------- -------------------NOTE----------------

Only applicable when more than Enter applicable Conditions and one 4.16 kV shutdown board is Required Actions of LCO 3.8.7, affected. "Distribution Systems - Operating,"

when Condition F is entered with no AC power source to any 4.16 kV F. One required offsite circuit shutdown board.

inoperable. --------------------------------------------

AND F.1 Restore required offsite 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months circuit to OPERABLE status.

One Unit 1 and 2 DG OR inoperable.

In accordance with the Risk Informed Completion Time Program OR F.2 Restore Unit 1 and 2 DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program

NOTE-------------

Applicable when only one 4.16 kV shutdown board is affected.

G. One required offsite circuit G.1 Declare the affected 4.16 kV Immediately inoperable. shutdown board inoperable.

AND One Unit 1 and 2 DG inoperable.

(continued)

BFN-UNIT 2 3.8-5 Amendment No. 253, ___

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The following DC electrical power systems shall be OPERABLE:

a. Unit DC subsystems 1, 2, and 3;

b. Shutdown Board DC subsystems A, B, C, and D;

c. Unit 1 and 2 Diesel Generator (DG) DC subsystems;

d. Unit 3 DG DC subsystem(s) supporting DG(s) required to be OPERABLE by LCO 3.8.1, "AC Sources - Operating"; and

e. Unit 3 Shutdown Board DC subsystem 3EB needed to support equipment required to be OPERABLE by LCO 3.7.3, "Control Room Emergency Ventilation (CREV) System."

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit DC electrical A.1 Restore DC electrical 7 days power subsystem power subsystem to inoperable. OPERABLE status. OR OR In accordance with the Risk One Unit 1 and 2 Informed Shutdown Board DC Completion Time electrical power Program subsystem inoperable.

(continued)

BFN-UNIT 2 3.8-22 Amendment No. 253, ___

Distribution Systems - Operating 3.8.7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit 1 and 2 4.16 kV -------------------NOTE----------------

Shutdown Board Enter applicable Conditions and inoperable. Required Actions of Condition B, C, D, and G when Condition A results in no power source to a required 480 volt board.

A.1 Restore the Unit 1 and 2 5 days 4.16 kV Shutdown Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program AND A.2 Declare associated diesel Immediately generator inoperable.

(continued)

BFN-UNIT 2 3.8-34 Amendment No. 253, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One Unit 2 480 V -------------------NOTE----------------

Shutdown Board Enter Condition C when inoperable. Condition B results in no power source to 480 volt RMOV board OR 2D or 2E.

480 V RMOV Board 2A inoperable. B.1 Restore Board to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OPERABLE status.

OR OR 480 V RMOV Board 2B In accordance inoperable. with the Risk Informed Completion Time Program C. Unit 2 480 V RMOV C.1 Declare the affected RHR Immediately Board 2D inoperable. subsystem inoperable.

OR Unit 2 480 V RMOV Board 2E inoperable.

D. One Unit 1 and 2 DG D.1 Restore Unit 1 and 2 DG 5 days Auxiliary Board Auxiliary Board to inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 2 3.8-35 Amendment No. 253, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One Unit DC Board E.1 Restore required Board or 7 days inoperable. Shutdown Board DC Distribution Panel to OR OR OPERABLE status.

In accordance One Unit 1 and 2 with the Risk Shutdown Board DC Informed Distribution Panel Completion Time inoperable. Program OR 250 V DC RMOV Board 2A inoperable.

OR 250 V DC RMOV Board 2B inoperable.

OR 250 V DC RMOV Board 2C inoperable.

(continued)

BFN-UNIT 2 3.8-36 Amendment No. 253, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. Unit 1 and 2 4.16 kV -------------------NOTE----------------

Shutdown Board A and B Enter applicable conditions and inoperable. required actions of Condition B, C, D, and G when Condition F OR results in no power source to a required 480 volt board.

Unit 1 and 2 4.16 kV --------------------------------------------

Shutdown Board C and D inoperable. F.1 Restore one 4.16 kV 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program G. One or more required G.1 Declare the affected SGT Immediately Unit 1 or 3 AC or DC or CREV subsystem Boards inoperable. inoperable.

H. Required Action and H.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, AND D, E, or F not met.

H.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months I. Two or more electrical I.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of function.

BFN-UNIT 2 3.8-37 Amendment No. 253, ___

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.15 Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk- Informed Method for Control of Surveillance Frequencies," Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

5.5.16 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1, 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in confirmation.

(continued)

BFN-UNIT 2 5.0-21c Amendment No. 338, ___

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.16 Risk Informed Completion Time Program (continued)

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

G For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior toexceeding the Completion Time, the RICT shall account for the increasedpossibility of common cause failure (CCF) by either:

Numerically accounting for the increased possibility of CCF in the RICT calculation; or

Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverseSSCs that perform the function(s) of the inoperable SSCs, and, ifpracticable, reduce the frequency of initiating events that challenge thefunction(s) performed by the inoperable SSCs.

H 7KHULVNDVVHVVPHQWDSSURDFKHVDQGPHWKRGVVKDOOEHDFFHSWDEOHWRWKH15&

7KHSODQW35$VKDOOEHEDVHGRQWKHDVEXLOWDVRSHUDWHGDQGPDLQWDLQHG

SODQWDQGUHIOHFWWKHRSHUDWLQJH[SHULHQFHDWWKHSODQWDVVSHFLILHGLQ

5HJXODWRU\*XLGH5HYLVLRQ0HWKRGVWRDVVHVVWKHULVNIURPH[WHQGLQJ

WKH&RPSOHWLRQ7LPHVPXVWEH35$PHWKRGVDSSURYHGIRUXVHZLWKWKLV

SURJUDPRURWKHUPHWKRGVDSSURYHGE\WKH15&IRUJHQHULFXVHDQGDQ\

FKDQJHLQWKH35$PHWKRGVWRDVVHVVULVNWKDWDUHRXWVLGHWKHVHDSSURYDO

ERXQGDULHVUHTXLUHSULRU15&DSSURYDO

BFN-UNIT 2 5.0-21d Amendment No. ___

Attachment 3.3 Proposed Technical Specification Pages (Unit 3 Final Retyped)

(42 total pages)

CNL-21-009

Completion Times 1.3 1.3 Completion Times DESCRIPTION The above Completion Time extension does not apply to a (continued) Completion Time with a modified "time zero." This modified "time zero" may be expressed as a repetitive time (i.e., "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Required Action versus the time of Condition entry) or as a time modified by the phrase "from discovery . . .".

The following examples illustrate the use of Completion Times with different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and associated Completion Time AND not met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Condition B has two Required Actions. Each Required Action has its own separate Completion Time. Each Completion Time is referenced to the time that Condition B is entered.

(continued)

BFN-UNIT 3 1.3-3 Amendment No. 212, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore 7 days Function X Function X subsystem subsystem to inoperable. OPERABLE status.

B. One B.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function Y Function Y subsystem subsystem to inoperable. OPERABLE status.

(continued)

BFN-UNIT 3 1.3-6 Amendment No. 212, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

If Required Action C.2 is completed within the specified Completion Time, Conditions B and C are exited. If the Completion Time for Required Action A.1 has not expired, operation may continue in accordance with Condition A. The remaining Completion Time in Condition A is measured from the time the affected subsystem was declared inoperable (i.e., initial entry into Condition A).

It is possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO. However, doing so would be inconsistent with the basis of the Completion Times. Therefore, there shall be administrative controls to limit the maximum time allowed for any combination of Conditions that result in a single contiguous occurrence of failing to meet the LCO. These administrative controls shall ensure that the Completion Times for those conditions are not inappropriately extended.

(continued)

BFN-UNIT 3 1.3-8 Amendment No. 212, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or any subsequent 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (plus the extension allowed by SR 3.0.2),

Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore 7 days subsystem subsystem to inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Required B.1 Be in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and MODE 3.

associated Completion AND Time not met.

B.2 Be in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months MODE 5.

BFN-UNIT 3 1.3-15 Amendment No. 212, ___

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

When a subsystem is declared inoperable, Condition A is entered.

The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time.

The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION Required Action should be pursued without delay and in a TIME controlled manner.

BFN-UNIT 3 1.3-15a Amendment No. 212, ___

SLC System 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SLC subsystem A.1 Restore SLC subsystem 7 days inoperable. to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. Two SLC subsystems B.1 Restore one SLC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met.

AND C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 3 3.1-23 Amendment No. 212, 249, ___

RPS Instrumentation 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1.

ACTIONS

NOTE-----------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR In accordance OR with the Risk Informed Completion Time Program A.2 -------------NOTE-------------

Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

Place associated trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months system in trip.

OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3-1 Amendment No. 212, 213, 221, ___

RPS Instrumentation 3.3.1.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. -------------NOTE------------- B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Not applicable for system in trip.

Functions 2.a, 2.b, 2.c, OR 2.d, or 2.f.

In accordance with the Risk Informed One or more Functions Completion Time with one or more required OR Program channels inoperable in both trip systems.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Place one trip system in trip. OR In accordance with the Risk Informed Completion Time Program C. One or more Functions C.1 Restore RPS trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with RPS trip capability not capability.

maintained.

D. Required Action and D.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A, B, or Table 3.3.1.1-1 for the C not met. channel.

E. As required by Required E.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Action D.1 and referenced POWER to < 26% RTP.

in Table 3.3.1.1-1.

F. As required by Required F.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action D.1 and referenced in Table 3.3.1.1-1.

(continued)

BFN-UNIT 3 3.3-2 Amendment No. 212, 213, 221, 283, ___

Feedwater and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Two channels of feedwater and main turbine high water level trip instrumentation per trip system shall be OPERABLE.

APPLICABILITY: THERMAL POWER t 23% RTP.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more feedwater A.1 Place channel(s) in trip. 7 days and main turbine high water level trip channels OR inoperable, in one trip system. In accordance with the Risk Informed Completion Time Program B. One or more feedwater B.1 Restore feedwater and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and main turbine high main turbine high water water level trip channels level trip capability.

inoperable in each trip system.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to < 23% RTP.

Time not met.

BFN-UNIT 3 3.3-22 Amendment No. 213, 283, ___

ATWS-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation LCO 3.3.4.2 Two channels per trip system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low, Level 2; and

b. Reactor Steam Dome Pressure - High.

APPLICABILITY: MODE 1.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 14 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program OR A.2 --------------NOTE------------

Not applicable if inoperable channel is the result of an inoperable breaker.

Place channel in trip.

14 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3-33 Amendment No. 213, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. As required by Required %1 -------------NOTE-----------

Action A.1 and Only applicable for referenced in )XQFWLRQVDED

Table 3.3.5.1-1. DQGE

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND B.2 --------------NOTE------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Coolant Injection (HPCI) discovery of loss System inoperable. of HPCI initiation capability AND B.3 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3-37 Amendment No. 213, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. As required by Required &1 -------------NOTE-----------

Action A.1 and 2QO\DSSOLFDEOHIRU

referenced in )XQFWLRQVFHFG

Table 3.3.5.1-1. DQGI

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. features in both divisions AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program D. As required by Required D.1 --------------NOTE------------

Action A.1 and Only applicable if HPCI referenced in pump suction is not Table 3.3.5.1-1. aligned to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable.

(continued)

BFN-UNIT 3 3.3-38 Amendment No. 213 213, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required (1 -------------NOTE-----------

Action A.1 and 2QO\DSSOLFDEOHIRU

referenced in )XQFWLRQG

Table 3.3.5.1-1. ----------------------------------

Declare supported ECCS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from feature(s) inoperable discovery of loss when its redundant of initiation feature ECCS initiation capability for capability is inoperable. subsystems in both divisions AND E.2 Restore channel to 7 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3-39 Amendment No. 213 213, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and Depressurization System discovery of loss referenced in (ADS) valves inoperable. of ADS initiation Table 3.3.5.1-1. capability in both trip systems AND F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable OR In accordance with the Risk Informed Completion Time Program AND 8 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3-40 Amendment No. 213, ___

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. As required by Required G.1 Declare ADS valves 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and inoperable. discovery of loss referenced in of ADS initiation Table 3.3.5.1-1. capability in both trip systems AND G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable OR In accordance with the Risk Informed Completion Time Program AND 8 days OR In accordance with the Risk Informed Completion Time Program H. Required Action and H.1 Declare associated Immediately associated Completion supported ECCS Time of Condition B, C, feature(s) inoperable.

D, E, F, or G not met.

BFN-UNIT 3 3.3-41 Amendment No. 213, ___

RCIC System Instrumentation 3.3.5.

3.3 INSTRUMENTATION 3.3.5. Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5. The RCIC System instrumentation for each Function in Table 3.3.5.-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.-1 for the channel.

B. As required by Required B.1 Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from Action A.1 and inoperable. discovery of loss referenced in of RCIC initiation Table 3.3.5.-1. capability AND B.2 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3- Amendment No. 213 213,

___

Primary Containment Isolation Instrumentation 3.3.6.1 ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 --------------NOTE------------

channels inoperable. Only applicable for Function 1.d if two or more channels are inoperable.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c OR In accordance with the Risk Informed Completion Time Program AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.b, 5.h, 6.b, and 6.c OR In accordance with the Risk Informed Completion Time Program AND A.2 --------------NOTE------------

Only applicable for Function 1.d when 15 of 16 channels are OPERABLE.

Place channel in trip. 30 days (continued)

BFN-UNIT 3 3.3-5 Amendment No. 213, 213 ___

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION 3.3.8.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Table 3.3.8.1-1 Function on 4 kV shutdown boards 3EA, 3EB, 3EC, and 3ED shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, When the associated diesel generator is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE---------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One degraded voltage A.1 Verify by administrative Immediately relay channel inoperable means that the other two on one or more shutdown degraded voltage relay board(s). channels and associated timers on the affected AND shutdown board(s) are OPERABLE.

The loss of voltage relay channels on the affected AND shutdown board(s) are OPERABLE. A.2 Place the degraded 15 days voltage relay channel in trip. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.3-7 Amendment No. 213, ___

ECCS - Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)539:$7(5,19(1725<

&21752/$1'5($&725&25(ISOLATION COOLING (RCIC) SYSTEM 3.5.1 ECCS - Operating LCO 3.5.1 Each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS) function of six safety/relief valves shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3, except high pressure coolant injection (HPCI) and ADS valves are not required to be OPERABLE with reactor steam dome pressure d 150 psig.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to HPCI.

CONDITION REQUIRED ACTION COMPLETION TIME A. One low pressure ECCS A.1 Restore low pressure 7 days injection/spray subsystem ECCS injection/spray inoperable. subsystem(s) to OR OPERABLE status.

OR In accordance with WKHRisk One low pressure coolant Informed injection (LPCI) pump in Completion Time both LPCI subsystems Program inoperable.

B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (continued)

BFN-UNIT 3 3.5-1 Amendment No. 212, 229, 244,

___

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. HPCI System inoperable. C.1 Verify by administrative Immediately means RCIC System is OPERABLE.

AND C.2 Restore HPCI System to 14 days OPERABLE status.

OR In accordance with WKHRisk Informed Completion Time Program D. HPCI System inoperable. D.1 Restore HPCI System to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

AND OR Condition A entered. In accordance with WKHRisk Informed Completion Time Program OR D.2 Restore low pressure 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ECCS injection/spray subsystem to OPERABLE OR status.

In accordance with WKHRisk Informed Completion Time Program (continued)

BFN-UNIT 3 3.5- Amendment No.

2, ___

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One ADS valve E.1 Restore ADS valve to 14 days inoperable. OPERABLE status.

OR In accordance with WKHRisk Informed Completion Time Program F. One ADS valve F.1 Restore ADS valve to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

OR AND In accordance Condition A entered. with WKHRisk Informed Completion Time Program OR F.2 Restore low pressure 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ECCS injection/spray subsystem to OPERABLE OR status.

In accordance with WKHRisk Informed Completion Time Program (continued)

BFN-UNIT 3 3.5-2D Amendment No. ___

RCIC System 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)539:$7(5,19(1725<

&21752/$1'5($&725&25(ISOLATION COOLING (RCIC) SYSTEM 3.5.3 RCIC System LCO 3.5.3 The RCIC System shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE--------------------------------------------------

LCO 3.0.4.b is not applicable to RCIC.

CONDITION REQUIRED ACTION COMPLETION TIME A. RCIC System inoperable. A.1 Verify by administrative Immediately means High Pressure Coolant Injection System is OPERABLE.

AND A.2 Restore RCIC System to 14 days OPERABLE status.

OR In accordance with WKHRisk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND B.2 Reduce reactor steam 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months dome pressure to d 150 psig.

BFN-UNIT 3 3.5-12 Amendment No. 212 212, 244, ___

Primary Containment Air Lock 3.6.1.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed.

AND B.3 --------------NOTE------------

Air lock doors in high radiation areas or areas with limited access due to inerting may be verified locked closed by administrative means.

Verify an OPERABLE door Once per 31 days is locked closed.

C. Primary containment air C.1 Initiate action to evaluate Immediately lock inoperable for reasons primary containment other than Condition A or overall leakage rate per B. LCO 3.6.1.1, using current air lock test results.

AND C.2 Verify a door is closed. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with WKHRisk Informed Completion Time Program (continued)

BFN-UNIT 3 3.6-6 Amendment No. 212, ___

PCIVs 3.6.1.3 ACTIONS FRQWLQXHG CONDITION REQUIRED ACTION COMPLETION TIME A. --------------NOTE------------ A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by main steam line penetration flow paths use of at least one closed and de-activated OR with two PCIVs.

automatic valve, closed In accordance manual valve, blind with the Risk One or more penetration flange, or check valve Informed flow paths with one PCIV with flow through the Completion Time inoperable except due to valve secured. Program MSIV leakage not within limits. AND 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam line OR In accordance with the Risk Informed Completion Time Program AND (continued)

BFN-UNIT 3.6-10 Amendment No. 2,

2 ___

PCIVs 3.6.1.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------------NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 penetration flow path is days >following isolated. isolation@ for isolation devices outside primary containment AND Prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days, for isolation devices inside primary containment (continued)

BFN-UNIT 3 3.6-11 Amendment No. 212, ___

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------------NOTE------------ B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Only applicable to penetration flow path by penetration flow paths use of at least one closed with two PCIVs. and de-activated

automatic valve, closed manual valve, or blind One or more penetration flange.

flow paths with two PCIVs inoperable except due to MSIV leakage not within limits.

C. --------------NOTE------------ C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by excess flow check penetration flow paths use of at least one closed valves (EFCVs) with only one PCIV. and de-activated

automatic valve, closed AND manual valve, or blind One or more penetration flange. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for flow paths with one PCIV EFCVs inoperable. AND C.2 --------------NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is >following isolation@

isolated.

(continued)

BFN-UNIT 3 3.6-12 Amendment No. 212, ___

RHR Suppression Pool Cooling 3.6.2.3 3.6 CONTAINMENT SYSTEMS 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling LCO 3.6.2.3 Four RHR suppression pool cooling subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool cooling subsystem suppression pool cooling inoperable. subsystem to OPERABLE status.

B. Two RHR suppression B.1 Restore one RHR 7 days pool cooling subsystems suppression pool cooling inoperable. subsystem to OPERABLE OR status.

In accordance with WKHRisk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool cooling suppression pool cooling subsystems inoperable. subsystems to OPERABLE status.

(continued)

BFN-UNIT 3 3.6-31 Amendment No. 212, 230, ___

RHR Suppression Pool Spray 3.6.2.4 3.6 CONTAINMENT SYSTEMS 3.6.2.4 Residual Heat Removal (RHR) Suppression Pool Spray LCO 3.6.2.4 Four RHR suppression pool spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore the RHR 30 days pool spray subsystem suppression pool spray inoperable. subsystem to OPERABLE status.

B. Two RHR suppression B.1 Restore one RHR 7 days pool spray subsystems suppression pool spray inoperable. subsystem to OPERABLE OR status.

In accordance with WKHRisk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months suppression pool spray suppression pool spray subsystems inoperable. subsystems to OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 3 3.6-34 Amendment No. 212, ___

RHR Drywell Spray 3.6.2.5 3.6 CONTAINMENT SYSTEMS 3.6.2.5 Residual Heat Removal (RHR) Drywell Spray LCO 3.6.2.5 Four RHR drywell spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR drywell spray A.1 Restore the RHR drywell 30 days subsystem inoperable. spray subsystem to OPERABLE status.

B. Two RHR drywell spray B.1 Restore one RHR drywell 7 days subsystems inoperable. spray subsystem to OPERABLE status. OR In accordance with WKHRisk Informed Completion Time Program C. Three or more RHR C.1 Restore required RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months drywell spray subsystems drywell spray subsystems inoperable. to OPERABLE status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months BFN-UNIT 3 3.6-36 Amendment No. 212, ___

RHRSW System 3.7.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One RHRSW subsystem B.1 -------------NOTE-------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling - Hot Shutdown," for RHR shutdown cooling made inoperable by the RHRSW system.

Restore RHRSW subsystem 30 days to OPERABLE status.

C. Two required RHRSW C.1 Restore one inoperable 7 days pumps inoperable. RHRSW pump to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program D. Two RHRSW subsystems D.1 -------------NOTE-------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, for RHR shutdown cooling made inoperable by the RHRSW System.

Restore one RHRSW 7 days subsystem to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.7-3 Amendment No. 214, 283, ___

EECW System and UHS 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Equipment Cooling Water (EECW) System and Ultimate Heat Sink (UHS)

LCO 3.7.2 The EECW System with three pumps and UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required EECW A.1 Restore the required 7 days pump inoperable. EECW pump to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Two or more required EECW pumps inoperable.

OR UHS inoperable.

BFN-UNIT 3 3.7-7 Amendment No. 214, ___

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no offsite discovery of no power available offsite power to inoperable when the one shutdown redundant required board concurrent feature(s) are inoperable. with inoperability of redundant required feature(s)

AND A.3 Restore required offsite 7 days circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One required Unit 3 DG B.1 Verify power availability 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. from the offsite transmission network. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

BFN-UNIT 3 3.8-2 Amendment No. 266, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.5 Restore Unit 3 DG to 7 days from OPERABLE status. discovery of unavailability of TDG(s)

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of Condition B entry 6 days concurrent with unavailability of TDG(s)

AND 14 days OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.8-3a Amendment No. 266, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One division of 480 V C.1 Restore required division 7 days load shed logic of 480 V load shed logic inoperable. to OPERABLE status.

D. One division of common D.1 Restore required division 7 days accident signal logic of common accident inoperable. signal logic to OPERABLE status.

E. Two required offsite E.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) inoperable discovery of when the redundant Condition E required feature(s) are concurrent with inoperable. inoperability of redundant AND required feature(s)

E.2 Restore one required KRXUV offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program FRQWLQXHG BFN-UNIT 3.8-4 Amendment No. 2, ___

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE------------- -------------------NOTE----------------

Only applicable when more than Enter applicable Conditions and one 4.16 kV shutdown board is Required Actions of LCO 3.8.7, affected. "Distribution Systems - Operating,"

when Condition F is entered with no AC power source to any 4.16 kV F. One required offsite circuit shutdown board.

inoperable. --------------------------------------------

AND F.1 Restore required offsite 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months circuit to OPERABLE status.

One Unit 3 DG inoperable. OR In accordance with the Risk Informed Completion Time Program OR F.2 Restore Unit 3 DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program

NOTE-------------

Applicable when only one 4.16 kV shutdown board is affected.

G. One required offsite circuit G.1 Declare the affected 4.16 kV Immediately inoperable. shutdown board inoperable.

AND One Unit 3 DG inoperable.

(continued)

BFN-UNIT 3 3.8-5 Amendment No. 212, ___

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The following DC electrical power systems shall be OPERABLE:

a. Unit DC subsystems 1, 2, and 3;

b. Shutdown Board DC subsystems 3EB;

c. Unit 3 Diesel Generator (DG) DC subsystems;

d. Unit 1 and 2 DG DC subsystem(s) supporting DG(s) required to be OPERABLE by LCO 3.8.1, "AC Sources Operating"; and

e. Unit 1 and 2 Shutdown Board DC subsystems needed to support equipment required to be OPERABLE by LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," and LCO 3.7.3, "Control Room Emergency Ventilation (CREV) System."

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit DC electrical A.1 Restore DC electrical 7 days power subsystem power subsystem to inoperable. OPERABLE status. OR OR In accordance with the Risk 3EB Shutdown Board DC Informed electrical power Completion Time subsystem inoperable. Program (continued)

BFN-UNIT 3 3.8-22 Amendment No. 212, ___

Distribution Systems - Operating 3.8.7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Unit 3 4.16 kV -------------------NOTE----------------

Shutdown Board Enter applicable Conditions and inoperable. Required Actions of Condition B, C, D, and G when Condition A results in no power source to a required 480 volt board.

A.1 Restore the Unit 3 5 days 4.16 kV Shutdown Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program AND A.2 Declare associated diesel Immediately generator inoperable.

(continued)

BFN-UNIT 3 3.8-34 Amendment No. 212, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One Unit 3 480 V -------------------NOTE----------------

Shutdown Board Enter Condition C when inoperable. Condition B results in no power source to 480 volt RMOV board OR 3D or 3E.

480 V RMOV Board 3A inoperable. B.1 Restore Board to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OPERABLE status.

OR OR In accordance 480 V RMOV Board 3B with the Risk inoperable. Informed Completion Time Program C. Unit 3 480 V RMOV C.1 Declare the affected RHR Immediately Board 3D inoperable. subsystem inoperable.

OR Unit 3 480 V RMOV Board 3E inoperable.

D. One Unit 3 DG Auxiliary D.1 Restore Unit 3 DG 5 days Board inoperable. Auxiliary Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 3 3.8-35 Amendment No. 212, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. One Unit DC Board E.1 Restore required Board or 7 days inoperable. Shutdown Board DC Distribution Panel 3EB to OR OR OPERABLE status.

In accordance Shutdown Board DC with the Risk Distribution Panel 3EB Informed inoperable. Completion Time Program OR 250 V DC RMOV Board 3A inoperable.

OR 250 V DC RMOV Board 3B inoperable.

OR 250 V DC RMOV Board 3C inoperable.

(continued)

BFN-UNIT 3 3.8-36 Amendment No. 212, ___

Distribution Systems - Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. Unit 3 4.16 kV Shutdown -------------------NOTE----------------

Board 3EA and 3EB Enter applicable conditions and inoperable. required actions of Condition B, C, D, and G when Condition F OR results in no power source to a required 480 volt board.

Unit 3 4.16 kV Shutdown --------------------------------------------

Board 3EC and 3ED inoperable. F.1 Restore one 4.16 kV 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Shutdown Board to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program G. One or more required G.1 Declare the affected SGT Immediately Unit 1 or 2 AC or DC or CREV subsystem Boards inoperable. inoperable.

H. Required Action and H.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, AND D, E, or F not met.

H.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months I. Two or more electrical I.1 Enter LCO 3.0.3. Immediately power distribution subsystems inoperable that result in a loss of function.

BFN-UNIT 3 3.8-37 Amendment No. 212, ___

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.15 Surveillance Frequency Control Program (continued)

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk- Informed Method for Control of Surveillance Frequencies,"

Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

5.5.16 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines."

The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1, 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

BFN-UNIT 3 5.0-21c Amendment No. 298, ___

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.16 Risk Informed Completion Time Program (continued)

3. Revising the RICT is not required Lf the plant configuration change would lower plant risk and would result in a longer RICT.

G For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

Numerically accounting for the increased possibility of CCF in the RICT calculation; or

Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

H 7KHULVNDVVHVVPHQWDSSURDFKHVDQGPHWKRGVVKDOOEH

DFFHSWDEOHWRWKH15&7KHSODQW35$VKDOOEHEDVHGRQWKHDV

EXLOWDVRSHUDWHGDQGPDLQWDLQHGSODQWDQGUHIOHFWWKHRSHUDWLQJ

H[SHULHQFHDWWKHSODQWDVVSHFLILHGLQ5HJXODWRU\*XLGH

5HYLVLRQ0HWKRGVWRDVVHVVWKHULVNIURPH[WHQGLQJWKH

&RPSOHWLRQ7LPHVPXVWEH35$PHWKRGVDSSURYHGIRUXVHZLWK

WKLVSURJUDPRURWKHUPHWKRGVDSSURYHGE\WKH15&IRUJHQHULF

XVHDQGDQ\FKDQJHLQWKH35$PHWKRGVWRDVVHVVULVNWKDWDUH

RXWVLGHWKHVHDSSURYDOERXQGDULHVUHTXLUHSULRU15&DSSURYDO

BFN-UNIT 3 5.0-21d Amendment No. 298, ___

Attachment 4 Proposed Technical Specification Bases Changes (BFN Unit 1 - For Information Only)

(43 total pages)

CNL-21-009

SLC System B 3.1.7 BASES (continued)

APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to ensure that the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System shutdown capability is not required to be OPERABLE when only a single control rod can be withdrawn.

In MODES 1, 2, and 3, the SLC System must be OPERABLE to ensure offsite doses remain within 10 CFR 50.67, Accident Source Term, limits following a LOCA involving significant fission product releases. The SLC System is used to maintain suppression pool pH above 7 following a LOCA to ensure iodine is retained in the suppression pool water.

or in accordance with the Risk Informed Completion Time Program ACTIONS A.1 If one SLC subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to perform the shutdown function. However, the overall reliability is reduced because a single failure in the remaining OPERABLE subsystem could result in reduced SLC System shutdown capability. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the intended SLC System function and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive (CRD)

System to shut down the plant.

(continued)

BFN-UNIT 1 B 3.1-50 Revision 0, 29 January 25, 2005

RPS Instrumentation B 3.3.1.1 BASES ACTIONS A.1 and A.2 (continued)

Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref. 9 and 12) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only Alternatively, a Completion Time can be determined in acceptable provided the associated Function's inoperable accordance with the Risk channel is in one trip system and the Function still maintains Informed Completion Time RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Program.

Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram),

Condition D must be entered and its Required Action taken.

As noted, Action A.2 is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of one required APRM channel affects both trip systems. For that condition, Required Action A.1 must be satisfied, and is the only action (other than restoring operability) that will restore capability to accommodate a single failure.

Inoperability of more than one required APRM channel of the same trip function results in loss of trip capability and entry into Condition C, as well as entry into Condition A for each channel.

(continued)

BFN-UNIT 1 B 3.3-30 Revision 0, 40, 45 February 27, 2007

RPS Instrumentation B 3.3.1.1 Alternatively, a Completion BASES Time can be determined in accordance with the Risk Informed Completion Time Program.

ACTIONS B.1 and B.2 (continued)

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram or RPT), Condition D must be entered and its Required Action taken.

As noted, Condition B is not applicable for APRM Function 2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of an APRM channel affects both trip systems and is not associated with a specific trip system as are the APRM 2-out-of-4 voter and other non-APRM channels for which Condition B applies. For an inoperable APRM channel, Required Action A.1 must be satisfied, and is the only action (other than restoring operability) that will restore capability to accommodate a single failure. Inoperability of a Function in more than one required APRM channel results in loss of trip capability for that Function and entry into Condition C, as well as entry into Condition A for each channel. Because Conditions A and C provide Required Actions that are appropriate for the inoperability of APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f, and these functions are not associated with specific trip systems as are the APRM 2-out-of-4 voter and other non-APRM channels, Condition B does not apply.

(continued)

BFN-UNIT 1 B 3.3-32 Revision 0, 40, 45 February 27, 2007

Feedwater and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS A.1 (continued) within the Completion Time, the channel(s) must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the inoperable channel(s) in trip would result in a feedwater or main turbine trip), Condition C must be entered and its Required Action taken.

The Completion Time of 7 days is based on the low probability of the event occurring coincident with a single failure in a remaining OPERABLE channel.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time B.1 Program.

With one or more channels inoperable in each trip system, the feedwater and main turbine high water level trip instrumentation cannot perform its design function (feedwater and main turbine high water level trip capability is not maintained). Therefore, continued operation is only permitted for a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period, during which feedwater and main turbine high water level trip capability must be restored. The trip capability is considered maintained when sufficient channels are OPERABLE or in trip such that the feedwater and main turbine high water level trip logic will generate a trip signal on a valid signal. This requires that two channels in one trip system be OPERABLE or in trip. If the required channels cannot be restored to OPERABLE status or placed in trip, Condition C must be entered and its Required Action taken.

(continued)

BFN-UNIT 1 B 3.3-76 Revision 0

ATWS-RPT Instrumentation B 3.3.4.2 BASES ACTIONS A.1 and A.2 (continued) compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Condition D must be entered and its Required Actions taken.

Alternatively, a Completion Time can be determined in accordance with the Risk B.1 Informed Completion Time Program.

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability. A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires one channel of the Function in each trip system to be OPERABLE or in trip, and the recirculation pump motor breakers to be OPERABLE or in trip.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and that one Function is still maintaining ATWS-RPT trip capability.

(continued)

BFN-UNIT 1 B 3.3-123 Revision 0

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that redundant features in the same system (e.g.,

both CS subsystems) cannot be automatically initiated due to inoperable, untripped channels within the same Function as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCI System cannot be automatically initiated due to inoperable, untripped channels within the same Function as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of Alternatively, a Completion service time, the channel must be placed in the tripped condition Time can be determined in per Required Action B.3. Placing the inoperable channel in trip accordance with the Risk Informed Completion Time would conservatively compensate for the inoperability, restore Program. capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.

(continued)

BFN-UNIT 1 B 3.3-162 Revision 0

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2 (continued)

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time D.1 Program.

Required Action D.1 is intended to ensure that appropriate actions are taken if an inoperable, untripped channel within the same Function results in a complete loss of automatic component initiation capability for the HPCI System. Since Table 3.3.5.1-1 only requires one channel to be OPERABLE, automatic component initiation capability is lost if the one required Function 3.d channel or the one required Function 3.e channel is inoperable and untripped. In this situation (loss of automatic suction swap), the HPCI system must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . As noted, Required Action D.1 is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

(continued)

BFN-UNIT 1 B 3.3-165 Revision 0

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued)

Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the Core Spray Pump Discharge Flow - Low Bypass Function results in redundant automatic initiation capability being lost for the feature(s). Automatic initiation capability of the Core Spray Pump Discharge Flow - Low (Bypass) Function in both CS subsystems is lost if two Function 1.d channels are inoperable.

In this situation (loss of capability for both subsystems), the 7 day allowance of Required Action E.2 is not appropriate and the subsystem associated with each inoperable channel must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Since each inoperable channel would have Required Action E.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected CS pump to be declared inoperable.

However, since channels for both CS subsystems are inoperable, and the completion times started concurrently for both channels this results in all four CS pumps being concurrently declared inoperable. A Note is provided (the Note to Required Action E.1) to delineate that Required Action E.1 is only applicable to Function 1.d. Required Action E.1 is not applicable to HPCI Function 3.f since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 4 and considered acceptable for the 7 days allowed by Required Action E.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

(continued)

BFN-UNIT 1 B 3.3-166 Revision 0, 125 January 26, 2022

ECCS Instrumentation Alternatively, a Completion B 3.3.5.1 Time can be determined in accordance with the Risk Informed Completion Time BASES Program.

or in accordance with the ACTIONS F.1 and F.2 (continued) Risk Informed Completion Time Program Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE. If either HPCI or RCIC is inoperable, the time is shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability.

However, the total time for an inoperable, untripped channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action F.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.

(continued)

BFN-UNIT 1 B 3.3-169 Revision 0

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS G.1 and G.2 (continued)

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE (Required Action G.2). If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to Alternatively, a Completion 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC Time can be determined in accordance with the Risk inoperability. However, the total time for an inoperable channel Informed Completion Time cannot exceed 8 days. If the status of HPCI or RCIC changes Program.

such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins or in accordance with the upon discovery of the inoperable channel. If the inoperable Risk Informed Completion channel cannot be restored to OPERABLE status within the Time Program allowable out of service time, Condition H must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

H.1 With any Required Action and associated Completion Time not met, the associated feature(s) may be incapable of performing the intended function, and the supported feature(s) associated with inoperable untripped channels must be declared inoperable immediately.

(continued)

BFN-UNIT 1 B 3.3-171 Revision 0

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS B.1 and B.2 (continued)

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. For conservatism, in some transient analyses, RCIC flow rates were used rather than HPCI flow Alternatively, a Completion Time can be determined in rates. If the inoperable channel cannot be restored to accordance with the Risk OPERABLE status within the allowable out of service time, the Informed Completion Time channel must be placed in the tripped condition per Required Program.

Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition D must be entered and its Required Action taken.

C.1 A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 1) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1) limiting the allowable out of service time, if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level - High, Level 8 Function whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability. As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable. The Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events.

(continued)

BFN-UNIT 1 B 3.3-182 Revision 0, 125 January 26, 2022

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS A.1 and A.2 (continued)

Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 2.a, 2.b, 5.h, 6.b, and 6.c; and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.b, 5.h, 6.b, and 6.c has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. Required Actions A.1 and A.2 are modified by Notes that specify the Applicability of the Required Actions for Function 1.d when 15 of 16 channels are OPERABLE.

Required Action A.2 provides an allowable out of service time of 30 days for Function 1.d when 15 of 16 channels are OPERABLE. This has been shown to be acceptable (Ref. 9) to permit restoration of the one inoperable channel to OPERABLE status. These out of service times are only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable Alternatively, a Completion out of service time, the channel must be placed in the tripped Time can be determined in condition per Required Action A.1 or A.2. Placing the accordance with the Risk Informed Completion Time inoperable channel in trip would conservatively compensate for Program. the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Action taken.

(continued)

BFN-UNIT 1 B 3.3-212 Revision 0

LOP Instrumentation B 3.3.8.1 BASES (continued)

ACTIONS A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.

A.1 and A.2 With one of the degraded voltage relay channels inoperable on one or more shutdown boards and with the loss of voltage relay channels on the affected shutdown board(s) OPERABLE, Required Action A.2 provides a 15 day allowable out of service time to restore the relay channel to OPERABLE status provided the other two degraded voltage relay channels and associated Alternatively, a Completion timers are OPERABLE. Immediate verification of the Time can be determined in OPERABILITY of the other degraded voltage relay channels accordance with the Risk Informed Completion Time and associated timers is therefore required (Required Action Program. A.1). This may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, (continued)

BFN-UNIT 1 B 3.3-258 Revision 0

ECCS - Operating B 3.5.1 BASES or in accordance with the Risk ACTIONS A.1 Informed Completion Time Program (continued)

If any one low pressure ECCS injection/spray subsystem is inoperable, or if one LPCI pump in both LPCI subsystems is inoperable, the inoperable subsystem(s) must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function.

(continued)

BFN-UNIT 1 B 3.5-8a Amendment No. 249 December 1, 2003

ECCS - Operating B 3.5.1 BASES ACTIONS A.1 (continued)

The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

B.1 and B.2 If the inoperable low pressure ECCS subsystem cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

or in accordance with the Risk C.1 and C.2 Informed Completion Time Program If the HPCI System is inoperable and the RCIC System is immediately verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS.

Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Immediate verification of RCIC OPERABILITY is therefore required when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is (continued)

BFN-UNIT 1 B 3.5-9 Revision 0

ECCS - Operating B 3.5.1 BASES ACTIONS C.1 and C.2 (continued) out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be verified, however, Condition G must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

or in accordance with the Risk D.1 and D.2 Informed Completion Time Program If any one low pressure ECCS injection/spray subsystem, or if one LPCI pump in both LPCI subsystems, is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, adequate core cooling is ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since both a high pressure system (HPCI) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

(continued)

BFN-UNIT 1 B 3.5-10 Amendment No. 240 Revision 0 March 12, 2001

ECCS - Operating B 3.5.1 BASES ACTIONS E.1 (continued)

The LCO requires six ADS valves to be OPERABLE in order to provide the ADS function. Reference 13 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only five ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced, because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

Alternatively, a Completion Time can be determined in accordance with the Risk F.1 and F.2 Informed Completion Time Program.

If any one low pressure ECCS injection/spray subsystem, or one LPCI pump in both LPCI subsystems, is inoperable in addition to one inoperable ADS valve, adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS injection/spray subsystem. However, overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA could result in the minimum required ECCS equipment not being available. Since both a high pressure system (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the low pressure ECCS subsystem or the ADS valve to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

(continued)

BFN-UNIT 1 B 3.5-11 Amendment No. 240 Revision 0 March 12, 2001

RCIC System B 3.5.3 BASES ACTIONS A.1 and A.2 or in accordance with the Risk Informed Completion Time Program (continued)

If the RCIC System is inoperable during MODE 1, or MODE 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCI System is immediately verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days.

In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high reactor pressure since the HPCI System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of HPCI is therefore immediately verified when the RCIC System is inoperable. This may be performed as an administrative check, by examining logs or other information, to determine if HPCI is out of service for maintenance or other reasons. It does not mean it is (continued)

BFN-UNIT 1 B 3.5-32a Amendment No. 249 December 1, 2003

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS C.1, C.2, and C.3 (continued)

If the air lock is inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results.

An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), primary containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with the overall air lock leakage not within limits, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the primary containment air lock must be verified closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock.

or in accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 B 3.6-14 Revision 0

PCIVs B 3.6.1.3 BASES or in accordance with the Risk ACTIONS A.1 and A.2 Informed Completion Time Program (continued)

With one or more penetration flow paths with one PCIV inoperable except for inoperability due to MSIV leakage not within limits, the affected penetration flow paths must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available valve to the primary containment. The Required Action must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam lines). The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. For main steam lines, an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is allowed. The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the main steam lines allows a period of time to restore the Alternatively, a Completion MSIVs to OPERABLE status given the fact that MSIV closure Time can be determined in will result in isolation of the main steam line(s) and a potential accordance with the Risk for plant shutdown.

Informed Completion Time Program.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path(s) must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not (continued)

BFN-UNIT 1 B 3.6-24 Revision 0

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2 (continued) [following isolation]

require any testing or device manipulation. Rather, it involves verification that those devices outside containment and capable of potentially being mispositioned are in the correct position.

The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4, if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility.

Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas, and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment once they have been verified to be in the proper position, is low.

(continued)

BFN-UNIT 1 B 3.6-25 Revision 0

PCIVs B 3.6.1.3 BASES ACTIONS C.1 and C.2 (continued) valve (EFCV) lines and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for EFCV lines. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable considering the instrument and the small pipe diameter of penetration (hence, reliability) to act as a penetration isolation boundary and the small pipe diameter of the affected penetrations. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident are isolated. [following isolation]

The Completion Time of once per 31 days for verifying each affected penetration is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low. Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one PCIV. For penetration flow paths with two PCIVs, Conditions A and B provide the appropriate Required Actions.

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is low.

(continued)

BFN-UNIT 1 B 3.6-27 Revision 0

RHR Suppression Pool Cooling B 3.6.2.3 BASES or in accordance with the Risk ACTIONS B.1 Informed Completion Time Program (continued)

With two RHR suppression pool cooling subsystems inoperable, at least one inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining two RHR suppression pool cooling subsystems are adequate to perform the primary containment cooling function.

However, the overall reliability is reduced because a single failure could result in reduced or no primary containment cooling capability depending upon whether the two OPERABLE subsystems are in separate loops or the same loop. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the two OPERABLE subsystems and the low probability of a DBA occurring during this period.

C.1 With three or more RHR suppression pool cooling subsystems inoperable, the required subsystems must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from the primary containment are available.

(continued)

BFN-UNIT 1 B 3.6-71 Amendment No. 241 Revision 0 June 8, 2001

RHR Suppression Pool Spray B 3.6.2.4 BASES (continued)

ACTIONS A.1 With one RHR suppression pool spray subsystem inoperable, the inoperable system must be restored to OPERABLE status within 30 days. In this condition, any two of the remaining three RHR suppression pool spray subsystems are adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the loop with two OPERABLE subsystems could result in reduced primary containment cooling capability. Because of the availability of equipment in excess of normal redundancy requirements, a 30 day Completion Time is acceptable.

or in accordance with the Risk B.1 Informed Completion Time Program With two RHR suppression pool spray subsystems inoperable, at least one inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining two OPERABLE RHR suppression pool spray subsystems are adequate to perform the primary containment bypass leakage mitigation function. However, the overall reliability is reduced because a single failure could result in reduced or no primary containment bypass mitigation capability, depending upon whether the two OPERABLE subsystems are in separate loops or the same loop. The 7 day Completion Time was chosen in light of the redundant RHR suppression pool spray capabilities afforded by the OPERABLE subsystems and the low probability of a DBA occurring during this period.

(continued)

BFN-UNIT 1 B 3.6-77 Revision 0

RHR Drywell Spray B 3.6.2.5 BASES or in accordance with the Risk ACTIONS B.1 Informed Completion Time Program (continued)

With two RHR drywell spray subsystems inoperable, at least one inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE RHR drywell spray subsystems are adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure could result in reduced primary containment cooling capability, depending upon whether the two OPERABLE subsystems are in separate loops or in the same loop. The 7 day Completion Time was chosen in light of the redundant RHR drywell spray capabilities afforded by the OPERABLE subsystems and the low probability of a DBA occurring during this period.

C.1 With three or more RHR drywell spray subsystems inoperable, required subsystems must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss of the primary containment cooling function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.

(continued)

BFN-UNIT 1 B 3.6-83 Revision 0

RHRSW System B 3.7.1 BASES ACTIONS C.1 (continued)

With two required RHRSW pumps inoperable (i.e., one required RHRSW pump inoperable in each of two separate RHRSW subsystems or two RHRSW pumps inoperable in the same RHRSW subsystem), the remaining RHRSW pumps are adequate to perform the RHRSW heat removal function.

However, the overall reliability is reduced because a single failure of the OPERABLE RHRSW pumps could result in a loss of RHRSW function. The seven day Completion Time is based on the redundant RHRSW capabilities afforded by the OPERABLE RHRSW pumps and the low probability of an event occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk D.1 Informed Completion Time Program.

With two RHRSW subsystems inoperable (e.g., two RHR heat exchangers inoperable) for reasons other than inoperable RHRSW pumps, which are covered b separate Conditions, the remaining OPERABLE RHRSW subsystems are adequate to perform the RHRSW heat removal function. However, the overall reliability is reduced because a single failure could result in reduced primary containment cooling capability. The seven day Completion Time is based on the availability of equipment in excess of normal redundancy requirements and the low probability of an event occurring requiring RHRSW during this period.

The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.7 be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

(continued)

BFN-UNIT 1 B 3.7-7 Revision 0, 73 January 3, 2013

EECW System and UHS B 3.7.2 BASES or in accordance with the Risk ACTIONS A.1 Informed Completion Time Program With one required EECW pump inoperable, the required EECW pump must be restored to OPERABLE status within 7 days.

With the system in this condition, the remaining OPERABLE EECW pumps are adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the EECW System could result in loss of EECW function.

(continued)

BFN-UNIT 1 B 3.7-13a Revision 0, 111 February 7, 2018

AC Sources - Operating B 3.8.1 BASES ACTIONS A.2 (continued)

The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

or in accordance with the Risk Informed Completion Time Program A.3 Based on the diversity of AC electrical power sources, and the remaining redundancy and reliability, operation may continue in Condition A for a period that should not exceed 7 days. With one required offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

(continued)

BFN-UNIT 1 B 3.8-13 Revision 0

AC Sources - Operating B 3.8.1 BASES ACTIONS A.3 (continued)

The second Completion Time for Required Action A.3 A3 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition A is entered while, LCO while for instance, instance a DG is inoperable, and that DG is subsequently returned OPERABLE inoperable OPERABLE, the LCO may already have been not met for up to 14 days. days This situation could lead to a total of 21 days, days since initial failure to meet the LCO, LCO to restore the offsite circuit.

circuit At this time time, a DG inoperable, the circuit restored could again become inoperable OPERABLE, and an additional 14 days (for a total of 35 days)

OPERABLE allowed prior to complete restoration of the LCOLCO. The 21 day Completion Time provides a limit on the time allowed in a LCO.

specified condition after discovery of failure to meet the LCO This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

concurrently The "AND"AND connector between the 7 day and 21 day Completion Times means that both Completion Times apply simultaneously simultaneously, and the more restrictive Completion Time must be met met.

As in Required Action A.2, A 2 the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time zero outage time "clock."

clock This exception results in establishing the "time zero" at the time the LCO was initially not met time zero met, instead of at the time that Condition A was entered.

entered (continued)

BFN-UNIT 1 B 3.8-14 Revision 0, Amendment 280 October 5, 2011

AC Sources - Operating B 3.8.1 BASES ACTIONS B.5 (continued)

Based on the diversity of AC electrical power sources, and the remaining redundancy and reliability, operation may continue in Condition B for a period that should not exceed 14 days if both TDGs are available. If one or both TDGs are or become unavailable with an inoperable DG, then action is required to restore both TDGs to available status or to restore the DG to OPERABLE status within 7 days from discovery of an unavailable TDG. However, if the TDG unavailability occurs sometime after 6 days of continuous DG inoperability, then the remaining time to restore both TDGs to available status or to restore the DG to OPERABLE status is limited to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The 7 day and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Times allow for an exception to the normal time zero for beginning the allowed outage time clock. The 7 day Completion Time only begins on discovery that both:

a) An inoperable Unit 1 and 2 DG exists; and b) One or both TDGs are unavailable.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time only beings on discovery that:

a) An inoperable Unit 1 and Unit 2 DG exists for > 6 days; and b) One or both TDGs are unavailable.

Therefore, when one required DG is inoperable due to preplanned maintenance (preventive or corrective) work, the Completion Time can be extended from 7 days to 14 days if both TDGs are verified available for backup operation.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

(continued)

BFN-UNIT 1 B 3.8-18 Revision 0, Amendment 280 October 5, 2011

AC Sources - Operating B 3.8.1 BASES ACTIONS B.5 (continued)

(continued)

In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 14 day Completion Time takes into account the capacity and capability of the remaining AC sources (including TDGs), reasonable time for repairs, and low probability of a DBA occurring during this period.

The fourth Completion Time me for Required Action B Tim B.5 5 establishes a limit on the e maximum time allowed for any combination of Alternatively, a Completion required AC power sources to be inoperable during any single Time can be determined in contiguous occurrence of failing to meet the LCO LCO. If accordance with the Risk Informed Completion Time Condition B is entered while, while for instance, instance an offsite circuit is Program. inoperable and that circuit is subsequently restored OPERABLE, OPERABLE the LCO may already have been not met for up to 7 days.

days This situation could lead to a total of 21 days, days since initial failure to meet the LCO LCO, to restore the DG DG. At this time time, an offsite circuit could again become inoperable inoperable, the DG restored OPERABLE, OPERABLE and an additional 7 days (for a total of 28 days) allowed prior to complete restoration of the LCO LCO. The 21 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCOLCO.

This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

concurrently The "AND" AND connector between the 14 day and 21 day Completion Times means that both Completion Times apply simultaneously simultaneously, and the more restrictive must be met met.

As in Required Action B.3,B 3 the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time zero outage time "clock."

clock This exception results in establishing the "time zero" at the time that the LCO was initially not met time zero met, instead of the time that Condition B was entered.

entered (continued)

BFN-UNIT 1 B 3.8-18a Revision 0, Amendment 280 October 5, 2011

AC Sources - Operating B 3.8.1 BASES ACTIONS E.1 and E.2 (continued)

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

Alternatively, a Completion Time can be determined in accordance with the Risk F.1 and F.2 Informed Completion Time Program.

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition F are modified by a Note to indicate that when Condition F is entered with no AC source to any 4.16 kV shutdown board, ACTIONS for LCO 3.8.7, "Distribution Systems - Operating," must be immediately entered. This allows Condition F to provide requirements for the loss of the offsite circuit and one DG without regard to whether a 4.16 kV shutdown board is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized 4.16 kV shutdown board.

(continued)

BFN-UNIT 1 B 3.8-22 Revision 0

AC Sources - Operating B 3.8.1 BASES ACTIONS F.1 and F.2 (continued)

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition F for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In Condition F, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition E (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

A Note has been added to Condition F to clarify that the Condition is only applicable when more than one shutdown board is affected. The situation where only one shutdown board is affected is covered by Condition G. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time G.1 Program.

Condition G addresses the situation where both one required offsite circuit and one DG are inoperable and affect only one 4.16 kV shutdown board. The Note clarifies the applicability.

The Required Action is to declare the affected 4.16 kV shutdown board inoperable immediately. This requires entry into the applicable Conditions and Required Actions of LCO 3.8.7, "Distribution Systems - Operating," which provides the appropriate restrictions for the affected 4.16 kV shutdown board. LCO 3.8.1 Conditions and Required Actions continue to apply until the required offsite circuit and DG are made OPERABLE.

(continued)

BFN-UNIT 1 B 3.8-23 Revision 0

DC Sources - Operating B 3.8.4 BASES (continued)

ACTIONS A.1 Condition A represents one Unit or Shutdown Board DC subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The 7 day limit is consistent with the allowed time for an inoperable Unit DC Board or Shutdown Board Distribution Panel.

If one Unit or Shutdown Board DC electrical power subsystem is inoperable (e.g., inoperable battery, inoperable battery charger(s), or inoperable battery charger and associated inoperable battery), the remaining Unit or Shutdown Board DC electrical power subsystems have the capacity to support a safe shutdown and cooldown of all three units in the event of a loss of offsite power and a DBA on one Unit. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 7 days. The loss of one shutdown board electrical power subsystem affects normal control power supply for the 480 V and 4.16 kV shutdown board(s) which it supplies. Loss of uninterrupted control power to these shutdown boards may result in loss of those engineered safety features supplied by these boards. Therefore, 7 days is considered a reasonable time to effect repairs and perform required testing of the unit or shutdown board DC electrical power subsystem, recognizes the ability to connect alternate sources to support continued operation or accident mitigation, and, if the unit or shutdown board DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

(continued)

BFN-UNIT 1 B 3.8-62 Revision 0

Distribution Systems - Operating B 3.8.7 BASES (continued)

ACTIONS A.1 With one Unit 1 and 2 4.16 kV shutdown board inoperable, the remaining Unit 1 and 2 4.16 kV shutdown boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition.

The overall reliability is reduced, however, because another single failure in the remaining three 4.16 kV shutdown boards could result in the minimum required ESF functions not being supported. Therefore, the 4.16 kV shutdown board must be Alternatively, a Completion restored to OPERABLE status within 5 days.

Time can be determined in accordance with the Risk Informed Completion Time The 5 day time limit before requiring a unit shutdown in this Program.

Condition is acceptable because the remaining 4.16 kV shutdown boards have AC power available, and the probability of an event in conjunction with a single failure of a redundant component in the 4.16 kV shutdown board with AC power is low. (The redundant component is verified OPERABLE in accordance with Specification 5.5.11, Safety Function Determination Program (SFDP).)

(continued)

BFN-UNIT 1 B 3.8-89 Revision 0, 36 June 22, 2006

Distribution Systems - Operating B 3.8.7 BASES ACTIONS A.1 (continued)

The second Completion Time for Required Action A.1 A1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO.

LCO If Condition A is entered while, while for instance, instance a Unit DC board is inoperable and subsequently returned OPERABLE, this LCO may already have been not met for up to OPERABLE 7 days.

days This situation could lead to a total duration of 12 daysdays, since initial failure of the LCO, LCO to restore the 4.16 4 16 kV shutdown board. At this time a Unit DC board could again become board inoperable, and the 4.16 inoperable 4 16 kV shutdown board could be restored OPERABLE. This could continue indefinitely OPERABLE indefinitely.

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

time zero clock This results in establishing the "time time zero" zero at the time this LCO was met, instead of at the time Condition A was entered initially not met entered.

The 12 day Completion Time is an acceptable limitation on this indefinitely.

potential to fail to meet the LCO indefinitely Pursuant to LCO 3.0.6, the Distribution System Actions B, C, or F would not be entered even if the 4.16 kV shutdown board was inoperable, resulting in de-energization of a 480 V board.

Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no power source to a required 480 V board, Actions B, C, or F must be immediately entered. This allows Condition A to provide requirements for the loss of the 4.16 kV shutdown board without regard to whether a 480 V shutdown board is de-energized. Actions B, C, or F provide the appropriate restrictions for a de-energized 480 V board.

(continued)

BFN-UNIT 1 B 3.8-90 Revision 0, 33 August 4, 2005

Distribution Systems - Operating B 3.8.7 BASES ACTIONS A.2 (continued)

With a shutdown board inoperable, the associated DG would have no power distribution mechanism and would hence also be inoperable. Required actions for an inoperable DG are included in LCO 3.8.1.

B.1 With one Unit 1 480 V shutdown board inoperable, the remaining 480 V shutdown board is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. The overall reliability is reduced because a single failure in the remaining 480 V shutdown board could result in the minimum required ESF functions not being supported.

Therefore, the inoperable 480 V shutdown board must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This condition also bounds the inoperability of 480 V RMOV boards 1A or 1B.

or in accordance with the Risk Informed Completion Time Program The Condition B postulated worst case scenario is one division (480 V shutdown board) without AC power (i.e., no offsite power to the division and the associated DG inoperable). In this condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit, and on restoring power to the affected division. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time period before requiring a unit shutdown is acceptable because:

(continued)

BFN-UNIT 1 B 3.8-91 Revision 0

Distribution Systems - Operating B 3.8.7 BASES ACTIONS B.1 (continued)

a. There is a potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.

b. The potential for an event in conjunction with a single failure of a redundant component in the division with AC power is minimal. (The redundant component is verified OPERABLE in accordance with Specification 5.5.11, "Safety Function Determination Program (SFDP).")

The second Completion Time (12 days) for Required Action B.1 B1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable in any single contiguous occurrence of failing to meet the LCO.

LCO If Condition B is entered while,while for instance, instance a 4.16 4 16 kV shutdown board is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to OPERABLE 5 days.

days This situation could lead to a total duration of 5 days and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , hours since initial failure of the LCO, LCO to restore the 480 V board. At this time board time, a 4 4.16 16 kV shutdown board could again become inoperable, inoperable and the 480 V board could be restored OPERABLE. This could continue indefinitely.

OPERABLE indefinitely This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

time zero clock This allowance results in establishing the "time zero" at the time the time zero LCO was initially not met, met instead of at the time Condition B was entered. The 12 day Completion Time is an acceptable entered limitation on this potential of failing to meet the LCO indefinitely indefinitely.

(continued)

BFN-UNIT 1 B 3.8-92 Revision 0

Distribution Systems - Operating B 3.8.7 BASES ACTIONS C.1 (continued)

With one Units 1 and 2 480 V diesel auxiliary board inoperable, the remaining 480 V diesel auxiliary board is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. The overall reliability is reduced because a single failure in the remaining 480 V diesel auxiliary board could result in the minimum required ESF functions not being supported. Therefore, the 480 V diesel auxiliary board must be restored to OPERABLE status within 5 days.

or in accordance with the Risk Informed Completion Time Program (continued)

BFN-UNIT 1 B 3.8-93 Revision 0, 33 August 4, 2005

Distribution Systems - Operating B 3.8.7 BASES ACTIONS C.1 (continued)

The second Completion Time (12 days) for Required Action C C.11 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable in any single contiguous occurrence of failing to meet the LCO.

LCO If Condition C is entered while, while for instance, instance a 4.16 4 16 kV shutdown board is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to OPERABLE 5 days. days, days This situation could lead to a total duration of 10 days since initial failure of the LCO, LCO to restore the 480 V DG auxiliary board. At this time board time, a 4 4.16 16 kV shutdown board could again become inoperable, inoperable and the 480 V DG auxiliary board could be OPERABLE. This could continue indefinitely restored OPERABLE indefinitely.

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

time zero clock This allowance results in establishing the "time zero" at the time the time zero LCO was initially not metmet, instead of at the time Condition C was entered. The 12 day Completion Time is an acceptable entered indefinitely.

limitation on this potential of failing to meet the LCO indefinitely D.1 With one Unit DC board or one Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable, the remaining boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining boards could result in the minimum required ESF functions not being supported. Therefore, the required Unit DC board or Unit 1 and 2 Shutdown Board DC Distribution Panel must be restored to OPERABLE status within 7 days by powering it from the associated battery or charger. This condition also bounds the inoperability of 250 V RMOV boards 1A, 1B, or 1C.

(continued)

BFN-UNIT 1 B 3.8-95 Revision 0, 33 August 4, 2005

Distribution Systems - Operating B 3.8.7 BASES ACTIONS D.1 (continued)

Condition D represents one Unit DC board or one Unit 1 and 2 Shutdown Board DC Distribution Panel without adequate DC power, potentially with both the battery significantly degraded and the associated charger nonfunctioning. In this situation the plant is significantly more vulnerable to a partial loss of DC power. However, the three Unit DC boards have ESF loads for the three BFN units distributed among them so that redundant subsystems on each unit have separate normal and alternate power supplies. The 7 day Completion Time is partially based on this and reflects a reasonable time to assess unit status as a function of the inoperable Unit DC board or Unit 1 and 2 Shutdown Board DC Distribution Panel and, if not restored to OPERABLE status, to prepare to effect an orderly and safe shutdown.

Alternatively, a Completion Time can be determined in The he second Completion Time for Required Action D D.11 accordance with the Risk Informed Completion Time establishes a limit on the maximum time allowed for any Program. combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO.

LCO If Condition D is entered while, while for instance instance, a 4.16 4 16 kV shutdown board is inoperable and subsequently OPERABLE, the LCO may already have been not met restored OPERABLE for up to 5 days.

days This situation could lead to a total duration of 12 days, days since initial failure of the LCO LCO, to restore the Unit DC board or the Shutdown Board DC Distribution Panel Panel. At this time, a 4.16 time 4 16 kV shutdown board could again become inoperable, and the Unit DC board or the Shutdown Board DC inoperable OPERABLE. This could Distribution Panel could be restored OPERABLE indefinitely.

continue indefinitely (continued)

BFN-UNIT 1 B 3.8-96 Revision 0, 33 August 4, 2005

Distribution Systems - Operating B 3.8.7 BASES ACTIONS D.1 (continued)

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

time zero clock This allowance results in establishing the "time zero" at the time the time zero met, instead of at the time Condition D was LCO was initially not met entered. The 12 day Completion Time is an acceptable entered indefinitely.

limitation on this potential of failing to meet the LCO indefinitely E.1 With one division of 4.16 kV shutdown boards inoperable, the remaining division of shutdown boards is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition assuming no single failure. The overall reliability is reduced because a single failure in the remaining 4.16 kV shutdown boards could result in the minimum required ESF functions not being supported.

Therefore, one of the inoperable 4.16 kV shutdown boards must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

The Condition E postulated worst case scenario is one division of 4.16 kV shutdown board without AC power (i.e., no offsite power to the division and the associated DGs inoperable). In this condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit, and on restoring power to the affected division. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time period before requiring a unit shutdown is acceptable because:

(continued)

BFN-UNIT 1 B 3.8-97 Revision 0, 33 August 4, 2005

Distribution Systems - Operating B 3.8.7 BASES ACTIONS E.1 (continued)

a. There is a potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.

b. The potential for an event in conjunction with a single failure of a redundant component in the division with AC power is minimal. (The redundant component is verified OPERABLE in accordance with Specification 5.5.11, "Safety Function Alternatively, a Completion Determination Program (SFDP).")

Time can be determined in accordance with the Risk Informed Completion Time The second Completion Time (12 days) for Required Action E E.1 1

Program.

establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable in any single contiguous occurrence of failing to meet the LCO.

LCO If Condition E is entered while,while for instance, instance a 480 V DG auxiliary board is inoperable and subsequently restored OPERABLE, the LCO may already have been not met for up to OPERABLE 5 days.

days This situation could lead to a total duration of 5 days and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , hours since initial failure of the LCO LCO, to restore the 480 V board. At this time shutdown board time, a 480 V DG auxiliary board could inoperable, and a 4.16 again become inoperable 4 16 kV shutdown board could OPERABLE. This could continue indefinitely be restored OPERABLE indefinitely.

This Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

time zero clock This allowance results in establishing the "time zero" at the time time zero the LCO was initially not met met, instead of at the time Condition E was entered.

entered The 12 day Completion Time is an acceptable limitation on this potential of failing to meet the LCO indefinitely.

indefinitely (continued)

BFN-UNIT 1 B 3.8-98 Revision 0, 33 August 4, 2005

Attachment 5 TSTF-505-A (NUREG-1433) Versus BFN TS Cross-Reference (8 pages)

CNL-21-009

TSTF-505-A vs. BFN Cross-Reference TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description Completion Times 1.3 1.3 Example 1.3-8 Example 1.3-8 Example 1.3-8 Incorporated No variation example Standby Liquid Control 3.1.7 3.1.7 (SLC) System B. One SLC subsystem B.1 A.1 Added RICT to A.1 Administrative Variation - Section 2.3.1.1 inoperable [for reasons other than Condition A]

Reactor Protection System 3.3.1.1 3.3.1.1 (RPS) Instrumentation A. One or more required A.1 A.1 Added RICT to A.1 No variation.

channels inoperable A.2 A.2 Added RICT to A.2 Administrative Variation - Section 2.3.1.3 B. One or more Functions B.1 B.1 Added RICT to B.1 Administrative Variation - Section 2.3.1.3 with one or more required B.2 B.2 Added RICT to B.2 Administrative Variation - Section 2.3.1.3 channels inoperable in both trip systems.

Source Range (SRM) 3.3.1.2 3.3.1.2 Instrumentation A. One or more required A.1 A.1 Did not add RICT Administrative Variation - Section 2.3.1.4 SRMs inoperable in Mode 2 with intermediate range monitors (IRMs) on Range 2 or below.

Feedwater and Main 3.3.2.2 3.3.2.2 Turbine High Water Level Trip Instrumentation A. One feedwater and main A.1 A.1 Added RICT Administrative Variation - Section 2.3.1.5 turbine high water level trip channel inoperable.

CNL-21-009 A5-1 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description B. Two or more feedwater B.1 B.1 Did not add RICT Administrative Variation - Section 2.3.1.4 and main turbine high water level trip channels inoperable.

End of Cycle Recirculation 3.3.4.1 3.3.4.1 Pump Trip (EOC-RPT)

Instrumentation A. One or more required A.1 A.1 Did not add RICT Administrative Variation - Section 2.3.1.6 channels inoperable. A.2 A.2 Did not add RICT Administrative Variation - Section 2.3.1.6 Anticipated Transient 3.3.4.2 3.3.4.2 Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation A. One or more required A.1 A.1 Added RICT No variation channels inoperable. A.2 A.2 Added RICT No variation Emergency Core Cooling 3.3.5.1 3.3.5.1 System (ECCS)

Instrumentation B. As required by Required B.3 B.3 Added RICT Administrative Variation - Section 2.3.1.3 Action A.1 and referenced in Table 3.3.5.1-1 C. As required by Required C.2 C.2 Added RICT Administrative Variation - Section 2.3.1.3 Action A.1 and referenced in Table 3.3.5.1-1.

D. As required by Required D.2.1 N/A N/A Administrative Variation - Section 2.3.1.2 Action A.1 and referenced in Table 3.3.5.1-1.

E. As required by Required E.2 E.2 Added RICT Administrative Variation - Section 2.3.1.3 Action A.1 and referenced in Table 3.3.5.1-1.

CNL-21-009 A5-2 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description F. As required by Required F.2 F.2 Added RICT No variation Action A.1 and referenced in Table 3.3.5.1-1.

G. As required by Required G.2 G.2 Added RICT No variation Action A.1 and referenced in Table 3.3.5.1-1.

Reactor Core Isolation 3.3.5.2 3.3.5.3 Cooling (RCIC) System Instrumentation B. As required by Required B.2 B.2 Added RICT Administrative Variation - Section 2.3.1.1 Action A.1 and referenced in Table 3.3.5.2-1 D. As required by Required D.2.1 N/A N/A Administrative Variation - Section 2.3.1.2 Action A.1 and referenced in Table 3.3.5.2-1.

Primary Containment 3.3.6.1 3.3.6.1 Isolation Instrumentation A. One or more required A.1 A.1 Added RICT Administrative Variation - Section 2.3.1.3 channels inoperable.

Low-Low Set (LLS) 3.3.6.3 N/A Instrumentation A. One LLS valve inoperable A.1 N/A N/A Administrative Variation - Section 2.3.1.2 due to inoperable channel(s).

Loss of Power (LOP) 3.3.8.1 3.3.8.1 Instrumentation A. One or more required A.1 N/A N/A Administrative Variation - Section 2.3.1.2 channels inoperable.

N/A N/A A.2 Added RICT Technical Variation - Section 2.3.2.1 Safety/Relief Valves 3.4.3 3.4.3 (S/RVs)

A. [One [or two][required] A.1 N/A N/A Administrative Variation - Section 2.3.1.2 S/RV[s] inoperable.

CNL-21-009 A5-3 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description ECCS - Operating 3.5.1 3.5.1 A. One low pressure ECCS A.1 A.1 Added RICT No variation injection/spray subsystem inoperable.

OR One LPCI pump in both LPCI subsystems inoperable.

C. HPCI System inoperable C.2 C.2 Added RICT No variation D. HPCI System D.1 D.1 Added RICT No variation inoperable. D.2 D.2 Added RICT No variation AND Condition A entered.

E. One ADS valve E.1 E.1 Added RICT No variation inoperable.

F. One ADS valve F.1 F.1 Added RICT No variation inoperable. F.2 F.2 Added RICT No variation AND Condition A entered.

RCIC System 3.5.3 3.5.3 A. RCIC System inoperable. A.2 A.2 Added RICT No variation Primary Containment 3.6.1.2 3.6.1.2 Airlock C. Primary containment air C.3 C.3 Added RICT No variation lock inoperable for reasons Additional justification provided in other than Condition A or B. Enclosure 1 of this submittal CNL-21-009 A5-4 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description Primary Containment 3.6.1.3 3.6.1.3 Isolation Valves (PCIVs)

A. One or more penetration A.1 A.1 Added RICT Administrative Variation - Section 2.3.1.1 flow paths with one PCIV Administrative Variation - Section 2.3.1.1 inoperable [for reasons other A.2 A.2 Added [following than Condition[s] D [and E)). isolation]

C. One or more penetration C.2 C.2 Added [following Administrative Variation - Section 2.3.1.1 flow paths with one PCIV isolation]

inoperable [for reasons other than Condition[s] D [and E)).

E. [ One or more penetration E.1 N/A N/A Administrative Variation - Section 2.3.1.2 flow paths with one or more E.2 N/A N/A Administrative Variation - Section 2.3.1.2 containment purge valves E.3 N/A N/A Administrative Variation - Section 2.3.1.2 not within purge valve leakage limits.

Reactor Building-to- 3.6.1.7 3.6.1.5 Suppression Chamber Vacuum Breakers C. One line with one or more C.1 C.1 Did not add RICT Administrative Variation - Section 2.3.1.6 reactor building-to-suppression chamber vacuum breakers inoperable for opening.

D. Two [or more] lines with D.1 D.1 Did not add RICT Administrative Variation - Section 2.3.1.6 one or more reactor building-to-suppression chamber vacuum breakers inoperable for opening.

Suppression Chamber-to- 3.6.1.8 3.6.1.6 Drywell Vacuum Breakers A. One required suppression A.1 A.1 Did not add RICT Administrative Variation - Section 2.3.1.6 chamber-to-drywell vacuum CNL-21-009 A5-5 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description breaker inoperable for opening.

RHR Suppression Pool 3.6.2.3 3.6.2.3 Cooling A. One RHR suppression A.1 B.1 Added RICT to B.1 Technical Variation - Section 2.3.2.2 pool cooling subsystem inoperable.

RHR Suppression Pool 3.6.2.4 3.6.2.4 Spray A. One RHR suppression A.1 B.1 Added RICT to B.1 Technical Variation - Section 2.3.2.2 pool spray subsystem inoperable.

N/A N/A 3.6.2.5 RHR Drywell Spray N/A N/A B.1 Added RICT Technical Variation - Section 2.3.2.2 Drywell Cooling System 3.6.3.1 N/A Fans B. Two [required] [drywell B.2 N/A N/A Administrative Variation - Section 2.3.1.2 cooling system fans]

inoperable.

Residual Heat Removal 3.7.1 3.7.1 Service Water (RHRSW)

System B. One RHRSW pump in B.1 C.1 Added RICT to C.1 Technical Variation - Section 2.3.2.3 each subsystem inoperable.

C. One RHRSW subsystem C.1 D.1 Added RICT to D.1 Technical Variation - Section 2.3.2.3 inoperable for reasons other than Condition A.

CNL-21-009 A5-6 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description Plant Service Water (PSW) 3.7.2 3.7.2 and Ultimate Heat Sink (UHS)

B. One [PSW] pump in each B.1 A.1 Added RICT to A.1 Administrative Variation - Section 2.3.1.1 subsystem inoperable.

C. [One or more cooling C.1 N/A N/A Administrative Variation - Section 2.3.1.2 towers with one cooling tower fan inoperable.

E. One [PSW] subsystem E.1 N/A N/A Administrative Variation - Section 2.3.1.2 inoperable for reasons other than Condition[s] A [and C].

Main Turbine Bypass 3.7.7 3.7.5 System A. [Requirements of the LCO A.1 A.1 Did not add RICT Administrative Variation - Section 2.3.1.4 not met or Main Turbine Bypass System inoperable].

AC sources - Operating 3.8.1 3.8.1 A. One [required] offsite A.3 A.3 Added RICT Administrative Variation - Section 2.3.1.1 circuit inoperable.

B. One [required] DG B.4 B.5 Added RICT to B.5 Administrative Variation - Section 2.3.1.1 inoperable.

C. Two [required] offsite C.2 E.2 Added RICT to E.2 Administrative Variation - Section 2.3.1.1 circuits inoperable.

D. One [required] offsite D.1 F.1 Added RICT to F.1 Administrative Variation - Section 2.3.1.1 circuit inoperable D.2 F.2 Added RICT to F.2 Administrative Variation - Section 2.3.1.1 AND One [required] DG inoperable.

F. [One [required] [automatic F.1 N/A N/A Administrative Variation - Section 2.3.1.2 load sequencer] inoperable.

CNL-21-009 A5-7 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description DC Sources - Operating 3.8.4 3.8.4 A. One [or two] battery A.3 N/A N/A Administrative Variation - Section 2.3.1.2 charger[s on one train]

inoperable.

[B. One [or two] batter[y][ies] B.1 N/A N/A Administrative Variation - Section 2.3.1.2 on one train] inoperable.

C. One DC electrical power C.1 A.1 Added RICT to A.1 Administrative Variation - Section 2.3.1.8 subsystem inoperable for reasons other than Condition A [or B].

Inverters - Operating 3.8.7 N/A A. One [required] inverter A.1 N/A N/A Administrative Variation - Section 2.3.1.2 inoperable.

Distribution Systems - 3.8.9 3.8.7 Operating A. One or more AC electrical A.1 N/A N/A Administrative Variation - Section 2.3.1.2 power distribution subsystems inoperable.

B. One or more AC vital B.1 N/A N/A Administrative Variation - Section 2.3.1.2 buses inoperable.

C. One or more DC electrical C.1 N/A N/A Administrative Variation - Section 2.3.1.2 power distribution subsystems inoperable.

N/A N/A A.1 Added RICT to A.1 Technical Variation - Section 2.3.2.4 N/A N/A B.1 Added RICT to B.1 Technical Variation - Section 2.3.2.4 N/A N/A C.1 (Unit 1) Added RICT to C.1 Technical Variation - Section 2.3.2.4 D.1 (Unit 2 and Added RICT to D.1 3)

N/A N/A D.1 (Unit 1) Added RICT to D.1 Technical Variation - Section 2.3.2.4 E.1 (Unit 2 and Added RICT to E.1 3)

CNL-21-009 A5-8 of 9

TSTF-505-A TS TSTF-505-A BFN TS/RA Disposition Attachment 1 Variation Reference Title/Section/ TS/RA Condition Description N/A N/A E.1 (Unit 1) Added RICT to E.1 Technical Variation - Section 2.3.2.4 F.1 (Unit 2 and Added RICT to F.1 3)

Risk Informed Completion 5.5.15 5.5.16 Time Program Program Description 5.5.15 5.5.16 Added Program Administrative Variation - Section 2.3.1.7 Description CNL-21-009 A5-9 of 9

Attachment 6 TSTF-439-A (NUREG-1433) Versus BFN TS Cross-Reference (1 page)

CNL-21-009

TSTF-439-A vs. BFN Cross-Reference TSTF-439-A NUREG-1433 TSTF-439-A Action BFN Disposition Attachment 1 Variation Reference Affected TS Completion Times 1.3 1.3 Example 1.3-3 Revised Example 1.3-3 Revised Example 1.3-3 No variation Standby Liquid Control 3.1.7 (SLC) System A. [Concentration of boron in Deleted second No change Administrative Variation - The BFN TS do not solution not within limits but Completion Time (CT) have this second CT.

>[] from RA A.1 B. One SLC subsystem Deleted second CT No change Administrative Variation - The BFN TS do not inoperable [for reasons other Time from RA B.1 have this second CT.

than Condition A]

AC sources - Operating 3.8.1 3.8.1 A. One [required] offsite Deleted second CT Deleted second CT No variation circuit inoperable. Time from RA A.3. from RA A.3.

B. One [required] DG Deleted second Deleted second Administrative Variation - The BFN Condition B inoperable. Completion Time from Completion Time from and RA B.5 are worded differently from RA B.4. RA B.5. NUREG 1433, but deletion of the second CT is equally applicable.

Distribution Systems - 3.8.9 3.8.7 Operating A. One or more AC electrical Deleted second CT No change Administrative Variation - BFN does not have power distribution Time from RA A.1. this Condition or RA.

subsystems inoperable.

B. One or more AC vital Deleted second CT Deleted second CT Administrative Variation - The BFN TS have buses inoperable. from RA B.1. from RA A.1, B.1, and more detailed Conditions covering the loss of C.1 vital AC buses than contained in NUREG-1433, but deletion of the second CT is equally applicable.

C. One or more DC electrical Deleted second CT Deleted second CT Administrative Variation - The BFN TS have power distribution from RA C.1. from RA D.1 more detailed Conditions covering the loss of subsystems inoperable. DC distribution subsystems than contained in NUREG-1433, but deletion of the second CT is equally applicable.

CNL-21-009 A6-1 of 1

List of Enclosures

1. List of Revised Required Actions to Corresponding PRA Functions

2. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

3. Information Supporting Technical Adequacy of PRA Models Without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2

4. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

5. Baseline CDF and LERF

6. Justification of Application of At-Power PRA Models to Shutdown Modes

7. PRA Model Update Process

8. Attributes of the Real-Time Model

9. Key Assumptions and Sources of Uncertainty

10. Program Implementation

11. Monitoring Program

12. Risk Management Action Examples CNL-21-009

ENCLOSURE 1 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" List of Revised Required Actions to Corresponding PRA Functions CNL-21-009

Enclosure 1

1. INTRODUCTION Section 4.0, Item 2 of the Nuclear Regulatory Commission's (NRC) Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (Reference 2) identifies the following needed content.

x The License Amendment Request (LAR) will provide identification of the Technical Specification (TS) Limiting Conditions for Operation (LCO) and action requirements to which the RMTS will apply.

x The LAR will provide a comparison of the TS functions to the probabilistic risk analysis (PRA) modeled functions of the structures, systems, and components (SSCs) subject to those LCO actions.

x The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., Title 10 of the Code of Federal Regulations (10 CFR) 50.46 emergency core cooling system (ECCS) flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This enclosure addresses the above topics as well as additional information in the following sections.

x Section 2 provides the revised required actions to corresponding PRA function.

x Section 3 provides the results of the example risk informed completion times (RICT) calculations.

x Section 4 provides the additional technical justification for the list of Required Actions from Table 1, Conditions Requiring Additional Technical Justification of Technical Specifications Task Force (TSTF)-505, Revision 2.

x Section 5 provides information regarding the diversity and redundancy of instrumentation and controls.

x Section 6 provides a discussion of the defense in depth per Regulatory Guide (RG) 1.174.

x Section 7 provides a description of the electrical capabilities for all three units.

x Section 8 provides a listing of references.

2. REVISED REQUIRED ACTIONS TO CORRESPONDING PRA FUNCTIONS This enclosure provides confirmation that the Browns Ferry Nuclear Plant (BFN) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the RICT Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the Nuclear Regulatory Commission (NRC) Final Safety Evaluation. The scope of the comparison includes each of the TS LCO Conditions and associated required actions within the scope of the RICT Program. The BFN PRA model has the capability to model directly or through use of a bounding surrogate, the risk impact of entering each of the TS LCOs in the scope of the RICT Program.

CNL-21-009 E1-1 of 46

Enclosure 1

Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions, and the results of the comparison:

x Columns Technical Specification (TS) Condition and TS Condition

Description:

Lists all the LCOs and Condition statements within the scope of the RICT Program. For TS Conditions which are applicable to all three units, no unit identifiers were noted.

x Column SSCs Covered by TS LCO Condition: The SSCs addressed by each action requirement.

x Column SSCs Modeled in PRA: Indicates whether the SSCs addressed by the TS LCO Condition are explicitly modeled in the PRA.

x Column Function Covered by TS LCO Condition: A summary of the required functions from the design basis analyses.

x Column Design Success Criteria: A summary of the success criteria from the design basis analyses. The design success criteria is based on successful response to the station with one unit in an accident (e.g., loss of coolant accident (LOCA)) and a single failure (e.g., loss of offsite power).

x Column PRA Success Criteria: The function success criteria modeled in the PRA.

x Column Other Comments: Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO Condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS Condition as required by NEI 06-09-A.

The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to Capability Category II of the PRA standard (Reference 3) as required by NEI 06-09-A.

CNL-21-009 E1-2 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments 3.1.7.A One Standby Liquid Two SLC Yes Provide a One of two Same as Design Control (SLC) subsystems, each backup subsystems Success Criteria subsystem inoperable containing an capability for OPERABLE bringing the pump, an reactor from full explosive valve, power and and associated minimum control piping, valves, and rod inventory to instruments and a subcritical controls to ensure condition.

an OPERABLE flow path.

3.3.1.1.A One or more required Four reactor No Provide reactor Generally, N/A Individual RPS channels inoperable, protection system scram initiation one-out-of-two instrumentation per Table 3.3.1.1-1. channels (RPS) signal based on taken twice inputs to the RPS (A1 and A2, B1 plant monitored logic; one of logic system are and B2) parameters two channels not modeled in the in both trip PRA. A surrogate is systems chosen which represents the common cause failure of the RPS electrical system.

This is conservative and represents failure of the RPS.

3.3.1.1.B One or more Four reactor No Provide reactor Generally, N/A Individual RPS Functions with one or protection system scram initiation one-out-of-two instrumentation more required channels (A1 and signal based on taken twice inputs to the RPS channels inoperable A2, B1 and B2) plant monitored logic; one of logic system are in both trip systems, parameters two channels not modeled in the per Table 3.3.1.1-1. in both trip PRA. A surrogate is NOTE: Not applicable systems chosen which represents the CNL-21-009 E1-3 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments for Functions 2.a, 2.b, common cause 2.c, 2.d, or 2.f. failure of the RPS electrical system.

This is conservative and represents failure of the RPS.

3.3.2.2.A One or more Four Reactor Yes Provide Two-of-two Same as Design feedwater and main Vessel Water feedwater pump channels in Success Criteria turbine high water Level - High turbines and one of two trip level trip channels instrumentation main turbine trip systems.

inoperable, in one trip channels on a valid high system. water level signal 3.3.4.2.A One or more Anticipated Yes Provide Two-of- two Same as Design channels inoperable. Transient Without recirculation channels in Success Criteria Scram pump trip one of two trip Recirculation initiation. systems.

Pump Trip (ATWS-RPT) instrumentation 3.3.5.1.B One or more ECCS actuation Yes for The ECCS Generally, Same as Design For function 2.e, channels inoperable instrumentation for Functions instrumentation one-out-of-two Success Criteria suppression pool as required by Action Core Spray (CS), (1.a, 1.b, 2.a, actuates CS, taken twice (Functions 1.a, 1.b, (cooling/spray)

A.1 and referenced in low pressure 2.b, 3.a, 3.b) LPCI, HPCI logic, one of 2.a, 2.b, 3.a, 3.b) valves are used as Table 3.3.5.1-1. coolant injection two channels surrogates as these (LPCI) and high Not Modeled in both trip valves are actuated Reactor Vessel Water pressure coolant for Function systems by the signals not Level - Low Low Low injection (HPCI) 2.e explicitly modeled.

Level 1 (Function 1.a, Reactor This is conservative 2.a) Vessel Water since the modeling Level - Level 0 evaluates both the Drywell Pressure - - one of two failure of High (Function 1.b, channels (one suppression pool 2.b, 3.b) channel per cooling/spray and subsystem) in a separate case failure of LPCI CNL-21-009 E1-4 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments Reactor Vessel Water injection due to flow Level - Level 0 diversion.

(Function 2.e)

Reactor Vessel Water Level - Low Low, Level 2 (Function 3.a) 3.3.5.1.C One or more ECCS actuation Yes The ECCS Generally, Same as Design Function 1.e: Not channels inoperable instrumentation for (Functions instrumentation one-out-of-two Success Criteria explicitly modeled.

as required by Action CS, LPCI, and 1.c, 2.c, 2.d, actuates CS, taken twice (Functions 1.c, 2.c, Surrogates are A.1 and referenced in HPCI 3.c) LPCI, HPCI logic, one of 2.d) chosen to Table 3.3.5.1-1. two channels represent failure of Not Modeled in both trip Function 3.c: Two-of the CS pumps to Reactor Steam Dome for (Functions systems -Two HPCI Level 8 start and either the Pressure - Low 1.e, 2.f) Trip Channels associated diesel (Injection Permissive Pump start generator (DG) fails and ECCS Initiation) logic - one to start (diesel (Function 1.c, 2.c) channel per power) or the pump Shutdown Bus faults (normal Reactor Steam Dome Reactor power). This is Pressure - Low Vessel Water conservative (Recirculation Level - High, because if a Discharge Valve Level 8 - one channel is not Permissive) (Function of two available, the time 2.d) channels delay would fail and the pump start CS Pump Start - Time could overload the Delay Relay diesel or shutdown (Function 1.e) board.

LPCI Pump Start - Function 2.f: Not Time Delay Relay explicitly modeled.

(Function 2.f) Surrogates are chosen to represent failure of the LPCI pumps to CNL-21-009 E1-5 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments Reactor Vessel Water start and either the Level - High, Level 8 associated DG (Function 3.c) (diesel power) fails to start or the Shutdown Bus faults (normal power). This is conservative because if a channel is not available, the time delay would fail and the pump start could overload the diesel or shutdown board.

3.3.5.1.E One or more ECCS actuation No The ECCS Two Channels, N/A Function 1.d: Not channels inoperable instrumentation for instrumentation (One channel explicitly modeled.

as required by Action CS and HPCI actuates CS per CS Failure of CS Pump A.1 and referenced in and HPCI subsystem) min-flow Table 3.3.5.1-1. motor-operated One of one valves are used as Core Spray Pump channel for surrogates. This is Discharge Flow - Low HPCI Pump conservative since (Bypass) (Function Discharge it fails the pump.

1.d) Flow Function 3.f: Not High Pressure explicitly modeled.

Coolant Injection HPCI fails to run is Pump Discharge Flow used as a

- Low (Bypass) surrogate. This is (Function 3.f) conservative since it fails the pump.

CNL-21-009 E1-6 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments 3.3.5.1.F One or more ECCS actuation No The ECCS One of two trip N/A ADS is not explicitly channels inoperable instrumentation for instrumentation systems modeled. Operator as required by Action Automatic actuates ADS action for failure A.1 and referenced in Depressurization to initiate Table 3.3.5.1-1. System (ADS) reactor-vessel depressurization is Reactor Vessel Water used as a Level - Low Low Low, surrogate.

Level 1 (Function 4.a, 5.a)

Drywell Pressure -

High (Function 4.b, 5.b)

Reactor Vessel Water Level - Low, Level 3 (Confirmatory)

(Function 4.d, 5.d) 3.3.5.1.G As required by ECCS actuation No The ECCS One of two trip N/A ADS is not explicitly Required Action A.1 instrumentation for instrumentation systems modeled. Operator and referenced in ADS actuates ADS action for failure Table 3.3.5.1-1. to initiate reactor-vessel Automatic depressurization is Depressurization used as a System Initiation surrogate.

Timer (Function 4.c, 5.c)

Core Spray Pump Discharge Pressure -

High (Function 4.e, 5.e)

CNL-21-009 E1-7 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments Low Pressure Coolant Injection Pump Discharge Pressure - High (Function 4.f, 5.f)

Automatic Depressurization System High Drywell Pressure Bypass Timer (Function 4.g, 5.g) 3.3.5.3.B One or more Reactor Core Yes The RCIC One-out-of-two Same as Design channels inoperable Isolation Cooling System taken twice Success Criteria as required by Action (RCIC) System instrumentation logic; one of A.1 and referenced in instrumentation actuates RCIC two channels Table 3.3.5.3-1 in both trip systems Reactor Vessel Water Level Low-Low, Level 2 (Function 1) 3.3.6.1.A One or more required Primary Yes (1a, 1b, Provide primary Generally, Same as Design 1.c, 1.d: Not channels inoperable, Containment 2a, 2b) containment one-out-of-two Success Criteria explicitly modeled.

as referenced in Isolation isolation valves taken twice (Functions 1.a, 1.b, Cases from Table 3.3.6.1-1. Instrumentation Not Explicitly (PCIVs) closure logic; one of 2.a, 2.b) Function 1.b are See Notes at the (1.c, 1.d, initiation. two channels used as surrogates.

bottom of this table 3.a-3.g, in both trip for affected functions. 4.a-4.g, systems 5.g: Not explicitly 5.a-5.h, modeled. Reactor 6.a-6.c) water cleanup isolation valves fail to close events are used as surrogates.

6.a: Not explicitly modeled.

CNL-21-009 E1-8 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments Shutdown cooling (SDC) isolation valves fail to close events are used as surrogates.

3.a-3.g, 4.a-4.g, 5.a-5.f, 5.h, 6.b, 6.c: Not explicitly modeled. A loss of primary containment isolation capability via one of the modeled pathways is used as a surrogate.

3.3.8.1.A One degraded Loss of power No Provide Two of three N/A Not explicitly voltage relay channel (LOP) adequate power channels modeled.

inoperable on one or instrumentation sources for (degraded Undervoltage DG more shutdown energizing the voltage relay start relays are board(s). various channel) used as surrogates.

AND component for This is conservative The loss of voltage ECCS safety Two-of-two because one of the relay channels on the function. channels (loss two diesel start affected shutdown of voltage signals are failed.

board(s) are relay channel)

OPERABLE.

3.5.1.A One low pressure Two CS Yes Provide One low Same as Design ECCS injection/spray subsystems and adequate core pressure Success Criteria subsystem two LPCI cooling during a ECCS inoperable. subsystems LOCA. injection/spray OR subsystem One low pressure One operable coolant injection LPCI pump in (LPCl) pump in both CNL-21-009 E1-9 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments LPCI subsystems each LPCI inoperable. subsystem.

3.5.1.C HPCI System HPCI system Yes Reactor One train Same as Design inoperable. inventory control Success Criteria for small break LOCA.

3.5.1.D HPCI System HPCI System Yes See LCO See LCO See PRA Success inoperable. AND one low Conditions Conditions Criteria for 3.5.1.A AND pressure ECCS 3.5.1.A and 3.5.1.A and and 3.5.1.C Condition A entered. injection / spray 3.5.1.C 3.5.1.C subsystem inoperable 3.5.1.E One ADS valve ADS (6 of 13 No Rapid reactor Five of Six N/A ADS is not explicitly inoperable Safety/Relief vessel ADS valves modeled. Operator Valves) depressurization actions for failure to to allow low initiate reactor-pressure ECCS vessel injection depressurization (medium steam LOCA) and (medium liquid LOCA) are used as surrogates.

3.5.1.F One ADS valve ADS and one low Yes (low See LCO See LCO See PRA Success ADS is not explicitly inoperable. pressure ECCS pressure Conditions Conditions Criteria for 3.5.1.A modeled. Operator AND injection / spray ECCS 3.5.1.A and 3.5.1.A and and 3.5.1.E actions for failure Condition A entered. subsystem injection / 3.5.1.E 3.5.1.E to initiate inoperable spray reactor-vessel subsystem) depressurization (medium steam ADS not LOCA) and modeled (medium liquid LOCA) are used as surrogates.

CNL-21-009 E1-10 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments 3.5.3.A RCIC System RCIC System Yes Provide One train Same as Design inoperable adequate core Success Criteria cooling and control of the RPV water level following reactor pressure vessel isolation.

3.6.1.2.C Primary containment Primary No Containment One of two N/A Not explicitly air lock inoperable for containment Integrity containment modeled. A loss of reasons other than airlock air lock doors primary Condition A or B. closed. containment isolation capability via one of the modeled pathways is used as a surrogate.

3.6.1.3.A One or more PCIVs on Not All PCIVs Primary One PCIV per Same as Design A loss of primary penetration flow paths flowpaths with two are modeled Containment penetration Success Criteria containment with one Primary PCIVs in series Isolation flow path isolation capability Containment Isolation via one of the Valves (PCIV) modeled pathways inoperable except is used as a due to Main Steam surrogate for PCIVs Isolation Valve not explicitly (MSIV) leakage not modeled.

within limits. (Only applicable to penetration flow paths with two PCIVs).

3.6.2.3.B Two residual heat Four redundant Yes Remove heat Two of four Same as Design removal (RHR) RHR suppression from RHR Success Criteria suppression pool pool cooling suppression suppression cooling subsystems subsystems pool pool cooling inoperable. subsystems CNL-21-009 E1-11 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments 3.6.2.4.B Two RHR Four redundant Yes Remove heat Two of four Same as Design suppression pool RHR suppression from the RHR Success Criteria spray subsystems pool spray suppression suppression inoperable. subsystems chamber pool spray airspace subsystems 3.6.2.5.B Two RHR drywell Four redundant Yes Remove heat Two of four Same as Design spray subsystems RHR drywell spray from the drywell RHR drywell Success Criteria inoperable. subsystems airspace spray subsystems 3.7.1.C Two required Four independent Yes Provide cooling Varies Six of eight pumps residual heat and redundant water for the depending on removal service subsystems, RHR system unit mode. For water (RHRSW) shared between heat all three units pumps inoperable. units, with each exchangers fueled, subsystem RHRSW consisting of two safety function redundant is maintained RHRSW pumps when:

and associated -Two RHRSW flow path. subsystems per fueled unit are OPERABLE

-Six RHRSW pumps are OPERABLE (two RHRSW pumps per fueled unit);

3.7.1.D Two RHRSW Four independent Yes Provide cooling Varies Same as Design subsystems and redundant for the RHR depending on Success Criteria inoperable subsystems, system (RHR unit mode. For shared between heat all three units units exchangers) fueled, RHRSW safety function CNL-21-009 E1-12 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments is maintained when:

-Two RHRSW subsystems per fueled unit are OPERABLE 3.7.2.A One required Two independent Yes Provide cooling Two EECW Same as Design Emergency and redundant water for heat pumps Success Criteria Equipment Cooling loops, with two removal from Water (EECW) pump pumps per loop equipment inoperable. (DGs, RHR coolers, ECCS room coolers) 3.8.1.A One required offsite Two qualified Yes Provide power One offsite AC Same as Design circuit inoperable. offsite circuits to safety-related power source Success Criteria buses 3.8.1.B (U1 & One required Unit 1 Four separate and Yes Provide power Three of four The DG is successful U2) and 2 DG (1 of 4 independent U1 & to safety-related U1 and U2 if power remains DGs) inoperable. U2 DGs buses DGs available at the power distribution system from the associated DG for a period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following an initiating event.

3.8.1.B (U3) One required Unit 3 Four separate and Yes Provide power Three of four The DG is successful DG inoperable. independent U3 to safety-related U3 DGs if power remains DGs buses available at the power distribution system from the associated DG for a period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following an initiating event.

CNL-21-009 E1-13 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments 3.8.1.E Two required offsite Two qualified Yes Provide power One offsite AC As needed to supply With both offsite circuits inoperable. offsite circuits to safety-related power source supported functions. circuits inoperable, buses Success of these top sufficient onsite AC events requires that sources are power remain available to available to the maintain the unit in applicable bus for a safe shutdown 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . condition in the event of a design basis accident or transient.

3.8.1.F (U1 & One required offsite Two qualified Yes Provide power One offsite AC As needed to supply U2) circuit inoperable. offsite circuits to safety-related power source supported functions.

AND AND buses AND Success of these top One required Unit 1 Four separate and Three of four events requires that and 2 DG inoperable. independent U1 & U1 and U2 power remain U2 DGs DGs available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.1.F (U3) One required offsite Two qualified Yes Provide power One offsite AC As needed to supply circuit inoperable. offsite circuits to safety-related power source supported functions.

AND AND buses AND Success of these top One Unit 3 DG Four separate and Three of four events requires that inoperable. independent U3 U3 DGs power remain DGs available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.4.A (U1 & One Unit DC Three 250 VDC Yes Provide motive One DC As needed to supply U2) electrical power Unit subsystems and control subsystem supported functions.

subsystem AND power for inoperable Success of these top inoperable. Four 250 VDC selected safety- (2 of 3 250 events requires that OR shutdown board related VDC Unit power remain One Unit 1 and 2 subsystems equipment subsystems, available to the Shutdown Board DC AND 3 of 4 250 applicable bus for electrical power Four Unit 2 and VDC shutdown 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

CNL-21-009 E1-14 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments subsystem Two Unit 3 DG DC board inoperable. subsystems subsystems) 3.8.4.A (U3) One Unit DC Three 250 VDC Yes Provide motive One DC As needed to supply electrical power Unit subsystems and control subsystem supported functions.

subsystem AND power for inoperable Success of these top inoperable. Four 250 VDC selected safety- (2 of 3 250 events requires that OR shutdown board related VDC Unit power remain 3EB Shutdown Board subsystems equipment subsystems, available to the DC electrical power AND 3 of 4 250 applicable bus for subsystem Four Unit 2 and VDC shutdown 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

inoperable. Two Unit 3 DG DC board subsystems subsystems) 3.8.7.A (U1 & One Unit 1 and 2 4.16 Four Unit 1 and 2 Yes Distribute 4.16 One of two As needed to supply U2) kV Shutdown Board 4.16 kV shutdown kV power to divisions supported functions.

inoperable. boards required loads Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.A (U3) One Unit 3 4.16 kV Four Unit 3 4.16 Yes Distribute 4.16 One of two As needed to supply Shutdown Board kV shutdown kV power to divisions supported functions.

inoperable. boards required loads Success of these top events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.B (U1) One Unit 1 480 V 480 VAC Yes Distribute 480 V One of two As needed to supply Shutdown Board shutdown boards power to Unit 1 480 V supported functions.

inoperable. and associated required loads shutdown Success of these top OR load centers and boards events requires that 480 V (reactor motor transformers One of two power remain operated valve 480 V RMOV available to the (RMOV)) Board 1A boards (1A or applicable bus for inoperable. 1B) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

CNL-21-009 E1-15 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments OR 480 V RMOV Board 1 B inoperable.

3.8.7.B (U2) One Unit 2 480 V 480 VAC Yes Distribute 480 V One of two As needed to supply Shutdown Board shutdown boards power to Unit 2 480 V supported functions.

inoperable. and associated required loads shutdown Success of these top OR load centers and boards events requires that 480 V RMOV Board transformers One of two power remain 2A inoperable. 480 V RMOV available to the OR boards (2A or applicable bus for 480 V RMOV Board 2B) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2B inoperable.

3.8.7.B (U3) One Unit 3 480 V 480 VAC Yes Distribute 480 V One of two As needed to supply Shutdown Board shutdown boards power to Unit 3 480 V supported functions.

inoperable. and associated required loads shutdown Success of these top OR load centers and boards events requires that 480 V RMOV Board transformers One of two power remain 3A inoperable. 480 V RMOV available to the OR boards (3A or applicable bus for 480 V RMOV Board 3B) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3B inoperable.

3.8.7.C (U1) One Unit 1 and 2 DG Two Units 1 and 2 Yes Distribute 480 V One of two As needed to supply Auxiliary Board 480 V diesel power to Units 1 and 2 supported functions.

inoperable. auxiliary boards required loads 480 V diesel Success of these top auxiliary events requires that boards power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.D (U1) One Unit DC Board Three Unit DC and Yes Distribute DC All but one DC As needed to supply inoperable. associated 250 V power to board supported functions.

OR DC RMOV boards required loads operable. Success of these top One Unit 1 and 2 AND events requires that Shutdown Board DC Five Shutdown Two of three power remain Distribution Panel Board 250 V DC unit battery available to the CNL-21-009 E1-16 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments inoperable. electrical power boards applicable bus for OR distribution 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

250 V DC RMOV subsystems Three of four Board 1A inoperable. Unit 1 & 2 OR Shutdown 250 V DC RMOV Boards Board 1 B inoperable.

OR Two of three 250 V DC RMOV RMOV Boards Board 1 C inoperable.

3.8.7.D (U2) One Unit 1 and 2 DG Two Units 1 and 2 Yes Distribute 480 V One of two As needed to supply Auxiliary Board 480 V diesel power to Units 1 and 2 supported functions.

inoperable. auxiliary boards required loads 480 V diesel Success of these top auxiliary events requires that boards power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.D (U3) One Unit 3 DG Two Unit 3 480 V Yes Distribute 480 V One of two As needed to supply Auxiliary Board diesel auxiliary power to Unit 3 480 V supported functions.

inoperable. boards required loads diesel auxiliary Success of these top boards events requires that power remain available to the applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.8.7.E (U1) Unit 1 and 2 4.16 kV Four Unit 1 and 2 Yes Distribute 4.16 One of two As needed to supply Shutdown Board A 4.16 kV shutdown kV power to divisions supported functions.

and B inoperable. boards, divided required loads Success of these top OR into two divisions events requires that Unit 1 and 2 4.16 kV power remain Shutdown Board C available to the and D inoperable. applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

CNL-21-009 E1-17 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments 3.8.7.E (U2) One Unit DC Board Three Unit DC and Yes Distribute DC All but one DC As needed to supply inoperable. associated 250 V power to board supported functions.

OR DC RMOV boards required loads operable. Success of these top One Unit 1 and 2 AND events requires that Shutdown Board DC Five Shutdown Two of three power remain Distribution Panel Board 250 V DC unit battery available to the inoperable. electrical power boards applicable bus for OR distribution 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

250 V DC RMOV subsystems Three of four Board 2A inoperable. Unit 1 & 2 OR Shutdown 250 V DC RMOV Boards Board 2B inoperable.

OR Two of three 250 V DC RMOV RMOV Boards Board 2 C inoperable.

3.8.7.E (U3) One Unit DC Board Three Unit DC and Yes Distribute DC All but one DC As needed to supply inoperable. associated 250 V power to board supported functions.

OR DC RMOV boards required loads operable. Success of these top Shutdown Board DC AND events requires that Distribution Panel Shutdown Board Two of three power remain 3EB inoperable DC Distribution unit battery available to the OR Panel 3EB boards applicable bus for 250 V DC RMOV 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Board 3A inoperable. Three of four OR Unit 1 & 2 250 V DC RMOV Shutdown Board 3B inoperable. Boards OR 250 V DC RMOV Two of three Board 3 C inoperable. RMOV Boards 3.8.7.F (U3) Unit 3 4.16 kV Four Unit 3 4.16 Yes Distribute 4.16 One of two As needed to supply Shutdown Board 3EA kV shutdown kV power to divisions supported functions.

and 3EB inoperable. boards, divided required loads Success of these top OR into two divisions events requires that Unit 3 4.16 kV power remain CNL-21-009 E1-18 of 46

ENCLOSURE 1 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Technical Specification SSCs Covered by SSCs Function Design (TS) TS Condition TS LCO Modeled in Required by TS Success PRA Success Condition Description Condition PRA? LCO Condition Criteria Criteria Other Comments Shutdown Board 3EC available to the and 3ED inoperable. applicable bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

NOTES to Table E1-1:

The affected functions for Technical Specification 3.3.6.1.A are as follows:

1. Main Steam Line Isolation - h. Reactor Vessel Water Level - Low, Level 3 (Function 5.h)

a. Reactor Vessel Water Level - Low Low Low, Level 1 (Function 1.a) 6. Shutdown Cooling System Isolation -

b. Main Steam Line Pressure - Low (Function 1.b) a. Reactor Steam Dome Pressure - High (Function 6.a)

c. Main Steam Line Flow - High (Function 1.c)

b. Reactor Vessel Water Level - Low, Level 3 (Function 6.b)

d. Main Steam Tunnel Temperature - High (Function 1.d)

2. Primary Containment Isolation - c. Drywell Pressure - High (Function 6.c)

a. Reactor Vessel Water Level - Low, Level 3 (Function 2.a)

b. Drywell Pressure - High (Function 2.b)

3. High Pressure Coolant Injection (HPCI) System Isolation -

a. HPCI Steam Line Flow - High (Function 3.a)

b. HPCI Steam Supply Line Pressure - Low (Function 3.b)

c. HPCI Turbine Exhaust Diaphragm Pressure - High (Function 3.c)

d. HPCI Steam Line Space HPCI Pump Room Area Temperature - High (Function 3.d)

e. HPCI Steam Line Space Torus Area (Exit) Temperature - High (Function 3.e)

f. HPCI Steam Line Space Torus Area (Midway) Temperature - High (Function 3.f)

g. HPCI Steam Line Space Torus Area (Entry) Temperature - High (Function 3.g)

4. Reactor Core Isolation Cooling (RCIC) System Isolation -

a. RCIC Steam Line Flow - High (Function 4.a)

b. RCIC Steam Supply Line Pressure - Low (Function 4.b)

c. RCIC Turbine Exhaust Diaphragm Pressure - High (Function 4.c)

d. RCIC Steam Line Space HPCI Pump Room Area Temperature - High (Function 4.d)

e. RCIC Steam Line Space Torus Area (Exit) Temperature - High (Function 4.e)

f. RCIC Steam Line Space Torus Area (Midway) Temperature - High (Function 4.f)

g. RCIC Steam Line Space Torus Area (Entry) Temperature - High (Function 4.g)

5. Reactor Water Cleanup (RWCU) System Isolation -

a. Main Steam Valve Vault Area Temperature - High (Function 5.a)

b. Pipe Trench Area Temperature - High (Function 5.b)

c. Pump Room A Area Temperature - High (Function 5.c)

d. Pump Room B Area Temperature - High (Function 5.d)

e. Heat Exchanger Room Area (West Wall) Temperature - High (Function 5.e)

f. Heat Exchanger Room Area (East Wall) Temperature - High (Function 5.f)

g. SLC System Initiation (Function 5.g)

CNL-21-009 E1-19 of 46

Enclosure 1

3. EXAMPLE RICT CALCULATIONS Examples of calculated RICTs are provided in Table E1-2 through E1-4 (for each Unit, respectively) for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable). These example calculations demonstrate the scope of the SSCs covered by technical specifications modeled in the PRA, and other non-TS SSCs credited by the PRA. Note that the more limiting of the core damage frequency (CDF) and large early release frequency (LERF) RICT result is shown.

Following TSTF-505 implementation, the actual RICT values will be calculated using the actual plant configuration and the current revision of the PRA models representing the as-built, as-operated condition of the plant, as required by NEI 06-09-A, Revision 0 and the NRC safety evaluation, and may differ from the RICTs presented.

The RICTs were calculated for each TS condition using the method outlined in NEI 06-09-A

[Reference 2] shown below. The same equation was used to calculate the LERF RICT by simply using the RICT incremental conditional large early release probability (ICLERP) Limit and

¨LERF instead.

365 1

The RICT incremental conditional core damage probability (ICCDP) limit is 1.00E-05, while the RICT ICLERP) limit is 1.00E-06. The RICTs are limited to a maximum of thirty (30) days, and to a minimum of the original TS completion time.

The RICT calculations are examples for the purposes of this Enclosure. Following TSTF-505 implementation, the RICT will be calculated using the actual plant configuration and may deviate from the example values.

Table E1-2: Example RICT Calculations for BFN Unit 1 Unit 1 RICT TS LCO Condition Estimate (1)

(Days) 3.1.7.A One SLC subsystem inoperable. 30.0 0.1 (No 3.3.1.1.A One or more required channels inoperable. Voluntary Entry) (2)

NOTE: Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f. 0.1 (No 3.3.1.1.B One or more Functions with one or more required channels inoperable Voluntary in both-trip systems. Entry) (2)

One or more feedwater and main turbine high water level trip channels 3.3.2.2.A 30.0 inoperable, in one trip system.

3.3.4.2.A One or more channels inoperable. 30.0 3.3.5.1.B As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.C As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 CNL-21-009 E1 20 of 46

ENCLOSURE 1 Table E1-2: Example RICT Calculations for BFN Unit 1 Unit 1 RICT TS LCO Condition Estimate (1)

(Days) 3.3.5.1.E As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.F As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.G As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.3.B As required by Required Action A.1 and referenced in Table 3.3.5.3-1. 30.0 0.8 (No 3.3.6.1.A One or more required channels inoperable. Voluntary Entry) (2)

One degraded voltage relay channel inoperable on one or more shutdown board(s) 3.3.8.1.A AND 30.0 The loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

One low pressure ECCS injection/spray subsystem inoperable 3.5.1.A OR 30.0 One LPCl pump in both LPCI subsystems inoperable.

3.5.1.C High pressure coolant injection (HPCI) system inoperable. 30.0 HPCI system inoperable 3.5.1.D AND 30.0 Condition A entered.

3.5.1.E One ADS valve inoperable 30.0 One ADS valve inoperable 3.5.1.F AND 30.0 Condition A entered.

3.5.3.A Reactor core isolation cooling (RCIC) system inoperable. 30.0 Primary containment air lock inoperable for reasons other than 3.6.1.2.C 19.9 Condition A or B.

NOTE: Only applicable to penetration flow paths with two PCIVs.

3.6.1.3.A One or more penetration flow paths with one PCIV inoperable except 19.9 due to MSIV leakage not within limits.

3.6.2.3.B Two RHR suppression pool cooling subsystems inoperable. 30.0 3.6.2.4.B Two RHR suppression pool spray subsystems inoperable. 30.0 3.6.2.5.B Two RHR drywell spray subsystems inoperable. 30.0 3.7.1.C Two required RHRSW pumps inoperable. 30.0 3.7.1.D Two RHRSW subsystems inoperable. 30.0 CNL-21-009 E1-21 of 46

ENCLOSURE 1 Table E1-2: Example RICT Calculations for BFN Unit 1 Unit 1 RICT TS LCO Condition Estimate (1)

(Days)

One required emergency equipment cooling water (EECW) pump 3.7.2.A 30.0 inoperable.

3.8.1.A One required offsite circuit inoperable. 23.7 3.8.1.B One required Unit 1 and 2 DG inoperable. 30.0 3.8.1.E Two required offsite circuits inoperable. 20.7 One required offsite circuit inoperable 3.8.1.F AND 5.7 One required Unit 1 and 2 DG inoperable.

One Unit DC electrical power subsystem inoperable OR 3.8.4.A 17.7 One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable.

3.8.7.A One Unit 1 and 2 4.16 kV Shutdown Board inoperable. 30.0 One Unit 1 480 V Shutdown Board inoperable OR 3.8.7.B 480 V RMOV Board 1A inoperable. 19.6 OR 480 V RMOV Board 1 B inoperable.

3.8.7.C One Unit 1 and 2 DG Auxiliary Board inoperable. 30.0 (U1)

One Unit DC Board inoperable OR One Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable OR 3.8.7.D 250 V DC RMOV Board 1A inoperable 7.9 OR 250 V DC RMOV Board 1 B inoperable OR 250 V DC RMOV Board 1 C inoperable.

Unit 1 and 2 4.16 kV Shutdown Board A and B inoperable 3.8.7.E OR 7.5 Unit 1 and 2 4.16 kV Shutdown Board C and D inoperable.

Notes to Table E1-2:

(1) RICTs are based on the One-Top Multi-Hazard Model (OTMHM) PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest tenth of a day.

(2) Per NEI 06-09-A, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be voluntarily entered. However, it is possible that the LCO could be entered for an emergent failure and RICT entry would be allowed.

CNL-21-009 E1-22 of 46

ENCLOSURE 1 Table E1-3: Example RICT Calculations for BFN Unit 2 Unit 2 RICT TS LCO Condition Estimate (1)

(Days) 3.1.7.A One SLC subsystem inoperable. 30.0 0.1 (No 3.3.1.1.A One or more required channels inoperable. Voluntary Entry) (2)

NOTE: Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f. 0.1 (No 3.3.1.1.B One or more Functions with one or more required channels inoperable Voluntary in both trip systems. Entry) (2)

One or more feedwater and main turbine high water level trip channels 3.3.2.2.A 30.0 inoperable, in one trip system.

3.3.4.2.A One or more channels inoperable. 30.0 3.3.5.1.B As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.C As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.E As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.F As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.G As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.3.B As required by Required Action A.1 and referenced in Table 3.3.5.3-1. 30.0 0.7 (No 3.3.6.1.A One or more required channels inoperable. Voluntary Entry) (2)

One degraded voltage relay channel inoperable on one or more shutdown board(s) 3.3.8.1.A AND 30.0 The loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

One low pressure ECCS injection/spray subsystem inoperable 3.5.1.A OR 30.0 One LPCl pump in both LPCI subsystems inoperable.

3.5.1.C HPCI System inoperable. 30.0 HPCI System inoperable 3.5.1.D AND 30.0 Condition A entered.

3.5.1.E One ADS valve inoperable. 30.0 One ADS valve inoperable 3.5.1.F AND 30.0 Condition A entered.

3.5.3.A RCIC System inoperable. 30.0 CNL-21-009 E1-23 of 46

ENCLOSURE 1 Table E1-3: Example RICT Calculations for BFN Unit 2 Unit 2 RICT TS LCO Condition Estimate (1)

(Days)

Primary containment air lock inoperable for reasons other than 3.6.1.2.C 11.7 Condition A or B.

NOTE: Only applicable to penetration flow paths with two PCIVs.

3.6.1.3.A One or more penetration flow paths with one PCIV inoperable except 11.7 due to MSIV leakage not within limits.

3.6.2.3.B Two RHR suppression pool cooling subsystems inoperable. 30.0 3.6.2.4.B Two RHR suppression pool spray subsystems inoperable. 30.0 3.6.2.5.B Two RHR drywell spray subsystems inoperable. 30.0 3.7.1.C Two required RHRSW pumps inoperable. 30.0 3.7.1.D Two RHRSW subsystems inoperable. 30.0 3.7.2.A One required EECW pump inoperable. 30.0 3.8.1.A One required offsite circuit inoperable. 21.1 3.8.1.B One required Unit 1 and 2 DG inoperable. 30.0 3.8.1.E Two required offsite circuits inoperable. 17.3 One required offsite circuit inoperable 3.8.1.F AND 7.5 One required Unit 1 and 2 DG inoperable.

One Unit DC electrical power subsystem inoperable OR 3.8.4.A 21.0 One Unit 1 and 2 Shutdown Board DC electrical power subsystem inoperable.

3.8.7.A One Unit 1 and 2 4.16 kV Shutdown Board inoperable. 30.0 One Unit 2 480 V Shutdown Board inoperable OR 3.8.7.B 480 V RMOV Board 2A inoperable 9.3 OR 480 V RMOV Board 2B inoperable.

3.8.7.D One Unit 1 and 2 DG Auxiliary Board inoperable. 30.0 One Unit DC Board inoperable OR One Unit 1 and 2 Shutdown Board DC Distribution Panel inoperable OR 3.8.7.E 250 V DC RMOV Board 2A inoperable 19.2 OR 250 V DC RMOV Board 2B inoperable OR 250 V DC RMOV Board 2 C inoperable.

CNL-21-009 E1-24 of 46

ENCLOSURE 1 Table E1-3: Example RICT Calculations for BFN Unit 2 Unit 2 RICT TS LCO Condition Estimate (1)

(Days)

Unit 1 and 2 4.16 kV Shutdown Board A and B inoperable 3.8.7.F OR 10.8 Unit 1 and 2 4.16 kV Shutdown Board C and D inoperable Notes to Table E1-3:

(1) RICTs are based on the OTMHM PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest tenth of a day.

(2) Per NEI 06-09-A, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be voluntarily entered. However, it is possible that the LCO could be entered for an emergent failure and RICT entry would be allowed.

Table E1-4: Example RICT Calculations for BFN Unit 3 Unit 3 RICT TS LCO Condition Estimate (1)

(Days) 3.1.7.A One SLC subsystem inoperable. 30.0 0.1 (No 3.3.1.1.A One or more required channels inoperable. Voluntary Entry) (2)

NOTE: Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f. 0.1 (No 3.3.1.1.B One or more Functions with one or more required channels inoperable Voluntary in both-trip systems. Entry) (2)

One or more feedwater and main turbine high water level trip channels 3.3.2.2.A 30.0 inoperable, in one trip system.

3.3.4.2.A One or more channels inoperable. 30.0 3.3.5.1.B As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.C As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.E As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.F As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.1.G As required by Required Action A.1 and referenced in Table 3.3.5.1-1. 30.0 3.3.5.3.B As required by Required Action A.1 and referenced in Table 3.3.5.3-1. 30.0 0.3 (No 3.3.6.1.A One or more required channels inoperable. Voluntary Entry) (2)

One degraded voltage relay channel inoperable on one or more shutdown board(s) 3.3.8.1.A AND 30.0 The loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

CNL-21-009 E1-25 of 46

ENCLOSURE 1 Table E1-4: Example RICT Calculations for BFN Unit 3 Unit 3 RICT TS LCO Condition Estimate (1)

(Days)

One low pressure ECCS injection/spray subsystem inoperable 3.5.1.A OR 30.0 One LPCl pump in both LPCI subsystems inoperable.

3.5.1.C HPCI system inoperable. 30.0 HPCI system inoperable 3.5.1.D AND 30.0 Condition A entered.

3.5.1.E One ADS valve inoperable. 30.0 One ADS valve inoperable 3.5.1.F AND 30.0 Condition A entered.

3.5.3.A RCIC System inoperable. 30.0 Primary containment air lock inoperable for reasons other than 3.6.1.2.C 17.6 Condition A or B.

NOTE: Only applicable to penetration flow paths with two PCIVs.

3.6.1.3.A One or more penetration flow paths with one PCIV inoperable except 17.6 due to main steam isolation valve (MSIV) leakage not within limits.

3.6.2.3.B Two RHR suppression pool cooling subsystems inoperable. 30.0 3.6.2.4.B Two RHR suppression pool spray subsystems inoperable. 30.0 3.6.2.5.B Two RHR drywell spray subsystems inoperable. 30.0 3.7.1.C Two required RHRSW pumps inoperable. 30.0 3.7.1.D Two RHRSW subsystems inoperable. 30.0 3.7.2.A One required EECW pump inoperable. 30.0 3.8.1.A One required offsite circuit inoperable. 12.9 3.8.1.B One required Unit 3 DG inoperable. 30.0 3.8.1.E Two required offsite circuits inoperable. 12.9 One required offsite circuit inoperable 3.8.1.F AND 4.0 One Unit 3 DG inoperable.

One Unit DC electrical power subsystem inoperable 3.8.4.A OR 16.0 3EB Shutdown Board DC electrical power subsystem inoperable.

3.8.7.A One Unit 3 4.16 kV Shutdown Board inoperable. 30.0 CNL-21-009 E1-26 of 46

ENCLOSURE 1 Table E1-4: Example RICT Calculations for BFN Unit 3 Unit 3 RICT TS LCO Condition Estimate (1)

(Days)

One Unit 3 480 V Shutdown Board inoperable.

OR 3.8.7.B 480 V RMOV Board 3A inoperable. 5.7 OR 480 V RMOV Board 3B inoperable.

3.8.7.D One Unit 3 DG Auxiliary Board inoperable. 30.0 One Unit DC Board inoperable OR Shutdown Board DC Distribution Panel 3EB inoperable OR 3.8.7.E 250 V DC RMOV Board 3A inoperable 5.7 OR 250 V DC RMOV Board 3B inoperable OR 250 V DC RMOV Board 3 C inoperable.

Unit 3 4.16 kV Shutdown Board 3EA and 3EB inoperable 3.8.7.F OR 9.5 Unit 3 4.16 kV Shutdown Board 3EC and 3ED inoperable.

Notes to Table E1-4:

(1) RICTs are based on the OTMHM PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest tenth of a day.

(2) Per NEI 06-09-A, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be voluntarily entered. However, it is possible that the LCO could be entered for an emergent failure and RICT entry would be allowed.

4. ADDITIONAL JUSTIFICATION FOR SPECIFIC ACTIONS This section contains the additional technical justification for the list of Required Actions from Table 1, Conditions Requiring Additional Technical Justification of TSTF-505, Revision 2.

TVAs additional justification for each of the identified BFN TS is provided below.

4.1 TS 3.6.1.2 - Primary Containment Air Lock LCO: The primary containment air lock shall be OPERABLE.

Condition C: Primary containment air lock inoperable for reasons other than Condition A or B.

As indicated in Table E1-1, the Primary Containment Air Lock is not explicitly modeled in the BFN PRA. The Design Success Criteria is one of two containment airlock doors intact. The PRA Success Criteria is essentially the same with containment isolation. A loss of primary containment isolation capability via one of the modeled pathways is a conservative surrogate in the PRA.

CNL-21-009 E1-27 of 46

ENCLOSURE 1 One primary containment air lock double door has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBA). The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

Compliance with the remaining portions of TS 3.6.1.2 ensures that there is a physical barrier (i.e., closed door) and an acceptable overall leakage from containment. Thus, the function is still maintained. Required Action C.1 of TS 3.6.1.2 requires the condition to be assessed in accordance with TS 3.6.1.1, Primary Containment (i.e., initiate action to evaluate overall primary containment leakage rate per LCO 3.6.1.1, using current air lock test results with a Completion Time of immediately).

Because it is confirmed that there is no loss of function, TS 3.6.1.2 Condition C meets the requirements for inclusion in the RICT Program.

5. EVALUATION OF INSTRUMENTATION AND CONTROL SYSTEMS The following Instrumentation Technical Specifications (TS) Sections are included in the TSTF-505 application for BFN:

1. TS 3.3.1.1 - Reactor Protection System (RPS) Instrumentation

2. TS 3.3.2.2 - Feedwater Pump and Main Turbine High Water Level Trip Instrumentation

3. TS 3.3.4.2 - Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation

4. TS 3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation

5. TS 3.3.5.3 - Reactor Core Isolation Cooling (RCIC) System Instrumentation

6. TS 3.3.6.1 - Primary Containment Isolation Instrumentation

7. TS 3.3.8.1 - Loss-of-Power (LOP) Instrumentation The BFN TS Section 3.3 Limiting Conditions for Operation (LCOs) were developed to assure that BFN maintains necessary redundancy and diversity, compliant with the "single failure" design criterion as licensed in comparison with IEEE-279-1971.

TSTF-505 sets forth the following as guidance for what is to be included in this enclosure.

The description of proposed changes to the protective instrumentation and control features in TS Section 3.3, "Instrumentation," should confirm that at least one redundant or diverse means (other automatic features or manual action) to accomplish the safety functions (for example, reactor trip, SI, containment isolation, etc.) remains available during use of the RICT, consistent with the defense-in-depth philosophy as specified in RG 1.174. (Note that for each application, the staff may selectively audit the licensing basis of the most risk-significant functions with proposed RICTs to verify that such diverse means exist.)

The BFN instrumentation design creates defense-in-depth due to the redundancy of the channels for each function, as described in the following tables. In general, the following principles apply to each BFN instrumentation system (see Tables E1-5, E1-6, E1-7, E1-8, E1-9, E1-10, and E1-11 for specific details).

CNL-21-009 E1-28 of 46

ENCLOSURE 1 x Each function has multiple channels.

x A failed channel does not cause or prevent a trip/actuation.

x When applicable, if 1 channel in the function is out-of-service, then the 1 channel can be placed in trip.

The following sections provide the justification that defense-in-depth is maintained for the applicable functions throughout the application of the RICT Program. Note that the following tables include a complete description of the functions for the instrumentation TS covered in this section, whereas Table E1-1 only includes those functions in scope of the RICT Program.

5.1 TS 3.3.1.1 - Reactor Protection System (RPS) Instrumentation The RPS Instrumentation employs diversity in the number and variety of different inputs which will actuate the associated equipment. The RPS, as described in the BFN Final Safety Analysis Report (FSAR), Section 7.2, includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve fast closure oil pressure, turbine stop valve position, drywell pressure, and scram discharge volume water level, as well as reactor mode switch in shutdown position, manual scram signals, and RPS channel test switch scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown and manual scram signals). Some channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic.

Table E1-5 below presents the TS 3.3.1.1 logic descriptions for all the functions listed in TS Table 3.3.1.1-1.

Table E1-5: RPS Instrumentation Diversity Function Logic Logic Description Intermediate Range Monitors (IRMs)

Function 1.a, Neutron 2/8 The IRM System is divided into two trip systems, Flux-High with four IRM channels inputting to each trip system.

One channel in each trip system is allowed to be bypassed. One IRM channel tripped in each RPS trip system causes a SCRAM. The eight channels are arranged in a one-out-of-four taken twice logic Function 1.b, Inop. 2/8 See Function 1.a.

Average Power Range Monitors (APRMs)

Function 2.a, Neutron 2/4 APRM System is divided into four APRM channels Flux-High (Setdown) and four 2-out-of-4 voter channels. Each APRM channel provides inputs to each of the four voter channels. The four voter channels are divided into two groups of two each; with each group of two providing CNL-21-009 E1-29 of 46

ENCLOSURE 1 Function Logic Logic Description inputs to one RPS trip system. The system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one un-bypassed APRM will result in a "half-trip in all four of the voter channels, but no trip inputs to either RPS trip system.

Function 2.b, Flow Biased 2/4 See Function 2.a above.

Simulated Thermal Power -

High Function 2.c, Neutron Flux - 2/4 See Function 2.a above.

High Function 2.d, Inop. 2/4 See Function 2.a above.

Function 2.e, 2-Out-Of-4 2/4 The 2-Out-Of-4 Voter function includes separate Voter outputs to RPS for the two independently voted sets of Functions, each of which is redundant (four total outputs). The logic is one-out-of-two taken twice.

Function 2.f, Oscillation Power 2/4 See Function 2.a above.

Range Monitor Upscale Function 3, Reactor 2/4 Four channels, with two channels in each RPS trip Vessel Steam Dome system, arranged in a one-out-of-two taken twice Pressure - High logic.

Function 4, Reactor Vessel 2/4 Four channels, with two channels in each RPS trip Water Level - Low, Level 3 system, are arranged in a one-out-of-two taken twice logic.

Function 5, Main Steam 6/16 Each of the eight MSIVs has two position switches; Isolation Valve - Closure one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve - Closure channels. The logic is arranged such that either the inboard or outboard valve on three or more of the main steam lines must be < 90% open in order for a SCRAM to occur.

Function 6, Drywell Pressure 2/4 Four channels, with two channels in each RPS trip

-High system, arranged in a one-out-of-two taken twice logic.

Scram Discharge Volume WaterLevel - High Function 7.a, Resistance 2/4 Scram Discharge Volume (SDV) water level is Temperature Detector measured by two diverse methods. The level in each of the two SDVs is measured by two float type level switches and two thermal probes for a total of eight level signals. The outputs of these devices are arranged so that there is a signal from a level switch and a thermal probe to each RPS logic channel. These combinations are arranged in a one-out-of-two taken twice logic.

Function 7.b, Float Switch 2/4 See Function 7.a above.

CNL-21-009 E1-30 of 46

ENCLOSURE 1 Function Logic Logic Description Function 8, Turbine Stop 6/8 Signals are initiated from position switches located on Valve -Closure each of the four Turbine Stop Valves (TSV). One of the two switches provides input to RPS trip system A; the other to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop Valve - Closure channels, each consisting of one position switch. The logic for the Turbine Stop Valve -

Closure Function is such that three or more TSVs must be < 90% open to produce a scram.

Function 9, Turbine Control 2/4 Four channels of Turbine Control Valve Fast Closure, ValveFast Closure, Trip Oil Trip Oil Pressure - Low Function with two channels in Pressure - Low each trip system arranged in a one-out-of-two taken twice logic.

Function 10, Reactor Mode 2/2 Each RPS trip system contains one Manual Scram Switch - Shutdown Position logic channel that is redundant to the two automatic trip channels. Actuation of both Manual Scram logic channels will result in a full reactor scram. The Reactor Mode Switch is a mechanical switch which provides a direct input into both Manual Scram channels when placed in the Shutdown position.

Function 11, Manual Scram 2/2 Each RPS Trip System contains one Manual Scram logic channel that is redundant to the two automatic trip channels. Actuation of both Manual Scram logic channels will result in a full reactor scram. There is one Manual Scram push button channel for each of the RPS manual scram logic channels.

Function 12, RPS Channel 2/4 Four channels of the RPS Channel Test Switch Test Switches Function with two channels in each trip system arranged in a one-out-of-two taken twice logic.

5.2 TS 3.3.2.2 - Feedwater Pump and Main Turbine High Water Level Trip Instrumentation The Feedwater Pump and Main Turbine High Water Level Trip Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a feedwater pump and main turbine trip signal to the trip logic.

Table E1-6 below presents the logic descriptions for the functions in TS 3.3.2.2.

Table E1-6: Feedwater Pump and Main Turbine High Water Level Trip Instrumentation Diversity Function Logic Description CNL-21-009 E1-31 of 46

ENCLOSURE 1 Reactor Vessel Water 2/2 There are two high water level trip systems each Level-High containing two channels of Reactor Vessel Water Level - High instrumentation with a two-out-of-two taken once initiation logic. Actuation of either trip system will trip the three feedwater pump turbines and the main turbine.

5.3 TS 3.3.4.2 - Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation The ATWS-RPT Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The ATWS-RPT System, as described in Final Safety Analysis Report Section 7.19, includes sensors, relays, bypass capability, circuit breakers, and switches that are necessary to cause initiation of an RPT. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an ATWS-RPT signal to the trip logic.

Table E1-7 below presents the logic descriptions for the functions in TS 3.3.4.2:

Table E1-7: ATWS-RPT Instrumentation Diversity Function Logic Logic Description Reactor Vessel Water Level - 2/4 The ATWS-RPT trip logic consists of two Low Low, Level 2 independent trip systems, with two channels of Reactor Steam Dome Pressure - High and two channels of Reactor Vessel Water Level - Low Low, Level 2 in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each Function.

Thus, either two Reactor Vessel Water Level - Low Low, Level 2 or two Reactor Pressure - High signals are needed to trip a trip system. The output of either trip system will trip both recirculation pumps motor breakers.

Reactor Vessel Steam Dome 2/4 The ATWS-RPT trip logic consists of two Pressure - High independent trip systems, with two channels of Reactor Steam Dome Pressure - High and two channels of Reactor Vessel Water Level - Low Low, Level 2 in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each Function.

Thus, either two Reactor Vessel Water Level - Low Low, Level 2 or two Reactor Pressure - High signals are needed to trip a trip system. The output of either trip system will trip both recirculation pumps motor breakers.

5.4 TS 3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation The ECCS instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The ECCS instrumentation actuates CS, LPCI, CNL-21-009 E1-32 of 46

ENCLOSURE 1 HPCI, ADS, and the emergency diesel generators (EDGs). The ECCS Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment.

Table E1-8 below presents the TS 3.3.5.1 logic descriptions for all of the functions listed in TSTable 3.3.5.1-1.

Table E1-8: ECCS Instrumentation Diversity Function Logic Logic Description Core Spray System Function 1.a, Reactor Vessel 2/4 Reactor water level is monitored by four redundant Water Level - Low Low Low, transmitters, which are, in turn, connected to four Level 1 trip units. The outputs of these trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) to initiate CS.

Function 1.b, Drywell Pressure - 2/4 Drywell pressure is monitored by four redundant High transmitters, which are, in turn, connected to four trip units. The outputs of these trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) to initiate CS.

Function 1.c, Reactor Steam 1/2 The Reactor Steam Dome Pressure - Low variable Dome Pressure - Low is monitored by two transmitters for each trip (Injection Permissive and system. The outputs from these transmitters are ECCS Initiation) connected to relays arranged in a one-out-of-two logic to initiate the injection permissive.

Function 1.d, Core Spray Pump 1/1 The CS pump discharge flow is monitored by a flow Discharge Flow - Low (Bypass) switch. When the pump is running and discharge flow is low enough so that pump overheating may occur, the minimum flow return line valve is opened.

The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the accident analysis.

Function 1.e, Core Spray Pump 1/1 There is one time delay relay per CS pump.

Start - Time Delay Relay Low Pressure Coolant Injection System Function 2.a, Reactor Vessel 2/4 Automatic initiation occurs for conditions of Reactor Water Level - Low Low Low, Vessel Water Level - Low Low Low, Level 1 or both Level 1 Drywell Pressure - High and Reactor Steam Dome Pressure - Low. Each of these diverse variables is monitored by four redundant transmitters, which, in turn, are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken CNL-21-009 E1-33 of 46

ENCLOSURE 1 Function Logic Logic Description twice logic (i.e., two trip systems) for each Function to initiate LPCI.

Function 2.b, Drywell Pressure - 2/4 Same as Function 2.a.

High Function 2.c, Reactor Steam 2/4 Same as Function 2.a.

Dome Pressure - Low (Injection Permissive and ECCS Initiation)

Function 2.d, Reactor Steam 2/4 The Reactor Steam Dome variable is monitored by Dome Pressure Permissive - four redundant transmitters, which are, in turn, Low (Recirculation Discharge connected to multiple trip units. The outputs of the Valve Permissive) trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

These instruments function to initiate closure of the recirculation pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines.

Function 2.e, Reactor Vessel 1/1 Low reactor water level in the shroud is detected by Water Level two additional instruments (one per subsystem) which inhibit the manual initiation of other modes of RHR (e.g., suppression pool cooling) when LPCI is required.

Function 2.f, Low Pressure 1/1 There is one time delay relay per LPCI pump.

Coolant Injection Pump Start -

Time Delay Relay High Pressure Coolant Injection System Function 3.a, Reactor Vessel 2/4 Four redundant transmitters are connected to Water Level - Low Low, Level 2 multiple trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic to initiate HPCI.

Function 3.b, Drywell Pressure - 2/4 Same as Function 3.a.

High Function 3.c, Reactor Vessel 2/2 Reactor Vessel Water Level - High signals for HPCI Water Level - High, Level 8 are initiated from two level transmitters from the narrow range water level measurement instrumentation. Both signals are required in order to close the HPCI turbine's stop valve.

Function 3.d, Condensate 1/2 Two level switches are used to detect low water Header Level - Low level in the condensate storage tank (CST). Either switch can cause the suppression pool suction valves to open and the CST suction valve to close (one-out-of-two logic).

CNL-21-009 E1-34 of 46

ENCLOSURE 1 Function Logic Logic Description Function 3.f, High Pressure 1/1 One flow switch is used to detect the HPCI System Coolant Injection Pump flowrate. The valve is automatically closed if flow is Discharge Flow - Low (Bypass) above the minimum flow setpoint to allow full system flow.

Automatic Depressurization System Trip Systems A and B Functions 4.a/5.a, Reactor 1/2 The ADS logic in each trip system is arranged in two Vessel Water Level - Low Low strings. Each string has a contact from Reactor Low, Level 1 Vessel Water Level - Low Low Low, Level 1; Drywell Pressure - High; High Drywell Pressure Bypass Timer; and Pump Discharge Pressure -

High. All contacts in both logic strings must close and the ADS initiation timer must time out to initiate an ADS trip system. Either the A or B trip system will cause all the ADS relief valves to open.

Functions 4.b/5.b, Drywell 1/2 See Function 4.a/5.a above Pressure - High Functions 4.c/5.c, Automatic 1/1 There are two ADS Initiation Timer relays, one in Depressurization System each of the two ADS trip systems.

Initiation Timer Functions 4.d/5.d, Reactor 1/1 Reactor Vessel Water Level - Low, Level 3 Vessel Water Level - Low, (Confirmatory) signals are initiated from two level Level 3 (Confirmatory) transmitters, one in each of the two ADS trip systems.

Functions 4.e/5.e, Core Spray 2/4 Pump discharge pressure signals are initiated from Pump Discharge Pressure - twelve pressure switches, two on the discharge side High of each RHR (LPCI) pump and one on the discharge side of each CS pump. There are two ADS low pressure ECCS pump permissives in each trip system. Each of these permissives receives inputs from all four RHR (LPCI) pumps (different signals for each permissive) and two CS pumps, one from each subsystem (different pumps for each permissive). In order to generate an ADS permissive in one trip system, it is necessary that only one LPCI pump or two CS pumps (CS pumps A or B and either C or D) indicate an adequate discharge pressure condition.

Functions 4.f/5.f, Low Pressure 2/8 See Function 4.e/5.e above.

Coolant Injection Pump Discharge Pressure - High Functions 4.g/5.g, Automatic 1/2 See Function 4.a/5.a above.

Depressurization System High Drywell Pressure Bypass Timer CNL-21-009 E1-35 of 46

ENCLOSURE 1 5.5 TS 3.3.5.3 - Reactor Core Isolation Cooling (RCIC) System Instrumentation The RCIC System instrumentation initiates actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable. RCIC Instrumentation employs diversity in the number of different inputs which will actuate the associated equipment.

Table E1-9 below presents the TS 3.3.5.3 logic descriptions for all of the functions listed in TS Table 3.3.5.3-1.

Table E1-9: RCIC System Instrumentation Diversity Function Logic Logic Description Function 1, Reactor Vessel 2/4 Four transmitters are connected to four trip units.

Water Level - Low Low, Level The outputs of the trip units are connected to relays 2 whose contacts are arranged in a one-out-of-two taken twice logic arrangement.

Function 2, Reactor Vessel 2/2 The Reactor Vessel Water Level - High trip is Water Level - High, Level 8 arranged ina two-out-of-two logic.

5.6 TS 3.3.6.1 - Primary Containment Isolation Instrumentation Primary containment isolation instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which outputs a primary containment isolation signal to the isolation logic.

Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL) flow measurement, (d) SLC system initiation, (e) MSL pressure, (f) HPCI and RCIC steam line flow, (g) drywell pressure, (h) HPCI and RCIC steam line pressure, (i) HPCI and RCIC turbine exhaust diaphragm pressure, and (j) reactor steam dome pressure. Redundant sensor input signals from each parameter are provided for the initiation of isolations. The only exception is SLC system initiation. Primary Containment Isolation instrumentation has inputs to the trip logic of the isolation functions listed below:

Table E1-10 below presents the TS 3.3.6.1 logic descriptions for all the functions listed in TS Table 3.3.6.1-1.

CNL-21-009 E1-36 of 46

ENCLOSURE 1 Table E1-10: Primary Containment Isolation Instrumentation Diversity Function Logic Description Main Steam Line Isolation Function 1.a, Reactor VesselWater 2/4 The Primary Containment Isolation System (PCIS)

Level - Low Low Low, Level 1 consists of two trip systems each containing two trip channels. PCIS trip system A has trip channels A1 and A2 and PCIS trip system B has trip channels B1 and B2.

The MSL Isolation Reactor Vessel Water Level - Low Low Low, Level 1 and Main Steam Line Pressure - Low functions each contain four channels with one input into each PCIS trip channel, A1, A2, B1 and B2. The PCIS trip channel output relays are arranged in logic systems for the MSL valves (separate logic systems for the inboard and outboard valves) such that PCIS trip channels A1 or A2 and B1 or B2 must trip (one-out-of-two taken twice logic) to cause an isolation of the MSIVs.

2/2 The PCIS trip channel output relays are arranged in logic systems for the MSL Drain Valves and Recirculation Loop Sample Valves such that both PCIS trip channels A1 and B1 must trip to isolate the inboard valves and both PCIS trip channels A2 and B2 must trip to isolate the outboard valves. This is effectively a two-out-of-two logic for each valve.

Function 1.b, Main Steam Line 2/4 See Function 1.a above.

Pressure - Low 2/2 See Function 1.a above.

Function 1.c, Main Steam Line Flow 2/4 The Main Steam Line Flow - High and Main Steam

- High Tunnel Temperature - High Functions each contain 16 channels. Each PCIS trip channel receives four inputs from each of these functions, one flow input from each MSL and one temperature input from each of the four areas monitored. Any one of these inputs will trip the associated PCIS trip channel. The four PCIS trip channels are arranged in a one-out-of-two taken twice logic.

Function 1.d, Main Steam Line 2/4 See Function 1.c above.

Tunnel Temperature - High Primary Containment Isolation Function 2.a, Reactor VesselWater 2/4 The PCIS consists of two trip systems each containing Level - Low, Level 3 two trip channels. PCIS trip system A has trip channels A1 and A2 and PCIS trip system B has trip channels B1 and B2. The MSL Isolation Reactor Vessel Water Level -

Low Low Low, Level 1 and Main Steam Line Pressure -

Low functions each contain four channels with one input into each PCIS trip channel, A1, A2, B1 and B2. The PCIS trip channel output relays are arranged in logic systems for the MSL valves (separate logic systems for the inboard and outboard valves) such that PCIS trip channels A1 or A2 and B1 or B2 must trip (one-out-of-CNL-21-009 E1-37 of 46

ENCLOSURE 1 Function Logic Description two taken twice logic) to cause an isolation of the MSIVs.

Function 2.b, Drywell Pressure - 2/4 See Function 2.a above.

High HPCI System Isolation Function 3.a, HPCI SteamLine 1/2 The Steam Line Flow - High Function for HPCI and Flow - High RCIC receive input from two channels, one per trip system. The channel output relays are arranged in logic systems using a one-out-of-two logic.

Function 3.b, HPCI Steam 2/4 The HPCI and RCIC Steam Supply Line Pressure - Low Supply Line Pressure - Low Functions contain four channels in a single trip system.

The Steam Supply Line Pressure - Low channels are arranged in a series of logic parallel pairs to form one-out-of-two taken twice logic.

Function 3.c, HPCI Turbine 2/4 The trip system for the HPCI and RCIC Turbine Exhaust Exhaust Diaphragm Pressure - Diaphragm Pressure - High Function contains two trip High channels. Each trip channel contains two instrument channels (logic parallel pair). The output relays for the trip channels are arranged in logic systems such that both trip channels must trip (effectively one-out-of-two taken twice logic for the instrument channels) to cause an isolation.

Function 3.d, HPCI Steam Line 2/4 The HPCI and RCIC Area Temperature - High Functions Space HPCI Pump Room Area each contain sixteen channels, four Pump Room Area Temperature - High and twelve Torus Area channels (four channels for each area monitored). Each trip system contains two trip channels; Logic A trip channel 1 and trip channel 2 and Logic B trip channel 1 and trip channel 2. Each trip channel receives one input from each of the four areas monitored. Any one of these inputs will trip the associated trip channel. The trip channel output relays are arranged in logic systems such that trip channel 1 of either the A or B Logic and trip channel 2 of either the A or B Logic must trip (one-out-of-two taken twice logic) to cause an isolation.

Function 3.e, HPCI Steam Line 2/4 See Function 3.d Space Torus Area (Exit)

Temperature - High Function 3.f, HPCI Steam Line 2/4 See Function 3.d Space Torus Area (Midway)

Temperature - High CNL-21-009 E1-38 of 46

ENCLOSURE 1 Function Logic Description Function 3.f, HPCI Steam Line 2/4 See Function 3.d Space Torus Area (Midway)

Temperature - High RCIC System Isolation Function 4.a, RCIC Steam Line 1/2 See Function 3.a Flow - High Function 4.b, RCIC Steam 2/4 See Function 3.b Supply Line Pressure - Low Function 4.c, RCIC Turbine 2/4 See Function 3.c Exhaust Diaphragm Pressure -

High Function 4.d, RCIC Steam Line 2/4 See Function 3.d Space HPCI Pump Room Area Temperature - High Function 4.e, RCIC Steam Line 2/4 See Function 3.d Space Torus Area (Exit)

Temperature - High Function 4.f, RCIC Steam Line 2/4 See Function 3.d Space Torus Area (Midway)

Temperature - High Reactor Water Cleanup System Isolation Function 5.a, Main Steam Valve 2/4 Each of the six Area Temperature - High Functions Vault Area Temperature - High contain four channels which monitor the area associated with the Function. One channel for each of these RWCU Isolation Functions are provided in each of the four PCIS trip channels (trip channels A1 and A2 for PCIS trip system A and trip channels B1 and B2 for PCIS trip system B). Any one of these inputs will trip the associated PCIS trip channel. The PCIS trip channel output relays are arranged in logic systems (one logic system for the inboard valve and one logic system for the outboard valve) such that PCIS trip channels A1 or A2 and B1 or B2 must trip (one-out-of-two taken twice logic) to cause an isolation.

Function 5.b, Pipe Trench Area 2/4 See Function 5.a above.

Temperature - High Function 5.c, Pump Room A 2/4 See Function 5.a above.

Area Temperature - High Function 5.d, Pump Room B 2/4 See Function 5.a above.

Area Temperature - High Function 5.e, Heat Exchanger 2/4 See Function 5.a above.

Room Area (West Wall)

Temperature - High CNL-21-009 E1-39 of 46

ENCLOSURE 1 Function Logic Description Function 5.f, Heat Exchanger 2/4 See Function 5.a above.

Room Area (East Wall)

Temperature - High Function 5.g, SLC Initiation 1/1 One SLC System Initiation signal provides logic input to close both RWCU valves.

Function 5.h, Reactor Vessel 2/4 The RWCU Isolation reactor Vessel Water Level -

Water Level - Low, Level 3 Low, Level 3 Function contain four channels. One channel for this RWCU Isolation Function is provided in each of the four PCIS trip channels (trip channels A1 and A2 for PCIS trip system A and trip channels B1 and B2 for PCIS trip system B). Any one of these inputs will trip the associated PCIS trip channel. The PCIS trip channel output relays are arranged in logic systems (one logic system for the inboard valve and one logic system for the outboard valve) such that PCIS trip channels A1 or A2 and B1 or B2 must trip (one-out-of-two taken twice logic) to cause an isolation.

Shutdown Cooling System Isolation Function 6.a, Reactor Steam 1/2 The Reactor Steam Dome Pressure - High Function Dome Pressure - High consists of two channels, one per trip system. The output relays from these channels are arranged in logic systems to provide one-out-of-two isolation logic to each RHR SDC isolation valve.

Function 6.b, Reactor Vessel 2/4 The Shutdown Cooling System Isolation Reactor Water Level - Low, Level 3 Vessel Water Level - Low, Level 3 and Drywell Pressure - High Functions each contain four channels.

One channel for each Function is provided in each of the four PCIS trip channels (trip channels A1 and A2 for PCIS trip system A and trip channels B1 and B2 for PCIS trip system B). Any one of these inputs will trip the associated PCIS trip channel. The PCIS trip channel output relays are arranged in logic systems (each division of logic provides a signal for one RHR LPCI Inboard Injection Valve and one RHR Shutdown Cooling Suction Isolation Valve) such that PCIS trip channels A1 or A2 and B1 or B2 must trip (one-out-of-two taken twice logic) to cause an isolation. Note -

Function 6.b is only required in Mode 3.

Function 6.c, Drywell Pressure - 2/4 See Function 6.b High

5.7 TS 3.3.8.1 - Loss-of-Power (LOP) Instrumentation Each 4.16 kV shutdown board has its own independent LOP instrumentation and associated trip logic. The voltage for each board is monitored at three levels, which can be considered as three different undervoltage Functions: Loss of Voltage, Unbalanced Voltage, and 4.16 kV Shutdown Board Undervoltage Degraded Voltage. Each Function causes various board transfers and disconnects.

CNL-21-009 E1-40 of 46

ENCLOSURE 1 Table E1-11 below presents the TS 3.3.8.1 logic descriptions for all the functions listed in TS Table 3.3.8.1-1.

Table E1-11: LOP Instrumentation Diversity Function Logic Description 4.16 kV Shutdown Board Undervoltage (Loss of Voltage)

Function 1.a, Board 2/2 The Loss of Voltage Function is monitored by two Undervoltage undervoltage relay pairs for each shutdown board, where outputs are arranged in a two-out-of-two logic configuration. The power supply to the board is transferred from offsite power to DG power upon total loss of shutdown board voltage after a time delay.

Function 1.b, Diesel Start 2/2 See Function 1.a Initiation Time Delay 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

Function 2.a, Board 2/3 The Degraded Voltage Function is monitored by Undervoltage three undervoltage relay channels (with time delays) for each shutdown board, whose outputs are arranged in a two-out-of-three logic configuration Function 2.b.1/2/3/4, Time 2/3 See Function 2.a above.

Delay 4.16 kV Shutdown Board Undervoltage (Unbalanced Voltage Relay)

Function 3, 4.16 kV 1/2 The unbalanced voltage function is monitored by Shutdown Board three unbalanced voltage relays (UVRs) for each Undervoltage (Unbalanced shutdown board, whose outputs are arranged in a Voltage Relay) permissive one-out-of-two logic configuration.

6. REGULATORY GUIDE 1.174, REVISION 2, SECTION 2.1.1 - DEFENSE-IN-DEPTH In accordance with the principles contained within Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

x A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

- The BFN TS reflect this balance by allowing one sensor module or channel to be placed in trip, while preserving the fundamental safety function of the applicable system. Tripping an inoperable channel does not affect the number of channels required to provide the safety function.

x Over-reliance on programmatic activities as compensatory measures associated CNL-21-009 E1-41 of 46

ENCLOSURE 1 with the change in the licensing basis is avoided.

- No programmatic activities are relied upon as compensatory measures when one or two channels of the applicable instrumentation are inoperable. The remaining operable channels for that function are fully capable of performing the safety function of the applicable system.

x System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,no risk outliers).

- System redundancy, independence, and diversity remain the same as in the as designed condition. The number of operable functions has not been decreased (diversity), the number of minimum operable channels to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one channel inoperable.

x Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

- This LAR does not impact the original determination of common-cause failure for the applicable instrumentation and its functions. It may allow the Completion Times (CTs) to be extended for one or two channels in a function to be inoperable prior to placing the channel in trip. Placing the channel in trip fulfills that channels trip function needed to perform the safety function of the applicable system.

x Independence of barriers is not degraded.

- Barriers are not affected by this LAR request.

x Defenses against human errors are preserved.

- In the conditions listed in the TS, a potential extension of the TS CTs does not change any personnel actions required when the TS Action is entered.

Therefore, no change to the possibility of a human error is introduced and no changes to the defenses against that potential human error have been altered.

x The intent of the plant's design criteria is maintained.

- The design criteria of the applicable systems are maintained as reflected in the FSAR. Redundancy, diversity of signal and independence of trip/actuation channel functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. The LAR only allows additional time, under certain low risk conditions in accordance with the RICT Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

7. DESCRIPTION OF ELECTRICAL SYSTEM CAPABILITIES AT BROWNS FERRY The unit Class 1E AC Electrical Power Distribution System AC circuits consist of the offsite power sources (preferred power sources, normal, and alternates), and the onsite standby power sources (Unit 1 and 2 DGs A, B, C, and D, and Unit 3 DGs 3A, 3B, 3C, and 3D). As required by CNL-21-009 E1-42 of 46

ENCLOSURE 1 10 CFR 50, Appendix A, General Design Criterion (GDC) 17 (Reference 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The Class 1E AC distribution system is divided into redundant divisions, so loss of any one division does not prevent the minimum safety functions from being performed. Each of the eight 4.16 kV shutdown boards has two offsite power circuits available and a single DG. Only offsite power delivered through the normal feeder breakers can be credited since common accident signal (CAS) logic (CAS A/CAS B) will trip the alternate breaker. This prevents an overload condition if all shutdown boards had been aligned to the same shutdown bus, and thus to the same transformer winding.

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the 4.16 kV shutdown boards. For Units 1 and 2, the 4.16 kV shutdown boards A and B are Division I and the 4.16 kV shutdown boards C and D are Division II. For Unit 3, the 4.16 kV shutdown boards 3EA and 3EB are Division I and the 4.16 kV shutdown boards 3EC and 3ED are Division II.

Offsite power is supplied to the 161 kV and 500 kV switchyards from the transmission network.

One of the two required qualified offsite circuits must be from the 500 kV transmission network to meet the requirements of 10 CFR 50, Appendix A, GDC 17.

For Units 1 and 2, four basic circuits from the transmission network to the safety-related Division I and Division II 4.16 kV shutdown boards are configured as follows.

1. Starts from the 500 kV switchyard through unit station service transformer (USST) 1B to a 4.16 kV unit board. That unit board feeds 4.16 kV shutdown bus 1 or 2, which then feeds two of the Unit 1 and 2 4.16 kV shutdown boards (A and B or C and D).

2. Starts from the 500 kV switchyard through USST 2B to a 4.16 kV unit board. That unit board feeds 4.16 kV shutdown bus 1 or 2, which then feeds two of the Unit 1 and 2 4.16 kV shutdown boards (A and B or C and D).

3. Starts from the 161 kV transmission network through common station service transformer (CSST) A to start bus 1A or 1B, then to a 4.16 kV unit board. That unit board feeds 4.16 kV shutdown bus 1 or 2, which then feeds two of the Unit 1 and 2 4.16 kV shutdown boards (A and B or C and D).

4. Starts from the 161 kV transmission network through CSST B to start bus 1A or 1B, and then to a 4.16 kV unit board. That unit board feeds 4.16 kV shutdown bus 1 or 2, which then feeds two of the Unit 1 and 2 4.16 kV shutdown boards (A and B or C and D).

Shutdown bus 1 normally feeds 4.16 kV shutdown boards A and B and shutdown bus 2 normally feeds 4.16 kV shutdown boards C and D. The 4.16 kV shutdown boards are normally aligned to power associated divisional 480 V safety equipment (two divisions per unit). This results in one DG powering only one 480 V division of one unit, and some of that same division's 4.16 kV loads for both Units 1 and 2.

For Unit 3, four basic circuits from the transmission network to the safety-related Division I and Division II 4.16 kV shutdown boards are configured as follows.

CNL-21-009 E1-43 of 46

ENCLOSURE 1

1. Starts from the 500 kV switchyard through unit station service transformer (USST) 3B to 4.16 kV unit board 3A and/or 3B. Each unit board feeds two of the Unit 3 4.16 kV shutdown boards (3EA and 3EB or 3EC and 3ED).

2. Starts from the 161 kV transmission network through common station service transformer (CSST) A to start bus 1A or 1B, and then to a 4.16 kV unit board. That unit board feeds two of the Unit 3 4.16 kV shutdown boards (3EA and 3EB or 3EC and 3ED).

3. Starts from the 161 kV transmission network through CSST B to start bus 1A or 1B, and then to a 4.16 kV unit board. That unit board feeds two of the Unit 3 4.16 kV shutdown boards (3EA and 3EB or 3EC and 3ED).

4.16 kV unit board 3A normally feeds 4.16 kV shutdown boards 3EA and 3EB and 4.16 kV Unit board 3B normally feeds 4.16 kV shutdown boards 3EC and 3ED. The 4.16 kV shutdown boards are normally aligned to power associated divisional 480 V safety equipment (two divisions per unit). This results in one DG powering only one 480 V division.

Table E1-12 shows the normal and alternate power supplies for each of the safety-related 480 V boards. Table E1-13 shows the major components on each of the 4.16 kV Shutdown boards.

Table E1-14 shows the major components on each of the 480 V Shutdown boards.

Table E1-12: Normal and Alternate Power Supplies for the Safety-related 480V Boards Board Normal Power Supply Alternate Power Supply 480V Shutdown Board 1A 4.16KV Shutdown Board A 4.16KV Shutdown Board B 480V Shutdown Board 1B 4.16KV Shutdown Board C 4.16KV Shutdown Board B 480V Shutdown Board 2A 4.16KV Shutdown Board B 4.16KV Shutdown Board C 480V Shutdown Board 2B 4.16KV Shutdown Board D 4.16KV Shutdown Board C 480V Shutdown Board 3A 4.16KV Shutdown Board 3EA 4.16KV Shutdown Board 3EB 480V Shutdown Board 3B 4.16KV Shutdown Board 3EC 4.16KV Shutdown Board 3EB 480V RMOV Board 1A 480V Shutdown Board 1A 480V Shutdown Board 1B 480V RMOV Board 1B 480V Shutdown Board 1B 480V Shutdown Board 1A 480V RMOV Board 1C 480V Shutdown Board 1B 480V Shutdown Board 1A 480V RMOV Board 2A 480V Shutdown Board 2A 480V Shutdown Board 2B 480V RMOV Board 2B 480V Shutdown Board 2B 480V Shutdown Board 2A 480V RMOV Board 2C 480V Shutdown Board 2B 480V Shutdown Board 2A 480V RMOV Board 2D 480V Shutdown Board 2A 480V Shutdown Board 2B 480V RMOV Board 2E 480V Shutdown Board 2B 480V Shutdown Board 2A 480V RMOV Board 3A 480V Shutdown Board 3A 480V Shutdown Board 3B 480V RMOV Board 3B 480V Shutdown Board 3B 480V Shutdown Board 3A 480V RMOV Board 3C 480V Shutdown Board 3B 480V Shutdown Board 3A 480V RMOV Board 3D 480V Shutdown Board 3A 480V Shutdown Board 3B 480V RMOV Board 3E 480V Shutdown Board 3B 480V Shutdown Board 3A 480V Diesel Aux Board A 4.16KV Shutdown Board A 4.16KV Shutdown Board B 480V Diesel Aux Board B 4.16KV Shutdown Board D 4.16KV Shutdown Board B 480V Diesel Aux Board 3EA 480V Shutdown Board 3A 480V Shutdown Board 3B 480V Diesel Aux Board 3EB 480V Shutdown Board 3B 480V Shutdown Board 3A 480V Cont. Bay Vent Board A 480V Shutdown Board 1A 480V Common Board 1 CNL-21-009 E1-44 of 46

ENCLOSURE 1 Table E1-12: Normal and Alternate Power Supplies for the Safety-related 480V Boards 480V Cont. Bay Vent Board B 480V HVAC Board B 480V Common Board 3 480V HVAC Board B 4.16KV Shutdown Board 3ED 480V Shutdown Board 3B Table E1-13: Power Supplies of Major Components on the 4.16 kV Shutdown Boards 4.16 kV Shutdown A B C D 3EA 3EB 3EC 3ED Board Core Spray Pumps 1A, 2A 1C, 2C 1B, 2B 1D, 2D 3A 3C 3B 3D RHR Pumps 1A, 2A 1C, 2C 1B, 2B 1D, 2D 3A 3C 3B 3D RHR Service Water A1, A2 C1, C2 B2 D2 B1 D1 Pumps RHR Service Water B3 D3 A3 C3 Pumps (EECW)

Raw Cooling Water 1D - - - - - 3D -

Pumps Control Rod Drive 1B - - - 3B - - -

Pumps Fire Pumps A B C - - - - -

Control Air

- G - - - - - -

Compressor Control Bay Chillers - A, 3A - B - - - 3B Standby Gas A - - B - - - C Treatment Table E1-14: Power Supplies of Major Components on the 480 V Shutdown Boards 480 V Shutdown Board 1A 1B 2A 2B 3A 3B Unit Preferred MG - - 2 TUP2 3 TUP3 I & C Transformers A B A B A B 250V Battery Charger 1 - 2A 2B 3 4 Control Air Compressors - A D - - -

Reactor Building Closed 1A 1C, 1B 2A 2B 3A 3B Cooling Water Reactor Water Clean Up 1A 1B 2A 2B 3A 3B Variable Frequency Drive 1A1,1B1 1A2,1B2 2A1, 2B1 2A2, 2B2 3A1, 3B1 3A2, 3B2 Cooling Water Pumps Standby Liquid Control 1A 1B 2A 2B 3A 3B CNL-21-009 E1-45 of 46

ENCLOSURE 1 Fuel Pool Cooling 1A 1B 2A 2B 3A 3B 1A-1, 1B-1, 2A-1, 2B-1, 3A-1, 3B-1, Drywell Blowers 1A-2 1B-2 2A-2 2B-2 3A-2 3B-2 480 V Shutdown Board 1A 1B 2A 2B 3A 3B Cond. Demin. Bd. Emer Fdr. - 1 - 2 - 3 Main Turbine TGOP - YES - YES YES -

Control Bay Chiller - - 3A - - -

BFN also has AC power sources in the form of FLEX diesels. Since these are not credited in the PRA model or in the RICT calculations, no discussion is provided here.

Browns Ferry currently uses temporary diesels for emergency power during diesel outages.

These temporary diesels are not credited in the PRA model or in the RICT calculations, no discussion is provided here.

8. REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ML071200238).

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ML12286A322).

3. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009.

CNL-21-009 E1-46 of 46

ENCLOSURE 2 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 CNL-21-009

Enclosure 2

1. INTRODUCTION The purpose of Enclosure 2 is to provide information on the technical acceptability of the Browns Ferry Nuclear Plant (BFN) Probabilistic Risk Assessment (PRA) Integrated One-Top Model representing the Full Power Internal Events (FPIE) PRA, including Internal Flooding, the Fire PRA (FPRA) and the Seismic PRA (SPRA) models in support of the license amendment request (LAR) to adopt Technical Specifications Task Force (TSTF)-505, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2 (Reference 1). The BFN internal events (including internal flooding) model described within this LAR is the same as described in BFNs submittal regarding adoption of Title 10 of the Code of Federal Regulations (CFR) 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (Reference 2).

The current internal events model of record (including internal flooding) is a combined PRA model that quantifies events for all three units. The PRA model is built with a common one-top fault tree, including individual basic events for all units components. The internal flooding PRA is integrated into the internal events model.

The FPRA model of record is built using the internal events PRA as a base, with fire PRA-specific fault tree modifications and additions such as spurious operation and alternate shutdown. It includes all potential fire initiating events.

The SPRA model of record is built using the internal events PRA as a base, with seismic PRA-specific fault tree modifications and additions to account for potential seismic failures.

Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Revision 0 (Reference 3), as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation included in the report (Reference 4), defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool required to implement this risk-informed application. Meeting these requirements satisfies Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3 (Reference 5). At Browns Ferry, the model is known as the One-Top Multi-Hazard Model (OTMHM) and the tool used to quantify plant configurations is the Electric Power Research Institute PHOENIX Risk Monitor. The OTMHM is discussed in Enclosure 8 of this LAR.

TVA employs a multi-faceted approach to establishing and maintaining the technical acceptability and fidelity of PRA models for its nuclear generation sites. This approach includes both a PRA maintenance and update process procedure and the use of self-assessments and independent peer reviews as described and incorporated by reference from Tennessee Valley Authority (TVA) letter to NRC, CNL-17-010 to adopt Title 10 of the Code of Federal Regulations (CFR 50.69) (Reference 2).

2. SCOPE OF BFN PRA MODELS The BFN full power internal events including internal flooding model of record (MOR), the BFN FPRA and SPRA models are at-power models (i.e., each directly addresses plant configurations during plant Modes 1 and 2). The models include both core damage frequency (CDF) and large early release frequency (LERF).

CNL-21-009 E2-1 of 6

Enclosure 2

3. TECHNICAL ACCEPTABILITY OF THE INTERNAL EVENTS INCLUDING INTERNAL FLOODING PRA MODEL The FPIE model of record (MOR) is an at-power model (i.e., it directly addresses plant configurations during plant Modes 1 and 2). The model includes both CDF and LERF.

Internal flooding is included in both the CDF and LERF internal events PRA model. As described previously, the internal events (including internal flooding) PRA model described within this LAR is the same as described within the BFN submittal of the LAR to adopt 10 CFR 50.69.

NEI 06-09-A requires that the PRA be reviewed to the guidance of RG 1.200 for a PRA which meets Capability Category (CC) II for the supporting requirements of the internal events at power American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) PRA Standard. It also requires that deviations from these CCs relative to the Risk Informed Completion Time (RICT) Program be justified and documented. The FPIE Model was peer reviewed in August 2009, and the internal flooding PRA model was peer reviewed in October 2009. A FPIE closure review and an internal flooding focused scope peer review was performed in September 2018. The focused scope peer review generated 7 finding level F&Os.

Open finding level F&Os were subjected to the Appendix X to Guidance 07-12 Close-Out of Facts and Observations (F&Os) process in December 2020. All finding level F&Os for both the Internal Events and Internal Flooding were reviewed by the Independent Assessment team and determined to be CLOSED and no longer pertinent to the FPIE model. No new F&Os were generated during this review. The team concluded that no upgrades were performed on the model. With no open finding level F&Os and all ASME/ANS PRA Standard (2009) Supporting Requirements being met at CC-II, or better, and review of NRC exceptions from RG 1.200 Revision 2 addressed, the FPIE is judged to be technically acceptable to support risk-informed applications.

4. TECHNICAL ACCEPTABILITY OF THE FPRA MODEL In May 2012, BFN Units 1, 2, and 3 FPRA was peer reviewed against the requirements of Part 4 of the ASME/ANS PRA Standard. The peer review also included the clarifications and qualifications provided in the NRC endorsement of the PRA Standard, contained in Revision 2 to RG 1.200 (Reference 6). This peer review was performed using the process defined in the document NEI 07-12 (Reference 7). A FPRA focused scope peer review was performed in June 2015.

The peer review team concluded, in general, the data, methodologies, and fire risk models used for BFN Units 1, 2, & 3 were appropriate and sufficient to meet the PRA Standard. All methods used in the BFN Fire PRA align with NRC-endorsed methodologies. Areas where supporting requirements were not met at CC II or better were documented as finding level F&Os. There were no unreviewed analysis methods identified during the review.

The BFN FPRA F&O Closure by independent assessment (F&O closure assessment) was held during December 2020. The purpose of the review was to perform an independent F&O closure assessment in accordance with NEI 07-12 Appendix X to review close out of Finding level F&Os of record from the prior PRA peer review. F&O dispositions reviewed and determined to have been adequately addressed through this F&O closure assessment are considered closed and no longer relevant to the current PRA model. No new F&Os CNL-21-009 E2-2 of 6

Enclosure 2 were generated during this review. With the closure of all peer review findings, the FPRA model of record meets the requirements for PRA technical acceptability for this application.

5. TECHNICAL ACCEPTABILITY OF THE SPRA MODEL The onsite phase of the BFN Seismic Probabilistic Risk Assessment (SPRA) Peer Review was performed 6 May through 10 May 2019 at the Browns Ferry training center in Athens, AL. This peer review was performed using the PRA Standard (ASME/ANS RA-Sb-2013, Code Case 1)

(Reference 8), and using the process defined in NEI-12-13 (Reference 9).

In 2013, the ASME/ANS PRA Standard was revised by the ASME/ANS Joint Committee on Nuclear Risk Management (JCNRM). This standard, ASME/ANS RA-Sb-2013 (Addendum B) [Reference 10], was approved by the American National Standards Institute in 2013, but has not been formally endorsed by the NRC through a revision to RG 1.200.

However, the NRC has accepted Code Case 1 as an accepted standard (Reference 11).

As a result of this review, there were no unreviewed analysis methods identified during the review.

The BFN SPRA F&O independent assessment was performed in November 2019. The purpose was to perform an independent assessment in accordance with Appendix X of NEI 12-13 to review TVAs proposed close out of finding level F&Os of record from the June 2019 peer review against the ASME/ANS RA-Sb-2013 PRA Standard (Code Case 1) and to assess whether closure action resulted in a PRA upgrade.

The Independent Assessment team consisted of a team having extensive qualifications and many years of experience in all areas of SPRA. All reviewers met the criteria specified in NEI 05-04 (Reference 12) and NEI 12-13 and the ASME/ANS RA-Sa-2009 (Reference 13)

PRA Standard Section 1-6.2, and in NRCs memoranda outlining expectations for a finding closure independent assessment (Reference 14).

Following completion of the independent assessment, all of the finding level F&Os were closed and no longer considered applicable to the BFN SPRA. With the closure of all peer review findings, the SPRA model of record meets the requirements for PRA technical acceptability for this application. No upgrades were required as a part of the F&O closure review. No new F&Os were generated during this review.

6. CREDIT FOR FLEX EQUIPMENT IN THE PRA MODELS The BFN PRA models do not credit portable FLEX equipment for core damage or release mitigation. There is, however, a permanently installed cart that holds a nitrogen bottle for use of opening a drywell vent valve, given the loss of supply air. This FLEX equipment is only credited by the SPRA model.

7. USE OF FLOOR VALUES FOR THE DEPENDENCY ANALYSIS IN THE BFN PRA MODELS The dependency analysis for the Internal Events/Internal Flooding was performed on the BFN Unit 1, 2, & 3 CDF and LERF cutset files. (Single unit files were combined into one file -

total and a single dependency analysis for all three units completed). This file also included human reliability analyses (HRA) from the Internal Flooding Analysis. This information was incorporated in the BFN quantification recovery rule file as described in the BFN PRA CNL-21-009 E2-3 of 6

Enclosure 2 Quantification Notebook. After final quantification, application of the recovery rules accounts for the level of dependency determined by the HRA Calculator.

The recovery rule file was developed to limit the joint probability of each combination to be no less than 1.0E-05. This lower bound was selected from industry guidance (Reference 6) because some of the Performance-Shaping Factors are global in nature and apply as a sum instead of a product. In order to satisfy this, the recovery rule file was developed to limit the joint probability of each combination to be no less than 1.0E-05.

The dependency analysis for the BFN Unit 1, 2, and 3 FPRA and SPRA models was performed similarly to what was done for the Internal Events/Internal Flooding model. The recovery rule file for each model was developed to limit the joint probability of each combination to be no less than 1.0E-05 in accordance with NUREG-1792 (Reference 15).

8. Treatment of Obstructed Plume The BFN Fire PRA credited obstructed plumes during the fire modeling task using the guidance in NUREG-2178, Volume 1, "Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE), Volume 1: Peak Heat Release Rates and Effect of Obstructed Plume.

9. Treatment of Well-Sealed MCCs The BFN Fire PRA used the guidance provided in FAQ 14-0009 to model well-sealed cabinets for MCC cabinets less than 440V. For cabinets above 440V either fire modeling was performed to justify screening them out or they were counted as ignition sources in the PRA model.

10. PRA Treatment of Fire Dependencies between Units The BFN Fire PRA consists of two types of fire scenarios, full room burns, or smaller fires associated with a limited number of components. Full room burn scenarios are scenarios in which all components included within that room are failed and the associated CDF/LERF for that unit is calculated based on those failures.

The smaller fires include a smaller subset of components within the room (e.g., component fires associated with a particular component catching on fire, transient fires, welding and cutting, etc.). Each of these scenarios have a certain zone of influence that will impact a specific set of components and cables in the room.

The BFN Fire PRA also includes propagation scenarios that evaluate the impact of a fire propagating from one room to another.

The BFN Fire PRA logic is built into a single fault tree model with a separate top event for CDF and LERF for each unit. The logic is built such that common equipment is modeled under each top event (Unit 1 CDF, Unit 1 LERF, Unit 2 CDF, Unit 2 LERF, Unit 3 CDF and Unit 3 LERF). Therefore, all components within the zone of influence that are directly impacted by the fire or components associated with cables that can be adversely affected by the fire scenario will be failed in the model. This includes components for each unit or components relied upon multiple units. These failures will propagate to the top event as allowed for by the fault tree logic. Because of this, dependencies between units are CNL-21-009 E2-4 of 6

Enclosure 2 accounted for in the fault tree logic. Each of the fire scenarios (whether in a Unit 1 room, a Unit 2 room, a Unit 3 room or in a common area) are quantified in each unit for CDF and LERF to ensure that the impacts from a particular fire scenario is captured for both units.

11. PRA Maintenance and Updates The TVA risk management process ensures that the applicable PRA model(s) used in this application continues to reflect the as-built and as-operated plant for each of the Browns Ferry units. The process delineates the responsibilities and guidelines for updating the PRA models and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, and industry operational experience), for assessing the risk impact of unincorporated changes, and or controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every other operating cycle.

12. REFERENCES

1. Letter from the Technical Specification Task Force (TSTF) to the NRC, TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk Informed Extended Completion Times and Submittal of TSTF-505, Revision 2, Revision 2, July 2, 2018 (ML18183A493)

2. Letter (CNL-20-002) from TVA to the NRC, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, July 17, 2020 (ML20199M373)

3. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, October 2012 (ML12286A322)

4. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), May 17, 2007 (ML071200238)

5. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3

6. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009

7. NEI Topical Report NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Revision 1, June 2010 (ML102230070)

8. ASME/ANS RA-S Case 1, ASME/ANS RA-Sb-2013, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Applications, September 2017 CNL-21-009 E2-5 of 6

Enclosure 2

9. NEI 12-13 Revision 3, External Hazards PRA Peer Review Process Guidelines, August 2012

10. ASME/ANS RA-Sb-2013, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum B to RA-S-2008, ASME, July 2013

11. Letter from the NRC to C. R. Grantom and R. J. Budnitz, U. S. Nuclear Regulatory Commission Acceptance of ASME/ANS RA- S Case 1, March 12, 2018 (ML18017A963)

12. NEI Topical Report NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Revision 2, November 2008 (ML083430462)

13. ASME/ANS RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, February 2009

14. U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations (F&Os), (ML17079A427), May 2017

15. NUREG-1792, Good Practices for Implementing Human Reliability Analysis (HRA), Sandia National Laboratory, April 2005

CNL-21-009 E2-6 of 6

ENCLOSURE

License Amendment Request

%URZQV)HUU\ Nuclear Plant, UnitV 1DQG

Renewed Facility Operating License Nos. DPR-'35DQG'35

NRC Docket Nos. 50-DQG

Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b"

,QIRUPDWLRQ6XSSRUWLQJ7HFKQLFDO$GHTXDF\RI

35$0RGHOV:LWKRXW35$6WDQGDUGV (QGRUVHGE\5HJXODWRU\*XLGH5HYLVLRQ

CNL-21-0

(QFORVXUH

7KLVHQFORVXUHLVQRWDSSOLFDEOHWRWKHVXEPLWWDO79$LVQRWSURSRVLQJWRXVHDQ\35$PRGHOVLQ

WKH5LVN,QIRUPHG&RPSOHWLRQ7LPH3URJUDPIRUZKLFKD35$VWDQGDUGHQGRUVHGE\WKH15&LQ

5HJXODWRU\*XLGH5HYLVLRQGRHVQRWH[LVW

CNL-21-0 (RI

ENCLOSURE 4 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models CNL-21-009

Enclosure 4

1. INTRODUCTION AND SCOPE Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1) as clarified by the Nuclear Regulatory Commission (NRC) final safety evaluation (Reference 2) requires that the license amendment request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on their insignificance to the calculation of configuration risk, and to discuss conservative or bounding analyses applied to the configuration risk calculation. This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources and providing the Browns Ferry Nuclear Plant (BFN) specific results of the application of the generic methodology and the disposition of impacts on the BFN Risk-Informed Completion Time (RICT) Program. Section 3.0 presents the justification for excluding analysis of other external hazards from the BFN PRA.

NEI 06-09-A does not provide a specific list of hazards to be considered in a RICT Program.

However, non-mandatory Appendix 6-A of the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) RA-Sa-2009 PRA Standard (hereafter ASME/ANS PRA Standard), Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 3) provides a guide for identification of most of the possible external events for a plant site.

Additionally, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1 (Reference 4), provides a discussion of hazards that should be evaluated to assess uncertainties in plant PRAs and support the risk-informed decision-making process. These hazards were reviewed for BFN, along with a review of information pertaining to the site region and plant design to identify the set of external events to be considered. Information from the BFN Updated Final Safety Analysis Report (UFSAR)

(Reference 5) pertaining to the geologic, seismologic, hydrologic, and meteorological characteristics of the site region, and the current and projected industrial activities in the plant vicinity was reviewed. No new site-specific or plant-unique external hazards were identified through this review. The list of hazards from Appendix 6-A of the ASME/ANS PRA Standard that were considered for BFN is summarized in Table E4-1.

2. HAZARD SCREENING The first step in the evaluation of the external hazard is screening based on an estimation of a bounding core damage frequency (CDF) for beyond design basis hazard conditions. An example of this type of screening is reliance on the NRCs 1975 Standard Review Plan (SRP)

(Reference 6) which is acknowledged in the NRCs Individual Plant Examination of External Events (IPEEE) procedural guidance (Reference 7) as assuring a bounding CDF of less than 1E-06 per year for each hazard. The bounding CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the bounding conditional core damage probability for those conditions. If the bounding CDF for the hazard can be shown to be less than 1E-06 per year, then beyond design basis challenges from the hazard can be screened and do not need to be addressed quantitatively in the RICT Program. The basis for this is as follows.

x The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-05.

x The maximum time interval allowed for the RICT is 30 days.

x If the maximum CDF contribution from a hazard is <1E-06 per year, then the maximum ICDP from the hazard is <1E-07 (1E-06/year

30 days/365 days/year).

CNL-21-009 E4-1 of 13

Enclosure 4

x Thus, the bounding ICDP contribution from the hazard is shown to be less than 1% of the permissible ICDP in the bounding time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.

The results shown in Section 3.0 list that all hazards can be screened from BFN.

While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using this approach, some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. These considerations are addressed in Section 3.0.

2.2 Hazard Analysis for CDF Contribution There are two options in cases where the bounding CDF for the external hazard cannot be shown to be less than 1E-06 per year. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the Systems, Structures, and Components (SSC) included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a bounding CDF contribution from the hazard. The bounding approach was not used for this analysis because all hazards can be screened.

2.3 Evaluation of Bounding Large Early Release Frequency Contribution The RICT Program requires addressing both core damage and large early release risk. When a comprehensive PRA does not exist, the large early release frequency (LERF) considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or bounding conditional large early release probability (CLERP) that aligns with the bounding CDF evaluation. The incremental large early release frequency (ILERF) is then computed as:

ILERFHazard = ICDFHazard

CLERPHazard

3. EVALUATION OF EXTERNAL EVENT CHALLENGES 3.1 Hazard Screening The BFN License Amendment Request for adoption of 10 CFR 50.69 for Units 1, 2, and 3 provides the necessary inputs for those accident classes labeled as other external events (Reference 8). Other analyses have been included based on guidance from the UFSAR on hazards such as aircraft impacts, industrial facility and pipelines, and external flooding.

Table E4-1 assesses the foundation for the evaluation of these hazards, examine any challenges posed, and examines any additional application of these challenges, if required.

Table E4-1 provides the guidelines used in the refined screening process applied in this assessment. The results of this assessment, as documented in Table E4-1, ensures that the hazard either does not show a design-bases challenge to BFN, or is sufficiently addressed in the PRA model. External hazards can be screened from the BFN site with the exception of internal flooding, internal fire, and seismic events, based on the reasons listed in Table E4-1.

CNL-21-009 E4-2 of 13

Enclosure 4

In the RICT program, the decision of whether a particular configuration would still screen based on a new plant configuration that normally screens under the normal plant configuration and base case risk profile is considered. Configuration-specific impacts have been accounted for in the external hazards screening evaluation of BFN.

Within the screening process, the screening criteria (Table E4-2) still applies to hazards that screen regardless of a specific configuration. The following criteria are not dependent on plant configuration.

x The occurrence of the event is of sufficiently low frequency that its impact on plant risk does not appreciably impact CDF or LERF (Criterion C2).

x The event cannot occur close enough to the plant to affect it (Criterion C3).

x The event which subsumes the external hazard is still applicable and bounds the hazard for other configurations (Criterion C4).

x The event develops slowly, allowing adequate time to eliminate or mitigate the hazard or its impact on the plant (Criterion C5).

For those hazards that do not screen per the above criteria, the next approach is to consider the effect of the hazard on the plant given particular configurations for which a RICT is allowed.

When the ability to achieve safe shutdown may be affected by a plant configuration, the impact of the hazard to the applicable SSC must be assessed and a basis provided for the screening decision.

As noted above, the configurations to be evaluated are those involving unavailable SSCs whose Limiting Condition for Operation are included in the RICT Program.

4. CONCLUSION Based on this analysis of external hazards for BFN Units 1, 2, and 3, no additional external hazards need to be added to the existing PRA model. The evaluation concluded that the hazards either do not present a design-basis challenge to BFN, the challenge is adequately addressed in the PRA, or the hazard has a negligible impact on the calculated RICT and can be excluded.

Table E4-1: Evaluation of External Hazards Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

There are no airports within five miles of the site. The Athens-Decatur Airport is about 10 miles east of the plant. The nearest Aircraft Impact Y C2 commercial airport is located in Huntsville about 25 miles from the site. The likelihood of an aircraft crash that potentially results in significant damage is negligible.(1)

CNL-21-009 E4-3 of 13

Enclosure 4

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

The absence of steep slopes in the terrain of the Browns Ferry site precludes the Avalanche Y C3 occurrence of an avalanche. Accordingly, an avalanche is not a probable event given the natural topography.

Raw water systems are chemically treated during peak clam spawning periods to ensure clam control. Chemical injection of corrosion Biological Event Y C5 inhibitors is implemented where required.

Chemical treatment systems are also designed to reduce tube fouling and improve heat transfer.(2)

The Browns Ferry nuclear plant site is not in proximity to any ocean or large body of water.

Coastal Erosion Y C5 This eliminates coastal erosion as a potential threat.

Drought is accounted for in the design basis of the plant such that the long-term effects do not adversely impact the UHS safety function Drought Y C5 capability. This meets the requirements of Regulatory Guide 1.27 section B. This is a slow developing event.

External floods defined as the most severe reasonable possible flood were analyzed to include excessive rainfall, storms, wind, waves, and potential dam failures.

Safety related structures, systems, and components have been designed to withstand and maintain cold shutdown in the event of a probable maximum flood as required by Regulatory Guide 1.59.

External Flooding Y C1 The external flooding hazard at BFN was recently evaluated as a result of the post-Fukushima 50.54(f) Request for Information. The flood hazard reevaluation report (FHRR) was submitted to NRC for review on March 12, 2015. The results indicate that flooding from all hazards, except local intense precipitation (LIP), are bounded by the current licensing basis (CLB) and do not pose a challenge to the plant. The FHRR CNL-21-009 E4-4 of 13

Enclosure 4 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) included commitments describing required actions to provide BFN protection against the re-evaluated LIP hazard. Flooding from local intense precipitation was subsequently evaluated in Focused Evaluation and concluded that no safety related SSCs are impacted. The actions required for the LIP protection strategy are determined to be feasible.

Snowfall is not a factor in determining maximum flood levels due to snowfall levels being relatively light for this area.

The maximum wind speed for the Browns Ferry design basis tornado is 300 mph. All class I structures and components have been designed to maintain integrity when exposed to a 300-mph tornado.

Structures and components that cannot withstand tornado loads were found not to perform any safety-related function nor disable the safety function of safety-related PS1 structures, systems, and components.

Extreme Wind or Y

Tornado PS4 The high winds hazard to core damage frequency is less than 10-6 per year. Metal siding panels part of secondary containment designed as relief panels are permitted to blow off during a design basis tornado.

The Condenser Circulating Water pumps are vulnerable to individual missile damage, but failure of all 9 is assumed impossible. Only 1 pump is needed to dissipate heat loads for all three units. No specific SSCs are identified whose failure results in unscreened scenarios Aircraft, sea, and land vehicle accidents may Fog Y C4 increase in the presence of dense fog. This event is subsumed within the rates for Transportation Accidents.

CNL-21-009 E4-5 of 13

Enclosure 4 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

External forest fires at the site boundary could potentially result in loss of offsite power, forced isolation of plant ventilation and control room evacuation. The loss of offsite power (LOOP) initiator in the internal events PRA bounds the LOOP potential as an external event.

C4 Forest or Range Y

Fire If a fire event required evacuation of the C3 control room, this would not invalidate the ability to shutdown the plant safely from the remote shutdown panel.

In accordance with TVA policy, vegetation has to be removed from safety-related structures as not to present a fire hazard.

Weather-related LOOP initiating event analyzed in the internal events model Frost Y C4 encompasses extreme weather affecting plant operations. Frost is subsumed within the frequency of this initiator.

Storm conditions including hailstorms are Hail Y C4 treated in the weather-related LOOP initiator from the internal events analysis.

Extreme temperature swing effects are limited to reducing the capacity of the Ultimate Heat Sink and loss of offsite power. General C1 High Summer Design Criteria 24 stipulates that a loss of all Y

Temperature offsite power does not prevent the reactor C4 protection system from functioning.

See Drought for Effects on the Ultimate Heat Sink.

Probable maximum flood levels assessed in High Tide, Lake the external flooding analysis qualifies the Level, or River Y C4 plants ability to handle increased reservoir Stage levels and achieve safe shutdown.

See External Flooding Analysis.

CNL-21-009 E4-6 of 13

Enclosure 4

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

A hurricane is not a naturally occurring event at Browns Ferry given this is a river site, not C3 an ocean site. The resulting storm surge with Hurricane Y associated high winds is equivalent to the C4 probable maximum flood with wave run-up.

See External Flooding, High Winds/Tornado.

Formation of ice cover on the Tennessee River is not a viable initiating event as this is a humid temperate climate.

C1 Ice Cover Y Changing river levels (natural phenomena)

C3 have also been analyzed and concluded to not impact safety-related structures from maintaining their safety function in accordance with General Design Criteria 2.

There are twelve industrial facilities listed in Table 2.2-8 of the FSAR within 5 to 10 miles Industrial or of the plant. The nearest military facility is the Military Facility Y C3 Redstone Arsenal 25 miles east of the plant.

Accident There are no industrial or military facilities located within a 5-mile radius of BFN where stored chemicals could cause a potential plant hazard.(1)

Internal Flooding N N/A Internal flooding is modeled specifically and included in the internal events PRA model.

Internal Fire N N/A BFN has an internal fire PRA.

The slopes at BFN were investigated and do not indicate instabilities or the potential for a landslide. There is no major elevation relief Landslide Y C3 near the BFN site. There are also no events on record of a landslide occurring at this site.

A landslide is not a credible initiating event given this topography.

According to NUREG-1407, the primary impact of lightning is LOOP. The initiating Lightning Y C4 event frequency of the LOOP initiator bounds this analysis.

Low levels in the Wheeler Reservoir and low inflow have already been factored in as the Low Lake Level most severe natural phenomena expected in Y C1 or River Stage accordance with General Design Criteria 2 and found to not impact the safety function capability of the UHS.

CNL-21-009 E4-7 of 13

Enclosure 4 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Freezing is rare in this humid temperate climate and the effects of low winter C1 temperature would be slow moving. Low and Low Winter Y high river reservoir levels have been analyzed Temperature C5 to conclude that safety-related structures, systems, and components are still within safe shutdown capability given either extreme.

The probability of a meteorite and/or satellite impact is less than 10-9 according to Meteorite or Y PS4 NUREG-5042 Supplement 2 and is excluded Satellite Impact based on its low occurrence probability. No specific SSCs are identified whose failure results in unscreened scenarios.

Transport of chemicals by pipeline were considered and analyzed according to the methods illustrated in Regulatory Guide 1.78.

Pipeline Accident Y C3 For chemicals transported near the site by pipeline within a 5-mile radius, no hazard to control room habitability was found.(1)

Onsite chemicals were considered using the approach shown in Regulatory Guide 1.78. It was concluded that no chemicals stored Release of onsite effect main control room habitability.

Chemicals in Y PS2 This was due to the fact that these chemicals Onsite Storage are stored in small quantities, are solids, are liquids with low vapor pressure, or the operators would have sufficient time to don protective equipment if released.

The most limiting flow rate postulated from any site related accident, including river River Diversion Y C1 diversion, is 100 cfs. This flow rate is above the minimum 80 cfs needed to meet the accident and shutdown requirements of the plant.

Sand or Dust Sand or dust storms are not a factor based on Y C3 Storm geography of the immediate area.

The Browns Ferry site elevation is over 9 feet above the maximum pool levels. The largest amplitude of seiche recorded on lakes, reservoirs or ponds in the area was 0.14 feet.

Seiche Y C3 This elevation difference precludes the potential for a seiche. There is also no recorded occurrence of a landslide causing a seiche in the Tennessee reservoir system. A seiche event poses no hazard.

CNL-21-009 E4-8 of 13

Enclosure 4 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Seismic Activity N N/A BFN has a Seismic PRA.

Snowfall does not occur in significant amounts and accumulation only lasts a few days given the humid temperate climate. Therefore, no potential hazard exists from snowfall.

Snow Y C3 Alternately, occurrence of the severe natural phenomena does not pose undue challenge to the safe shutdown capability of safety-related structures, systems, and components in accordance with General Design Criteria 2.

Section 2.5.4 of the UFSAR concludes that Soil Shrink-Swell the underlying bedrock of the site boundary is Y C1 Consolidation such that the foundation of all plant structures is adequate.

The Browns Ferry nuclear plant is located Storm Surge Y C3 several hundred miles away from any large bodies of water. The potential for a storm surge of significant magnitude is negligible.

The worst-case accidents analyzed revealed that a barge carrying chemicals listed in section 10.12.5.3 of the UFSAR would be the most limiting. On release, the concentration in the control room would pose a potential threat Toxic Gas Y PS2 to the control room operators. The chemicals released were determined to be detected by smell, giving operators enough time to don protective equipment.

See Transportation Accidents.

PS2 Barge - Table 2.2-10 of the UFSAR lists hazardous river traffic that passes BFN. This allows BFN to meet the 1975 SRP and Regulatory Guide 1.91 acceptance criteria since the distances and locations of nearby industrial, military and transportation facilities, the nature and extent of activities conducted Transportation Y at the facilities, and the products and Accident materials stored, transported or used at the facilities is provided.

Potential accidents due to river transport identifies no vulnerabilities and conforms to the design basis. Section 10.12.5.3 of the UFSAR concludes that of the chemicals CNL-21-009 E4-9 of 13

Enclosure 4 Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a) transported by the site by pipeline, barge, rail, or road within a 5-mile radius, only chlorine traveling by barge could present a hazard to control room personnel. The probability of this chlorine exceeding the concentration limits in Regulatory Guide 1.78 is less than 1.0E-6 events per year. At that value, chlorine release can be excluded from consideration.

No specific SSCs are identified whose failure results in unscreened scenarios. If a coal barge were to sink in the channel, flow to the Intake Pumping Station would not be blocked.

PS4 Railroad - There are no railroads that enter the site boundary. The closest railroad tracks are listed in section 2.2.3 and 10.12.5.3 of the UFSAR. Description of the locations and distances of transportation facilities in the vicinity of the plant meets the acceptance criteria of the 1975 SRP and is therefore satisfied by the description above.

C3 Highway- There are no highways which penetrate the site boundary. The nearest principal highways are listed in section 2.2.3 of the UFSAR. Description of the locations and distances of transportation facilities in the vicinity of the plant meets the acceptance criteria of the 1975 SRP and is therefore satisfied by the description above.

Aircraft - See Aircraft Impact.

BFN is not an ocean site. This treatment is Tsunami Y C3 not applicable to BFN based on lack of proximity to sea or large bodies of water.

The positioning of the low-pressure turbines ensures that no turbine generated missiles will damage safety related systems, structures, Turbine- and components.

Generated Y PS1 Missiles The probability of a turbine generator failure leading to the ejection of missiles is designed to be less than 1E-04 per year. No specific SSCs are identified whose failure results in unscreened scenarios.

CNL-21-009 E4-10 of 13

Enclosure 4

Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

No hazard from volcanoes is present for BFN Volcanic Activity Y C3 given the location of the site away from active volcanoes.

Wave producing effects are caused by storm surges, high winds, and external flooding.

Waves Y C4 See Storm Surge, High Winds, Seiche, and External Flooding.

Note (1): NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, refers to a five-mile threshold for evaluating significant military and industrial facility changes since issuance of the operating license.

That threshold was used by TVA for evaluating pipeline and aircraft hazards as well.

Note (2): As noted in Licensee Event Report 20-001-01 (ML20322A440), eel grass growth and breakaway accumulation in the BFN intake strainers (resulting in a decrease in main condenser vacuum) is a new phenomenon for BFN. Intake strainer plugging is subsumed and accounted for in the internal events model.

CNL-21-009 E4-11 of 13

Enclosure 4

Table E4-2: Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Initial C1. Event damage potential is less than NUREG/CR-2300 Preliminary events for which plant is designed.

Screening ASME/ANS Standard RA-Sa-2009 C2. Event has lower mean frequency and no NUREG/CR-2300 worse consequences than other events analyzed. ASME/ANS Standard RA-Sa-2009 C3. Event cannot occur close enough to the NUREG/CR-2300 plant to affect it.

ASME/ANS Standard RA-Sa-2009 C4. Event is included in the definition of NUREG/CR-2300 another event.

ASME/ANS Standard RA-Sa-2009 C5. Event develops slowly, allowing ASME/ANS Standard adequate time to eliminate or mitigate the RA-Sa-2009 threat.

Progressive PS1. Design basis hazard cannot cause a ASME/ANS Standard Screening core damage accident. RA-Sa-2009 PS2. Design basis for the event meets the NUREG-1407 criteria in the NRC 1975 Standard Review Plan (SRP) (Reference 8). ASME/ANS Standard RA-Sa-2009 PS3. Design basis event mean frequency is NUREG-1407

< 1E-05 per year and the mean conditional core damage probability is < 0.1. ASME/ANS Standard RA-Sa-2009 PS4. Bounding mean CDF is < 1E06 per NUREG-1407 year.

ASME/ANS Standard RA-Sa-2009 Detailed PRA Screening not successful. PRA needs to NUREG-1407 meet requirements in the ASME/ANS PRA Standard. ASME/ANS Standard RA-Sa-2009 CNL-21-009 E4-12 of 13

Enclosure 4

5. REFERENCES

1. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ML12286A322)

2. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995),

dated May 17, 2007 (ML071200238)

3. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009

4. NRC NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1, dated March 2017

5. Browns Ferry Nuclear Plant Updated Final Safety Analysis Report, Amendment 28.

6. NRC NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, September 1975

7. NRC NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, dated June 1991

8. Tennessee Valley Authority letter, CNL-20-002, Browns Ferry Nuclear Plant, Units 1, 2 and 3 - Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for nuclear power reactors, (TS-BFN-529), dated July 17, 2020 (ML20199M373)

CNL-21-009 E4-13 of 13

ENCLOSURE 5 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

CNL-21-009

Enclosure 5

1. INTRODUCTION Section 4.0, Item 6 of the Nuclear Regulatory Commission (NRC) Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) 06-09-A, Revision 0, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines" (Reference 2), requires that the license amendment request (LAR) provide the plant-specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm applicability of the limits of Regulatory Guide (RG) 1.174 Revision 1, (Note that RG 1.174, Revision 3 (Reference 3), issued by the NRC in January 2018, did not revise these limits).

The purpose of this enclosure is to demonstrate that the Browns Ferry Nuclear (BFN) plant total CDF and total LERF are below the guidelines established in RG 1.174. RG 1.174 does not establish firm limits for total CDF and LERF but recommends that risk-informed applications be implemented only when the total plant risk is no more than 1E-4/year and 1E-5/year, respectively. Demonstrating that these limits are met confirms that the risk metrics of NEl-06-09-A can be applied to the BFN Risk-Informed Completion Time (RICT)

Program.

2. TECHNICAL APPROACH The BFN Probabilistic Risk Assessment (PRA) model update process includes "model of record" (MOR) updates which are full scope model updates that include all documentation required by the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) RA-Sa-2009 PRA Standard (hereafter "ASME/ANS PRA Standard"), "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" (Reference 4) as endorsed by Regulatory Guide 1.200 (Reference 5). The update process and the associated procedures implement plant changes, or correct errors to support one or more risk-informed applications.

The current internal events including internal flooding PRA model of record is MOR 10, the fire PRA (FPRA) is MOR 6 and the seismic PRA (SPRA) is MOR 1.

In order to efficiently calculate the Risk Informed Completion Time for a particular technical specification for a given plant configuration, the total risk from internal events/internal flooding, fire and seismic must all be quantified simultaneously. This is accomplished by using a One-Top Multi-Hazard Model (OTMHM). The OTMHM was created by merging the one-top models for Internal Events and Internal Flooding PRA (MOR 10), SPRA (MOR 1), and FPRA (MOR 6) into a single fault tree. This model was optimized to increase the quantification speed.

This model is further discussed in Enclosure 8 of this LAR. The optimized OTMHM was quantified (by individual hazard) to demonstrate that the BFN plant total CDF and total LERF are below the guidelines established in RG 1.174.

Table E5-1 lists the Unit 1, 2, and 3 CDF and LERF values as calculated by the optimized OTMHM. Other external hazards have been screened as discussed in Enclosure 4 of this LAR; therefore, external hazards do not contribute significantly to the total risk.

CNL-21-009 E5-1 of 3

Table E5-1. Total Baseline Model of Record CDF/LERF from OTMHM BFN Unit 1 Baseline CDF BFN Unit 1 Baseline LERF Source Contribution Source Contribution Internal Events PRA Internal Events PRA 3.50E-06 8.95E-07 (Including Flooding) (Including Flooding)

Fire PRA 2.75E-05 Fire PRA 4.19E-06 Seismic CDF 5.87E-06 Seismic LERF 3.99E-06 No significant No significant Other External Events Other External Events contribution contribution Total Unit 1 CDF 3.69E-05 Total Unit 1 LERF 9.08E-06 BFN Unit 2 Baseline CDF BFN Unit 2 Baseline LERF Source Contribution Source Contribution Internal Events PRA Internal Events PRA 2.99E-06 6.89E-07 (Including Flooding) (Including Flooding)

Fire PRA 3.19E-05 Fire PRA 4.05E-06 Seismic CDF 5.80E-06 Seismic LERF 3.89E-06 No significant No significant Other External Events Other External Events contribution contribution Total Unit 2 CDF 4.07E-05 Total Unit 2 LERF 8.63E-06 BFN Unit 3 Baseline CDF BFN Unit 3 Baseline LERF Source Contribution Source Contribution Internal Events PRA Internal Events PRA 3.34E-06 7.80E-07 (Including Flooding) (Including Flooding)

Fire PRA 2.69E-05 Fire PRA 3.58E-06 Seismic CDF 6.23E-06 Seismic CDF 4.17E-06 No significant No significant Other External Events Other External Events contribution contribution Total Unit 3 CDF 3.65E-05 Total Unit 3 LERF 8.53E-06 Notes:

1. Results presented in this table were calculated using the optimized OTMHM.

2. Other external hazards have been screened as discussed in Enclosure 4 of this LAR.

As demonstrated in Table E5-1, the total CDF and total LERF for the PRA models of record is within the guidelines set forth in Regulatory Guide (RG) 1.174 and support small changes in risk that may occur during RICT entries following implementation of the RICT Program. Therefore, the proposed BFN RICT Program implementation is consistent with NEI 06-09-A guidance.

CNL-21-009 E5-2 of 3

3. REFERENCES

1. Letter from the NRC to NEI, "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines' (TAC No. MD4995)," dated May 17, 2007 (ML071200238)

2. NEI Topical Report NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, dated October 2012 (ML12286A322)

3. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, dated January 2018.

4. ASME Standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," dated February 2, 2009

5. NRC Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Revision 2, dated March 2009 (ML090410014)

CNL-21-009 E5-3 of 3

ENCLOSURE

License Amendment Request

%URZQV)HUU\ Nuclear Plant, UnitV 1DQG

Renewed Facility Operating License Nos. DPR-'35DQG'35

NRC Docket Nos. 50-DQG50-

Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b"

-XVWLILFDWLRQRI$SSOLFDWLRQRI$W3RZHU

35$0RGHOVWR6KXWGRZQ0RGHV CNL-21-0

(QFORVXUH

7KLVHQFORVXUHLVQRWDSSOLFDEOHWRWKH%URZQV)HUU\1XFOHDU3ODQWVXEPLWWDO7KH

7HQQHVVHH9DOOH\$XWKRULW\LVSURSRVLQJWRDSSO\WKH5LVN,QIRUPHG&RPSOHWLRQ7LPH

3URJUDPRQO\LQ0RGHVDQG

CNL-21-0 (RI

ENCLOSURE 7 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" PRA MODEL UPDATE PROCESS CNL-21-009

Enclosure 7

1. INTRODUCTION Section 4.0, Item 8 of the Nuclear Regulatory Commission (NRC) Final Safety Evaluation for Nuclear Energy Institute (NEI) 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0 (References 1 and 2), requires that the license amendment request (LAR) provide a discussion of the licensee's programs and procedures which assure the Probabilistic Risk Assessment (PRA) models supporting the RMTS are maintained consistent with the as-built, as-operated plant. Tennessee Valley Authority (TVA) implements a framework and procedure to maintain and update the PRA models in such a way to ensure these models adequately reflect the as-built, as-operated plant. For TVA, a full-scope integrated PRA model of record (MOR) is used to evaluate plant risks for Browns Ferry Nuclear (BFN) Unit 1, Unit 2, and Unit 3.

This enclosure describes the administrative controls and procedural processes applicable to the configuration control and update of the PRA models used to support risk-informed applications, including the Risk-Informed Completion Time (RICT) Program to ensure that these models reflect the as-built, as-operated plant. Plant related activities such as modifications, procedure changes, or plant performance will be identified, reviewed, and evaluated prior to implementation to determine if they could impact the PRA models. This includes tracking pending model changes in a PRA Change Database. The PRA model update process will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions and errors associated with the PRA models.

In the event that a plant modification or a corrective action is identified with potential significant impact to the RICT Program calculations or results in a change in core damage frequency (CDF)/large early release frequency (LERF) of more than 25%, as defined by TVA procedures, an unscheduled update of the PRA model will be implemented.

Otherwise, the PRA model change is considered for incorporation into a subsequent periodic model update, which occurs once every other refueling cycle, based on Unit 1.

Such pending changes are considered when evaluating other changes until they are fully implemented into PRA models.

2. PRA MODEL UPDATE PROCESS 2.1 Internal Events, Internal Flood, Fire, and Seismic PRA Models Maintenance and Update The BFN plant risk management process and model governance ensures that the applicable PRA MOR and application-specific models used for the RICT Program reflect the as-built, as-operated plant for BFN Units 1, 2, and 3. The PRA model update process depicts the interdepartmental responsibilities and guidelines for controlling and updating the full power internal events, internal flood, fire PRA, and seismic PRA models including the periodic and unscheduled updates. Any change that meets the criteria for an upgrade will be subject to a peer review.

TVA processes and management of PRA applications include: periodic PRA updates, and PRA model maintenance and review for impact areas affecting the key elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, procedural changes, or errors or limitations identified in the model, assessing the individual and cumulative risk impact of CNL-21-009 E7-1 of 3

Enclosure 7 unincorporated changes, and controlling the model and necessary computer files, including those associated with the Configuration Risk Management (CRM) model.

TVA PRA procedures assure that model updates are completed at least once every two refueling cycles or sooner if estimated cumulative impact of plant configuration changes exceed the threshold of +/-25% of CDF or LERF. They also ensure that the decision to update the PRA model ahead of the normal schedule is made commensurate with the overall impact to the model, taking into consideration the impact on applications and programs that use the results from quantifying the model.

2.2 Review of Plant Changes for Incorporation into the PRA Model BFN notifies the PRA group of modifications and procedure changes that may affect the PRA.

These are periodically reviewed for impact to both the model and assumptions and the results of the reviews are documented. The follows actions are taken by the PRA staff:

1. The BFN PRA Change Database (PCD) and the procedural steps are used to identify and track all PRA model changes including physical modifications to the facility and to operating practices and procedures with consideration of both temporary and permanent changes. Changes with potential significant risk impact are tracked using the BFN PRA PCD and the Corrective Action Program (CAP).

2. Plant changes or discovered conditions captured in the PCD are subject to an applicability review for potential impacts to the PRA models including the CRM model and the subsequent risk calculations which support the RICT Program (NEI 06-09-A, Section 2.3.4, Items 7.2 and 7.3, and Section 2.3.5, Items 9.2 and 9.3).

3. Plant changes are preliminarily evaluated and screened based on risk criteria consistent with TVA procedural requirements with consideration of the cumulative impact of other pending changes. Changes with potential for significant impact will be incorporated in an unscheduled update and application-specific PRA model(s),

consistent with the NEI 06-09-A guidance (Section 2.3.5, Item 9.2) with the PRA model published afterward. These changes are also addressed in the CAP.

4. Otherwise, the change is assigned a priority and is incorporated in a subsequent periodic update consistent with TVA procedural requirements.

5. PRA updates for plant changes are performed at least once every two refueling cycles, consistent with the guidance of NEI 06-09-A (NEI 06-09-A, Section 2.3.4, Item 7.1, and 2.3.5, Item 9.1).

6. If a PRA model change is required for the CRM model but cannot be immediately implemented for a significant plant change or discovered condition, one of the following is applied:

a. The application and use of such bounding analyses, as appropriate, may serve as quantitative analyses to support the expected risk impact of the change and is consistent with the guidance of NEI 06-09-A.

CNL-21-009 E7-2 of 3

Enclosure 7

b. Appropriate administrative restrictions on the use of the RICT program for extended Completion Times are put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A, Section 2.3.5, Item 9.3.

These actions satisfy NEI 06-09-A, Section 2.3.5, Item 9.3.

2.3 Plant Changes Having Potential Impact on RICT The following actions are planned to be performed to monitor for potential impacts to the RICT program:

x A check is performed using the Full Power Internal Events model to identify if there is a >2x increase in the accident class/sequence that contributes >5% to risk.

x A qualitative check is performed to evaluate whether an impact is expected to key components which by themselves result in non-green risk increase factors in Phoenix-EOOS.

These evaluations ensure changes that could significantly impact RICT calculations initiate an emergent PRA model update or result in administrative limits on the RICT program per TVA procedures.

3. REFERENCES

1. Letter from the NRC to NEI, "Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, 'Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines' (TAC No. MD4995),"

dated May 17, 2007 (ADAMS Accession No. ML071200238)

2. NEI Topical Report NEI 06-09-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

CNL-21-009 E7-3 of 3

ENCLOSURE 8 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Attributes of the Real-Time Model CNL-21-009

Enclosure 8

1. INTRODUCTION Section 4.0, Item 9 of the Nuclear Regulatory Commission (NRC) Final Safety Evaluation for NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1), requires that the license amendment request (LAR) provide a description of the probabilistic risk assessment (PRA) models and tools used to support the RMTS. This includes explanation of how the baseline probabilistic risk assessment model will be modified for use in the Configuration Risk Management (CRM) tools, consistency of calculated results from the PRA and CRM model, quality requirements applied to the PRA models and CRM tools, and training and qualification programs applicable to personnel responsible for development and use of the CRM tools. This item should also confirm that the Risk-Informed Completion Time (RICT) Program tools can be readily applied for each Technical Specification (TS) Limiting Conditions for Operation (LCO) within the scope of the plant-specific submittal.

This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the Phoenix Risk Monitor (PRM) Program software to support the RICT Program. The process that will be employed to adapt the baseline models has been demonstrated:

a) To preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results; b) To maintain the quality of the peer-reviewed PRA models; and c) To correctly accommodate changes in risk due to configuration-specific consideration.

Quality control and training programs applicable to the RICT Program are also discussed in this enclosure.

2. TRANSLATION OF BASELINE MODEL FOR USE IN CONFIGURATION RISK The baseline PRA models for internal events, (including internal flooding), seismic events, and internal fires, are peer-reviewed models. These models are updated when necessary to incorporate plant changes to reflect the as-built, as-operated plant as discussed in Enclosure 7.

The internal flood model is integrated in the internal events model. The internal fire and seismic PRA models are maintained as separate models. These PRA models have been used to develop the PRM Program software for the RICT Program.

The PRM software will be used to facilitate all configuration-specific risk calculations and support RICT Program implementation. The baseline PRA models will be modified to create a single top model as follows.

x The unit availability factor is set to 1.0 (unit available).

x Maintenance unavailability is set to zero/false, unless unavailable due to the configuration.

x Mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration.

x For systems where some trains are in service and some in standby, the PRM model addresses the actual configuration of the plant including defining in service trains as needed.

CNL-21-009 E8-1 of 5

Enclosure 8 x Seasonal flags will be adjusted to conservatively bound the seasonal configurations.

(At Browns Ferry Nuclear Plant (BFN) the only seasonal flag currently modeled is for the Raw Cooling Water (RCW) system. The flags will be adjusted to account for the worst case configuration which is Winter or Fall).

The PRM software is designed to quantify the unit-specific configuration for internal events, internal flooding, fire, and seismic risk contributions when calculating the RICT. The models have been optimized for quantification speed and have been verified to provide results equivalent to the baseline models and in accordance with approved procedures.

3. ATTRIBUTES OF THE REAL TIME RISK MODEL Key attributes of the integrated, optimized one-top model are described in this section.

Seasonal variations are included in the BFN plant risk model. Systems included in this treatment include RCW and Residual Heat Removal Service Water (RHRSW) systems. For modeling purposes, normal RCW operation is divided into three seasonal modes. The summer mode lasts two months and has all 12 RCW pumps running. The winter mode lasts four months and has five RCW pumps running.

The spring/fall mode lasts six months and has eight RCW pumps running. This is accomplished by applying a flag to toggle between all seasons in the model. The RHRSW system includes modeling to account for the probability of intake plugging for the given season.

Modifications to the current plant configuration are implemented by taking components out of service using the PRM software. Modifications include tagging out a component for maintenance, setting alignments, defining environmental impacts, starting a test or surveillance, and entering an LCO. The PRM software links to the one-top model fault trees to take components out of service. Basic events ending in *IE represent system initiating events and are mapped under the basic event mapping in PRM. These basic events function as the link between the initiator and the system response models. Pre-solved cut sets will not be used in the one-top multi hazard model. It will be solved in real time using a one-top multi hazard model for RICT.

The CRM model update frequency is on par with the internal events model update criteria. If modeling changes result in a 25% change in CDF/LERF value, then an internal events model update is required. Otherwise, the internal events model is updated once every other refueling cycle. The CRM model update periodicity follows the same update guidelines.

Table E8-1 lists the major components shared between units. These systems are credited where applicable in the CRM model for completeness. There are also shared electrical systems as discussed in Enclosure 1 Table E8 Shared System Modeling System Component Shared Plant Control Air and Nitrogen System Nitrogen Tank B Control Rod Drive (CRD) Hydraulic System CRD Pump 1B Core Spray System Condensate Storage Tank suction source, Common Accident Signal Emergency Equipment Cooling Water EECW Pumps/Swing Pumps (EECW) System CNL-21-009 E8-2 of 5

Enclosure 8 Table E8 Shared System Modeling System Component Shared Raw Cooling Water System Suction/Discharge Header 12 pumps shared among 3 units Residual Heat Removal Service Water RHRSW Pumps (RHRSW) System

4. COMMON CAUSE ADJUSTMENTS Adjustments to the common cause failure (CCF) grouping or CCF probabilities are not necessary when a component is taken out of service for preventative maintenance (PM).

x The component is not out of service for reasons subject to a potential common cause failure, and so the in service components are not subject to increases in common cause probabilities.

x CCF relationships are retained for the remaining in service components.

x The net failure probability for the in service components includes the CCF contribution of the out of service component.

As described in Regulatory Guide (RG) 1.177 (Reference 2), Section A-1.3.2.2, the CCF term should be treated differently when a component is taken out of service for PM than as described for failure of a component. For PMs, the common cause factor is changed so that the model represents the unavailability of the remaining component. In the example provided in RG 1.177 for a 2-train system, the CCF event can be set to zero for PMs. This is done so that the model represents the unavailability of the remaining component, and not the common cause multiplier.

The BFN approach is conservative in that for a 2-train system, the CCF event is retained for the component removed from service. Likewise, for systems with three or more trains, the CCF events that are related to the out of service component are retained.

The Vogtle RICT Safety Evaluation (Reference 3) describes the Vogtle approach for modeling common cause events with planned inoperability: "For planned inoperability, the licensee sets the appropriate independent failure to 'true' and makes no other changes while calculating a RICT." The BFN approach is the same as this Vogtle approach.

It is recognized that other modifications could be made to CCF factors for planned maintenance, particularly for common cause groups of three or more components. For example, in the Safety Evaluation (SE) in the Vogtle RICT Amendment, the NRC identifies a possible planned maintenance CCF modification to "modify all the remaining basic event probabilities to reflect the reduced number of redundant components."

Like Vogtle, the BFN CCF approach is a straightforward simplification that has inherent uncertainties. In the context of modifying CCF basic events for PMs, the Vogtle SE states the following:

The NRC staff also notes that common cause failure probability estimates are very uncertain and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because it does not systematically and purposefully produce non-conservative results and because the calculations reasonably include common cause failures consistent with the accuracy of the estimates.

CNL-21-009 E8-3 of 5

Enclosure 8 The BFN approach for CCF during PMs is the same as the NRC-approved Vogtle approach; therefore, the BFN CCF approach is acceptable for RICT calculations and adjusting the common cause grouping is not necessary for PMs. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

For emergent conditions where the extent of condition is not completed prior to entering into the Risk Management Action (RMA) Times or the extent of condition cannot rule out the potential for common cause failure, common cause RMAs are expected to be implemented to mitigate common cause failure potential and impact, in accordance with TVA procedures. This is in line with the guidance of NEI 06-09-A and precludes the need to adjust CCF probabilities. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

5. QUALITY REQUIREMENT AND CONSISTENCY OF PRA MODEL AND CONFIGURATION RISK MANAGEMENT TOOLS The approach for establishing and maintaining the quality of the PRA models, including the PRM model, includes both a PRA maintenance and update process (described in Enclosure 7),

and the use of self-assessments and independent peer reviews (described in Enclosure 2).

The information provided in Enclosure 2 demonstrates that the BFN internal events (including internal flooding) and internal fire PRA models reasonably conform to the associated industry standards endorsed by RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 4).

This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.

For maintenance of an existing CRM model, changes made to the baseline PRA model in translation to the CRM model will be controlled and documented in accordance with Tennessee Valley Authority PRA procedures. These procedures address the process for identification and corrective actions to evaluate and disposition model errors and changes to ensure models are accurate, as described in Enclosure 7. Acceptance testing is performed after every configuration risk model update to ensure that the software works as intended and that quantification results are reasonable. The PRM model is nominally updated to reflect the as-built, as-operated plant once every two fuel cycles but may be sooner depending on plant needs and management discretion.

These actions satisfy NEI 06-09-A, Section 2.3.5, Item 9. (Reference 5)

6. TRAINING AND QUALIFICATION The PRA staff is responsible for development and maintenance of the PRM model. Operations and Work Control staff will use the configuration risk tool under the RICT Program. The PRA and Operations staff are trained in accordance with a program using National Academy for Nuclear Training ACAD-series documents, which is also accredited by Institute of Nuclear Power Operations (INPO). Training will be given to the PRA staff involved with the program.

CNL-21-009 E8-4 of 5

Enclosure 8 Training records are maintained in a qualification matrix detailing what training has been successfully completed.

7. APPLICATION OF THE CONFIGURATION RISK TOOL TO THE RICT PROGRAM SCOPE The Electric Power Research Institute (EPRI) Phoenix Risk Monitor software, or equivalent, will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. This program is specifically designed to support the implementation of RMTS.

The Phoenix Risk Monitor software will permit the user to evaluate all plant configurations using appropriate mapping of plant equipment to the PRA basic events. The equipment in the scope of the RICT Program shall be able to be evaluated in the appropriate PRA models.

8. REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995),

dated May 17, 2007 (ML071200238)

2. Nuclear Regulatory Commission, Regulatory Guide 1.177, May 2011, Revision 1

3. Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Regarding Implementation of Topical Report Nuclear Energy Institute NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specification (RMTS)

Guidelines," Revision 0-A (CAC NOS. ME9555 and ME9556), (ML15127A669)

4. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009

5. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2010 (ML12286A322)

CNL-21-009 E8-5 of 5

ENCLOSURE 9 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Key Assumptions and Sources of Uncertainty CNL-21-009

Enclosure 9

1. INTRODUCTION The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time Technical Specifications Task Force (TSTF)-505 Program. Nuclear Energy Institute (NEI) topical report NEI 06-09-A (Reference 1), Section 2.3.4, item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMA) to address these uncertainties.

The baseline internal events (including internal flooding), fire, and seismic PRA models document assumptions and sources of uncertainty and these were reviewed during the model peer reviews. The approach taken is, therefore, to review these documents to identify the items which may be directly relevant to the TSTF-505 Program calculations, to perform sensitivity analyses where appropriate, to discuss the results, and to provide dispositions for the TSTF-505 Program.

The epistemic uncertainty analysis approach described below applies to the internal events PRA; any epistemic uncertainty impacts that are unique to the fire PRA (FPRA) and seismic PRA (SPRA) are also addressed. In addition, Topical Report NEI 06-09-A requires that the uncertainty be addressed in TSTF-505 Program Configuration Risk Management Program (CRMP), otherwise referred to as the Real-Time Risk (RTR), tools by consideration of the translation from the PRA models to the RTR model. The RTR model, also referred to as the PHOENIX model, discussed in Enclosure 8 includes internal events including internal flooding, fire, and seismic events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the RTR tool during TSTF-505 Program calculations.

The State of Knowledge Correlation (SOKC) is addressed in the Browns Ferry Nuclear Plant (BFN) Quantification Notebook (and is modeled directly in the PRA quantification). The failure probabilities used in the PRA models that are derived from common data sources are correlated in the parametric uncertainty analysis through the use of type codes. An example would be the type code for an air handling unit (AHU) failing to run (type code AHUFR). All basic events associated with the AHU failing to run use the AHUFR type code. When the sampling is done by the UNCERT code to calculate the mean core damage frequency (CDF),

all AHUFR basic events are correlated.

The BFN Seismic PRA includes the same correlations described above for random failure events. It also includes the 100 percent correlation of the seismic failure of components within their respective fragility groups. The basic events used in the Seismic PRA Model associated with these parameters were correlated using type codes in the same manner as described above for the internal events PRA model.

The BFN Fire PRA model includes the same correlations described above for random failure events. It also includes uncertainties for many different fire-specific parameters, including but not limited to uncertainties in the following parameters:

x Fire ignition frequencies, x Non-Suppression probabilities, x Hot short probabilities, x Component failures, and x Human failures.

CNL-21-009 E9-1 of 9

Enclosure 9 The basic events used in the Fire PRA Model associated with these parameters were correlated using type codes in the same manner as described above for the internal events PRA model.

A comparison of CDF results from the normal model quantification and the parametric uncertainty evaluation shows that the difference between the point estimate and mean results is less than 2%. Therefore, SOKC is not a key source of uncertainty for the TSTF-505 application.

2. ASSESSMENT OF INTERNAL EVENTS PRA EPISTEMIC UNCERTAINTY IMPACTS In order to identify key sources of uncertainty for the TSTF-505 Program application, an evaluation of the internal events, including internal flooding, baseline PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and Electric Power Research Institute (EPRI) report 1016737 (Reference 3). As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.

Parametric uncertainty was addressed as part of the BFN internal events, including internal flooding baseline model quantification documented in the summary notebook, the fire baseline model quantification documented in the Fire PRA uncertainty notebook, and the seismic baseline model quantification. See Section 3.0 and 4.0 for discussions on the Fire PRA and Seismic PRA uncertainties.

Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development to address a particular modeling uncertainty because there is not a single definitive approach.

Plant-specific assumptions made for each of the BFN internal events PRA technical elements are noted in the individual notebooks. The internal events, including internal flooding, PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary.

EPRI compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (Reference 4), and the evaluation performed for BFN considered each of the generic sources of modeling uncertainty as well as the plant-specific sources. The process for identification of key assumptions and sources of uncertainty for the internal events and internal flooding PRA, the Seismic PRA, and the Fire PRA are identical and is discussed in Section 6.

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA model documentation but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to the TSTF-505 application, based on the results of the internal events including internal flooding, fire and seismic PRA model peer reviews.

Additionally, an evaluation of analysis performed for the Large Early Release Frequency (LERF) for internal events, including internal flooding, PRA model uncertainty was performed, based on the guidance in NUREG-1855 and EPRI Report 1026511. The potential sources of model uncertainty in the BFN PRA model were evaluated for the 32 Level 2 PRA topics outlined in EPRI 1026511.

CNL-21-009 E9-2 of 9

Enclosure 9 A detailed review of the generic and plant specific sources of model uncertainties for the internal events (including internal flooding) PRA that could impact the TSTF 505 application was performed. Based on following the methodology discussed above, there are no key sources of uncertainty in the internal events (including internal flooding) model and therefore, the PRA model can produce accurate TSTF 505 calculations. Risk management actions will be developed when appropriate using insights from the PRA model results specific to the configuration.

A review of regulatory correspondence in the form of NRC Requests for Additional Information (RAI) provided to other nuclear utilities' TSTF-505 applications was conducted for common or generic impacts. These sources of uncertainty are not "key" but the RAIs and their applicability to BFN are provided as information in Table E9-1.

Table E9-1 ASSESSMENT OF INTERNAL EVENTS, INCLUDING INTERNAL FLOODING, PRA EPISTEMIC UNCERTAINTY Sources of Uncertainty and Model Sensitivity and TSTF-505 Program Impact Assumptions Disposition Digital I&C Process Protection There are some digital There are no digital RPS basic System components implemented in the events or fault tree logic within plant, but the RPS system uses the PRA model.

analog components. There are no digital basic events or fault tree logic in the PRA models.

FLEX No credit taken for FLEX in the No credit for FLEX is taken in internal events (with internal the internal events (with internal flooding) PRA. flooding) PRA.

3. ASSESSMENT OF SUPPLEMENTARY FIRE PRA EPISTEMIC UNCERTAINTY IMPACTS The purpose of the following discussion is to address the epistemic uncertainty in the BFN FPRA. The BFN FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA and because the state of knowledge in these elements continues to evolve. The development of the BFN FPRA was guided by NUREG/CR-6850 (Reference 5). The BFN FPRA model used consensus models described in NUREG/CR-6850.

BFN used guidance provided in NUREG/CR-6850 and NUREG-1855 to address uncertainties associated with FPRA for the TSTF-505 Program application. As stated in Section 1.3 of NUREG-1855:

Although the guidance in this report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision making is generic CNL-21-009 E9-3 of 9

Enclosure 9 and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at-power and low power and shutdown operating conditions, and both internal and external hazards.

NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions. It defines:

A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, changes to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis. Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time. In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time.

NUREG-1855 defines consensus model as:

A model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that NRC has utilized or accepted for the specific risk-informed application for which it is proposed.

The plant-specific assumptions in the BFN FPRA and the 71 generic sources of uncertainty identified in EPRI 1026511 were evaluated for their potential impact on the TSTF-505 application. This guideline organizes the uncertainties in Topic Areas similar to those outlined in NUREG/CR-6850 and was used to evaluate the baseline FPRA epistemic uncertainty and evaluate the impact of this uncertainty on TSTF-505 Program calculations.

A detailed review of the generic and plant-specific sources of internal fire model uncertainties was performed. The process for identification of key assumptions and sources of uncertainty for the internal events and internal flooding PRA, the Seismic PRA, and the Fire PRA are identical and is discussed in Section 6. There are no key sources of uncertainty in the fire model and therefore, the model can produce accurate TSTF-505 calculations. Risk management actions will be developed when appropriate using insights from the PRA model results specific to the configuration.

A review of regulatory correspondence in the form of NRC RAIs provided to other nuclear utilities' TSTF-505 applications was conducted for common or generic impacts. These sources of uncertainty are not "key" but the RAIs and their applicability to BFN are provided as information in Table E9-2.

CNL-21-009 E9-4 of 9

Enclosure 9 Table E9-2 Assessment of Fire PRA Epistemic Uncertainty Description Sources of Uncertainty Disposition for TSTF-505 Application FLEX No credit taken for FLEX No credit for FLEX is taken in the Fire PRA.

in the Fire PRA.

NFPA 805 Any outstanding All Facts & Observations related to NFPA-805 Modifications NFPA-805 modification modifications have been closed and there are no commitments should be additional modification commitments that are considered as potential required to be implemented.

implementation activities.

4. ASSESSMENT OF SUPPLEMENTARY SEISMIC PRA EPISTEMIC UNCERTAINTY IMPACTS To identify the assumptions and uncertainties used in the seismic PRA supporting this application, the BFN PRA documentation for plant-specific assumptions and uncertainties were reviewed, as well as the generic issues identified in EPRI 1026511. The detailed review of the generic and plant-specific sources of seismic model uncertainties is discussed in (Reference

[8]) and is therefore not repeated in this enclosure. The process for identification of key assumptions and sources of uncertainty for the internal events and internal flooding PRA, the Seismic PRA, and the Fire PRA are identical and is discussed in Section 6. There are no key sources of uncertainty in the seismic model and therefore the model can produce accurate TSTF-505 calculations. Risk management actions will be developed when appropriate using insights from the PRA model results specific to the configuration.

A review of regulatory correspondence in the form of NRC RAIs provided to other nuclear utilities' TSTF-505 applications was conducted for common or generic impacts. These sources of uncertainty are not "key," but the RAIs and their applicability to BFN are provided as information in Table E9-3.

Table E9-3 Assessment of Seismic PRA Epistemic Uncertainty Description Sources of Uncertainty Disposition for TSTF-505 Application FLEX Credit for FLEX in the Seismic While credit is taken for the nitrogen bottles, this PRA is limited to the FLEX is dominated by the human failure event (HFE).

nitrogen bottles as a recovery for The HFE was modeled by following consensus models and realistic approaches. Therefore, this Drywell Control Air (DCA). No is not considered a key source of uncertainty for other FLEX equipment is credited the Seismic PRA.

in the BFN PRA models.

CNL-21-009 E9-5 of 9

Enclosure 9

5. ASSESSMENT OF TRANSLATION REAL-TIME RISK MODEL UNCERTAINTY IMPACTS Incorporation of the baseline PRA models into the RTR model (PHOENIX) used for TSTF-505 Program calculations may introduce new sources of model uncertainty. Table E9-4 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to for additional discussion on the RTR model.

CNL-21-009 E9-6 of 9

Enclosure 9 Table E9-4 Assessment of Translation Uncertainty Impacts RTR Model Change and Part of Model Affected Impact on Model Disposition Assumptions PRA model logic structure Fault tree logic model The model is logically equivalent and Since the restructured model produces may be optimized to structure, affecting produces results comparable to the comparable numerical results, this is not a increase solution speed Internal Events (with baseline PRA logic model. source of uncertainty for the TSTF-505 InternalFlooding), Fire, program.

and Seismic PRAs.

Reduce HFE seed values HFEs with low HFE seed values are reduced to ease the Improved quantification speed was Fussell-Vesely (FV) burden on the quantification process. By achieved with minimal impact on risk importance, but high restricting this change to HFEs with low results. Therefore, the reduction of human seed values relative to FV, quantification speed was improved error probability (HEP) seed values is not a the nominal value with minimal impact on risk results. source of uncertainty for the TSTF-505 program.

High seismic fragility High seismic The impact can be seen with improved This is a typical setting used in SPRAs to probabilities set to TRUE fragility probabilities quantification speeds. There is little reduce quantification time and prevent (i.e., probability >0.8) change to seismic CDF as a result of this software memory limitations. This treatment set to TRUE change; however, changes to seismic introduces a slight conservative bias in the LERF results are more pronounced. results but is not a key source of uncertainty for TSTF-505.

CNL-21-009 E9-7 of 9

6. PROCESS FOR IDENTIFICATION OF KEY ASSUMPTIONS AND SOURCES OF UNCERTAINTY To determine whether each assumption or uncertainty that is identified is key for each application, the assumption or source of uncertainty was assessed against the criteria listed below. These criteria are based on the definitions in Regulatory Guide (RG) 1.200 Revision 3 along with related guidance from NUREG-1855 Revision 1 and related references (i.e., EPRI 1016737, EPRI 1013491, EPRI 1026511, ASME/ANS RA-Sa-2009, and ASME/ANS RA-Sb-2013).

Consistent with Section 4.1 of EPRI Report 1016737, ASME/ANS RA-Sa-2009, and ASME/ANS RA-Sb-2013, a source of uncertainty is labeled key when it could impact the PRA results that are being used in a decision, and consequently, may influence the decision being made. EPRI Report 1016737, ASME/ANS RA-Sa-2009, and ASME/ANS RA-Sb-2013 further indicate that this impact would need to be significant enough that it changes the degree to which the risk acceptance guidelines or criteria are met, and therefore, could potentially influence the decision.

Assumptions and sources of uncertainty that do not meet any of the following screening criteria are determined to be potentially key for the application:

The uncertainty is addressed by implementing a consensus model defined as follows:

Consensus model - (As previously defined by NUREG-1855).

Consensus method/model -In the context of risk-informed regulatory decisions, a method or model approach that the NRC has used or accepted for the specific risk-informed application for which it is proposed. A consensus method or model may also have a publicly available, published basis and may have been peer reviewed and widely adopted by an appropriate stakeholder group. (RG 1.200).

EPRI 1013491 elaborates on the definition of a consensus model to include those areas of the PRA where extensive historical precedent is available to establish a model that has been accepted and yields PRA results that are considered reasonable and realistic. Thus, assumptions for which there is extensive historical precedent, andwhich produces results that are reasonable and realistic, can be screened from further consideration. According to NRC Regulatory Position C.3.3.2 in RG 1.200, When a key assumption is shown to be consistent with a consensus method or approach, that key assumption may no longer be subject to additional sensitivity studies in the context of a PRA application.

The uncertainty has no impact or insignificant impact on the PRA results andtherefore no impact or insignificant impact on the calculated change in risk due toproposed FKDQJHs that are to be addressed by the PRA application.

The assumption introduces a realistic conservative bias in the PRA model results.EPRI 1013491 uses the term realistic conservatisms and notes that judiciouslyapplied realistic conservatism can provide a PRA that avoids many of the trapsassociated with the use of excess conservatism. This criterion, which allowsscreening of sources of conservative bias, is intended to be less restrictive than the CNL-21-009 E9-8 of 9

previous criterion, which does not distinguish between conservative and nonconservative bias. Thus, using this criterion, assumptions that introduce realistic (slight) conservatisms can be screened from further consideration.

4. There is no reasonable alternative assumption or reasonable modeling refinement to address the uncertainty that would produce different results. For the base PRA, the term different results refers to a change in the risk profile (e.g., total CDF and total LERF, or the set of initiating events and accident sequences that contribute most to CDF and to LERF) and the associated changes in insights derived from the changes in the risk profile. A reasonable alternative assumption is one that has broad acceptance within the technical community and for which the technical basis for consideration is at least as sound as that of the assumption being challenged.

(NUREG-1855, ASME/ANS RA-Sa- 2009, ASME/ANS RA-Sb-2013).

5. There is no reasonable alternative assumption or reasonable modeling refinement to address the uncertainty that is at least as sound as the assumption under consideration. A reasonable alternative assumption is one that has broad acceptance within the technical community and for which the technical basis for consideration is at least as sound as that of the assumption being challenged. (NUREG-1855, ASME/ANS RA-Sa- 2009, ASME/ANS RA-Sb-2013).

7. REFERENCES

1. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines," Revision 0-A, October 12, 2012 (ML12286A322)

2. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making," USNRC, Revision 1, March 2017

3. Electric Power Research Institute (EPRI) TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," Final Report, December 2008

4. Electric Power Research Institute (EPRI) Technical Report TR-1026511, "Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012

5. NUREG/CR-6850 (also EPRI 1011989), "Fire PRA Methodology for Nuclear Power Facilities," September 2005, with Supplement 1 (EPRI 1019259), September 2010 CNL-21-009 E9-9 of 9

ENCLOSURE 10 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Program Implementation CNL-21-009

Enclosure 10

1. INTRODUCTION Section 4.0, Item 10 of the Nuclear Regulatory Commission (NRC) Final Safety Evaluation for Nuclear Energy Institute (NEI) 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1), requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding plant staff responsibilities for the Risk Managed Technical Specifications (RMTS) implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a Risk-Informed Completion Time (RICT).

Several procedures and processes are detailed in other enclosures that are not repeated in this enclosure addressing Probabilistic Risk Assessment (PRA) Model Update, Cumulative Risk Assessment, Monitoring Program, and Risk Management Actions. In addition, the NEI 06-09-A methodology satisfies the five key safety principles specified in RG 1.177 relative to the risk impact due to the application of a RICT. Moreover, NRC staff position C.3.2 provided in RG 1.177 for meeting the fifth key safety principle acknowledges the use of performance criteria to assess degradation of operational safety over a period. This enclosure provides a description of the implementing programs and the administrative controls and procedures regarding the plant staff responsibilities for the RICT Program, including training of plant personnel, and specifically discusses the decision process for RMA implementation during extended Completion Times (CT).

2. RICT PROGRAM AND PROCEDURES Tennessee Valley Authority (TVA) will develop a program description and implementing procedures for the RICT Program. The program description will establish the management responsibilities and general requirements for risk management, training, implementation, and monitoring of the RICT Program. More detailed procedures will provide specific responsibilities, limitations, and instructions for implementing the RICT Program. The program description and implementing procedures will incorporate the programmatic requirements for the RMTS included in NEI 06-09-A, Revision 0 (Reference 2). The program will be integrated with the online work control process. The work control process currently identifies the need to enter a Limiting Condition for Operation (LCO) action statement as part of the planning process and will additionally identify whether the provisions of the RICT Program are requirements for the planned work. The risk thresholds associated with 10 Code of Federal Regulations (CFR) 50.65(a)(4) performance monitoring provisions and Mitigating System Performance Index (MSPI) thresholds will assist in controlling the aggregate risk expended in use of the RICT Program.

The governing Maintenance Rule (MR) Program procedure provides instruction for Scoping/Risk Significance/Specific Level Performance Criteria, and requires that structures, systems, and components (SSC)/Functions that are within the scope of the MR are shown either in each sites Technical Instruction or database(s) with the screening criteria which required the SSC/Function be included in scope of the MR. Changes to Scoping/Risk Significance Classification/Specific Level Performance Criteria may be needed as a result of regulatory actions, design change, PRA, plant/industry event, industry lessons learned, temporary equipment performing a MR function, etc. The Scoping/Risk Significance Classification/Specific Level Performance Criteria of SSC/Functions can be revised in accordance the procedures.

Performance criteria includes applicable qualitative methodologies used to measure each functions performance such as Unavailability (UnA) and Unreliability (UnR) and delineate the quantitative value for each parameter. Words like no more than X are utilized to avoid CNL-21-009 E10-1 of 3

Enclosure 10 confusion over the exact maximum allowable value. The UnA performance criteria should be expressed as a percentage (##.#%) rather than as hours per monitoring period. As such TVAs process follows the guidance of NUMARC 93-01 Section 9.2 for establishing risk and performance criteria.

The Operations Department (licensed operators) is responsible for compliance with the Technical Specification (TS) and will be responsible for the implementation of the RICTs and RMAs. Entry into the RICT Program will require senior management approval prior to pre-planned activities and as soon as practicable following emergent conditions.

The procedures for the RICT Program will address the following attributes consistent with plant management positions with authority to approve entry into RICT Program.

Important definitions related to the RICT Program.

Departmental and position roles and responsibilities for activities in the RICT Program.

Plant conditions for which the RICTs under voluntary and emergent conditions are authorized.

Limitations on implementing RICTs under voluntary and emergent conditions.

Implementation of the RICT and risk management action time (RMAT) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or within the most limiting front-stop CT after a plant configuration change.

Requirement to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded, and to consider common cause failure potential in emergent RICTs.

Guidance on the use of RMAs including the conditions under which they may be credited in RICT calculations.

Conditions for exiting a RICT.

Documentation requirements related to individual RICT evaluations, implementation of extended CTs, and aggregate annual risk.

3. RICT PROGRAM TRAINING The scope of training for the RICT Program will include rules for the new TS program, Configuration Risk Management (CRM) software (Electric Power Research Institute (EPRI)

Phoenix Risk Monitor), TS Actions included in the program, and procedures. This training will be conducted for the following TVA staff positions at each station that has adopted Technical Specifications Task Force (TSTF)-505 into their operating license.

Site Personnel

Operations Manager

Operations Personnel (Licensed and Non-Licensed)

Outage Manager

Plant Manager

Work Planning Personnel

Work Week Managers

Regulatory Affairs/Licensing Personnel

Selected Maintenance Personnel

PRA Personnel CNL-21-009 E10-2 of 3

Enclosure 10

Other Selected Management Training will be carried out in accordance with TVA training procedures and processes. These procedures were written based on the Institute of Nuclear Power Operations (INPO)

Accreditation requirements, as developed and maintained by the National Academy for Nuclear Training. TVA has planned two levels of training for the implementation of the RICT Program, as described below.

3.1 Level 1 Training Higher level training intended for the individuals who will be directly involved in the implementation of the RICT Program. This level of training includes the following attributes.

Specific training on the revised TS

Record keeping requirements

Case studies

Hands-on experience with the CRM tool for calculating RMAT and RICT

Identifying appropriate RMAs

Common cause failure RMA considerations in emergent RICTs

Other detailed aspects of the RICT Program 3.2 Level 2 Training Level 2 training is applicable to plant management positions with authority to approve entry into the RICT Program, as well as supervisors, managers, and other personnel who will closely support RICT implementation. Additionally, this training with be given to remaining personnel who require an awareness of the RICT Program. These individuals need a broad understanding of the purpose, concepts, and limitations of the RICT Program. Level 2 training is different from Level 1 training in that hands-on time with the Real Time Risk Tool, case studies, and other specifics are not required. All of the above training will be conducted within the procedural guidance set forth in TVAs training and qualification procedures, unless otherwise noted.

4. REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995),

dated May 17, 2007 (ML071200238)

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ML12286A322)

CNL-21-009 E10-3 of 3

ENCLOSURE 11 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Monitoring Program CNL-21-009

Enclosure 11

1. INTRODUCTION Section 4.0, Item 12 of the Nuclear Regulatory Commission (NRC) Final Safety Evaluation for Nuclear Energy Institute (NEI) 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1), requires that the license amendment request provide a description of the implementing and monitoring program as described in Regulatory Guide (RG) 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1 (Reference 2), and NEI 06-09-A (Reference 3). Note that Revision 3 of RG 1.174 was issued by the NRC in January 2018 (Reference 4). The change in this revision presents up-to-date defense-in-depth guidance using precise language to assure consistent interpretation of the defense-in-depth philosophy. Revision 3 contains significant changes including the expansion of the guidance on the meaning of, and the process for, assessing defense-in-depth considerations. Additionally, Revision 3 adopts the term PRA acceptability (and its variations) in place of terms such as PRA quality, PRA technical adequacy, and technical adequacy to describe the appropriateness of the probabilistic risk assessment (PRA) used to support risk-informed licensing submittals. Other changes in this revision include expanding the discussions of uncertainties, including aggregation of risk results, consistent with NUREG-1855, updating the risk acceptance guideline figures, and adding discussions of the application of this guide to new reactors. Tennessee Valley Authority will employ the use of RG 1.174 for Risk-Informed Completion Time (RICT) calculations.

This enclosure provides a description of the process applied to govern and monitor calculation of cumulative risk impact in support of the RICT Program, specifically the calculation of cumulative risk of extended Completion Times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in NEI 06-09-A Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in Element 3 of the RG 1.174, Revision 3.

2. DESCRIPTION OF MONITORING PROGRAM The RICT Program will require calculation of cumulative risk impacts at least once every refueling cycle on a periodicity not to exceed 24 months. For the assessment period under evaluation, plant and system historical data is collected to establish the risk increase associated with each extended CT for both core damage frequency (CDF) and large early release frequency (LERF). The total risk impact will be calculated by summing all risk associated with each RICT calculation. This summation is the change in CDF or LERF above the zero maintenance baseline levels during the period of operation in the extended CT (i.e., beyond the front-stop CT). The change in risk will be converted to average annual values and documented every refueling cycle not to exceed 24 months.

The total average annual change in risk for extended CTs will be compared to the guidance of RG 1.174, Revision 3, Figures 4 and 5 acceptance guidelines for CDF and LERF, respectively.

If the actual annual risk increase is acceptable (i.e., not in Region I of Figures 4 and 5 of RG 1.174, Revision 3), then RICT Program implementation is acceptable for the assessment period. Otherwise, a report of the analysis will be presented to the Integrated Decision-Making Panel (IDP) to garner further assessment of the cause of exceeding the acceptance guidelines of RG 1.174, Revision 3, and implementation of any necessary corrective actions to ensure future plant operation is within the guidelines will be conducted under the corrective action program.

CNL-21-009 E11-1 of 2

Enclosure 11 The evaluation of the cumulative risk will also identify areas for consideration, such as:

x RICT applications that dominated the risk increase x Risk contributions from planned versus emergent RICT applications x Risk Management Actions implemented but not credited in the risk calculations x Risk impact from applying RICT to avoid multiple shorter duration outages Based on a review of the considerations above, corrective actions will be developed and implemented as appropriate. These actions may include:

x Administrative restrictions of the use of RICTs for specific high-risk configurations x Additional RMAs for specific configurations x Rescheduling planned maintenance activities x Deferring planned maintenance to shutdown conditions x Use of temporary equipment to replace out-of-service systems, structures, or components (SSC) x Plant modifications to reduce risk impact of future planned maintenance configurations In addition to impacting cumulative risk, the implementation of the RICT Program may potentially impact the unavailability of SSCs. The Maintenance Rule (MR) monitoring programs under Title 10 of the Code of Federal Regulations 50.65 provide for evaluation and disposition of unavailability impacts, which may be incurred from implementation of the RICT Program. The SSCs in the scope of the RICT Program, which are also in the scope of the MR, allows the use of the MR Program.

The monitoring program of the MR, along with the specific assessment of cumulative risk impact described above, serve as the Implementation and Monitoring Program for the RICT Program as described in Element 3 of RG 1.174, Revision 3, and NEI 06-09-A.

3. REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ML071200238)

2. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, dated November 2002 (ML023240437)

3. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ML12286A322)

4. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 3, dated January 2018

CNL-21-009 E11-2 of 2

ENCLOSURE 12 License Amendment Request Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Risk Management Action Examples CNL-21-009

Enclosure 12

1. INTRODUCTION This enclosure describes the process for identification and implementation of Risk Management Actions (RMA) required when the Risk Management Action Time (RMAT) has been exceeded, along with examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. The procedures will provide guidance for the determination and implementation of RMAs when exceeding the RMAT consistent with the guidance provided in Nuclear Energy Institute (NEI) 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1).

2. RESPONSIBILITIES For planned entries into the Risk Informed Completion Time (RICT) Program that exceed the RMAT, the Work Management department is responsible for developing the RMAs with assistance from the Operations department and the Site Probabilistic Risk Assessment (PRA)

Engineer. Operations is responsible for approval and implementation of RMAs. For emergent entry into RICTs, Operations is also responsible for developing the RMAs when the expected time to be in a RICT exceeds the RMAT.

3. PROCEDURAL GUIDANCE For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the RMAT will be exceeded. Thresholds are established at a factor of ten below the RICT limits for Incremental Core Damage Probability (ICDP) and Incremental Large Early Release Probability (ILERP) and used to calculate the RMAT. If the equipment out-of-service time exceeds the RMAT, or if the planned outage duration is expected to result in exceeding the RMAT, then RMAs must be considered and applied as appropriate to the specific configuration and plant conditions. These limits are consistent with the guidance of NUMARC 93-01 endorsed by Regulatory Guide 1.182. Topical Report (TR) NEI 06-09-A, Revision 0, provides guidance on typical RMAs which may be considered, but is not prescriptive in requiring specific actions. RMAs are based on the configuration-specific risk and determined in accordance with plant-specific procedures and programs. The configuration risk management program (CRMP) is required to be used to calculate the risk prior to a planned entry into a RICT.

Emergent conditions must be assessed within the time limits of any applicable technical specifications (TS) actions up to a maximum allowed time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Compensatory measure or RMAs are required to be in place for planned activities and must be implemented upon reaching specified risk thresholds for either planned or unplanned activities.

A RICT will not be entered (i.e., to exceed the frontstop completion time) when the calculated configuration-specific risk exceeds the 10-3 core damage frequency (CDF) or 10-4 large early release frequency (LERF) limits. However, TR NEI 06-09-A, Revision 0, does not require exiting a RICT if the limits of either 10-3 CDF or 10-4 LERF are subsequently exceeded due to emergent conditions which arise after a RICT is in effect. This is consistent with the guidance of NUMARC 93-01. The RICT, once in effect, is solely governed by the ICDP and ILERP limits described above, and emergent configurations whose risk level exceeds the 10-3 CDF or 10-4 LERF limits are managed using RMAs.

By determining which structures, systems, or components (SSC) are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events.

CNL-21-009 E12-1 of 7

Enclosure 12

If the planned activity or emergent condition includes an SSC that is identified to impact the Fire PRA (FPRA), as identified in the current Real Time Risk Program, FPRA specific RMAs associated with that SSC will be implemented per the current plant procedure.

Currently, RMAs are not included within the PRA model. It is possible to credit RMAs in RICT calculations, to the extent the associated plant equipment and operator actions are modeled in the PRA; however, such quantification of RMAs is neither required nor expected by NEI 06-09-A, Revision 0. Nonetheless, if RMAs will be credited to determine RICTs, the procedural instructions will be consistent with the guidance in NEI 06-09-A, Revision 0.

NEI 06-09-A, Revision 0 classifies RMAs into three categories.

1) Actions to increase risk awareness and control.

2) Actions to reduce the duration of maintenance activities.

3) Actions to minimize the magnitude of the risk increase.

These categories are demonstrated in the examples shown in Section 4.0.

4. EXAMPLES Generic RMAs are performed for any entry into technical specification conditions utilizing RICT which exceeds the RMAT, whether voluntary or involuntary. These actions are generic in nature and are not specific to a certain system or component. There are also fire RMAs that must be performed to address the risk associated should a fire event occur while maintenance activities are performed. There are also common cause RMAs that look at the function of a system instead of just one component. Finally, there are system specific RMAs that should be performed depending on which system is out of service.

Voluntary entry into an RICT which exceeds the RMAT is considered as high risk. A cross functional team including Operations, Maintenance, Work Management, PRA, and Engineering approves the High Risk Management Plan to include Risk Mitigation Strategies. Examples are listed in A, below.

A. Generic RMAs considered for planned maintenance configurations that exceed the RMAT.

1) Actions to increase risk awareness and control.

x Perform the Operational Vulnerability / Conditional Single Point Vulnerability Risk Mitigation Checklist.

o Determine if this is the right time to perform work on the equipment or if there is a better maintenance window available.

o Evaluate environmental/river conditions.

o Determine if there is a plant configuration that eliminates, or mitigates risk and if so, can that plant configuration be aligned.

x Shift brief x Just in Time (JIT), or other specific training x Shift Order or Standing Order to identify risk sources and contingency plans x Protect redundant systems, trains, and components x Evaluate weather conditions prior to execution for potential impacts on plant operations and grid stability.

CNL-21-009 E12-2 of 7

Enclosure 12

x Check the opposite train components.

o Check for no open Operational Decision Making Issues (ODMIs), Adverse Condition Monitoring and Contingency Plans (ACMPs), operator rounds, or open troubleshooting plans that would pose a threat to the work.

o Review any pre-identified adverse conditions based on predictive technologies that would preclude reliable operation of the component.

o Identify and assess any pre-identified adverse conditions based on review of Maximo, system health reports, heat maps, bridging and mitigation strategies, operator rounds, and walk-downs that would preclude reliable operation of the components.

o Review preventive maintenance (PM) to see if any deferred or in grace maintenance would preclude reliable operation of the components.

o Review contingency planning worksheet for outstanding items that could challenge work completion.

o Review if any contingencies are required to perform work.

2) Actions to reduce the duration of maintenance activities.

x For preplanned RICT entry exceeding RMAT, create a resource loaded schedule specific to the evolution and obtain Critical Evolution approval as required.

x Confirmation of parts availability prior to entry into a preplanned RICT exceeding RMAT.

x Pre-stage materials.

x Conducting training on mock-ups.

x Performing the activity in consecutive shifts until complete.

x Performing walk-downs on the actual system(s) to be worked on prior to beginning work.

x Provide field supervisory monitoring of the activity.

3) Actions to minimize the magnitude of the risk.

x Provide dedicated operator support as needed.

x Ensure experienced leaders, engineers, and technical personnel are selected to perform or directly oversee the work.

x Mockup, rehearsal, simulator, JIT, or other special training is performed as necessary for the activity.

x Suspend or minimize activities on other systems that adversely affect the CDF or LERF through the Configuration Risk Management Program.

x Suspend or minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate.

x Use temporary equipment to provide backup power, ventilation, etc.

x Presence of system engineer or other expertise related to the activity.

x Other RMAs as deemed appropriate for scope of work performed.

Risk-management actions are implemented to address fire risk should a fire occur while the system is in maintenance.

B. Perform any Fire Response RMAs as applicable for the component taken out of service.

1) Fire risk associated with unavailable equipment important to Fire Safe Shutdown is managed by the fire risk aspect of Maintenance Rule (a)(4) in accordance with NUMARC 93-01. A Browns Ferry Nuclear (BFN) EOOS-PHOENIX model calculation CNL-21-009 E12-3 of 7

Enclosure 12

documents risk significant components for Maintenance Rule (a)(4) fire risk and the associated Fire Areas where Risk Management Actions are required. This information is communicated to the Operations staff through the EOOS software when equipment is taken out of service. Fire Risk Management Actions and completion times are specified in Tennessee Valley Authority (TVA) Procedures. Due to their risk significance, the Emergency High Pressure Makeup Pumps and Supplemental Diesel Generators have specific Fire Protection Limiting Conditions for Operation statements and may include more expedient completion times than those required by TVA procedures.

2) The risk management actions and fire watches are managed in accordance with plant procedures. Plant Operations Review Committee (PORC) review and plant manager approval of the adequacy of the risk management actions is required every 60 days from the time the risk management action is established until the impairment is closed.

During the time when a RICT is in effect and risk is being assessed and managed, it is possible that emergent failures of SSCs may occur, and these must be assessed to determine the impact on the RICT. If a failed component is one of two or more redundant components in separate trains of a system, then there is potential for a common cause failure mechanism. Assessment of the remaining redundant components to determine there is reasonable assurance of their continued operability is required and is not changed by implementation of the RMTS. If it is concluded that the redundant components remain operable, then these components are functional for purposes of the RICT. However, it is required to consider and implement additional RMAs due to the potential for increased risks from common cause failure of similar equipment. Consideration is required of such RMAs whenever the redundant components are considered to remain operable, but the extent of condition evaluations have not been completed, and as required by a follow-up prompt operability determination.

Some common cause RMAs are developed by considering the impact of loss of function for the affected SSCs. Instead of performing actions based on a single component, the function the SSC performs is evaluated. These RMAs can be performed for either voluntary or involuntary entry into technical specifications conditions, depending on the system being managed.

C. Example common cause RMAs

1) Performance of non-intrusive inspections on alternate trains.

2) Testing of redundant, required SSCs, or some other verification approach (i.e., work order reviews, active clearances, etc.).

3) Monitoring of running components increased in frequency and expanded in scope.

4) Deferment of maintenance and testing activities that could generate an initiating event which would require operation of potentially affected SSCs.

5) Prepare operators and maintenance to respond to additional failures.

6) Conduct Operations shift briefs or development of standing orders which focus on initiating event response or loss of potentially affected SSCs.

Multiple example RMAs that may be considered during a RICT Program entry which exceed RMAT to reduce or mitigate the risk impact and ensure adequate defense-in-depth are provided below. These RMAs would be performed in addition to any of the applicable generic RMAs shown above. (Note: the RMAs shown below are performed whether there are one or more of the systems out of service.) Examples are given for the unavailability of:

x Diesel Generator x Offsite Circuit CNL-21-009 E12-4 of 7

Enclosure 12

x DC Sources x AC Sources x AC/DC Power Distribution Train These systems are associated with the following Technical Specification Conditions:

x 3.8.1.A x 3.8.1.B x 3.8.4.A x 3.8.7.A x 3.8.7.B x 3.8.7.C x 3.8.7.D x 3.8.7.E D. Diesel Generator (DG) inoperable

1) Review Risk Mitigation Strategies for any applicable strategies. Some examples include:

x Prohibit elective maintenance on remaining available DGs and SSCs associated with offsite power circuits.

x Protect remaining available DGs and offsite power sources per BFN risk-management procedures.

x Protect other SSCs as directed by BFN risk-management procedures.

x Perform evaluation of equipment powered from remaining available trains.

x Review weather forecasts for severe weather during the RICT, prior to voluntary entry. Take appropriate actions to mitigate impacts of severe weather for both voluntary and involuntary entries into a RICT exceeding RMAT.

x Contact Transmission Operator to evaluate deferral of element outages that would reduce grid stability.

x Minimize activities on trip sensitive equipment that could cause a Unit Trip.

x Perform shift briefs that focus on actions operators will take in response to a loss of offsite power and loss of all AC power.

x Perform walkdown to verify availability of Supplemental DG.

x Verify required parts/materials on site prior to voluntary entry into a RICT exceeding RMAT.

x Establish continuous maintenance coverage.

E. Offsite circuit inoperable

1) Review Risk Mitigation Strategies for any applicable strategies. Some examples include:

x Prohibit elective maintenance on SSCs associated with available offsite power circuit and all DGs.

x Protect remaining available DGs and offsite power sources per BFN risk-management procedures.

x Protect other SSCs as directed by BFN risk-management procedures.

x Perform evaluation of equipment powered from remaining available trains.

CNL-21-009 E12-5 of 7

Enclosure 12

x Review weather forecasts for severe weather during the RICT prior to voluntary entry. Take appropriate actions to mitigate impacts of severe weather for both voluntary and involuntary entries into a RICT exceeding RMAT.

x Contact Transmission Operator to evaluate deferral of element outages that would reduce grid stability.

x Minimize activities on TRIP SENSITIVE EQUIPMENT that could cause a Unit Trip.

x Perform shift briefs that focus on actions operators will take in response to a loss of offsite power and loss of all AC power.

x Perform walkdown to verify availability of Supplemental DG.

x Verify required parts/materials on site prior to voluntary entry into a RICT exceeding RMAT.

x Establish continuous maintenance coverage.

F. DC Sources

1) Review the Risk Mitigation Strategies for any applicable strategies, some examples include:

x Prohibit elective maintenance on remaining available 250V Vital DC SSCs.

x Protect remaining available 250V Vital DC SSCs per BFN risk-management procedures.

x Minimize activities on TRIP SENSITIVE EQUIPMENT that could cause a Unit Trip.

x Perform shift briefs that focus on actions operators will take in response to a loss of offsite power and loss of DC power. Walkdown actions for aligning spare charger or spare battery.

x Verify required parts/materials on site prior to voluntary entry into a RICT exceeding RMAT.

x Establish continuous maintenance coverage.

G. AC Sources

1) Review the Risk Mitigation Strategies for any applicable strategies, some examples include:

x Prohibit elective maintenance on 120V AC SSCs.

x Review weather forecasts for severe weather during the RICT prior to voluntary entry. Take appropriate actions to mitigate impacts of severe weather for both voluntary and involuntary entries into a RICT exceeding RMAT.

x Perform shift briefs that focus on actions operators will take in response to a loss of offsite power and loss of instrument and control board.

x Minimize activities on TRIP SENSITIVE EQUIPMENT that could cause a Unit Trip.

x Verify required parts/materials on site prior to voluntary entry into a RICT exceeding RMAT.

x Establish continuous maintenance coverage.

x Evaluate currently ongoing maintenance activities and prioritize activities for return to service.

CNL-21-009 E12-6 of 7

Enclosure 12

H. AC / DC power distribution train inoperable

1) Review the Risk Mitigation Strategies for any applicable strategies some examples include:

x Protect remaining AC or DC power distribution subsystems per BFN risk-management procedures.

x Prohibit any elective maintenance on all safety related AC or DC distribution subsystems.

x Perform shift briefs that focus on actions operators will take in response to a loss of offsite power, loss of all AC power or loss of DC power.

x Contact Transmission Operator to evaluate deferral of element outages that would reduce grid stability.

x Minimize activities on TRIP SENSITIVE EQUIPMENT that could cause a Unit Trip.

x Verify required parts/materials on site prior to voluntary entry into a RICT exceeding RMAT.

x Establish continuous maintenance coverage.

5. REFERENCES

1. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ML12286A322)

CNL-21-009 E12-7 of 7

v t e Letter Sequence Request
EPID:L-2022-LLA-0049, TSTF-505 (Approved, Closed)
Initiation Request, Request Acceptance Supplement, Supplement Administration Questions 19 October 2022 Answers Results Approval, Approval Other: ML22147A137, ML22238A065, ML22238A067, ML22259A037, ML22259A038, ML22259A039
MONTHYEAR2022-08-19 [Table View]

CNL-21-009, License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative

Text

Subject:

Reference:

Subject:

SUMMARY

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

Description:

Navigation menu

CNL-21-009, License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505-A, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative

Text

Subject:

Reference:

Subject:

SUMMARY

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

Description:

Navigation menu

Search